User Tools
internet:mail:zimbra:zimbra_firewall
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
internet:mail:zimbra:zimbra_firewall [2018/10/30 15:18] gcooper |
internet:mail:zimbra:zimbra_firewall [2023/11/13 08:53] (current) gcooper |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Zimbra Firewall ====== | ====== Zimbra Firewall ====== | ||
| + | |||
| + | FIXME This page could probably use a review and updating. | ||
| **Zimbra IP Ports Used**: http:// | **Zimbra IP Ports Used**: http:// | ||
| Line 7: | Line 9: | ||
| :!: Make sure your Zimbra server is working well before implementing a firewall. | :!: Make sure your Zimbra server is working well before implementing a firewall. | ||
| - | ===== IPTABLES | + | ===== IPTABLES ===== |
| http:// | http:// | ||
| Line 13: | Line 15: | ||
| :!: Clustering requires additional ports. | :!: Clustering requires additional ports. | ||
| - | Need modify and verify this: | + | :!: This example was from an older CentOS installation. |
| < | < | ||
| Line 33: | Line 35: | ||
| </ | </ | ||
| - | ===== CSF (CentOS) | + | ===== CSF ===== |
| - | + | ||
| - | FIXME Unfinished | + | |
| See also **[[networking: | See also **[[networking: | ||
| Line 41: | Line 41: | ||
| http:// | http:// | ||
| - | :!: Reload or restart CSF and LFD for changes to be activated. | + | :!: Reload or restart CSF and LFD for changes to be activated |
| ==== Postfix ==== | ==== Postfix ==== | ||
| - | **RegEx Tester**: https:// | + | **RegEx Tester**: https:// |
| **Reference**: | **Reference**: | ||
| - | <note warning> | + | <note warning> |
| - | Note that the Postfix log format seems to change frequently, so your custom regex will only work until the next log format change.</ | + | Consider these lines clipped from ''/ |
| - | + | ||
| - | Consider these lines clipped from ''/ | + | |
| < | < | ||
| - | Oct 28 09:45:55 zimbra | + | Oct 2 08:18:04 zimbra3 |
| - | Oct 28 09:45:56 zimbra | + | Oct 5 14:27:13 zimbra3 |
| - | Oct 26 10:07:34 zimbra postfix/ | + | |
| - | Oct 26 10:07:36 zimbra postfix/ | + | |
| - | Oct 30 13:57:58 zimbra postfix/ | + | |
| - | Oct 30 13:57:58 zimbra postfix/ | + | |
| </ | </ | ||
| - | Add a custom RegEx to detect authentication failures: | + | Add a custom RegEx to detect authentication failures |
| < | < | ||
| Line 73: | Line 67: | ||
| < | < | ||
| - | if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ / | + | if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ / |
| - | return (" | + | return (" |
| } | } | ||
| </ | </ | ||
| - | :!: $1 matches | + | :!: Group 1 ($1) matches the offending |
| - | + | ||
| - | :!: $2 is the second set of parenthesis matching | + | |
| - | + | ||
| - | A variant for an older log format: | + | |
| - | + | ||
| - | < | + | |
| - | if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ / | + | |
| - | return (" | + | |
| - | } | + | |
| - | </ | + | |
| - | + | ||
| - | Another older variant (5 failures, block ports 25 and 587, for 3600 seconds): | + | |
| - | + | ||
| - | < | + | |
| - | if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ / | + | |
| - | return (" | + | |
| - | } | + | |
| - | </ | + | |
| Now, edit the CSF configuration to tell it to monitor the proper log file for the new RegEx: | Now, edit the CSF configuration to tell it to monitor the proper log file for the new RegEx: | ||
| Line 107: | Line 83: | ||
| < | < | ||
| - | CUSTOM1_LOG = "/ | + | CUSTOM1_LOG = "/ |
| </ | </ | ||
| ==== csf.allow ==== | ==== csf.allow ==== | ||
| + | |||
| + | :!: This example is for Ubuntu 20.04 and Zimbra 9. | ||
| < | < | ||
| Line 131: | Line 109: | ||
| # add it to csf.ignore | # add it to csf.ignore | ||
| - | 192.168.0.0/24 # csf SSH installation/ | + | 192.168.1.0/24 # LAN network |
| - | 10.10.1.9 # NFS backup server | + | 10.1.1.9 |
| - | 10.10.1.40 | + | 10.1.1.40 # Manually allowed |
| - | 70.162.35.134 | + | 78.123.35.134 |
| - | 64.119.33.99 | + | 49.312.33.99 |
| - | tcp|in|d=25|s=174.37.170.192/ | + | tcp|in|d=25|s=74.37.170.192/ |
| - | tcp|in|d=25|s=174.36.242.64/ | + | tcp|in|d=25|s=74.36.242.64/ |
| - | tcp|in|d=25|s=208.43.201.128/ | + | tcp|in|d=25|s=108.43.201.128/ |
| - | tcp|in|d=25|s=67.225.140.128/ | + | tcp|in|d=25|s=57.225.140.128/ |
| - | tcp|in|d=25|s=50.201.66.0/ | + | tcp|in|d=25|s=40.201.66.0/ |
| udp|out|d=53|| # Outbound DNS query with random source port | udp|out|d=53|| # Outbound DNS query with random source port | ||
| + | |||
| + | # Zimbra Zextras Docs Server | ||
| + | tcp|in|d=389|s=98.167.189.29 | ||
| + | tcp|in|d=8443|s=98.167.189.29 | ||
| + | tcp|out|d=9980|d=98.167.189.29 # Allow to Zimbra Zextras Docs | ||
| + | |||
| + | # LDAP Testing | ||
| + | tcp|in|d=389|s=192.168.1.46 | ||
| </ | </ | ||
| ==== csf.pignore ==== | ==== csf.pignore ==== | ||
| + | |||
| + | :!: This example is for Ubuntu 20.04 with Zimbra 9. | ||
| These entries will minimize Process Tracking false alerts (entries for multiple Zimbra versions): | These entries will minimize Process Tracking false alerts (entries for multiple Zimbra versions): | ||
| < | < | ||
| + | ############################################################################### | ||
| + | # Copyright 2006-2014, Way to the Web Limited | ||
| + | # URL: http:// | ||
| + | # Email: sales@waytotheweb.com | ||
| ############################################################################### | ############################################################################### | ||
| # The following is a list of executables (exe) command lines (cmd) and | # The following is a list of executables (exe) command lines (cmd) and | ||
| Line 197: | Line 189: | ||
| exe:/ | exe:/ | ||
| exe:/ | exe:/ | ||
| + | exe:/ | ||
| + | exe:/ | ||
| exe:/ | exe:/ | ||
| exe:/ | exe:/ | ||
