CBpolicyD on Postfix for Tetra Relay Servers

Referance Links :

https://computingforgeeks.com/install-cbpolicyd-on-centos-7/

and

https://www.kutukupret.com/2009/09/13/postfix-centos-policyd-v2-mysql/

Installation of Packages

wget https://download.policyd.org/v2.0.14/cluebringer-2.0.14-1.noarch.rpm
yum install epel-release
yum install mariadb-server	
yum insatll perl-Net-Server perl-Config-IniFiles perl-Cache-FastMmap perl-Mail-SPF perl-Net-IP
yum install php php-pdo php-mysql	
rpm -Uvh cluebringer-2.0.14-1.noarch.rpm
systemctl status mariadb	
systemctl enable mariadb	
systemctl start mariadb	
mysqladmin -u root password Tetra321	
yum install unzip
wget https://download.policyd.org/v2.0.14/cluebringer-v2.0.14.zip
unzip cluebringer-v2.0.14.zip	
cd cluebringer-v2.0.14	
cd database	
for i in core.tsql access_control.tsql	 quotas.tsql amavis.tsql checkhelo.tsql checkspf.tsql greylisting.tsql ;  do ./convert-tsql mysql $i; done > policyd.sql
mysqladmin -u root -p create policyd	
sed -i 's/TYPE=InnoDB CHARACTER SET latin1 COLLATE latin1_bin//' policyd.sql
mysql -u root -pTetra321 policyd < policyd.sql

Configurations

vi /etc/policyd/cluebringer.conf
Change the following
DSN=DBI:mysql:database=policyd;host=localhost
Username=root
Password=Tetra321

For Web Access

vi /etc/policyd/webui.conf
#$DB_DSN="sqlite:////tmp/cluebringer.sqlite";
$DB_DSN="mysql:host=localhost;dbname=policyd";
$DB_USER="root";
$DB_PASS="Tetra321";

vi /etc/httpd/conf.d/cluebringer.conf	
Change the following 
Alias /cluebringer /usr/share/cluebringer/webui
<Directory /usr/share/cluebringer/webui>
   # Comment out the following 3 lines to make web ui accessible from anywhere
       AllowOverride AuthConfig
       Order Deny,Allow
       #Deny from all
       Allow from all
</Directory>

Create Web Access protections with username and password

vi /usr/share/cluebringer/webui/.htaccess
Add following in new file 
AuthUserFile /usr/share/cluebringer/webui/.htpasswd
AuthGroupFile /dev/null
AuthName "user and password"
AuthType Basic
#
<LIMIT GET>
require valid-user
</LIMIT>

Create user

htpasswd -c /usr/share/cluebringer/webui/.htpasswd tetra_service
password: System_0099?

systemctl status httpd	
systemctl enable httpd	
systemctl start httpd	
systemctl restart cbpolicyd
systemctl enable cbpolicyd

Configuration at Postfix for integration

vi /etc/postfix/main.cf
change the line to 
smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:10031, check_sender_access hash:/etc/postfix/sender_access, permit_mynetworks, permit_sasl_authenticated, reject_sender_login_mismatch, reject_unauth_destination
systemctl restart postfix	
tail -f /var/log/cbpolicyd.log
tail -f /var/log/maillog

Web based policy configuration

Objective : No Email address should be able to send more than 100 mails per hour except any mail from pacefin and consortium securites

URL : http://serverIP/cluebringer e.g - http://13.235.234.103/cluebringer/

give username and password as defined earlier ( tetra_service / System_0099? )

Groups--> Internal Domains --> members --> add @pacefin.net and @consortiumsecurities.com
Ensure Disable should be no 
Main --> Default Inbound  --> members and have 
   !%internal_ips,!%internal_domains as Source  	any as destination
Quotas--> Configure --> new as per below image 

Then

On the New policy add limit of Messagecount as 100

Please keep checking the logs for any errors