On the web server I am going to run rkhunter, tripwire, OSSEC, fail2ban and psad. All of those applications need to be able to send emails to notify the sysadmin.
Therefore, I've:
sudo apt-get install -y mailutils postifx
Then I configured postfix to catch mails sent to root@localhost and send those mails to [email protected] :
sudo nano /etc/aliases
and I have added this alias (after postmaster: root
):
root: [email protected]
I have allowed outgoing traffic on port 25/tcp (since my default UFW policy is DROP on both INPUT, OUPUT and FORWARD)
sudo ufw allow out 25/tcp
I am now able to send-only emails, and I am going to use postifx/mail only for those applications listed aboIve, while I will use PHPMailer for the web application itself (login notifications, email verification, password change notification, etc, etc).
At this point, I wonder:
- Is postfix/mail, as I set it above, a safe way to send logs in terms of security? Assuming that an attacker wants to get my logs, how hard will be for him with my current configuration?
- Does anyone know a good link where to learn something that can help me in this stuff?
My postfix TLS configuration lines:
smtp_enforce_tls=yes
smtp_use_tls=yes
smtp_tls_security_level=encrypt
smtp_tls_mandatory_ciphers = high
smtp_tls_loglevel = 1
smtp_tls_session_cache_timeout = 3600s
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
tls_random_source = dev:/dev/urandom
smtpd_tls_received_header = yes
smtpd_tls_loglevel = 1
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt