Samba configuration on RHEL 7 for Windows Clients

The initial install and config is very straight forward. For the purposes of this guide I am setting up a share called backupdata for a new user called backup:

1. yum install samba samba-client

samba is the actual server side software. samba-client is just to test connectivity for step 7

2. useradd backup

3. passwd backup - set a password

4. smbpasswd -a backup - enter same password as above

5. vim /etc/samba/smb.conf

under the [global] tag, add in ntlm auth = yes

create a new tag at the bottom such as the following:

[data]
        comment = Backup Data  #describe what the share is
        browseable = Yes
        writeable = Yes
        path = /backupdata  #path to directory to share
        valid users = backup root  #users to allow login
        create mask = 0765 #permissions on new files, adjust as appropriate

6. systemctl restart smb - restarts the samba service

7. smbclient -L servername -U backup - tests what shares are available on your server to the user backup. It should return asking for the password then the following: 

[root@servername~]# smbclient -L branchbackups -U backup
Enter SAMBA\backup's password:

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        data            Disk      Backup Data
        IPC$            IPC       IPC Service (Samba 4.8.3)
        backup          Disk      Home Directories
Reconnecting with SMB1 for workgroup listing.

        Server               Comment
        ---------            -------

        Workgroup            Master
        ---------            -------



Providing this is there, you should be able to map it from Windows

SPF and DMARC Quick Guide

SPF Filtering

Add the following into DNS as txt records with the name as the top level domain
 

To only authorise email out from the host specified in your MX record - v=spf1 mx -all
Same but an additional host, in this case stackmail.com - v=spf1 mx include:stackmail.com -all

IMPORTANT: The usage of -all specified that you are instructing recipient mail servers to reject any mail that doesn't come from the hosts specified in this record. This does mean that they neccesarily will, but they will if they have hard SPF filtering enabled. You can use a tilde symbol instead of the hyphen to give a softfail response that lets recipient servers know it is probably spoof mail but not 100%



DMARC

To configure DMARC reporting only, add the following to DNS as a txt record with name _dmarc. This should have email addresses that you want to receive reports back to (replace email@address.com)

v=DMARC1; p=none; rua=mailto:email@address.com; ruf=mailto:email@address.com; fo=1

This will send aggregate reports to you from other organizations

To setup a reject policy you should configure DKIM and SPF first. DMARC will evaluate these. Once this is in place, put the following into your DNS

"v=DMARC1;p=reject;pct=100;rua=mailto:email@address.com"

For more info, see the dmarc website https://dmarc.org/overview/

Message Tracking on Exchange 2013 and later

Message Tracking on Exchange 2013 and later

Microsoft in their infinite wisdom have decided to do away with the GUI for this in Exchange 2013. Now it has to be done in the exchange management powershell 

Use the following to search by sender

Get-MessageTrackingLog -resultsize unlimited -Start "05/01/2019" -End "05-10-2019" -Sender scott.sharland@molevalleyfarmers.com | export-csv c:\savefile.csv 

  

Date format is MONTH/DAY/YEAR 

  

Add -server SERVERNAME to change the server you want to search for tracking logs on. The default will be the server you are running the shell on 

  

Change -Sender to -Recipients to look for where mail has been sent to instead of from