Hello,
great how to, congrats.
Just to notify a couple of things:
a) on Debian Jessie you don't need anymore to run "freshclam" from crontab, otherwise you will get an error:
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
ERROR: /var/log/clamav/freshclam.log is locked by another process
The reason of that is because the freshclam deamon already does the updating work from itself
You can try with :
/etc/init.d/clamav-freshclam stop
run the
freshclam -v
and at this time should works
and start again the daemon
/etc/init.d/clamav-freshclam start
b) about opendmarc: it should be useful to send the Forensic report to other admins who want.
Copy the DMARC database schema SQL script to your database server(if that is not the same as your mail server). You can find the SQL script under following path:
/usr/share/doc/opendmarc/schema.mysql
Edit the script to fit your needs. The default is mostly fine. But if you do not wish to create your database users by hand, you should uncomment and edit these two lines in the script (to uncomment them remove the leading –):
-- CREATE USER 'opendmarc'@'localhost' IDENTIFIED BY 'changeme';
-- GRANT ALL ON opendmarc.* to 'opendmarc'@'localhost';
With this part you create a database user and allow him access to the database. The following parts of this statement may need to be modified:
‘opendmarc’@: This is the username, you can choose whatever you like as username. But make sure that you put it into quotes. (The @ is not part of the username, but simply here to differentiate the username from the database name)
‘localhost’: this the host from which the database user is allowed to connect. If the MySQL database runs on your mail server, you can leave localhost here. If your MySQL database runs on a different server, put the IP of your mail server here.
‘changeme’: This is the user password. I suggest a nice strong randomly generated password here.
opendmarc.*: This is the database name. if you did not change anything in the upper part of the script, leave this alone.
connect to the database with an account with sufficient privileges to create a new database and run the script. One of the simpler ways of doing this would be the following commands on the database server:
cd /path/to/schema.mysql/
mysql -u root -p < schema.sql
You can replace the root user with any user, that has the right to create new databases and users. The command will prompt you for the user password and then execute the script.
Once the database exists go back to your mail server and create a new script to read the history file into the database and send out the reports.
/etc/opendmarc/report_script
I used following script for this:
#!/bin/bash
DB_SERVER='database.example.com'
DB_USER='opendmarc'
DB_PASS='password
DB_NAME='opendmarc'
WORK_DIR='/var/run/opendmarc'
REPORT_EMAIL='dmarc [at] example [dot] com'
REPORT_ORG=example.com'
mv ${WORK_DIR}/opendmarc.dat ${WORK_DIR}/opendmarc_import.dat -f
cat /dev/null > ${WORK_DIR}/opendmarc.dat
/usr/sbin/opendmarc-import --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose < ${WORK_DIR}/opendmarc_import.dat
/usr/sbin/opendmarc-reports --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose --interval=86400 --report-email $REPORT_EMAIL --report-org $REPORT_ORG
/usr/sbin/opendmarc-expire --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose
You will need to fill in the database details of your previously created database here.
Make the script executable:
chmod +x /etc/opendmarc/report_script
And run it under the opendmarc user as a test:
su -c "/etc/opendmarc/report_script" -s /bin/bash opendmarc
When the script worked as expected you can add it to your cron jobs:
nano /etc/crontab
Add following line:
1 0 * * * opendmarc /etc/opendmarc/report-script
This example will execute the script every day at 00:01 under the user opendmarc.
c) Also, the new opendmarc 1.3.0 release seems to have the ability to do its own SPF checks. I haven’t tried this myself, but the SPFIgnoreResults and SPFSelfValidate options seem to control this behavior. Should be interesting to add to this howto so people uses it, can remove SPF milter like smf-spf.
