Simple Authentication and Security Layer

1

apt install postfix sasl2-bin libsasl2-modules

1

vi /etc/default/saslauthd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#
# Settings for saslauthd daemon
# Please read /usr/share/doc/sasl2-bin/README.Debian for details.
#

# Should saslauthd run automatically on startup? (default: no)
START=yes

# Description of this saslauthd instance. Recommended.
# (suggestion: SASL Authentication Daemon)
DESC="SASL Authentication Daemon"

# Short name of this saslauthd instance. Strongly recommended.
# (suggestion: saslauthd)
NAME="saslauthd"

# Which authentication mechanisms should saslauthd use? (default: pam)
#
# Available options in this Debian package:
# getpwent  -- use the getpwent() library function
# kerberos5 -- use Kerberos 5
# pam       -- use PAM
# rimap     -- use a remote IMAP server
# shadow    -- use the local shadow password file
# sasldb    -- use the local sasldb database file
# ldap      -- use LDAP (configuration is in /etc/saslauthd.conf)
#
# Only one option may be used at a time. See the saslauthd man page
# for more information.
#
# Example: MECHANISMS="pam"
MECHANISMS="pam"

# Additional options for this mechanism. (default: none)
# See the saslauthd man page for information about mech-specific options.
MECH_OPTIONS=""

# How many saslauthd processes should we run? (default: 5)
# A value of 0 will fork a new process for each connection.
THREADS=5

# Other options (default: -c -m /var/run/saslauthd)
# Note: You MUST specify the -m option or saslauthd won't run!
#
# WARNING: DO NOT SPECIFY THE -d OPTION.
# The -d option will cause saslauthd to run in the foreground instead of as
# a daemon. This will PREVENT YOUR SYSTEM FROM BOOTING PROPERLY. If you wish
# to run saslauthd in debug mode, please run it by hand to be safe.
#
# See /usr/share/doc/sasl2-bin/README.Debian for Debian-specific information.
# See the saslauthd man page and the output of 'saslauthd -h' for general
# information about these options.
#
# Example for chroot Postfix users: "-c -m /var/spool/postfix/var/run/saslauthd"
# Example for non-chroot Postfix users: "-c -m /var/run/saslauthd"
#
# To know if your Postfix is running chroot, check /etc/postfix/master.cf.
# If it has the line "smtp inet n - y - - smtpd" or "smtp inet n - - - - smtpd"
# then your Postfix is running in a chroot.
# If it has the line "smtp inet n - n - - smtpd" then your Postfix is NOT
# running in a chroot.
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd"

1

vi /etc/postfix/main.cf

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

[...]

# SASL (saslauthd + smptd)
# https://www.postfix.org/SASL_README.html
smtpd_tls_auth_only = no
smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
#smtp_sasl_mechanism_filter = !gssapi, !login, static:all
smtp_sasl_mechanism_filter = login, plain
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = cyrus
smtpd_sasl_path = smtpd

1

vi /etc/postfix/smptd.conf

1
2

pwcheck_method: saslauthd
mech_list: plain login CRAM-MD5 DIGEST-MD5

1

usermod -aG sasl postfix

1
2

useradd -s /bin/false -M -c "PKSII test account" pks_ii_test_account
passwd pks_ii_test_account

1

grep pks_ii_test_account /etc/passwd

1

pks_ii_test_account:x:30069:30069:PKSII test account::/bin/false

1

systemctl restart postfix.service saslauthd.service

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

volumes:
  prometheus_data:

networks:
  traefik:

services:
  alertmanager:
    image: prom/alertmanager:main
    container_name: alertmanager
    ports:
      - 9093:9093
    volumes:
      - /etc/prometheus/:/etc/alertmanager/
      - /etc/prometheus/alertmanager/templates:/etc/alertmanager/templates/
    restart: always
    networks:
      - traefik
    command:
      - '--config.file=/etc/alertmanager/alertmanager-config.yml'
      - '--storage.path=/alertmanager'

  prometheus:
    container_name: prometheus
    image: "prom/prometheus:main"
    restart: unless-stopped
    ports:
      - 9000:9090
    networks:
      - traefik
    volumes:
      - "/etc/prometheus:/etc/prometheus:ro"
      - "prometheus_data:/prometheus"
    command: 
      - --web.enable-lifecycle 
      - --config.file=/etc/prometheus/prometheus.yml 
      - --web.external-url=https://prometheus.vxn.dev
      - --storage.tsdb.retention.time=90d

