OpenARC - ArchWiki

Jump to content

# OpenARC

1 language

- 日本語

From ArchWiki

OpenARC is an open source implementation of the experimental Authenticated Received Chain (ARC) email authentication system, designed to allow an intermediate mail server like a mailing list or forwarding service to sign an email's original authentication results.

ARC is supported by most common mail providers, including Microsoft, Google, Fastmail, and Proton Mail.

## The idea

DMARC allows a sender's domain to indicate that a message is protected by SPF and/or DKIM. DMARC also indicates what a receiving server should do if a check of the message's SPF and/or DKIM does not pass (the receiving server can reject the message, for example).

However, when an email is sent through a mailing list or mail forwarder, DKIM or SPF checks might fail due to those intermediary servers making changes to the message. To prevent this failing of legitimate messages, ARC was created.

ARC re-signs the message with ARC headers. These headers allow us to see who modified the message, and what the state of authentication was before the modifications by an intermediary server.

After changes to the message by an intermediary server, SPF and/or DKIM checks might fail (see above). However, if there is a valid ARC chain, then a receiving server can still pass the message, if it trusts the intermediary server(s), as the ARC chain will allow the receiving mail server to extract the (old) SPF and DKIM results, which will pass the check.

See RFC 8617 for more information.

## Installation

Install the openarcAUR package.

Note: The original software by the TrustedDomainProject has not been updated in years, but is available as openarc-legacyAUR. openarcAUR follows the maintained fork by flowerysong.

Install the openarc-gitAUR package for the most recent development updates.

## Configuration

The main configuration file for the signing service is `/etc/openarc/openarc.conf`.

- Create an empty configuration file `/etc/openarc/openarc.conf`, or copy/move the sample configuration file `/usr/share/doc/openarc/openarc.conf.sample` to `/etc/openarc/openarc.conf` and change or add the following options (See `openarc.conf(5)` for details):

    /etc/openarc/openarc.conf

    PidFile /run/openarc/openarc.pid
    UserID  openarc:openarc
    Socket  local:/run/openarc/openarc.sock

    Mode                    sv
    Canonicalization        relaxed/simple
    Domain                  example.com
    Selector                myselector
    KeyFile                 /etc/openarc/keys/myselector.private

- Socket address is the one specified in `/etc/postfix/main.cf`. This is what `/etc/postfix/main.cf` should contain:

    /etc/postfix/main.cf

    smtpd_milters = unix:/run/opendkim/opendkim.sock
        unix:/run/openarc/openarc.sock
    non_smtpd_milters = $smtpd_milters
    milter_default_action = accept

- To generate a secret signing key using OpenDKIM's opendkim-genkey, specify the domain used to send mails and a selector which is used to refer to the key. The selector may be any value. See the RFC for details, but alpha-numeric strings should be OK:

    # opendkim-genkey -D /etc/openarc/keys -r -s myselector -d example.com
    # chown -R openarc /etc/openarc/keys

Note that opendkim-keygen also generates a DNS zone file for your domain.

- Alternatively, you can also generate keys with just OpenSSL. Specify your domain instead of {YOURDOMAIN.COM}, and choose a 2048-bit key if you prefer.

First, create the private key:

    # openssl genrsa -out /etc/openarc/keys/{YOURDOMAIN.COM}.key 1024

Then, extract the public key from the private key you just generated:

    # openssl rsa -in /etc/openarc/keys/{YOURDOMAIN.COM}.key -pubout -out /etc/openarc/keys/{YOURDOMAIN.COM}.pub

Change the owner of the key files and restrict permissions:

    # chown -R openarc /etc/openarc/keys
    # chmod -R 600 /etc/openarc/keys/{yourkey}.key

Your Public key (for DNS):

    # cat /etc/openarc/keys/{YOURDOMAIN.COM}.pub

Now either create a DNS txt file for your locally hosted DNS in the following format:

    {YOURSELECTOR}._domainkey.{YOURDOMAIN.COM}.	IN TXT "v=DKIM1;k=rsa;p={YOUR-PUBLIC-KEY};"

Or, copy the Public key and paste it into your DNS txt file with the following format:

    <selector>._domainkey.<domain>.
    {YOUR-PUBLIC-KEY}

- If you want logging to syslog, enable it as follows:

    /etc/openarc/openarc.conf

    ...
    Syslog  yes
    ...

- To tell OpenARC which headers to sign, configure them for example as follows:

    /etc/openarc/openarc.conf

    ...
    SignHeaders to,subject,message-id,date,from,mime-version,dkim-signature,arc-authentication-results
    ...

- The PeerList contains a list of IP addresses, CIDR blocks, hostnames, or domain names, whose mail should be neither signed, nor verified by this filter. This can be used to exclude your local mail for example. This file needs to be created if it does not yet exist.

    /etc/openarc/openarc.conf

    ...
    PeerList /etc/openarc/PeerList
    ...

- Other configuration options are available. Make sure to read the documentation.
- Enable/start the `openarc.service`.

## Postfix integration

To integrate ARC using unix sockets, add the postfix user to the openarc group and edit the OpenARC and Postfix configuration files as follows:

    /etc/openarc/openarc.conf

    UserID  openarc:openarc
    Socket  local:/run/openarc/openarc.sock

    /etc/postfix/main.cf

    smtpd_milters = unix:/run/opendkim/opendkim.sock
        unix:/run/openarc/openarc.sock
    non_smtpd_milters = $smtpd_milters
    milter_default_action = accept

## Security

Note: This section is copied from the OpenDKIM#Security

The default configuration for the OpenARC daemon is less than ideal from a security point of view (all those are minor security issues):

- The OpenARC daemon does not need to run as `root` at all (the configuration suggested earlier will have OpenARC drop `root` privileges by itself, but systemd can do this too and much earlier).
- If your mail daemon is on the same host as the OpenARC daemon, there is no need for localhost tcp sockets, and unix sockets may be used instead, allowing classic user/group access controls.
- OpenARC is using the `/tmp` folder by default whereas it could use its own folder with additional access restrictions.

The following configuration files will fix most of those issues (assuming you are using Postfix) and drop some unnecessary options in the systemd service unit. First, create a missing directory:

    # mkdir /var/lib/openarc

Then:

    /etc/openarc/openarc.conf

    BaseDirectory           /var/lib/openarc
    Domain                  example.com
    KeyFile                 /etc/openarc/keys/myselector.private
    Selector                myselector
    Socket                  local:/run/openarc/openarc.sock
    Syslog                  Yes
    TemporaryDirectory      /run/openarc

    /etc/systemd/system/openarc.service

    [Unit]
    Description=OpenARC daemon
    After=network.target remote-fs.target nss-lookup.target

    [Service]
    Type=forking
    User=openarc
    Group=openarc
    ExecStart=/usr/bin/openarc -c /etc/openarc/openarc.conf
    RuntimeDirectory=openarc
    RuntimeDirectoryMode=0700

    [Install]
    WantedBy=multi-user.target

Edit `/etc/postfix/main.cf` accordingly to make Postfix listen to this unix socket:

    /etc/postfix/main.cf

    smtpd_milters = unix:/run/opendkim/opendkim.sock
        unix:/run/openarc/openarc.sock
    non_smtpd_milters = $smtpd_milters

## See also

- ARC Specification for Email
- ARC email authentication - Google Workspace Admin Help
- "What is Authenticated Received Chain (ARC) and why does it matter?" by Proton Mail
- What is ARC - by Fastmail
- What is ARC - b y Postmarkapp

Category:

- Mail server