**Security warning:** this guide is written for a lab or internal relay. It disables SELinux and the firewall, allows plaintext authentication (`disable_plaintext_auth = no`, `auth_mechanisms = plain login`) and sets the Dovecot auth socket to `mode = 0666` (any local user can use it). For anything internet-facing: keep SELinux enforcing, keep firewalld running and open only the mail ports you need, require TLS before authentication (for example Postfix [smtpd\_tls\_auth\_only = yes](https://www.postfix.org/postconf.5.html#smtpd_tls_auth_only)), and restrict the auth socket to Postfix (`mode = 0660`, `user = postfix`, `group = postfix`, as in the [Postfix SASL README](https://www.postfix.org/SASL_README.html)).
## System Configuration ### Upgrade Current System ```shell subscription-manager repos --enable codeready-builder-for-rhel-10-$(arch)-rpms dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm -y dnf upgrade -y ``` ### Configure SELinux ```shell setenforce 0 sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config ``` ### Disable Firewall ```shell systemctl disable firewalld.service ``` ### Install Core Tools ```shell dnf install bind-utils bzip2 cups cifs-utils enscript ftp gdb ghostscript krb5-workstation ksh lftp lrzsz lsof libnsl lzop mariadb-server plocate mutt ncompress net-tools net-snmp net-snmp-utils net-tools nfs-utils nmap nvme-cli openldap-clients openssh-clients psmisc realmd rsync samba-client strace sysstat tcpdump telnet telnet-server tmux unix2dos vim vim-enhanced vsftpd wget xfsdump vsftpd htop mc rsyslog rsyslog-doc postfix dbus-daemon s-nail dovecot cyrus-sasl cyrus-sasl-lib cyrus-sasl-plain tree -y ``` Extras not included in EPEL to get the java version for Kiwi ```bash cat <| \#server \_gateway iburst **server ntp.example.com iburst** \# Use public servers from the pool.ntp.org project. \# Please consider joining the pool (https://www.pool.ntp.org/join.html). |
**Security warning:** this guide is written for a lab or internal relay. It disables SELinux and the firewall, allows plaintext authentication (`disable_plaintext_auth = no`, `auth_mechanisms = plain login`) and sets the Dovecot auth socket to `mode = 0666` (any local user can use it). For anything internet-facing: keep SELinux enforcing, keep firewalld running and open only the mail ports you need, require TLS before authentication (for example Postfix [smtpd\_tls\_auth\_only = yes](https://www.postfix.org/postconf.5.html#smtpd_tls_auth_only)), and restrict the auth socket to Postfix (`mode = 0660`, `user = postfix`, `group = postfix`, as in the [Postfix SASL README](https://www.postfix.org/SASL_README.html)).
## System Configuration ### Upgrade Current System ```shell dnf install epel-release -y dnf upgrade -y ``` ### Configure SELinux ```shell setenforce 0 sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config ``` ### Disable Firewall ```shell systemctl disable firewalld.service ``` ### Install Core Tools ```shell dnf install bind-utils bzip2 cups cifs-utils enscript ftp gdb ghostscript java-1.8.0-openjdk-headless java-11-openjdk-headless krb5-workstation ksh lftp lrzsz lsof libnsl lzop mariadb-server mlocate mutt ncompress net-tools net-snmp net-snmp-utils net-tools nfs-utils nmap nvme-cli openldap-clients openssh-clients psmisc realmd rsync samba-client strace sysstat tcpdump telnet telnet-server tmux unix2dos vim vim-enhanced vsftpd wget xfsdump vsftpd htop mc rsyslog rsyslog-doc postfix dbus-daemon s-nail dovecot cyrus-sasl cyrus-sasl-lib cyrus-sasl-plain -y ``` ### Configure Virtual Tool ```shell dnf install open-vm-tools -y sysctl vm.swappiness=10 ``` ### Time Sync ```shell systemctl enable --now chronyd ``` ## Configure Postfix ### Postfix Settings We now have to configure Postfix. One thing to keep in mind is that we're configuring Postfix to only send email, not receive it (as that is a far more complicated topic that requires considerable setup time and understanding to prevent the server from becoming an open relay, which could lead to a serious spam issue). Because of this, we can skip setting up Postfix to listen and instead go right to the hostname. The Postfix hostname must be set to match the system hostname. We'll use the [mail.example.com](http://mail.example.com) address (so make sure to change this to match your hostname). Set that hostname with the command: ```shell sudo postconf -e "myhostname = mail.yourdomain.com" ``` Make sure to check that the apex domain (aka root domain) is correct with the command: ```shell postconf mydomain ``` The apex domain for our