Mail Log Analyze : AWstats

2014/09/30

	Install AWstats which is the Mail Log reporting tool.
[1]	Install and start Apache HTTP Server, refer to here.
[2]	Install AWstats.

# install from EPEL [root@mail ~]#  yum --enablerepo=epel -y install awstats # "awstas.(your hostname).conf" is generated automatically [root@mail ~]#  vi /etc/awstats/awstats.mail.server.world.conf # line 50: change LogFile=" /usr/share/awstats/tools/maillogconvert.pl standard < /var/log/maillog | " # line 62: change LogType= M # line 122 comment out and the line below # LogFormat=1 LogFormat="%time2 %email %email_r %host %host_r %method %url %code %bytesd" # line 838: change like follows LevelForBrowsersDetection= 0 LevelForOSDetection= 0 LevelForRefererAnalyze= 0 LevelForRobotsDetection= 0 LevelForSearchEnginesDetection= 0 LevelForKeywordsDetection= 0 LevelForFileTypesDetection= 0 LevelForWormsDetection=0 # line 956: change like follows ShowMonthStats= UHB ShowDaysOfMonthStats= HB ShowDaysOfWeekStats= HB ShowHoursStats= HB ShowDomainsStats= 0 ShowHostsStats= HBL ShowRobotsStats= 0 ShowEMailSenders= HBML ShowEMailReceivers= HBML ShowSessionsStats= 0 ShowPagesStats= 0 ShowFileTypesStats= 0 ShowOSStats= 0 ShowBrowsersStats= 0 ShowOriginStats= 0 ShowKeyphrasesStats= 0 ShowKeywordsStats= 0 ShowMiscStats= 0 ShowHTTPErrorsStats= 0 ShowSMTPErrorsStats= 1 [root@mail ~]#  vi /etc/httpd/conf.d/awstats.conf # line 30: add IP address you permit to access Require ip 10.0.0.0/24 [root@mail ~]#  systemctl restart httpd  # update reports manually ( it's updated automatically for hours by Cron ) [root@mail ~]#  /usr/share/awstats/wwwroot/cgi-bin/awstats.pl -update -config=mail.server.world -configdir=/etc/awstats Create/Update database for config "/etc/awstats/awstats.mail.server.world.conf" by AWStats version 7.3 (build 20140126) From data in log file "/usr/share/awstats/tools/maillogconvert.pl standard < /var/log/maillog |"... Phase 1 : First bypass old records, searching new record... Searching new records from beginning of log file... Phase 2 : Now process new records (Flush history on disk after 20000 hosts)... Jumped lines in file: 0 Parsed lines in file: 11 Found 4 dropped records, Found 0 comments, Found 0 blank records, Found 0 corrupted records, Found 0 old records, Found 7 new qualified records.

[3]	Access to 'http://(your server's hostname or IP address)/awstats/awstats.pl' with web browser on clients. Then following screen is shown and it's possible to make sure mail log summary.

Mail Log Analyze : AWstats

Mail Log Analyze : AWstats 2014/09/30

	Install AWstats which is the Mail Log reporting tool.
[1]	Install and start Apache HTTP Server, refer to here.
[2]	Install AWstats.

# install from EPEL [root@mail ~]#  yum --enablerepo=epel -y install awstats # "awstas.(your hostname).conf" is generated automatically [root@mail ~]#  vi /etc/awstats/awstats.mail.server.world.conf # line 50: change LogFile=" /usr/share/awstats/tools/maillogconvert.pl standard < /var/log/maillog | " # line 62: change LogType= M # line 122 comment out and the line below # LogFormat=1 LogFormat="%time2 %email %email_r %host %host_r %method %url %code %bytesd" # line 838: change like follows LevelForBrowsersDetection= 0 LevelForOSDetection= 0 LevelForRefererAnalyze= 0 LevelForRobotsDetection= 0 LevelForSearchEnginesDetection= 0 LevelForKeywordsDetection= 0 LevelForFileTypesDetection= 0 LevelForWormsDetection=0 # line 956: change like follows ShowMonthStats= UHB ShowDaysOfMonthStats= HB ShowDaysOfWeekStats= HB ShowHoursStats= HB ShowDomainsStats= 0 ShowHostsStats= HBL ShowRobotsStats= 0 ShowEMailSenders= HBML ShowEMailReceivers= HBML ShowSessionsStats= 0 ShowPagesStats= 0 ShowFileTypesStats= 0 ShowOSStats= 0 ShowBrowsersStats= 0 ShowOriginStats= 0 ShowKeyphrasesStats= 0 ShowKeywordsStats= 0 ShowMiscStats= 0 ShowHTTPErrorsStats= 0 ShowSMTPErrorsStats= 1 [root@mail ~]#  vi /etc/httpd/conf.d/awstats.conf # line 30: add IP address you permit to access Require ip 10.0.0.0/24 [root@mail ~]#  systemctl restart httpd  # update reports manually ( it's updated automatically for hours by Cron ) [root@mail ~]#  /usr/share/awstats/wwwroot/cgi-bin/awstats.pl -update -config=mail.server.world -configdir=/etc/awstats Create/Update database for config "/etc/awstats/awstats.mail.server.world.conf" by AWStats version 7.3 (build 20140126) From data in log file "/usr/share/awstats/tools/maillogconvert.pl standard < /var/log/maillog |"... Phase 1 : First bypass old records, searching new record... Searching new records from beginning of log file... Phase 2 : Now process new records (Flush history on disk after 20000 hosts)... Jumped lines in file: 0 Parsed lines in file: 11 Found 4 dropped records, Found 0 comments, Found 0 blank records, Found 0 corrupted records, Found 0 old records, Found 7 new qualified records.

[3]	Access to 'http://(your server's hostname or IP address)/awstats/awstats.pl' with web browser on clients. Then following screen is shown and it's possible to make sure mail log summary.

Mail Log Analyze : pflogsumm

Mail Log Analyze : pflogsumm 2014/09/26

	Install pflogsumm which is the Postfix Log reporting tool.
[1]	Install postfix-perl-scripts package.

[root@mail ~]#  yum -y install postfix-perl-scripts # generate log summary for yesterday [root@mail ~]#  perl /usr/sbin/pflogsumm -d yesterday /var/log/maillog Postfix log summaries for Sep 26 Grand Totals ------------ messages 5 received 8 delivered 0 forwarded 0 deferred 0 bounced 0 rejected (0%) 0 reject warnings 0 held 0 discarded (0%) 4755 bytes received 7015 bytes delivered 2 senders 2 sending hosts/domains 2 recipients 2 recipient hosts/domains Per-Hour Traffic Summary ------------------------ time received delivered deferred bounced rejected -------------------------------------------------------------------- 0000-0100 0 0 0 0 0 0100-0200 0 0 0 0 0 0200-0300 0 0 0 0 0 0300-0400 0 0 0 0 0 0400-0500 0 0 0 0 0 0500-0600 0 0 0 0 0 0600-0700 0 0 0 0 0 0700-0800 0 0 0 0 0 0800-0900 0 0 0 0 0 0900-1000 1 1 0 0 0 1000-1100 0 1 0 0 0 1100-1200 0 0 0 0 0 1200-1300 1 1 0 0 0 1300-1400 0 0 0 0 0 1400-1500 1 3 0 0 0 1500-1600 2 2 0 0 0 1600-1700 0 0 0 0 0 1700-1800 0 0 0 0 0 1800-1900 0 0 0 0 0 1900-2000 0 0 0 0 0 2000-2100 0 0 0 0 0 2100-2200 0 0 0 0 0 2200-2300 0 0 0 0 0 2300-2400 0 0 0 0 0 Host/Domain Summary: Message Delivery -------------------------------------- sent cnt bytes defers avg dly max dly host/domain -------- ------- ------- ------- ------- ----------- 5 3885 0 2.3 s 9.8 s mail.server.world 3 3130 0 3.4 s 9.7 s server.world Host/Domain Summary: Messages Received --------------------------------------- msg cnt bytes host/domain -------- ------- ----------- 3 3130 server.world 2 1625 mail.server.world Senders by message count ------------------------ 3 root@server.world 2 cent@mail.server.world Recipients by message count --------------------------- 5 cent@mail.server.world 3 root@server.world Senders by message size ----------------------- 3130 root@server.world 1625 cent@mail.server.world Recipients by message size -------------------------- 3885 cent@mail.server.world 3130 root@server.world message deferral detail: none message bounce detail (by relay): none message reject detail: none message reject warning detail: none message hold detail: none message discard detail: none smtp delivery failures: none Warnings -------- smtps/smtpd (total: 1) 1 TLS library problem: 2214:error:14094418:SSL routines:SSL3_READ... tlsmgr (total: 4) 2 redirecting the request to postfix-owned data_directory /var/li... 2 request to update table btree:/etc/postfix/smtpd_scache in non-... Fatal Errors: none Panics: none Master daemon messages ---------------------- 5 daemon started -- version 2.10.1, configuration /etc/postfix 3 terminating on signal 15 [root@mail ~]#  crontab -e # send mail log summary at AM 1:00 everyday to root 00 01 * * * perl /usr/sbin/pflogsumm -e -d yesterday /var/log/maillog | mail -s 'Logwatch for Postfix' root