| Line 216: | Line 210: | ||
| exe:/ | exe:/ | ||
| exe:/ | exe:/ | ||
| + | exe:/ | ||
| cmd:/ | cmd:/ | ||
| Line 251: | Line 246: | ||
| cmd:/ | cmd:/ | ||
| cmd:/ | cmd:/ | ||
| + | cmd:/ | ||
| + | cmd:/ | ||
| + | cmd:/ | ||
| + | cmd: | ||
| + | cmd:/ | ||
| + | cmd:/ | ||
| + | cmd:/ | ||
| + | cmd:/ | ||
| + | cmd:/ | ||
| + | |||
| + | pcmd:/ | ||
| pcmd:sh -c / | pcmd:sh -c / | ||
| pcmd:/ | pcmd:/ | ||
| Line 259: | Line 265: | ||
| pcmd:/ | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| + | pcmd:/ | ||
| pcmd:sh -c / | pcmd:sh -c / | ||
| pcmd:/ | pcmd:/ | ||
| Line 264: | Line 271: | ||
| pcmd:/ | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| + | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| Line 273: | Line 281: | ||
| pcmd:/ | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| + | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| Line 279: | Line 288: | ||
| pcmd:/ | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| + | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| + | pcmd:/ | ||
| pcmd:/ | pcmd:/ | ||
| - | pcmd:/ | + | pcmd:/ |
| pcmd:/ | pcmd:/ | ||
| Line 300: | Line 311: | ||
| pexe:/ | pexe:/ | ||
| pexe:/ | pexe:/ | ||
| + | pexe:/ | ||
| + | pexe:/ | ||
| </ | </ | ||
| Line 307: | Line 320: | ||
| < | < | ||
| - | diff --unchanged-line-format= --old-line-format= --new-line-format=' | + | diff --unchanged-line-format= --old-line-format= --new-line-format=' |
| </ | </ | ||
| + | |||
| + | :!: This example is for Ubuntu 20.04 with Zimbra 9. | ||
| < | < | ||
| TESTING = " | TESTING = " | ||
| RESTRICT_SYSLOG = " | RESTRICT_SYSLOG = " | ||
| - | TCP_IN = "22, | + | TCP_IN = "20,21,25,53, |
| - | TCP_OUT = " | + | TCP_OUT = " |
| UDP_IN = " | UDP_IN = " | ||
| UDP_OUT = " | UDP_OUT = " | ||
| + | ICMP_IN_RATE = " | ||
| IPV6 = " | IPV6 = " | ||
| - | TCP6_IN = "22, | + | TCP6_IN = "20,21,25,53, |
| - | TCP6_OUT = "22,25, | + | TCP6_OUT = " |
| UDP6_IN = " | UDP6_IN = " | ||
| UDP6_OUT = " | UDP6_OUT = " | ||
| - | USE_CONNTRACK = " | ||
| SYSLOG_CHECK = " | SYSLOG_CHECK = " | ||
| - | DENY_IP_LIMIT = "1000" | + | DENY_IP_LIMIT = "5000" |
| DENY_TEMP_IP_LIMIT = " | DENY_TEMP_IP_LIMIT = " | ||
| LF_IPSET = " | LF_IPSET = " | ||
| STYLE_CUSTOM = " | STYLE_CUSTOM = " | ||
| SMTP_ALLOWUSER = "" | SMTP_ALLOWUSER = "" | ||
| - | SYNFLOOD = " | + | CONNLIMIT = "80;60,110;10,143;10,443;60,465;10,587;10,993;10,995;10" |
| - | CONNLIMIT = "80;30,110;5,143;5,443;30,465;5,587;5,993;5,995;5" | + | PORTFLOOD = " |
| - | PORTFLOOD = " | + | UDPFLOOD_ALLOWUSER = " |
| - | DROP_NOLOG = " | + | DROP_IP_LOGGING = "1" |
| + | DROP_NOLOG = " | ||
| + | DROP_PF_LOGGING = "1" | ||
| CONNLIMIT_LOGGING = " | CONNLIMIT_LOGGING = " | ||
| LF_PERMBLOCK_COUNT = " | LF_PERMBLOCK_COUNT = " | ||
| + | LF_PERMBLOCK_ALERT = " | ||
| LF_NETBLOCK = " | LF_NETBLOCK = " | ||
| + | LF_NETBLOCK_COUNT = " | ||