1

vi /etc/prometheus/prometheus.yml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

global:
  scrape_interval: 30s
  scrape_timeout: 15s

alerting:
  alertmanagers:
  - static_configs:
    - targets:
      - alertmanager:9093

rule_files:
  - alert.yml

scrape_configs:
  - job_name: postfix_exporters
    scrape_interval: 30s
    metrics_path: /metrics
    static_configs:
      - targets:
        - frank.vxn.net:9155
        - helix.vxn.net:9155

1

apt install prometheus-postfix-exporter

1

docker compose up --daemonize --force-recreate

1

vi /etc/prometheus/alertmanager-config.yml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

global:
  smtp_from: '[email protected]'
  smtp_smarthost: 10.4.5.130:25
  smtp_require_tls: false
  smtp_auth_username: alertmanager
  smtp_auth_password: 27703cc8a71f7fd5c2b81c32a9d69a1af28e2f3a8de3baa0f3d595c2255dde45fb4c21cd

route:
  group_by: ['job']
  group_wait: 10s
  group_interval: 15s
  repeat_interval: 30m
  receiver: 'telegram'

receivers:
- name: "telegram"
  telegram_configs:
  - bot_token: "1234567890:adDFG66KADDdsdFSADfsaffdfhhg"
    api_url: https://api.telegram.org
    chat_id: -12345678901234
    parse_mode: 'HTML'
    message: '{{ template "telegram_message" . }}'

templates:
  - '/etc/alertmanager/templates/telegram.tmpl'

1

vi /etc/prometheus/alert.yml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

---

groups:
  - name: postfix
    rules:
      - alert: SASLAuthenticationFailuresRateAboveZero
        expr: rate(postfix_smtpd_sasl_authentication_failures_total{}[5m]) > 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "SMTPd SASL Auth failure rate is above zero (0): {{ $value }}!"
          description: "SMTPd SASL Auth failure rate is above zero\n VALUE= {{ $value }}\n LABELS = {{ $labels }}"

1

vi /etc/alertmanager/templates/telegram.tmpl

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

{{ define "telegram_message" }}
{{ if gt (len .Alerts.Firing) 0 }}
🔥 {{ len .Alerts.Firing }} alert(s) firing:
{{ range .Alerts.Firing }}
{{ template "telegram_alert_firing" . }}
{{ end }}
{{ end }}
{{ if gt (len .Alerts.Resolved) 0 }}
✅ {{ len .Alerts.Resolved }} alert(s) resolved:
{{ range .Alerts.Resolved }}
{{ template "telegram_alert_resolved" . }}
{{ end }}
{{ end }}
{{ end }}

{{ define "telegram_alert_firing" }}
{{ .Annotations.summary }}

{{ .Annotations.description }}

<b>Details</b>:
{{ range .Labels.SortedPairs }}- {{ .Name }}: <i>{{ .Value }}</i>
{{ end }}

{{ end }}

{{ define "telegram_alert_resolved" }}
{{ .Annotations.summary }}

<b>Instance</b>: {{ .Labels.instance }}
<b>Alert</b>: {{ .Labels.alertname }}
<b>Job</b>: {{ .Labels.job }}
{{ end }}

1

less /var/log/mail.log

1
2
3

postfix/smtpd[1452866]: connect from unknown[45.144.212.120]
postfix/smtpd[1452866]: warning: unknown[45.144.212.120]: SASL LOGIN authentication failed: authentication failure, sasl_username=test
postfix/smtpd[1452866]: disconnect from unknown[45.144.212.120] ehlo=1 auth=0/1 quit=1 commands=2/3