Postfix-Server als Reverse Proxy:
Basis ist eine funktionierende Debian / Ubuntu-Installation - eleganterweise mit squid3

NEUE überarbeitete Version von meinem "Alten Beitrag": Ubuntu / Debian PROXY-SERVER-Installation mit AD-Integration

Beispielkonfiguration:
Exchange-Server: 192.168.200.101
Proxy-Server: 192.168.200.100
ad1.domain.local: 192.168.200.10
ad2.domain.local: 192.168.200.11

Installation auf Debian (8):

Squid-Proxy-Server-Installation:

apt-get install squid3 ldap-utils

für eine Live-Ansicht des /var/log/squid3/access.log:

apt-get install squidview

Da squidview hardcodiert programmiert ist, muss noch ein entsprechender Link auf das Log-Verzeichnis des Squid generiert werden:

ln -s /var/log/squid3/ /var/log/squid

Für die Integration ins Active-Directory:

apt-get install winbind samba samba-common-bin

Kerberos-Pakete:

apt-get install krb5-user libkrb5-3 libsasl2-modules-gssapi-mit libsasl2-modules 

Konfigurationen anpassen:

Die Original Konfigurationsdateien immer kopieren
(Bsp: cp /etc/resolv.conf /etc/resolf.original)

/etc/resolv.conf:
domain domain.local

search domain.local
nameserver 192.168.200.10
nameserver 192.168.200.11

/etc/krb5.conf:
[libdefaults]

       default_realm = DOMAIN.LOCAL

# The following krb5.conf variables are only for MIT Kerberos.

       krb4_config = /etc/krb.conf

       krb4_realms = /etc/krb.realms

       kdc_timesync = 1

       ccache_type = 4

       forwardable = true

       proxiable = true 

[realms]

       DOMAIN.LOCAL = {

              kdc = ad2.domain.local

              kdc = ad1.domain.local

              admin_server = ad1.domain.local

              password_server = ad1.domain.local

              default_domain = DOMAIN.LOCAL

       }

   /etc/samba/smb.conf: 

[global]

netbios name = proxy

realm = DOMAIN.LOCAL

workgroup = DOMAIN

security = ads

#password server = ad1.ldomain.local ad2.domain.local

socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

idmap uid = 10000-20000

domain master = no

local master = no

preferred master = no

winbind enum groups = yes

winbind enum users = yes

winbind uid = 10000-20000

winbind gid = 10000-20000

winbind separator = +

winbind use default domain = Yes

encrypt passwords = yes

log level = 5 passdb:5 auth:10 winbind:5

server string = proxy

dns proxy = no

log file = /var/log/samba/log.%m

max log size = 1000

syslog only = no

syslog = 0

encrypt passwords = true

load printers = no

/etc/squid3/squid.conf

Änderungen:
http-Port: 3128 à 8080
authenticate_ttl 0 seconds
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 20 startup=0 idle=1
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Domain Proxy Server
auth_param basic credentialsttl 5 hours
auth_param basic casesensitive off
authenticate_cache_garbage_interval 10 seconds
icp_access deny all
http_access deny to_localhost
Chache-Mem: 320MB à 512MB
cache_dir ufs /var/spool/squid3 100 16 256
logfile_rotate 90
negative_ttl 0 seconds

Postfix-Installlation:

apt-get install postfix amavisd-new clamav-daemon spamassassin razor pyzor

Im Anschluss die Konfigurationsdateien editieren:

Konfigurationsdateien:

/etc/postfix/main.cf /etc/postfix/master.cf /etc/postfix/transport


master.cf:

#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
#Ausleiten der Mails
192.168.200.100:smtp      inet  n       -       -       -       -       smtpd
#smtp      inet  n       -       -       -       1       postscreen
#smtpd     pass  -       -       -       -       -       smtpd
#dnsblog   unix  -       -       -       -       0       dnsblog
#tlsproxy  unix  -       -       -       -       0       tlsproxy
#submission inet n       -       -       -       -       smtpd
#  -o syslog_name=postfix/submission
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#smtps     inet  n       -       -       -       -       smtpd
#  -o syslog_name=postfix/smtps
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628       inet  n       -       -       -       -       qmqpd
pickup    unix  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp
relay     unix  -       -       -       -       -       smtp
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
#  mailbox_transport = lmtp:inet:localhost
#  virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus     unix  -       n       n       -       -       pipe
#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix  -       n       n       -       -       pipe
#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix    -    n    n    -    2    pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}

# Mails, die auf dieser IP ankommen, nur noch durch den Virenscanner
smtp-amavis   unix -    -    n    -    2    smtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o disable_mime_output_conversion=yes
    -o smtp_generic_maps=
    -o max_use=20
    