Postfix + Clamav + Amavisd

Postfix + Clamav + Amavisd 2014/09/26

	Configure Virus-Scanning with Postfix + Clamav.
[1]	Install Clamav, refer to here.
[2]	Install Amavisd and Clamav Server, and start Clamav Server first.

# install from EPEL [root@mail ~]#  yum --enablerepo=epel -y install amavisd-new clamav-server clamav-server-systemd [root@mail ~]#  cp /usr/share/doc/clamav-server*/clamd.sysconfig /etc/sysconfig/clamd.amavisd  [root@mail ~]#  vi /etc/sysconfig/clamd.amavisd # line 1, 2: uncomment and change CLAMD_CONFIGFILE=/etc/clamd.d/ amavisd.conf CLAMD_SOCKET=/var/run/ clamd.amavisd /clamd.sock [root@mail ~]#  vi /etc/tmpfiles.d/clamd.amavisd.conf # create new d /var/run/clamd.amavisd 0755 amavis amavis - [root@mail ~]#  vi /usr/lib/systemd/system/clamd@.service # add follows to the end [Install] WantedBy=multi-user.target [root@mail ~]#  systemctl start clamd@amavisd  [root@mail ~]#  systemctl enable clamd@amavisd  ln -s '/usr/lib/systemd/system/clamd@.service' '/etc/systemd/system/multi-user.target.wants/clamd@amavisd.service'

[3]	Configure Amavisd.

[root@mail ~]#  vi /etc/amavisd/amavisd.conf # line 20: change to the own domain name $mydomain = ' server.world '; # line 152: change to the own hostname $myhostname = ' mail.server.world '; # line 154: uncomment $notify_method = 'smtp:[127.0.0.1]:10025'; $forward_method = 'smtp:[127.0.0.1]:10025'; [root@mail ~]#  systemctl start amavisd  [root@mail ~]#  systemctl enable amavisd  [root@mail ~]#  systemctl start spamassassin  [root@mail ~]#  systemctl enable spamassassin

[4]	Configure Postfix.

[root@mail ~]#  vi /etc/postfix/main.cf # add follows to the end content_filter=smtp-amavis:[127.0.0.1]:10024 [root@mail ~]#  vi /etc/postfix/master.cf # add follows to the end smtp-amavis unix - - n - 2 smtp -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -o disable_dns_lookups=yes 127.0.0.1:10025 inet n - n - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 [root@mail ~]#  systemctl restart postfix

[5]	It' OK all. These lines below are added in the header section of emails after this configuration and emails with known Virus will not sent to Clients.

Set Virtual Domain

Set Virtual Domain 2014/07/21

	Configure Postfix to use Virtulal Domain to send an email with another domain name different from original domain. For example,  present domain name ⇒ server.world new domain name ⇒ virtual.host a User [cent] has an email address [cent@mail.server.world], a User [redhat] has an email address [cent@mail.virtual.host], the user [redhat] uses the same name for before [@] with [cent].
[1]	Set Virtual Domain.

[root@mail ~]#  vi /etc/postfix/main.cf # add follows to the end virtual_alias_domains = virtual.host virtual_alias_maps = hash:/etc/postfix/virtual [root@mail ~]#  vi /etc/postfix/virtual # add follows to the head cent@mail.virtual.host redhat [root@mail ~]#  postmap /etc/postfix/virtual  [root@mail ~]#  systemctl reload postfix

[2]	Set new account to Email client and make sure to be able to send emails.

Configure SSL

Configure SSL 2014/07/21

	Configure SSL to encrypt connections. SMTPS uses 465/TCP, POP3S uses 995/TCP, IMAPS uses 993/TCP.
[1]	Create certificates first, Refer to here.
[2]	Configure Postfix and Dovecot for SSL.