| + | LF_NETBLOCK_ALERT = " | ||
| SAFECHAINUPDATE = " | SAFECHAINUPDATE = " | ||
| DYNDNS = " | DYNDNS = " | ||
| + | MM_LICENSE_KEY = " | ||
| + | CC_SRC = " | ||
| + | CC_DENY = " | ||
| + | CC_DENY_PORTS_TCP = " | ||
| + | CC_DENY_PORTS_UDP = " | ||
| + | CC_INTERVAL = " | ||
| LF_SELECT = " | LF_SELECT = " | ||
| LF_EMAIL_ALERT = " | LF_EMAIL_ALERT = " | ||
| LF_SSHD_PERM = " | LF_SSHD_PERM = " | ||
| LF_FTPD_PERM = " | LF_FTPD_PERM = " | ||
| - | LF_SMTPAUTH = " | ||
| LF_SMTPAUTH_PERM = " | LF_SMTPAUTH_PERM = " | ||
| + | LF_POP3D = " | ||
| LF_POP3D_PERM = " | LF_POP3D_PERM = " | ||
| - | LF_IMAPD_PERM | + | LF_IMAPD |
| LF_HTACCESS_PERM = " | LF_HTACCESS_PERM = " | ||
| LF_MODSEC_PERM = " | LF_MODSEC_PERM = " | ||
| Line 355: | Line 381: | ||
| LF_WEBMIN = " | LF_WEBMIN = " | ||
| LF_WEBMIN_PERM = " | LF_WEBMIN_PERM = " | ||
| - | LF_WEBMIN_EMAIL_ALERT = " | ||
| - | LF_CONSOLE_EMAIL_ALERT = " | ||
| LF_APACHE_404 = " | LF_APACHE_404 = " | ||
| LF_APACHE_403 = " | LF_APACHE_403 = " | ||
| + | LF_APACHE_401_PERM = " | ||
| + | LF_MODSECIPDB_ALERT = " | ||
| + | LF_MODSECIPDB_FILE = "/ | ||
| LF_DISTATTACK = " | LF_DISTATTACK = " | ||
| LF_DISTFTP = " | LF_DISTFTP = " | ||
| Line 372: | Line 399: | ||
| MESSENGER_HTTPS_KEY = "/ | MESSENGER_HTTPS_KEY = "/ | ||
| MESSENGER_HTTPS_CRT = "/ | MESSENGER_HTTPS_CRT = "/ | ||
| + | MESSENGER_HTTPS_IN = "" | ||
| + | MESSENGER_CHILDREN = " | ||
| + | MESSENGERV3LOCATION = "/ | ||
| + | MESSENGERV3RESTART = " | ||
| + | MESSENGERV3HTTPS_CONF = "/ | ||
| + | MESSENGERV3GROUP = " | ||
| + | CLUSTER_SENDTO = " | ||
| + | CLUSTER_RECVFROM = " | ||
| + | CLUSTER_MASTER = " | ||
| + | CLUSTER_KEY = " | ||
| + | CLUSTER_CONFIG = " | ||
| ST_SYSTEM = " | ST_SYSTEM = " | ||
| + | IPTABLES = "/ | ||
| + | IPTABLES_SAVE = "/ | ||
| + | IPTABLES_RESTORE = "/ | ||
| + | IP6TABLES_SAVE = "/ | ||
| + | IP6TABLES_RESTORE = "/ | ||
| + | MODPROBE = "/ | ||
| + | IFCONFIG = "/ | ||
| SENDMAIL = "/ | SENDMAIL = "/ | ||
| - | HTACCESS_LOG = "/ | + | PS = "/ |
| - | MODSEC_LOG = "/ | + | NETSTAT = "/ |
| + | LS = "/ | ||
| + | TAR = "/ | ||
| + | GUNZIP = "/ | ||
| + | DD = "/ | ||
| + | GREP = "/ | ||
| + | IP = "/ | ||
| + | HTACCESS_LOG = "/ | ||
| + | MODSEC_LOG = "/ | ||
| + | SSHD_LOG = "/ | ||
| + | SU_LOG = "/ | ||
| + | FTPD_LOG = "/ | ||
| SMTPAUTH_LOG = "/ | SMTPAUTH_LOG = "/ | ||
| - | CUSTOM1_LOG = "/ | + | POP3D_LOG = "/ |
| + | IMAPD_LOG = "/ | ||
| + | IPTABLES_LOG = "/ | ||
| + | SUHOSIN_LOG = "/ | ||
| + | BIND_LOG = "/ | ||
| + | SYSLOG_LOG = "/ | ||
| + | WEBMIN_LOG = "/ | ||
| + | CUSTOM1_LOG = "/ | ||
| + | PORTS_pop3d = " | ||
| + | PORTS_imapd = " | ||
| + | PORTS_sshd = " | ||
| GENERIC = " | GENERIC = " | ||
| </ | </ | ||
internet/mail/zimbra/zimbra_firewall.1540934334.txt.gz · Last modified: 2018/10/30 15:18 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
