Roll Out Done in Pahwa: Difference between revisions

Revision as of 14:49, 2 December 2014

Objective

SSL Certicate was implemented on the Pahwa mail server ( postfix , trend Micro and Qmail )
Now all the NON - Secure ports needs to disabled or modified
Identified Ports / Services were POP3 (Qmail-pop) , IMAP (Courier) , HTTP (Apache) and SMTP (postfix) without Auth ( SMTP service cannot be disabled )

Solution

POP3 - disabled on Qmail by removing (qmail-pop3d ) the Link to /service
IMAP - Disable by binding it to localhost ( 127.0.0.1) in imapd.conf files
HTTP - Redirect hhtp to HTTPS .

^ SMTP - Disable Authentication on postfix so that relay mails cannot come on port 25 . Also allowed few designated IP to relay ( As that was customer requirement )

Technical Roll Out Process In Pahwa qmail + postfix + Apache

For the Apache done the below in httpd.conf

RewriteEngine On
  RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]

For the Non secure Pop port disablement done below

unlink /services/qmail-pop3d

For the Postfix done below in main.cf

mynetworks = 127.0.0.0/8, 192.168.0.2, 192.168.0.16, 192.168.0.49, 182.71.174.125
smtpd_sasl_auth_enable = no

@@ Line 1: / Line 1: @@
 [[category:Pahwa Group]]
-<center>'''Roll Out Process In Pahwa qmail + postfix + Apache'''</center>
+==Objective==
+* SSL Certicate was implemented on the Pahwa mail server ( postfix , trend Micro and Qmail )
+* Now all the NON - Secure ports needs to disabled or modified
+* Identified Ports / Services were  POP3 (Qmail-pop) , IMAP (Courier) , HTTP (Apache) and SMTP (postfix) without Auth ( SMTP service cannot be disabled )
+==Solution==
+* POP3 - disabled on Qmail by removing (qmail-pop3d ) the Link to /service
+* IMAP - Disable by binding it to localhost ( 127.0.0.1) in imapd.conf files
+* HTTP - Redirect hhtp to HTTPS .
+^ SMTP - Disable Authentication on postfix so that relay mails cannot come on port 25 . Also allowed few designated IP to relay ( As that was customer requirement )
+'''Technical Roll Out Process In Pahwa qmail + postfix + Apache'''