[root@mail ~]#  vi /etc/postfix/main.cf # add follows to the end smtpd_use_tls = yes smtpd_tls_cert_file = /etc/pki/tls/certs/server.crt smtpd_tls_key_file = /etc/pki/tls/certs/server.key smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_scache [root@mail ~]#  vi /etc/postfix/master.cf # line 26-28: uncomment smtps       inet   n       -       n       -       -       smtpd   -o syslog_name=postfix/smtps   -o smtpd_tls_wrappermode=yes [root@mail ~]#  vi /etc/dovecot/conf.d/10-ssl.conf # line 8: change ssl =  yes # line 14,15: specify certificates ssl_cert = < /etc/pki/tls/certs/server.crt ssl_key = < /etc/pki/tls/certs/server.key [root@mail ~]#  systemctl restart postfix  [root@mail ~]#  systemctl restart dovecot

[3]	For Email Client's settings, (Windows Live Mail) Open the property of an account and change settings like following example. (if you use PO3S, input '995 for incoming mail)

[4]	Click syncronize on Windows Live Mail, then following warning is shown because certificates is own created on your server. It's no ploblem. Click 'Yes' to proceed, then it's possible to send/receive emails through SSL connection.

Email Client's Setting

Email Client's Setting 2014/07/21

	Configure your Email Client on your PC. This example shows with Windows Live Mail.
[1]	Start Windows Live Mail and move to [Account] tab and Click [Email] button.

[2]	Input an email address, account's password, sender's name and check a box 'Configure Manually' and go next.

[3]	Select IMAP or POP. This example selects IMAP. And input other information of your Mail server. Don't forget to check a box [this server requires to authenticate] at the bottom.

[4]	Click [Finish] button.

[5]	Connect and get server's folder settings automatically.

Install Dovecot

Install Dovecot 2014/07/21

	Install Dovecot to configure POP/IMAP server. POP uses 110/TCP, IMAP uses 143/TCP.
[1]	Install Dovecot.

[root@mail ~]#  yum -y install dovecot

[2]	This example shows to configure to provide SASL function to Postfix.

[root@mail ~]#  vi /etc/dovecot/dovecot.conf # line 24: uncomment protocols = imap pop3 lmtp # line 30: uncomment and change ( if not use IPv6 ) listen =  * [root@mail ~]#  vi /etc/dovecot/conf.d/10-auth.conf # line 10: uncomment and change ( allow plain text auth ) disable_plaintext_auth =  no # line 100: add auth_mechanisms = plain  login [root@mail ~]#  vi /etc/dovecot/conf.d/10-mail.conf # line 30: uncomment and add mail_location =  maildir:~/Maildir [root@mail ~]#  vi /etc/dovecot/conf.d/10-master.conf # line 96-98: uncomment and add like follows # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth {     mode = 0666     user = postfix      group = postfix  } [root@mail ~]#  vi /etc/dovecot/conf.d/10-ssl.conf # line 8: change (not require SSL) ssl =  no [root@mail ~]#  systemctl start dovecot  [root@mail ~]#  systemctl enable dovecot

Install Postfix

Install Postfix 2014/07/21

	Install Postfix to configure SMTP server. SMTP uses 25/TCP.
[1]	Postfix is installed even if CentOS system was installed with [Minimal Install], but if Postfix is not, Install it first like follows.

[root@mail ~]#  yum -y install postfix

[2]	This example shows to configure SMTP-Auth to use Dovecot's SASL function.

[root@mail ~]#  vi /etc/postfix/main.cf # line 75: uncomment and specify hostname myhostname =  mail.server.world # line 83: uncomment and specify domain name mydomain =  server.world # line 99: uncomment myorigin = $mydomain # line 116: change inet_interfaces =  all # line 164: add mydestination = $myhostname, localhost.$mydomain, localhost , $mydomain # line 264: uncomment and specify your local network mynetworks = 127.0.0.0/8,  10.0.0.0/24 # line 419: uncomment (use Maildir) home_mailbox = Maildir/ # line 574: add smtpd_banner = $myhostname ESMTP # add follows to the end # limit an email size for 10M message_size_limit = 10485760 # limit a mailbox for 1G mailbox_size_limit = 1073741824 # for SMTP-Auth smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination,permit_sasl_authenticated,reject [root@mail ~]#  systemctl restart postfix  [root@mail ~]#  systemctl enable postfix