-
Notifications
You must be signed in to change notification settings - Fork 0
TP7 : Sécurisation du service mail
https://studio.youtube.com/video/3OxphpXu99Q/edit
Ce TP vise à mettre en place et sécuriser un service mail complet utilisant Docker Mailserver (DMS) avec authentification de domaine, chiffrement TLS et filtrage anti-spam.
- VPS Principal : Hébergement du service mail (mail.l2-2.ephec-ti.be)
- IP du serveur : 54.36.181.95
- Domaine utilisé : ephec-ti.be
- Container : Docker Mailserver (DMS) avec Postfix/Dovecot
Le service mail est isolé dans un container Docker pour faciliter la maintenance et la sécurité.
# Records DNS ajoutés
ephec-ti.be. IN MX 10 mail.l2-2.ephec-ti.be.
mail.l2-2.ephec-ti.be. IN A 54.36.181.95DMS_GITHUB_URL="https://raw.githubusercontent.com/docker-mailserver/docker-mailserver/master"
wget "${DMS_GITHUB_URL}/compose.yaml"
wget "${DMS_GITHUB_URL}/mailserver.env"-
compose.yaml : Modification du hostname vers
mail.l2-2.ephec-ti.be -
mailserver.env : Configuration
SSL_TYPE=letsencrypt
sudo certbot certonly --standalone -d mail.l2-2.ephec-ti.betheocle@anzeyimavps:/home/anzeyima/tp7$ # Obtenir l'IP de votre serveur
dig A mail.l2-2.ephec-ti.be
# ou
nslookup mail.l2-2.ephec-ti.be
; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> A mail.l2-2.ephec-ti.be
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44157
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;mail.l2-2.ephec-ti.be. IN A
;; ANSWER SECTION:
mail.l2-2.ephec-ti.be. 86400 IN A 54.36.181.95
;; Query time: 15 msec
;; SERVER: 213.186.33.99#53(213.186.33.99) (UDP)
;; WHEN: Tue Jun 10 07:51:19 UTC 2025
;; MSG SIZE rcvd: 66
Server: 213.186.33.99
Address: 213.186.33.99#53
Non-authoritative answer:
Name: mail.l2-2.ephec-ti.be
Address: 54.36.181.95
theocle@anzeyimavps:/home/anzeyima/tp7$
theocle@anzeyimavps:/home/anzeyima/tp7$ openssl s_client -connect mail.l2-2.ephec-ti.be:587 -starttls smtp
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = E6
verify return:1
depth=0 CN = mail.l2-2.ephec-ti.be
verify return:1
---
Certificate chain
0 s:CN = mail.l2-2.ephec-ti.be
i:C = US, O = Let's Encrypt, CN = E6
a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA384
v:NotBefore: Jun 9 17:01:57 2025 GMT; NotAfter: Sep 7 17:01:56 2025 GMT
1 s:C = US, O = Let's Encrypt, CN = E6
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
a:PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256
v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDmDCCAx2gAwIBAgISBbYu0Gkjxt8o/hA/a6IUDfu9MAoGCCqGSM49BAMDMDIx
CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
NjAeFw0yNTA2MDkxNzAxNTdaFw0yNTA5MDcxNzAxNTZaMCAxHjAcBgNVBAMTFW1h
aWwubDItMi5lcGhlYy10aS5iZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABHDN
rnWhdWRBudVPROy9ZQOw4daG4mE8t1n+OFqBpe+Q7k0Z3hNPkKdnzXMOyDF8GxHH
Lg1HaSyY82+vsAS9gNSjggIjMIICHzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYw
FAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFLzY
ieyP6bJGXQIvWX57lv9NpHZ2MB8GA1UdIwQYMBaAFJMnRpgDqVFojpjWxEJI2yO/
WJTSMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL2U2LmkubGVu
Y3Iub3JnLzAgBgNVHREEGTAXghVtYWlsLmwyLTIuZXBoZWMtdGkuYmUwEwYDVR0g
BAwwCjAIBgZngQwBAgEwLQYDVR0fBCYwJDAioCCgHoYcaHR0cDovL2U2LmMubGVu
Y3Iub3JnLzYyLmNybDCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB1AN3cyjSV1+EW
BeeVMvrHn/g9HFDf2wA6FBJ2Ciysu8gqAAABl1XZz+AAAAQDAEYwRAIgLs/4kiS0
vreOF0LcR/0vQ0i7KTP0V3hgKLNHJkjzRPwCIEHXA4Y8kQbFI8Ey9dMlL2u8CgaV
osBrkT5DKpFOSIAdAHcApELFBklgYVSPD9TqnPt6LSZFTYepfy/fRVn2J086hFQA
AAGXVdnXewAABAMASDBGAiEAl70qGdFm5Aj/rEFOeuqSWWCOZdbUKffOMwj7KpxK
TmwCIQCLRY5Y/X5pP+2gOusGUgzGPxIvE5EgtukRa6mJDvB8CTAKBggqhkjOPQQD
AwNpADBmAjEA6mukyhWIFLnCql4yD5GjQlCiUtIHnobqRlSlla9CxIvXpdn0oRnF
I0+K4gLvf3oRAjEAsjpMncbhRqq0uBsoh+T3pyBDN0FoBcGtfgEggfSCx7PfHCv6
xS5ZSplESuPuNUiH
-----END CERTIFICATE-----
subject=CN = mail.l2-2.ephec-ti.be
issuer=C = US, O = Let's Encrypt, CN = E6
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2627 bytes and written 440 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
250 CHUNKING
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: F911F4F031C867281D25EDEFB3229D5CA3A1AEFFDB108E4D4E4540FDC8407AEB
Session-ID-ctx:
Resumption PSK: 9BCB0BA042BB80C4BAD33C502433FCF2E0C657B4EBE5FC37A5EF60D89598FE4C2A1EC46EB157858EF3276E23FE31D752
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 8a a9 ee 7f 18 a4 15 ed-de 25 6c 10 24 8a 83 67 .........%l.$..g
0010 - ef c5 1b 79 4d 2d 86 d1-2c 5d 32 69 22 5b 57 5f ...yM-..,]2i"[W_
0020 - 42 a9 f5 8b d4 eb 28 84-74 1c bd ec fb 2a 2e 4d B.....(.t....*.M
0030 - de 48 22 f7 6e d8 df 6c-92 31 97 27 e8 bb fa de .H".n..l.1.'....
0040 - bd e1 64 78 86 de 36 81-b3 64 cb b1 ab 81 a1 0a ..dx..6..d......
0050 - 7b 21 e2 df 3e 9b 8b 47-8d 7f 36 2c fe 3f d1 50 {!..>..G..6,.?.P
0060 - 35 1f 33 c6 1f e5 83 17-b7 27 d0 aa 98 6f 4a ea 5.3......'...oJ.
0070 - d8 6a da 3f 36 39 a7 49-e6 0e 0b 75 c9 0a 6a 7c .j.?69.I...u..j|
0080 - 17 90 87 f4 19 87 07 cb-c8 c5 83 de 4e 28 71 03 ............N(q.
0090 - 6d 49 27 1d a4 69 ed 88-dc 91 7d 70 7b e3 b5 ac mI'..i....}p{...
00a0 - 7c cd d2 89 3b b6 3e fc-19 db 5d dc 89 2b 49 93 |...;.>...]..+I.
00b0 - 93 1d bd 35 b8 9a bf 20-5b 80 03 f4 11 3c 7f 3d ...5... [....<.=
00c0 - a5 07 94 38 a7 a6 04 7e-54 78 84 15 2e 37 3c 9b ...8...~Tx...7<.
Start Time: 1749541954
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
docker compose up -d
# Création des utilisateurs (dans les 2 minutes suivant le démarrage)
docker exec -ti mailserver setup email list
* user1@l2-2.ephec-ti.be ( 0 / ~ ) [0%]
[ aliases -> postmaster@l2-2.ephec-ti.be ]
* user2@l2-2.ephec-ti.be ( 0 / ~ ) [0%]theocle@anzeyimavps:/home/anzeyima/tp7$ swaks --to user2@l2-2.ephec-ti.be \
--from user1@l2-2.ephec-ti.be \
--server mail.l2-2.ephec-ti.be:587 \
--tls \
--auth \
--auth-user user1@l2-2.ephec-ti.be \
--auth-password user1
=== Trying mail.l2-2.ephec-ti.be:587...
=== Connected to mail.l2-2.ephec-ti.be.
<- 220 mail.l2-2.ephec-ti.be ESMTP
-> EHLO anzeyimavps
<- 250-mail.l2-2.ephec-ti.be
<- 250-PIPELINING
<- 250-SIZE 10240000
<- 250-ETRN
<- 250-STARTTLS
<- 250-ENHANCEDSTATUSCODES
<- 250-8BITMIME
<- 250-DSN
<- 250 CHUNKING
-> STARTTLS
<- 220 2.0.0 Ready to start TLS
=== TLS started with cipher TLSv1.3:TLS_AES_256_GCM_SHA384:256
=== TLS no local certificate set
=== TLS peer DN="/CN=mail.l2-2.ephec-ti.be"
~> EHLO anzeyimavps
<~ 250-mail.l2-2.ephec-ti.be
<~ 250-PIPELINING
<~ 250-SIZE 10240000
<~ 250-ETRN
<~ 250-AUTH PLAIN LOGIN
<~ 250-AUTH=PLAIN LOGIN
<~ 250-ENHANCEDSTATUSCODES
<~ 250-8BITMIME
<~ 250-DSN
<~ 250 CHUNKING
~> AUTH LOGIN
<~ 334 VXNlcm5hbWU6
~> dXNlcjFAbDItMi5lcGhlYy10aS5iZQ==
<~ 334 UGFzc3dvcmQ6
~> dXNlcjE=
<~ 235 2.7.0 Authentication successful
~> MAIL FROM:<user1@l2-2.ephec-ti.be>
<~ 250 2.1.0 Ok
~> RCPT TO:<user2@l2-2.ephec-ti.be>
<~ 250 2.1.5 Ok
~> DATA
<~ 354 End data with <CR><LF>.<CR><LF>
~> Date: Tue, 10 Jun 2025 07:10:43 +0000
~> To: user2@l2-2.ephec-ti.be
~> From: user1@l2-2.ephec-ti.be
~> Subject: test Tue, 10 Jun 2025 07:10:43 +0000
~> Message-Id: <20250610071043.594123@anzeyimavps>
~> X-Mailer: swaks v20201014.0 jetmore.org/john/code/swaks/
~>
~> This is a test mailing
~>
~>
~> .
<~ 250 2.0.0 Ok: queued as EF8618C6DF
~> QUIT
<~ 221 2.0.0 Bye
=== Connection closed with remote host.
theocle@anzeyimavps:/home/anzeyima/tp7$
##Test mail exterieur
theocle@anzeyimavps:/home/anzeyima/tp7$ swaks --to theo7.kill@gmail.com \
--from user1@l2-2.ephec-ti.be \
--server mail.l2-2.ephec-ti.be:587 \
--tls \
--auth \
--auth-user user1@l2-2.ephec-ti.be \
--auth-password user1
=== Trying mail.l2-2.ephec-ti.be:587...
=== Connected to mail.l2-2.ephec-ti.be.
<- 220 mail.l2-2.ephec-ti.be ESMTP
-> EHLO anzeyimavps
<- 250-mail.l2-2.ephec-ti.be
<- 250-PIPELINING
<- 250-SIZE 10240000
<- 250-ETRN
<- 250-STARTTLS
<- 250-ENHANCEDSTATUSCODES
<- 250-8BITMIME
<- 250-DSN
<- 250 CHUNKING
-> STARTTLS
<- 220 2.0.0 Ready to start TLS
=== TLS started with cipher TLSv1.3:TLS_AES_256_GCM_SHA384:256
=== TLS no local certificate set
=== TLS peer DN="/CN=mail.l2-2.ephec-ti.be"
~> EHLO anzeyimavps
<~ 250-mail.l2-2.ephec-ti.be
<~ 250-PIPELINING
<~ 250-SIZE 10240000
<~ 250-ETRN
<~ 250-AUTH PLAIN LOGIN
<~ 250-AUTH=PLAIN LOGIN
<~ 250-ENHANCEDSTATUSCODES
<~ 250-8BITMIME
<~ 250-DSN
<~ 250 CHUNKING
~> AUTH LOGIN
<~ 334 VXNlcm5hbWU6
~> dXNlcjFAbDItMi5lcGhlYy10aS5iZQ==
<~ 334 UGFzc3dvcmQ6
~> dXNlcjE=
<~ 235 2.7.0 Authentication successful
~> MAIL FROM:<user1@l2-2.ephec-ti.be>
<~ 250 2.1.0 Ok
~> RCPT TO:<theo7.kill@gmail.com>
<~ 250 2.1.5 Ok
~> DATA
<~ 354 End data with <CR><LF>.<CR><LF>
~> Date: Tue, 10 Jun 2025 07:30:59 +0000
~> To: theo7.kill@gmail.com
~> From: user1@l2-2.ephec-ti.be
~> Subject: test Tue, 10 Jun 2025 07:30:59 +0000
~> Message-Id: <20250610073059.597858@anzeyimavps>
~> X-Mailer: swaks v20201014.0 jetmore.org/john/code/swaks/
~>
~> This is a test mailing
~>
~>
~> .
<~ 250 2.0.0 Ok: queued as 14B638C72E
~> QUIT
<~ 221 2.0.0 Bye
=== Connection closed with remote host.
theocle@anzeyimavps:/home/anzeyima/tp7$
Résultats attendus avant sécurisation :
- SPF Record : Absent
- DKIM : Non configuré
- DMARC : Absent
- PTR Record : Non aligné
- MX Record : Configuré
- Ports ouverts : 25, 587, 465, 143, 993
Les utilisateurs sont gérés via un fichier plat dans Docker Mailserver :
- Stockage dans
/var/mail/ - Commande :
docker exec -ti mailserver setup email add - Pas d'intégration Unix directe ni de base de données
Le format utilisé est Maildir :
- Un répertoire par utilisateur
- Emails stockés individuellement
- Structure :
/var/mail/domaine.com/utilisateur/
docker exec -ti mailserver netstat -tlnpPorts identifiés :
- Port 25 : SMTP standard (non chiffré, STARTTLS disponible)
- Port 587 : SMTP soumission avec STARTTLS (TLS explicite)
- Port 465 : SMTPS (TLS implicite)
- Port 143 : IMAP standard (STARTTLS disponible)
- Port 993 : IMAPS (TLS implicite)
Configuration de capture :
# Capture sur l'interface réseau du client
# Filtres : tcp.port == 587 or tcp.port == 993Résultats attendus :
Pour l'envoi (SMTP) :
- Port utilisé : 587
- Type TLS : Explicite (STARTTLS)
- Séquence : Connexion claire → EHLO → STARTTLS → Négociation TLS → Authentication
Pour la réception (IMAP) :
- Port utilisé : 993
- Type TLS : Implicite
- Séquence : Connexion TLS directe → Authentication
Configuration PTR :
# - IP : 54.36.181.95
# - PTR souhaité : mail.l2-2.ephec-ti.be
# - Nom actuel : vps-6fe8e7f5.vps.ovh.netVérification :
dig -x 54.36.181.95
nslookup 54.36.181.95Résultat MXToolbox attendu :
- MX Record pointe vers mail.l2-2.ephec-ti.be
- A Record résout vers 54.36.181.95
- PTR Record inverse vers mail.l2-2.ephec-ti.be
Configuration DNS :
# Record TXT ajouté
ephec-ti.be. IN TXT "v=spf1 mx -all"
Configuration :
# Génération des clés
docker exec -it mailserver setup config dkim
# Vérification du fichier généré
cat config/dkim/mail.txtValidation
theocle@anzeyimavps:/home/anzeyima/tp7$ dig TXT mail._domainkey.l2-2.ephec-ti.be
; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> TXT mail._domainkey.l2-2.ephec-ti.be
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14182
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;mail._domainkey.l2-2.ephec-ti.be. IN TXT
;; ANSWER SECTION:
mail._domainkey.l2-2.ephec-ti.be. 86400 IN TXT "v=DKIM1; h=sha256; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA10wspjhAnqNECa/si5oG0vnmd2TumNFdCgVzDd4qqJOusZRzOnmUQG+8xHysvbwlohC9FKfG9eQNJvxS/duCQs55LV32Io6gRb3pesOorefOqgvsihwDwekbGH1pDSF4FM/wgtAaVt0FmwlnIIu8aVB1GjmDo2b3QSeE8DziGH8/7HDd6iuNwmdStc+NB9UbB5Xfs0bV2rAwSJ" "gHwTMG5NeEVv9QavZ6G8YqsYhniS+mifnM5bQngPWVrVf9e6Hb8HZztATRORKU138VlZ87byaAEK8kwe+Z/oU88o5gjATRrzzU2sHG3G1WjWgALUvI93SiiAj0TPJlqGrOyCOzmQIDAQAB"
;; Query time: 7 msec
;; SERVER: 213.186.33.99#53(213.186.33.99) (UDP)
;; WHEN: Tue Jun 10 07:49:32 UTC 2025
;; MSG SIZE rcvd: 496
theocle@anzeyimavps:/home/anzeyima/tp7$
Ajout du record DNS :
# Contenu du fichier mail.txt à ajouter en tant que record TXT
# Exemple :
mail._domainkey.ephec-ti.be. IN TXT "v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."Redémarrage :
docker compose down
docker compose up -dValidation en-tête email :
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ephec-ti.be;
s=mail; h=Date:From:To:Subject; bh=xxx; b=yyy
Résultat DKIM Validator :

Configuration DNS :
# Record TXT ajouté
_dmarc.ephec-ti.be. IN TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@ephec-ti.be"
Configuration :
# Édition mailserver.env
nano mailserver.env
# Ajout de la ligne :
ENABLE_SPAMASSASSIN=1
#### Validation avec email valide
#### Validation avec email suspect
##Mail logdebian@anzeyimavps:$ sudo grep "3500E8C6E1" /home/anzeyima/tp7/docker-data/dms/mail-logs/mail.log
2025-06-10T07:39:04.217244+00:00 mail postfix/submission/smtpd[66843]: 3500E8C6E1: client=unknown[54.36.181.95], sasl_method=LOGIN, sasl_username=user1@l2-2.ephec-ti.be
2025-06-10T07:39:04.219901+00:00 mail postfix/sender-cleanup/cleanup[66845]: 3500E8C6E1: prepend: header Message-Id: 20250610073903.599108@anzeyimavps from unknown[54.36.181.95]; from=user1@l2-2.ephec-ti.be to=user2@l2-2.ephec-ti.be proto=ESMTP helo=: X-MS-Reactions: disallow
2025-06-10T07:39:04.220319+00:00 mail postfix/sender-cleanup/cleanup[66845]: 3500E8C6E1: message-id=20250610073903.599108@anzeyimavps
2025-06-10T07:39:04.269703+00:00 mail opendkim[664]: 3500E8C6E1: DKIM-Signature field added (s=mail, d=l2-2.ephec-ti.be)
2025-06-10T07:39:04.313673+00:00 mail postfix/qmgr[771]: 3500E8C6E1: from=user1@l2-2.ephec-ti.be, size=329, nrcpt=1 (queue active)
2025-06-10T07:39:04.410423+00:00 mail postfix/smtp-amavis/smtp[66846]: 3500E8C6E1: prepend: header Message-Id: 20250610073903.599108@anzeyimavps: X-MS-Reactions: disallow
2025-06-10T07:39:05.011105+00:00 mail amavis[66120]: (66120-01) Passed SPAM {RelayedTaggedInbound,Quarantined}, [54.36.181.95]:40288 [54.36.181.95] user1@l2-2.ephec-ti.be -> user2@l2-2.ephec-ti.be, quarantine: L/spam-L1VSA2bgNtye.gz, Queue-ID: 3500E8C6E1, Message-ID: 20250610073903.599108@anzeyimavps, mail_id: L1VSA2bgNtye, Hits: 999.799, size: 832, queued_as: F17A48C7C9, 659 ms
2025-06-10T07:39:05.014082+00:00 mail postfix/smtp-amavis/smtp[66846]: 3500E8C6E1: to=user2@l2-2.ephec-ti.be, relay=127.0.0.1[127.0.0.1]:10024, delay=0.81, delays=0.11/0.03/0.02/0.65, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as F17A48C7C9)
2025-06-10T07:39:05.014401+00:00 mail postfix/qmgr[771]: 3500E8C6E1: removed
debian@anzeyimavps:$```
sudo grep "3500E8C6E1" /home/anzeyima/tp7/docker-data/dms/mail-logs/mail.log
Résultat attendu :
X-Spam-Status: Yes, score=1000.0 required=5.0
X-Spam-Flag: YES
X-Spam-Level: **************************************************