example should be listed as [http://example.com](http://example.com) . If not, set it with: ```shell sudo postconf -e "mydomain = example.com" ``` Set the myorigin parameter with: ```shell sudo postconf -e "myorigin = $mydomain" ``` Set to allow all IP to access the server with: ```shell sudo postconf -e "inet_interfaces = all" ``` Set to only allow IPv4 to use this server with: ```shell sudo postconf -e "inet_protocols = ipv4" ``` Set the mydestination parameter with: ```shell sudo postconf -e "mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain" ``` Set the allowed IP address to relay on this server with: ```shell sudo postconf -e "mynetworks = 127.0.0.0/8, 10.0.0.0/24, 192.168.0.0/16" ``` Set the mail folder with: ```shell sudo postconf -e "home_mailbox = Maildir/" ``` Set the banner with: ```shell sudo postconf -e "smtpd_banner = $myhostname ESMTP" ``` Set to disable verify with: ```shell sudo postconf -e "disable_vrfy_command = yes" ``` Set to require the HELO for senders with: ```shell sudo postconf -e "smtpd_helo_required = yes" ``` Set the message limit for example 10MB with: ```shell sudo postconf -e "message_size_limit = 10240000" ``` Set SMTP Authentication with: ```shell sudo postconf -e "smtpd_sasl_type = dovecot" sudo postconf -e "smtpd_sasl_path = private/auth" sudo postconf -e "smtpd_sasl_auth_enable = yes" sudo postconf -e "smtpd_sasl_security_options = noanonymous" sudo postconf -e "smtpd_sasl_local_domain = $myhostname" sudo postconf -e "smtpd_recipient_restrictions = permit_mynetworks, permit_auth_destination, permit_sasl_authenticated, reject" ``` With these taken care of, restart Postfix with: ```shell sudo systemctl restart postfix ``` ### Extra Authentications Configure additional settings for Postfix if you need. It's possible to reject many spam emails with the settings below. However, you should consider to apply the settings, because sometimes normal emails are also rejected with them. Especially, there are SMTP servers that forward lookup and reverse lookup of their hostnames on DNS do not match even if they are not spammers. ```shell sudo postconf -e "smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname, permit" sudo postconf -e "smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain,reject_non_fqdn_sender" sudo postconf -e "smtpd_helo_restrictions = permit_mynetworks, reject_unknown_hostname,reject_non_fqdn_hostname, reject_invalid_hostname, permit" ``` ### Enable Postfix ```shell sudo systemctl enable --now postfix ``` ## Configure Dovecot ### Dovecot Settings This example shows to configure to provide SASL function to Postfix. vi /etc/dovecot/dovecot.conf and uncomment and if not use IPv6, remove \[::\] ```shell listen = *, :: ``` vi /etc/dovecot/conf.d/10-auth.conf and uncomment and change for the case you allow plain text auth ```shell disable_plaintext_auth = no ``` and then add login to ```shell auth_mechanisms = plain login ``` vi /etc/dovecot/conf.d/10-mail.conf and uncomment and add ```shell mail_location = maildir:~/Maildir ``` vi /etc/dovecot/conf.d/10-master.conf and uncomment and add like follows Postfix smtp-auth ```shell unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix group = postfix } ``` vi /etc/dovecot/conf.d/10-ssl.conf and change to use SSL if available but not require SSL ```shell ssl = yes ``` ### Enable Dovecot ```shell sudo systemctl enable --now dovecot ``` ## Test the setup Now that everything is set up, test Postfix by sending an email from the command line like so: ```shell echo "Rocky Linux Rocks" | sendmail EMAIL ``` Where EMAIL is a valid email address. If you receive the email, congratulate yourself on a job well done. If the email fails to arrive, you might need to verify if your DNS records are correct and the changes have taken effect (they can take up to 24 hours). You can also check the maillog with a command like: ```shell tail -f /var/log/maillog ``` With the tail running, open another terminal window and attempt to send another email to see what kind of logs are written. From that information, you can start troubleshooting any issues that are causing problems. Used ref from [https://www.server-world.info/en/note?os=Rocky\_Linux\_8&p=mail&f=1](https://www.server-world.info/en/note?os=Rocky_Linux_8&p=mail&f=1) [https://www.server-world.info/en/note?os=Rocky\_Linux\_8&p=mail&f=2](https://www.server-world.info/en/note?os=Rocky_Linux_8&p=mail&f=2) # Linux - Setting up a Logging ServerLast verified: October 2026 against the RHEL 9 remote logging guide and the current rsyslog documentation.
## Summary This is to setup a logging server to capture logs from any servers on your network. ### Prerequisites Install of a RedHat or Rocky Linux minimal install (RHEL 9 / Rocky Linux 9 or later) ### Configuration You will need to edit the file "/etc/rsyslog.conf" #### Editing the file ```bash vi /etc/rsyslog.conf ``` You will need to change to the following to allow port 514 to be open ```bash # Provides UDP syslog reception # for parameters see http://www.rsyslog.com/doc/imudp.html module(load="imudp") # needs to be done just once input(type="imudp" port="514") # Provides TCP syslog reception # for parameters see http://www.rsyslog.com/doc/imtcp.html module(load="imtcp") # needs to be done just once input(type="imtcp" port="514") ``` Open port 514 in the firewall (skip if firewalld is disabled), check the configuration and then restart the rsyslog daemon ```bash firewall-cmd --permanent --add-port=514/tcp firewall-cmd --permanent --add-port=514/udp firewall-cmd --reload rsyslogd -N1 systemctl restart rsyslog ``` Port 514 is already labelled `syslogd_port_t` in the default SELinux policy. If you use a different port, add it with `semanage port -a -t syslogd_port_t -p tcpOlder guides use `& ~` here. The `~` discard action is deprecated and logs a warning on current rsyslog; use `& stop` instead.
#### Setup Log Rotate Create a log file configuration file ```bash vi /etc/logrotate.d/remote-hosts ``` then add the following, and change the folder name pattern(s) to match your host names. Each line must match the log files inside the per-host folders. ```bash /var/log/server*/*.log /var/log/web*/*.log /var/log/vcenter*/*.log { rotate 2 maxsize 200k daily } ``` Run to make sure the config is good ```bash logrotate -d /etc/logrotate.d/remote-hosts ``` #### Setup Host Servers This is what to setup on the servers you wish to log to one server You must login to the server and then edit the following file ```bash vi /etc/rsyslog.conf ``` Once opened, add one of the following lines at the end of the file to send everything (use only one, TCP is recommended). Replace 192.168.x.x with your logging server's IP or hostname, then run `systemctl restart rsyslog`. ```bash *.* @192.168.x.x:514 # use @ for UDP protocol *.* @@192.168.x.x:514 # use @@ for TCP protocol ``` You can also setup specific logging by doing the following ```bash auth.* @@192.168.x.x:514 # only for authentication based records ``` #### Results This is what your folder will look like with the host name of the server or device ```bash drwx------ 2 root root 42 Aug 29 22:30 router01 drwx------ 2 root root 82 Aug 29 22:32 server01 drwx------ 2 root root 87 Aug 29 22:32 web01 ``` This is a look within a folder of a server ```bash [/var/log]# cd server01/ root@server01.example.com : Linux : Thu Aug 29 22:35:01 : [/var/log/server01]# ls -lrt total 16 -rw------- 1 root root 850 Aug 29 22:30 rsyslogd.log -rw------- 1 root root 56 Aug 29 22:32 sssd_kcm.log -rw------- 1 root root 948 Aug 29 22:32 systemd.log -rw------- 1 root root 251 Aug 29 22:32 CROND.log ``` #### Sources - [https://docs.redhat.com/en/documentation/red\_hat\_enterprise\_linux/9/html/security\_hardening/assembly\_configuring-a-remote-logging-solution\_security-hardening](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/assembly_configuring-a-remote-logging-solution_security-hardening) - [https://docs.rsyslog.com/doc/configuration/actions.html](https://docs.rsyslog.com/doc/configuration/actions.html) - [https://docs.rsyslog.com/doc/configuration/converting\_to\_new\_format.html](https://docs.rsyslog.com/doc/configuration/converting_to_new_format.html) - [https://docs.rsyslog.com/doc/faq/common-config-mistakes.html](https://docs.rsyslog.com/doc/faq/common-config-mistakes.html)