0

On the web server I am going to run rkhunter, tripwire, OSSEC, fail2ban and psad. All of those applications need to be able to send emails to notify the sysadmin.

Therefore, I've:

sudo apt-get install -y mailutils postifx

Then I configured postfix to catch mails sent to root@localhost and send those mails to [email protected] :

sudo nano /etc/aliases 

and I have added this alias (after postmaster: root):

root:  [email protected] 

I have allowed outgoing traffic on port 25/tcp (since my default UFW policy is DROP on both INPUT, OUPUT and FORWARD)

sudo ufw allow out 25/tcp

I am now able to send-only emails, and I am going to use postifx/mail only for those applications listed aboIve, while I will use PHPMailer for the web application itself (login notifications, email verification, password change notification, etc, etc).

At this point, I wonder:

  • Is postfix/mail, as I set it above, a safe way to send logs in terms of security? Assuming that an attacker wants to get my logs, how hard will be for him with my current configuration?
  • Does anyone know a good link where to learn something that can help me in this stuff?

My postfix TLS configuration lines:

smtp_enforce_tls=yes
smtp_use_tls=yes
smtp_tls_security_level=encrypt
smtp_tls_mandatory_ciphers = high
smtp_tls_loglevel = 1
smtp_tls_session_cache_timeout = 3600s
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
tls_random_source = dev:/dev/urandom
smtpd_tls_received_header = yes
smtpd_tls_loglevel = 1
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
2
  • It's near impossible to judge security on such a narrow focus. Whether your Postfix setup as described is secure depends on lots of details and circumstances like, what kind of attacker do you need to protect against, is the server itself protected against physical access, how secure is the communication link between this server and the server handling the [email protected] mailbox. It is also not clear what you mean by "get my logs". Do you want to prevent the attacker from reading the logs? From altering them? From blocking them reaching you? Aug 12, 2015 at 10:53
  • The server is not accessible physically..also, the communication link between our server and [email protected] (actually handled by Google, it runs our mail server) uses TLS. Moreover, with "get my logs" i mean he's not able to catch and read the emails containing logs and, as consequence, also altering them.. Blocking them from reach me isn't a case i have thought, but it's obviously desirable that he will not able to do so too..
    – Jhon Zunda
    Aug 12, 2015 at 11:01

1 Answer 1

3

The security of your current setup against interception, and consequently possible disclosure and modification, of your mails on their way from your server to the destination mailbox, depends on the security of your server's DNS resolution. If an attacker is able to forge DNS replies to your server she can divert your mails to her own TLS-enabled SMTP server. Your Postfix daemon will log a certificate verification failure but deliver the mail anyway. To protect against that sort of attack you need to use one of the higher smtp_tls_security_level values (dane-only, fingerprint, verify, secure) and/or use DNSSEC.

Security against blocking your mails depends mainly on the reliability and security of your Internet connection, but also of your DNS resolution, and of course on the destination mail server hosting the [email protected] mailbox. For example, if the destination server has an overly strict antispam policy it may be possible to block your mails by falsely reporting your server as a spam source.

Last but not least, once the mails are delivered to the [email protected] mailbox their security depends of course entirely on the security of that mailbox. For example, if an attacker gets hold of the access credentials for that mailbox (through phishing) she can read, delete or replace any mail in it.

1
  • Considering that my hosting and domain provider provides me a DNSSEC by default, i will have only to look into smtp_tls_security_level . About the 2nd paragraph, my reply would be too long, anyway, i am safe here. About the security of my mailbox, it's obvious and of course i will keep an eye on it. Thank you for your reply Herr Schmidt.
    – Jhon Zunda
    Aug 12, 2015 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .