虚拟机插入 Centos 7 Min .ISO 光盘

进入到安装选 项 按tab键

esxi部署zabbix esxi部署邮箱_php

添加 inst.ks=http://dl.efa-project.org/build/4/kstesting.cfg

esxi部署zabbix esxi部署邮箱_php_02

按Enter 自动安装，网络安装 大概需要下载500MB左右的文件 需要等60分钟左右

esxi部署zabbix esxi部署邮箱_网络_03

安装完成

esxi部署zabbix esxi部署邮箱_垃圾邮件_04

安装配置

esxi部署zabbix esxi部署邮箱_网络_05

修改网卡

vi /etc/sysconfig/network-scripts/ifcfg-ens160

esxi部署zabbix esxi部署邮箱_垃圾邮件_06

你不会在eFa上使用智能主机，而是建立eFa作为出站中继。

EFA配置选项7）邮件设置 - >选项1）出站邮件中继

esxi部署zabbix esxi部署邮箱_esxi部署zabbix_07

EFA配置选项7“出站智能主机”（7,2）“智能主机：已禁用”，因为您希望EFA直接发送邮件

esxi部署zabbix esxi部署邮箱_垃圾邮件_08

EFA配置选项7“传输设置” “（7,4）as”domain.com“”<您的交换服务器的内部IP地址“

esxi部署zabbix esxi部署邮箱_垃圾邮件_09

EFA配置选项8“垃圾邮件设置” “（8,1）非垃圾邮件设置

垃圾邮件设置>非垃圾邮件设置

  • 禁用存储非垃圾邮件：否（这允许培训误报以及最近的存档/恢复）。

禁用非垃圾邮件签名：是（此设置取决于您是否需要EFA水印，我禁用它，因为我们（IT管理员）管理垃圾邮件而不是用户。此外，我们的大多数（99％）用户都是外部的将全民教育暴露在互联网上。）

esxi部署zabbix esxi部署邮箱_esxi部署zabbix_10

esxi部署zabbix esxi部署邮箱_垃圾邮件_11

  • EFA配置选项9“垃圾邮件设置” “（8,2）圾邮件设置
  • 推荐：垃圾邮件设置>垃圾邮件设置。启用垃圾邮件传递：是的。（这与后面提到的其他规则相结合，允许可疑垃圾邮件进入用户的垃圾邮件文件夹。
EFA V4与Active Directory集成
请安装 php-ldap （rpm -qa|grep php）
yum install lrzsz -y

esxi部署zabbix esxi部署邮箱_网络_12

vi /var/www/html/mailscanner/conf.php（编辑后重启系统 需要开启apache https）
// LDAP settings for authentication
define('USE_LDAP', true);
define('LDAP_SSL', false);
define('LDAP_HOST', '192.168.32.83');
define('LDAP_PORT', '389');
define('LDAP_DN', 'OU=email,DC=test,DC=xyz');
define('LDAP_USER', 'test@test.xyz');
define('LDAP_PASS', '123456');
define('LDAP_SITE', 'Default-First-Site-Name');
define('LDAP_FILTER', 'proxyAddresses=smtp:%s', 'mail=%s');
define('LDAP_PROTOCOL_VERSION', 3);
define('LDAP_EMAIL_FIELD', 'mail');
define('LDAP_USERNAME_FIELD', 'cn');
define('LDAP_MS_AD_COMPATIBILITY', true);

esxi部署zabbix esxi部署邮箱_垃圾邮件_13

vi /etc/hosts (添加exchange服务器IP和域名)

192.168.32.83 mail.test.xyz

esxi部署zabbix esxi部署邮箱_esxi部署zabbix_14

设置垃圾邮件不修改主题

vi /etc/MailScanner/MailScanner.conf

Spam Subject Text =

esxi部署zabbix esxi部署邮箱_垃圾邮件_15

/etc/init.d/spamassassin restart
exchange 设置垃圾邮件过滤
添加规则
New-TransportRule -Name "EFA to Junk Folder" -HeaderMatchesMessageHeader "X-Spam-Status" -HeaderMatchesPatterns "Yes" -SetSCL 9 -Comments "This rule moves spam messages from the EFA filter to the users junk mail folder."
步骤 2：使用命令行管理程序重新启动 Microsoft Exchange 传输服务
运行命令：Restart-Service MSExchangeTransport

