Security Hardening & Identity Authentication#

EFA-NG is engineered with a zero-trust email security philosophy.

---

1. Domain Authentication: DKIM & DMARC#

Verifies outgoing and incoming cryptographic signatures:

bash

systemctl status opendkim

Validates alignment between SPF/DKIM identifiers and the From: header to prevent executive spoofing:

bash

systemctl status opendmarc

---

Fail2ban monitors system and authentication logs to dynamically ban malicious IP addresses:

Postfix SASL Jail: Blocks brute-force relay attempts on port 25/587.

MailWatch UI Jail: Protects the web management console against credential stuffing.

SSH Jail: Blocks unauthorized SSH probing.

Check active jails and banned IPs:

bash

fail2ban-client status

---

EFA-NG operates natively under SELinux Enforcing mode on CentOS Stream 10 without requiring permissive workarounds.