Restructure in-progress

2025-07-04 23:48:04 -04:00
parent 32aad50820
commit 36de65ba60
114 changed files with 670 additions and 1041 deletions
@@ -0,0 +1,151 @@
+---
+# Configure MTA Front server for email relay and SMTP smuggling
+
+- name: Update system packages
+  apt:
+    update_cache: yes
+    upgrade: dist
+
+- name: Install MTA packages
+  apt:
+    name:
+      - postfix
+      - postfix-pcre
+      - dovecot-core
+      - dovecot-imapd
+      - opendkim
+      - opendkim-tools
+      - python3-pip
+      - python3-venv
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - dnsutils
+      - swaks
+      - telnet
+    state: present
+
+- name: Configure Postfix for MTA fronting
+  template:
+    src: "../templates/phishing/postfix-mta-front.j2"
+    dest: /etc/postfix/main.cf
+    backup: yes
+  notify: restart postfix
+
+- name: Configure Postfix master.cf for advanced relaying
+  blockinfile:
+    path: /etc/postfix/master.cf
+    block: |
+      # SMTP smuggling and advanced relay configurations
+      587      inet  n       -       y       -       -       smtpd
+        -o syslog_name=postfix/submission
+        -o smtpd_tls_security_level=encrypt
+        -o smtpd_sasl_auth_enable=yes
+        -o smtpd_tls_wrappermode=no
+        -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+        -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+        -o milter_macro_daemon_name=ORIGINATING
+      
+      # SMTP smuggling support
+      cleanup   unix  n       -       y       -       0       cleanup
+        -o header_checks=pcre:/etc/postfix/header_checks
+        -o nested_header_checks=pcre:/etc/postfix/nested_header_checks
+
+- name: Create SMTP smuggling header checks
+  copy:
+    dest: /etc/postfix/header_checks
+    content: |
+      # SMTP smuggling techniques
+      /^Content-Transfer-Encoding:\s*7bit/i REPLACE Content-Transfer-Encoding: 8bit
+      /^Content-Type:\s*text\/plain/i REPLACE Content-Type: text/html
+    mode: '0644'
+  notify: 
+    - reload postfix
+    - postmap header_checks
+
+- name: Create nested header checks for advanced smuggling
+  copy:
+    dest: /etc/postfix/nested_header_checks
+    content: |
+      # Advanced SMTP smuggling patterns
+      /^\s*<script/i IGNORE
+      /^\s*<iframe/i IGNORE
+    mode: '0644'
+  notify:
+    - reload postfix
+    - postmap nested_header_checks
+
+- name: Configure DKIM for domain reputation
+  include_tasks: ../tasks/configure_mail.yml
+
+- name: Create relay authentication
+  copy:
+    dest: /etc/postfix/sasl_passwd
+    content: |
+      {{ phishing_domain }} {{ smtp_relay_user }}:{{ smtp_relay_pass }}
+    mode: '0600'
+    owner: root
+    group: root
+  notify:
+    - postmap sasl_passwd
+    - restart postfix
+
+- name: Configure transport maps for backend routing
+  copy:
+    dest: /etc/postfix/transport
+    content: |
+      {{ phishing_domain }}    smtp:[{{ gophish_ip }}]:25
+      .{{ phishing_domain }}   smtp:[{{ gophish_ip }}]:25
+    mode: '0644'
+  notify:
+    - postmap transport
+    - restart postfix
+
+- name: Install Python SMTP testing tools
+  pip:
+    name:
+      - smtplib-extended
+      - email-validator
+      - faker
+    state: present
+
+- name: Create SMTP smuggling test script
+  template:
+    src: "../templates/phishing/smtp-smuggling-test.py.j2"
+    dest: /root/Tools/smtp-smuggling-test.py
+    mode: '0755'
+
+- name: Create email reputation monitoring script
+  template:
+    src: "../templates/phishing/reputation-monitor.sh.j2"
+    dest: /root/Tools/reputation-monitor.sh
+    mode: '0755'
+
+- name: Set up log monitoring for deliverability
+  cron:
+    name: "Monitor email deliverability"
+    minute: "*/15"
+    job: "/root/Tools/reputation-monitor.sh >> /var/log/reputation.log 2>&1"
+
+handlers:
+  - name: restart postfix
+    service:
+      name: postfix
+      state: restarted
+
+  - name: reload postfix
+    service:
+      name: postfix
+      state: reloaded
+
+  - name: postmap header_checks
+    command: postmap /etc/postfix/header_checks
+
+  - name: postmap nested_header_checks
+    command: postmap /etc/postfix/nested_header_checks
+
+  - name: postmap sasl_passwd
+    command: postmap /etc/postfix/sasl_passwd
+
+  - name: postmap transport
+    command: postmap /etc/postfix/transport
@@ -0,0 +1,71 @@
+# Postfix MTA Front Configuration for Phishing Infrastructure
+# This server acts as the front-end mail relay
+
+# Basic settings
+myhostname = {{ mta_hostname | default('mail.' + domain) }}
+mydomain = {{ domain }}
+myorigin = $mydomain
+mydestination = $myhostname, localhost
+inet_interfaces = all
+inet_protocols = ipv4
+
+# Network settings
+mynetworks = 127.0.0.0/8 {{ gophish_server_ip }}/32 {{ mta_allowed_ips | default([]) | join(' ') }}
+relay_domains = $mydestination
+
+# SMTP smuggling mitigation
+smtpd_forbid_bare_newline = yes
+smtpd_forbid_bare_newline_reject_code = 550
+
+# TLS Configuration
+smtpd_tls_cert_file = /etc/letsencrypt/live/{{ mta_hostname | default('mail.' + domain) }}/fullchain.pem
+smtpd_tls_key_file = /etc/letsencrypt/live/{{ mta_hostname | default('mail.' + domain) }}/privkey.pem
+smtpd_use_tls = yes
+smtpd_tls_security_level = may
+smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+smtp_tls_security_level = may
+
+# SASL Authentication
+smtpd_sasl_auth_enable = yes
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
+smtpd_sasl_security_options = noanonymous
+smtpd_sasl_authenticated_header = yes
+
+# Restrictions
+smtpd_helo_required = yes
+smtpd_recipient_restrictions =
+    permit_mynetworks,
+    permit_sasl_authenticated,
+    reject_unauth_destination,
+    reject_unauth_pipelining,
+    reject_invalid_helo_hostname,
+    reject_non_fqdn_helo_hostname
+
+# Rate limiting
+smtpd_client_connection_rate_limit = {{ rate_limit_connections | default(100) }}
+smtpd_client_message_rate_limit = {{ rate_limit_messages | default(100) }}
+
+# Message size and queue settings
+message_size_limit = {{ max_message_size | default(10240000) }}
+mailbox_size_limit = 0
+queue_lifetime = 1h
+maximal_queue_lifetime = 1h
+bounce_queue_lifetime = 0
+
+# Header modifications
+header_checks = regexp:/etc/postfix/header_checks
+
+# DKIM signing
+milter_default_action = accept
+milter_protocol = 6
+smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock
+non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock
+
+# Logging
+{% if zero_logs | default(true) %}
+# Zero-logs configuration
+syslog_facility = local0
+syslog_name = 
+maillog_file = /dev/null
+{% endif %}