User Tools
internet:mail:zimbra:zimbra_firewall
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
internet:mail:zimbra:zimbra_firewall [2022/10/07 09:27] gcooper |
internet:mail:zimbra:zimbra_firewall [2023/11/13 08:53] (current) gcooper |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Zimbra Firewall ====== | ====== Zimbra Firewall ====== | ||
| + | |||
| + | FIXME This page could probably use a review and updating. | ||
| **Zimbra IP Ports Used**: http:// | **Zimbra IP Ports Used**: http:// | ||
| Line 39: | Line 41: | ||
| http:// | http:// | ||
| - | :!: Reload or restart CSF and LFD for changes to be activated. | + | :!: Reload or restart CSF and LFD for changes to be activated |
| ==== Postfix ==== | ==== Postfix ==== | ||
| - | **RegEx Tester**: https:// | + | **RegEx Tester**: https:// |
| **Reference**: | **Reference**: | ||
| - | <note warning> | + | <note warning> |
| - | + | ||
| - | Note that the Postfix log format seems to change | + | |
| Consider these lines clipped from ''/ | Consider these lines clipped from ''/ | ||
| Line 55: | Line 55: | ||
| < | < | ||
| Oct 2 08:18:04 zimbra3 postfix/ | Oct 2 08:18:04 zimbra3 postfix/ | ||
| - | |||
| Oct 5 14:27:13 zimbra3 postfix/ | Oct 5 14:27:13 zimbra3 postfix/ | ||
| </ | </ | ||
| - | Add a custom RegEx to detect authentication failures (5 failures, block ports 25 and 587, for 3600 seconds): | + | Add a custom RegEx to detect authentication failures (5 failures, block ports 25 and 587, for 3600 seconds/1 hour): |
| < | < | ||
| Line 73: | Line 72: | ||
| </ | </ | ||
| - | :!: $1 matches the offending IP address. | + | :!: Group 1 ($1) matches the offending IP address. |
| Now, edit the CSF configuration to tell it to monitor the proper log file for the new RegEx: | Now, edit the CSF configuration to tell it to monitor the proper log file for the new RegEx: | ||
| Line 124: | Line 123: | ||
| udp|out|d=53|| # Outbound DNS query with random source port | udp|out|d=53|| # Outbound DNS query with random source port | ||
| - | # Zimbra Docs | + | # Zimbra |
| tcp|in|d=389|s=98.167.189.29 | tcp|in|d=389|s=98.167.189.29 | ||
| tcp|in|d=8443|s=98.167.189.29 | tcp|in|d=8443|s=98.167.189.29 | ||
| Line 130: | Line 129: | ||
| # LDAP Testing | # LDAP Testing | ||
| - | tcp|in|d=389|s=192.168.1.46 | + | tcp|in|d=389|s=192.168.1.46 |
| </ | </ | ||
| Line 321: | Line 320: | ||
| < | < | ||
| - | diff --unchanged-line-format= --old-line-format= --new-line-format=' | + | diff --unchanged-line-format= --old-line-format= --new-line-format=' |
| </ | </ | ||
| + | |||
| + | :!: This example is for Ubuntu 20.04 with Zimbra 9. | ||
| < | < | ||
| TESTING = " | TESTING = " | ||
| RESTRICT_SYSLOG = " | RESTRICT_SYSLOG = " | ||
| - | TCP_IN = "22, | + | TCP_IN = "20,21,25,53, |
| - | TCP_OUT = " | + | TCP_OUT = " |
| UDP_IN = " | UDP_IN = " | ||
| UDP_OUT = " | UDP_OUT = " | ||
| + | ICMP_IN_RATE = " | ||
| IPV6 = " | IPV6 = " | ||
| - | TCP6_IN = "22, | + | TCP6_IN = "20,21,25,53, |
| - | TCP6_OUT = "22,25, | + | TCP6_OUT = " |
| UDP6_IN = " | UDP6_IN = " | ||
| UDP6_OUT = " | UDP6_OUT = " | ||
| - | USE_CONNTRACK = " | ||
| SYSLOG_CHECK = " | SYSLOG_CHECK = " | ||
| - | DENY_IP_LIMIT = "1000" | + | DENY_IP_LIMIT = "5000" |
| DENY_TEMP_IP_LIMIT = " | DENY_TEMP_IP_LIMIT = " | ||
| LF_IPSET = " | LF_IPSET = " | ||
| STYLE_CUSTOM = " | STYLE_CUSTOM = " | ||
| SMTP_ALLOWUSER = "" | SMTP_ALLOWUSER = "" | ||
| - | SYNFLOOD = " | + | CONNLIMIT = "80;60,110;10,143;10,443;60,465;10,587;10,993;10,995;10" |
| - | CONNLIMIT = "80;30,110;5,143;5,443;30,465;5,587;5,993;5,995;5" | + | PORTFLOOD = " |
| - | PORTFLOOD = " | + | UDPFLOOD_ALLOWUSER = " |
| - | DROP_NOLOG = " | + | DROP_IP_LOGGING = "1" |
| + | DROP_NOLOG = " | ||
| + | DROP_PF_LOGGING = "1" | ||
| CONNLIMIT_LOGGING = " | CONNLIMIT_LOGGING = " | ||
| LF_PERMBLOCK_COUNT = " | LF_PERMBLOCK_COUNT = " | ||
| + | LF_PERMBLOCK_ALERT = " | ||
| LF_NETBLOCK = " | LF_NETBLOCK = " | ||
| + | LF_NETBLOCK_COUNT = " | ||
| + | LF_NETBLOCK_ALERT = " | ||
| SAFECHAINUPDATE = " | SAFECHAINUPDATE = " | ||
| DYNDNS = " | DYNDNS = " | ||
| + | MM_LICENSE_KEY = " | ||
| + | CC_SRC = " | ||
| + | CC_DENY = " | ||
| + | CC_DENY_PORTS_TCP = " | ||
| + | CC_DENY_PORTS_UDP = " | ||
| + | CC_INTERVAL = " | ||
| LF_SELECT = " | LF_SELECT = " | ||
| LF_EMAIL_ALERT = " | LF_EMAIL_ALERT = " | ||
| LF_SSHD_PERM = " | LF_SSHD_PERM = " | ||
| LF_FTPD_PERM = " | LF_FTPD_PERM = " | ||
| - | LF_SMTPAUTH = " | ||
| LF_SMTPAUTH_PERM = " | LF_SMTPAUTH_PERM = " | ||
| + | LF_POP3D = " | ||
| LF_POP3D_PERM = " | LF_POP3D_PERM = " | ||
| - | LF_IMAPD_PERM | + | LF_IMAPD |
| LF_HTACCESS_PERM = " | LF_HTACCESS_PERM = " | ||
| LF_MODSEC_PERM = " | LF_MODSEC_PERM = " | ||
| Line 369: | Line 381: | ||
| LF_WEBMIN = " | LF_WEBMIN = " | ||
| LF_WEBMIN_PERM = " | LF_WEBMIN_PERM = " | ||
| - | LF_WEBMIN_EMAIL_ALERT = " | ||
| - | LF_CONSOLE_EMAIL_ALERT = " | ||
| LF_APACHE_404 = " | LF_APACHE_404 = " | ||
| LF_APACHE_403 = " | LF_APACHE_403 = " | ||
| + | LF_APACHE_401_PERM = " | ||
| + | LF_MODSECIPDB_ALERT = " | ||
| + | LF_MODSECIPDB_FILE = "/ | ||
| LF_DISTATTACK = " | LF_DISTATTACK = " | ||
| LF_DISTFTP = " | LF_DISTFTP = " | ||
| Line 386: | Line 399: | ||
| MESSENGER_HTTPS_KEY = "/ | MESSENGER_HTTPS_KEY = "/ | ||
| MESSENGER_HTTPS_CRT = "/ | MESSENGER_HTTPS_CRT = "/ | ||
| + | MESSENGER_HTTPS_IN = "" | ||
| + | MESSENGER_CHILDREN = " | ||
| + | MESSENGERV3LOCATION = "/ | ||
| + | MESSENGERV3RESTART = " | ||
| + | MESSENGERV3HTTPS_CONF = "/ | ||
| + | MESSENGERV3GROUP = " | ||
| + | CLUSTER_SENDTO = " | ||
| + | CLUSTER_RECVFROM = " | ||
| + | CLUSTER_MASTER = " | ||
| + | CLUSTER_KEY = " | ||
| + | CLUSTER_CONFIG = " | ||
| ST_SYSTEM = " | ST_SYSTEM = " | ||
| + | IPTABLES = "/ | ||
| + | IPTABLES_SAVE = "/ | ||
| + | IPTABLES_RESTORE = "/ | ||
| + | IP6TABLES_SAVE = "/ | ||
| + | IP6TABLES_RESTORE = "/ | ||
| + | MODPROBE = "/ | ||
| + | IFCONFIG = "/ | ||
| SENDMAIL = "/ | SENDMAIL = "/ | ||
| - | HTACCESS_LOG = "/ | + | PS = "/ |
| - | MODSEC_LOG = "/ | + | NETSTAT = "/ |
| + | LS = "/ | ||
| + | TAR = "/ | ||
| + | GUNZIP = "/ | ||
| + | DD = "/ | ||
| + | GREP = "/ | ||
| + | IP = "/ | ||
| + | HTACCESS_LOG = "/ | ||
| + | MODSEC_LOG = "/ | ||
| + | SSHD_LOG = "/ | ||
| + | SU_LOG = "/ | ||
| + | FTPD_LOG = "/ | ||
| SMTPAUTH_LOG = "/ | SMTPAUTH_LOG = "/ | ||
| - | CUSTOM1_LOG = "/ | + | POP3D_LOG = "/ |
| + | IMAPD_LOG = "/ | ||
| + | IPTABLES_LOG = "/ | ||
| + | SUHOSIN_LOG = "/ | ||
| + | BIND_LOG = "/ | ||
| + | SYSLOG_LOG = "/ | ||
| + | WEBMIN_LOG = "/ | ||
| + | CUSTOM1_LOG = "/ | ||
| + | PORTS_pop3d = " | ||
| + | PORTS_imapd = " | ||
| + | PORTS_sshd = " | ||
| GENERIC = " | GENERIC = " | ||
| </ | </ | ||
internet/mail/zimbra/zimbra_firewall.1665156463.txt.gz · Last modified: 2022/10/07 09:27 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