esxi部署zabbix esxi部署邮箱_php_16

重启服务
service sqlgrey restart
service spamassassin restart
service webmin restart
service clamd restart
service MailScanner restart
service postfix restart
MailScanner --lint
spamassassin -D --lint （重新加载规则）
安装fail2ban  自动拦截邮件***
yum install fail2ban –y
# vi /etc/fail2ban/jail.conf
最后一行添加如下：
[postfix]
enabled = true
filter = postfix
action = iptables-allports[name=postfix, port=25, protocol=tcp]
ignoreip = 127.0.0.1
logpath = /var/log/maillog
bantime = 6048000
findtime = 120
maxretry = 3
[postfix-ddos]
enabled = true
filter = postfix-ddos
action = iptables-allports[name=MAIL, protocol=all]
logpath = /var/log/maillog
maxretry = 2
findtime = 86400
bantime = 604800
/etc/fail2ban/filter.d中编辑或新加文件，文件名一定要跟上一步jail.conf配置文件中的“filter=”对应
POSTFIX
vi /etc/fail2ban/filter.d/postfix.conf
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 510 $
#
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = warning: (.*)\[<HOST>\]: SASL LOGIN authentication failed:
reject: RCPT from (.*)\[<HOST>\]: 550 5.1.1
reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1
reject: RCPT from (.*)\[<HOST>\]: 554 5.7.1
reject: RCPT from (.*)\[<HOST>\]: 554 5.5.2
reject: RCPT from (.*)\[<HOST>\]: 504 5.5.2
reject: RCPT from (.*)\[<HOST>\]: 450
reject: RCPT from (.*)\[<HOST>\]: 554
reject: RCPT from (.*)\[<HOST>\]: 554 5.7.1
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
--------------------------------------------------------------------------------------------------------------
vi /etc/fail2ban/filter.d/postfix-ddos.conf
# Fail2Ban filter for Postfix DDOS attacks # [INCLUDES] before = common.conf [Definition] _daemon = postfix/(submission/)?smtp(d|s) failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.1 Service unavailable; Client host \[\S+\] blocked using .* from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$ ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 504 5\.5\.2 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$ ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$ ^%(__prefix_line)slost connection after \S+ from [^[]*\[<HOST>\]:?$ ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$ ^%(__prefix_line)sstatistics: max connection rate \S+ for \(smtp:<HOST>\):?$ ignoreregex = lost connection after .* from unknown\[unknown\]$ authentication failed: Connection lost to authentication server$ statistics: max connection rate .* for \(smtp:unknown\).*$ [Init] journalmatch = _SYSTEMD_UNIT=postfix.service # Author: kn007
启动fail2ban
systemctl start fail2ban
查看拦截fail2ban
fail2ban-client status postfix
CentOS7版本后防火墙默认使用firewalld
systemctl start firewalld
yum install -y iptables-services
service iptables start
vi /etc/sysconfig/iptables
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
测试邮件内容过滤 
发送测试邮件的文本内容如下：
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
测试反病毒邮件 
发送测试邮件的文本内容如下：
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
关闭MailScanner 对邮件内容扫描签名
vi /etc/MailScanner/MailScanner.conf
Dangerous Content Scanning = no
对发送的邮件进行签名
vi /etc/Mailscanner/Mailscanner.conf
Sign Clean Messages = no
这个选项默认是打开的，表示MailScanner对邮件内容进行扫描，但是过于严格了，会把很多html邮件滤掉，所以我把它关了。
systemctl restart mailscanner.service

esxi部署zabbix esxi部署邮箱_网络_17

Virus Scanners = clamd
设置杀毒软件，如果使用clamav，则Virus Scanners = clamav。
vi /etc/MailScanner/MailScanner.conf
在2242行 
Required SpamAssassin Score = 4
（高评分垃圾邮件投递）
High Scoring Spam Actions = deliver header "X-Spam-Status:Yes

"

esxi部署zabbix esxi部署邮箱_网络_18

systemctl restart mailscanner.service