127.0.0.1:10025 inet    n       -       -       -       -       smtpd
        -o content_filter=
        -o local_recipient_maps=
        -o relay_recipient_maps=
        -o smtpd_restriction_classes=
        -o smtpd_delay_reject=no
        -o smtpd_client_restrictions=permit_mynetworks,reject
        -o smtpd_helo_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o smtpd_data_restrictions=reject_unauth_pipelining
        -o smtpd_end_of_data_restrictions=
        -o mynetworks=127.0.0.0/8
        -o smtpd_error_sleep_time=0
        -o smtpd_soft_error_limit=1001
        -o smtpd_hard_error_limit=1000
        -o smtpd_client_connection_count_limit=0
        -o smtpd_client_connection_rate_limit=0
        -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks

main.cf:

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP Mailer
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
#smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
#smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
#smtpd_use_tls=yes
#smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
#smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

#smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mx01.domain.local
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $mydomain

smtp_helo_name = $myhostname
relay_domains = $transport_maps

mydestination = localhost.doamin.local, , localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.200.100/32 192.168.200.101/32 # Exchange-Server
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
smtpd_helo_required = yes
transport_maps = hash:/etc/postfix/transport
sender_canonical_maps = hash:/etc/postfix/canonical-sender
recipient_canonical_maps = hash:/etc/postfix/canonical-recipient
address_verify_map = btree:/var/spool/postfix/data/verify
#message_size_limit = 50000000
message_size_limit = 104857600
#message_size_limit = 104857600
#header_checks = regexp:/etc/postfix/spamstopper
# Zustellversuche von Mails nur 3 Tage, default sind 5 Tage
maximal_queue_lifetime = 3d
#simple-restrictions=reject_unauth_destination
# Rueckmeldung, welcher Code gesendet werden soll, wenn ein
# Empfaenger bei address_verify nicht vorhanden ist.
# Default ist 450, also nur "temporaer nicht erreichbar",
# damit gibt es weitere Zustellversuche.
unverified_recipient_reject_code = 550
smtpd_recipient_restrictions =
        # Nur "saubere" Mails annehmen
        reject_non_fqdn_recipient,
        reject_non_fqdn_sender,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain,
        # Eigene Netze erlauben
        permit_mynetworks,
        # Spamlisten werde jetzt in Policyd-Weight getestet
        #reject_rbl_client ix.dnsbl.manitu.net,
        #reject_rbl_client zen.spamhaus.org,
        #ireject_rbl_client b1.spamcop.net,
        #reject_rbl_client dnsbl.njabl.org,
        #reject_rbl_client list.dsbl.org,
        #reject_rhsbl_client blackhole.securitysage.com,
        # Aussortieren der Null-Sender ueber PCRE, 31.05.2013,GO, enbiz
        check_sender_access pcre:/etc/postfix/check_null_sender.pcre,
        # Policyd-Weight und Greylisting
        check_client_access hash:/etc/postfix/policyd_weight_client_whitelist
        #check_policy_service inet:127.0.0.1:12525,
        #check_policy_service inet:127.0.0.1:10023,
        # Dynamisch Empfaengerlisten auf Mailserver ueberpruefen
        #reject_unverified_recipient,
        # Relaying und Massenmails verbieten
        reject_unauth_destination,
        reject_unauth_pipelining,
        # ... den Rest erlauben
        permit
content_filter=smtp-amavis:[127.0.0.1]:10024

transport:

domain.local    smtp:[192.168.200.101] # Transportziel --> Exchange-Server

Im Anschluss muss die Datei noch in eine Datenbank umgewandelt werden:

postmap transport

Commandos für die Administration:

mailq | awk 'BEGIN { RS = "" } / admin@.*$/ { print $1 }' | tr -d '*!' | postsuper -d -

Versendelimit einer Mail von standard 10 MB auf 100MB setzen:
sudo postconf -e "message_size_limit = 104857600"

Testmail vom Postfix-Server aus versenden:
echo "Test mail from postfix" | mail -s "Test Postfix" "Diese E-Mail-Adresse ist vor Spambots geschützt! Zur Anzeige muss JavaScript eingeschaltet sein."

Reverse-Proxy-Eigenschaften und Konfiguration:
Um einem Exchange-Server (hier Exchange2010) den direkten Zugriff zu ermöglichen, sind Anpassungen in der Konfigurationsdatei des Apache-Dienstes notwendig

(/etc/apache2/sites-available/default-ssl.conf)

# --- Regeln fuer die Weiterleitung ---
ProxyPass        /owa     https://exchange2010.domain.local/owa
ProxyPassReverse /owa     https://exchange2010.domain.local/owa 
ProxyPass        /ecp     https://exchange2010.domain.local/ecp
ProxyPassReverse /ecp     https://exchange2010.domain.local/ecp
ProxyPass        /ews     https://exchange2010.domain.local/ews
ProxyPassReverse /ews     https://exchange2010.domain.local/ews        
ProxyPass        /rpc/    https://exchange2010.domain.local/rpc/
ProxyPassReverse /rpc/    https://exchange2010.domain.local/rpc/
ProxyPass        /autodiscover    https://exchange2010.domain.local/autodiscover
ProxyPassReverse /autodiscover     https://exchange2010.domain.local/autodiscover
ProxyPass        /Microsoft-Server-ActiveSync https://exchange2010.domain.local/Microsoft-ServerActiveSync
ProxyPassReverse /Microsoft-Server-ActiveSync https://exchange2010.domain.local/Microsoft-Server-ActiveSync

SquidGuard-Installieren als Webfilter:

apt-get install squidguard

Squid muss umgeleitet werden:
#  TAG: redirect_programurl_redirect_program /usr/bin/squidGuard -c /etc/squidguard/squidGuard.confurl_rewrite_children 2 

Blacklist-Datenbank herunterladen und im Verzeichnis /var/lib/squidguard/db entpacken:
Blacklistprovider z.B. http://www.shallalist.de/Downloads/shallalist.tar.gz wählen und entsprechend herunterladen mit:
wget  http://www.shallalist.de/Downloads/shallalist.tar.gz

danach entpacken mit:
tar –xzvf shallalist.tar.gz –C /var/lib/squidGuard/db 

Datenbank anhand der heruntergeladenen Blacklist  im Namenskontext des proxy erstellen : (Auf Ausgabe des squidguardlog achten – sollten keine Fehler auftauchen !)
sudo -u proxy squidGuard -C all

Ebenso ist auf die korrekten Berechtigungen des proxyusers zu achten (Besitzrechte folgender Ordner bzw. Dateien !)
chown proxy:proxy /etc/squidguard/squidGuard.confchown -R proxy:proxy /var/lib/squidguard/db/chown -R proxy:proxy /var/log/squid3/

Live-logging des squidguard-Dienstes anschauen:
tail -f /var/log/squidguard/squidGuard.log

Überprüfung, ob der squidguardfilter funktioniert: (Ip-Adresse eines proxy-Clients)
echo "http://www.sex.com 192.168./- - GET" | squidGuard -c /etc/squidguard/squidGuard.conf

Zum Schluss muss die Konfiguration im squid neu geladen werden mit:
/etc/init.d/squid3 reload

Squid-Neustart mit:

/etc/init.d/squid3 restart 

Manuelle Blacklist mit URLS und Domains pflegen:
Unter /var/lib/squidguard/db/BL/deny
Datei: domains und urls 
Darin werden die jeweiligen Einträge gepflegt 
Eine ACL (deny) ist ebenfalls in der /etc/squidguard/squidguard.conf einzutragen ! 
Im Anschluss und bei jeder Änderung der Textdateien muss die entspr. Datenbank (Dateiname.db) generiert werden:

sudo -u proxy squidGuard -C all
squid3 -k reconfigure

Konfiguration anschliessend einlesen:
sudo /etc/init.d/squid reload

Passwortschutz für die Verzeichnisse
/var/www/html/squid-reports/anon
und
/var/www/html/squid-reports/full

erstellen:

Anlegen der entsprechenden Dateien (.htaccess) im jeweiligen Ordner (/anon und /full)

Anlegen der Passwortdateien (Das Passwort des entsprechenden Benutzers wird beim Anlegen abgefragt und kryptisch in die Datei eingetragen):

htpasswd -c /etc/apache2/.htpasswd_full fullaccess
htpasswd -c /etc/apache2/.htpasswd anonymaccess

Änderung der Passworte:

htpasswd /etc/apache2/.htpasswd anonymaccess
htpasswd /etc/apache2/.htpasswd_full fullaccess

Dateirechte für Erlaubnis des Kontextusers www-data:

chown www-data:www-data /etc/apache2/.htpasswd
chown www-data:www-data /etc/apache2/.htpasswd_full
chmod 0660 /etc/apache2/.htpasswd_full
chmod 0660 /etc/apache2/.htpasswd

Damit die Passwortabfragefunktion aktiviert wird, muss noch eine Anpassung in der Apache-Konfiguration gemacht werden:

/etc/apache2/sites-available/000-default.conf

      <Directory "/var/www/html">

        Options Indexes FollowSymLinks

        AllowOverride All

        Require all granted

         </Directory>

Im Anschluss muss der Apache Dienst noch neu gestartet bzw. die Konfiguration geladen werden:

/etc/init.d/apache2 reload
/etc/init.d/apache2 restart