Editing CBpolicyD on Postfix for Tetra Relay Servers




== Referance Links : ==

https://computingforgeeks.com/install-cbpolicyd-on-centos-7/

and 

https://www.kutukupret.com/2009/09/13/postfix-centos-policyd-v2-mysql/


== Installation of Packages ==
 
 wget https://download.policyd.org/v2.0.14/cluebringer-2.0.14-1.noarch.rpm
 yum install epel-release
 yum install mariadb-server	
 yum insatll perl-Net-Server perl-Config-IniFiles perl-Cache-FastMmap perl-Mail-SPF perl-Net-IP
 yum install php php-pdo php-mysql	
 rpm -Uvh cluebringer-2.0.14-1.noarch.rpm
 systemctl status mariadb	
 systemctl enable mariadb	
 systemctl start mariadb	
 mysqladmin -u root password Tetra321	
 yum install unzip
 wget https://download.policyd.org/v2.0.14/cluebringer-v2.0.14.zip
 unzip cluebringer-v2.0.14.zip	
 cd cluebringer-v2.0.14	
 cd database	
 for i in core.tsql access_control.tsql	 quotas.tsql amavis.tsql checkhelo.tsql checkspf.tsql greylisting.tsql ;  do ./convert-tsql mysql $i; done > policyd.sql
 mysqladmin -u root -p create policyd	
 sed -i 's/TYPE=InnoDB CHARACTER SET latin1 COLLATE latin1_bin//' policyd.sql
 mysql -u root -pTetra321 policyd < policyd.sql

== Configurations ==
 

 vi /etc/policyd/cluebringer.conf
 Change the following
 DSN=DBI:mysql:database=policyd;host=localhost
 Username=root
 Password=Tetra321

'''For Web Access''' 

 vi /etc/policyd/webui.conf
 #$DB_DSN="sqlite:////tmp/cluebringer.sqlite";
 $DB_DSN="mysql:host=localhost;dbname=policyd";
 $DB_USER="root";
 $DB_PASS="Tetra321";

 vi /etc/httpd/conf.d/cluebringer.conf	
 Change the following 
 Alias /cluebringer /usr/share/cluebringer/webui
 <Directory /usr/share/cluebringer/webui>
    # Comment out the following 3 lines to make web ui accessible from anywhere
        AllowOverride AuthConfig
        Order Deny,Allow
        #Deny from all
        Allow from all
 </Directory>

'''Create Web Access protections with username and password''' 

 vi /usr/share/cluebringer/webui/.htaccess
 Add following in new file 
 AuthUserFile /usr/share/cluebringer/webui/.htpasswd
 AuthGroupFile /dev/null
 AuthName "user and password"
 AuthType Basic
 #
 <LIMIT GET>
 require valid-user
 </LIMIT>

'''Create user'''

 htpasswd -c /usr/share/cluebringer/webui/.htpasswd tetra_service
 password: System_0099?

 systemctl status httpd	
 systemctl enable httpd	
 systemctl start httpd	
 systemctl restart cbpolicyd
 systemctl enable cbpolicyd
'''
Configuration at Postfix for integration''' 

 vi /etc/postfix/main.cf
 change the line to 
 smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:10031, check_sender_access hash:/etc/postfix/sender_access, permit_mynetworks, permit_sasl_authenticated, reject_sender_login_mismatch, reject_unauth_destination
 systemctl restart postfix	
 tail -f /var/log/cbpolicyd.log
 tail -f /var/log/maillog


== Web based policy configuration ==
 
'''Objective : No Email address should be able to send more than 100 mails per hour''' except any mail from pacefin and consortium securites 

URL : http://serverIP/cluebringer   e.g - http://13.235.234.103/cluebringer/

give username and password as defined earlier ( tetra_service / System_0099? )

 Groups--> Internal Domains --> members --> add @pacefin.net and @consortiumsecurities.com
 Ensure Disable should be no 
 Main --> Default Inbound  --> members and have 
    !%internal_ips,!%internal_domains as Source  	any as destination
 Quotas--> Configure --> new as per below image 
[[File:Screenshot_from_2019-08-30_09-39-00.png]]

Then 
 On the New policy add limit of Messagecount as 100
[[File:Screenshot_from_2019-08-30_09-47-09.png]]

Please keep checking the logs for any errors