![\"\u00cbsht\u00eb](\"\/wp-content\/uploads\/2024\/03\/e675c9211d656f8603bcbc42ad9b67bf.gif\")
<\/center> <\/p>\nT\u00eb rejat kryesore: <\/p>\n
- \n
- Shtuar nj\u00eb klient p\u00ebr MongoDB, q\u00eb lejon ruajtjen n\u00eb k\u00ebt\u00eb DB baz\u00ebn e p\u00ebrdoruesve virtuel, pseudonimet, listat e p\u00ebrputhjes s\u00eb adresave dhe tabela t\u00eb ndryshme verifikimi. P\u00ebr t\u00eb konfiguruar qasjen n\u00eb MongoDB, \u00ebsht\u00eb shtuar tipi i tabelave \u00abmongodb\u00bb. P\u00ebr shembull, \u00abalias_maps = proxy:mongodb:\/etc\/postfix\/mongo.cf\u00bb, ku mongo.cf \u00ebsht\u00eb skedari me konfigurimin p\u00ebr lidhjen me MongoDB dhe filtri i k\u00ebrkesave.\n
- N\u00eb agentin e dor\u00ebzimit lokal \u00ebsht\u00eb shtuar eksportimi i identifikuesit t\u00eb ridrejtimit, i dh\u00ebn\u00eb gjat\u00eb seanc\u00ebs SMTP n\u00ebp\u00ebrmjet parametrin ENVID (Envelope ID) n\u00eb komand\u00ebn ESMTP MAIL (RFC 3461). Identifikuesi shkruhet n\u00eb nd\u00ebrvar\u00ebsin\u00eb ENVID dhe d\u00ebrgohet n\u00eb agentin e dor\u00ebzimit t\u00eb tubit p\u00ebrmes parametrin e vij\u00ebs s\u00eb komand\u00ebs \u00ab${envid}\u00bb.\n
- N\u00eb klient\u00ebt p\u00ebr ruajtjen e t\u00eb dh\u00ebnave n\u00eb MySQL (\u00abmysql:\u00bb) dhe PostgreSQL (\u00abpgsql:\u00bb) jan\u00eb shtuar parametrat: \u00abidle_interval\u00bb p\u00ebr t\u00eb p\u00ebrcaktuar koh\u00ebn e pasivitetit p\u00ebrpara mbylljes s\u00eb lidhjes dhe \u00abretry_interval\u00bb p\u00ebr caktimin e koh\u00ebs p\u00ebr riprovimin e k\u00ebrkesave. N\u00eb m\u00ebnyr\u00eb default, parametrat kan\u00eb vler\u00ebn 60 sekonda. Vlera \u00abretry_interval\u00bb mund t\u00eb reduktohet, p\u00ebr shembull, p\u00ebr t\u00eb shkurtuar koh\u00ebn e rikuperimit pas gabimeve, n\u00eb rastin e p\u00ebrdorimit t\u00eb vet\u00ebm nj\u00eb serveri n\u00eb atributin \u00abhosts\u00bb.\n
- N\u00eb klientin p\u00ebr MySQL \u00ebsht\u00eb shtuar konfigurimi \u00abcharset\u00bb p\u00ebr t\u00eb p\u00ebrcaktuar kodimin e karaktereve sipas parazgjedhjes. N\u00eb m\u00ebnyr\u00eb default, p\u00ebrdoret vlera \u00abutf8mb4\u00bb, e cila i p\u00ebrgjigjet configurimeve t\u00eb parazgjedhura n\u00eb MySQL 8.0 (n\u00eb versione m\u00eb t\u00eb hershme \u00ebsht\u00eb p\u00ebrdorur vlera \u00ablatin1\u00bb). \u00cbsht\u00eb ndalur mb\u00ebshtetja p\u00ebr versionet m\u00eb t\u00eb vjetra se MySQL 4.0 (dmth. versionet e l\u00ebshuara para vitit 2003).\n
- \u00cbsht\u00eb ofruar mund\u00ebsia opsionale p\u00ebr t\u00eb k\u00ebrkuar nj\u00eb \u00e7el\u00ebs t\u00eb hapur (raw) t\u00eb vet\u00eb-p\u00ebrshkruar p\u00ebr TLS, q\u00eb nuk lidhet me nj\u00eb autoritet t\u00eb certifikimit, n\u00eb vend t\u00eb certifikat\u00ebs X.509. P\u00ebrdorimi i \u00e7el\u00ebsave raw p\u00ebr autentikimin e klient\u00ebve dhe server\u00ebve aktivizohet p\u00ebrmes parametrave «smtpd_tls_enable_rpk = yes» dhe «smtp_tls_enable_rpk = yes», por sjellja gjat\u00eb verifikimit varet shum\u00eb nga niveli i siguris\u00eb t\u00eb vendosur dhe mb\u00ebshtetje e \u00e7el\u00ebsave raw n\u00eb implementimin lokal t\u00eb TLS (shihni dokumentacionin).\n
- \u00cbsht\u00eb shtuar mb\u00ebshtetje fillestare p\u00ebr skedar\u00ebt e konfigurimit OpenSSL. P\u00ebr t\u00eb specifikuar nj\u00eb lidhje me skedarin e cil\u00ebsimeve TLS \u00ebsht\u00eb propozuar parametri tls_config_file, dhe p\u00ebr t\u00eb specifikuar emrin e seksionit me cil\u00ebsime nga skedari i konfigurimit \u2014 parametri «tls_config_name». Lidhja me skedar\u00ebt e konfigurimit OpenSSL mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb reduktuar var\u00ebsin\u00eb nga konfigurimet e shp\u00ebrndarjeve, ndryshimi i nivelit t\u00eb siguris\u00eb t\u00eb t\u00eb cilave mund t\u00eb \u00e7oj\u00eb n\u00eb rritjen e p\u00ebrqindjes s\u00eb mesazheve q\u00eb d\u00ebrgohen pa enkriptim.\n
- N\u00eb kokat e mesazheve \u00ebsht\u00eb ndryshuar formatimi i numrave t\u00eb dit\u00ebve n\u00eb data \u2014 dit\u00ebt nga 1 n\u00eb 9 tani plot\u00ebsohen me zero, e jo me hap\u00ebsir\u00eb (pra, «01», «02» etj.). Ky ndryshim \u00ebsht\u00eb b\u00ebr\u00eb sepse RFC 5322 rekomandon p\u00ebrdorimin e hap\u00ebsirave t\u00eb vetme si ndar\u00ebs n\u00eb datat.\n
- \u00cbsht\u00eb shtuar mbrojtja nga disa lloje sulmesh «Blind» (sulmet SSRF ndaj klient\u00ebve web, t\u00eb fokusuar n\u00eb aksesimin e serverit p\u00ebrmes SMTP), q\u00eb aplikohet kur \u00ebsht\u00eb vendosur cil\u00ebsimi «smtpd_forbid_unauth_pipelining = yes» (n\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar).\n
- N\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar \u00ebsht\u00eb aktivizuar cil\u00ebsimi «smtpd_forbid_bare_newline = normalize», i cili siguron mbrojtjen e serverit nga sulmet e klas\u00ebs «SMTP smuggling», q\u00eb lejojn\u00eb ndarjen e nj\u00eb mesazhi n\u00eb disa mesazhe t\u00eb ndryshme p\u00ebrmes p\u00ebrdorimit t\u00eb nj\u00eb sekuence jokonvencionale p\u00ebr ndarjen e mesazheve. Gjithashtu \u00ebsht\u00eb shtuar mbrojtje nga realizimi i sulmeve t\u00eb jashtme SMTP smuggling, ku sulmuesi p\u00ebrdor nj\u00eb server t\u00eb bazuar n\u00eb Postfix p\u00ebr t\u00eb sulmuar nj\u00eb server tjet\u00ebr SMTP. N\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar \u00ebsht\u00eb aktivizuar cil\u00ebsimi «cleanup_replace_stray_cr_lf = yes», i cili z\u00ebvend\u00ebson karakteret e tep\u00ebrta <CR> dhe <LF> me hap\u00ebsir\u00eb.\n
- N\u00eb implementimin e klientit DNS, madh\u00ebsia e p\u00ebrgjigjeve t\u00eb kthyer nga k\u00ebrkesa DNS tani \u00ebsht\u00eb e kufizuar n\u00eb 100 regjistra, q\u00eb \u00ebsht\u00eb 20 her\u00eb m\u00eb shum\u00eb se numri maksimal mb\u00ebshtetur n\u00eb klientin SMTP IP-adresave<\/a> p\u00ebr nj\u00eb server.\n
- Parametrat «disable_dns_lookup» dhe «permit_mx_backup» jan\u00eb b\u00ebr\u00eb t\u00eb pap\u00ebrshtatsh\u00ebm, s\u00eb bashku me disa parametrat e konfigurimit TLS.\n
- \u00cbsht\u00eb nd\u00ebrprer\u00eb mb\u00ebshtetja p\u00ebr cil\u00ebsimet q\u00eb jan\u00eb shpallur t\u00eb pap\u00ebrshtatshme rreth 20 vjet m\u00eb par\u00eb: «permit_naked_ip_address», «check_relay_domains» dhe «reject_maps_rbl». <\/ul>\n