NTACurrent en:Additional measures
Log data protection and retention
According to NTA 7516, "Log data shall be protected in conformity with NEN 7510:2017 and NEN 7513:2018" and "Log data, as specified in 6.4.2, shall have a storage period in conformity with NEN 7513:2018" (see chapter 7.4). These requirements need to be addressed by implementing appropriate measures, as outlined in the respective norms.
The Cryptshare Mail Gateway includes several components that generate logs related to the processing of messages, which are described below.
This component processes messages that are to be sent to NTA 7516-compliant recipients. Events regarding these messages are logged to two destinations:
- Standard output, which is collected by the Systemd Journald service. By default, Journald keeps its logs in /run/log/journal, and the logs are discarded on reboot. If the path /var/log/journal exists, logs will be persistently logged to that location and will survive a reboot.
- The application log file, which is by default located at /opt/cryptshare-mail-gateway/smtp-filter/log/smtp-filter.log. This location can be changed by setting a different path in the configuration file of the application, /opt/cryptshare-mail-gateway/smtp-filter/config.properties, using the parameter logging.file.name. This information will also be logged to Journald.
Postfix instances
There are two Postfix instances involved in the message processing: The default instance is located in /etc/postfix and another instance that is used for outbound NTA7516 compliant mails, located at /etc/postfix-nta7516. Both instances log via syslog to the following files
- /etc/syslog
- /etc/mail.log
- /etc/mail.info
Removal of unprotected headers
To ensure the confidentiality of the messages according to NTA 7516, chapters 6.1.11 and 6.2.2.2, the technical agreements for NTA 7516 prescribe the removal of unnecessary and unprotected e-mail headers. This means that email headers that are considered unnecessary by the technical agreements must be removed if present, as long as they are not protected by other measures.
Cryptshare for NTA 7516 removes these headers by default. If other measures are present (e.g. a message encryption that includes the headers), the removal may be disabled by adjusting the list of headers in the configuration file of the application, /opt/cryptshare-mail-gateway/smtp-filter/config.properties, using the parameter app.email.headers.markedforremoval.
By default, the following headers are removed: Accept-Language, Apparently-To, ARC-Authentication-Results, ARC-Message-Signature, ARC-Seal, Base, Content-Base, Content-Language, DL-Expansion-History, Downgraded-Bcc, Downgraded-Cc, Downgraded-Disposition-Notification-To, Downgraded-From, Downgraded-Mail-From, Downgraded-Rcpt-To, Downgraded-Reply-To, Downgraded-Resent-Bcc, Downgraded-Resent-Cc, Downgraded-Resent-From, Downgraded-Resent-Reply-To, Downgraded-Resent-Sender, Downgraded-Resent-To, Downgraded-Return-Path, Downgraded-Sender, Downgraded-To, EDIINT-Features, Eesst-Version, Errors-To, Form-Sub, Jabber-ID, Language, List-Archive, List-Help, List-ID, List-Owner, List-Post, List-Subscribe, List-Unsubscribe, List-Unsubscribe-Post, MMHS-Acp127-Message-Identifier, MMHS-Authorizing-Users, MMHS-Codress-Message-Indicator, MMHS-Copy-Precedence, MMHS-Exempted-Address, MMHS-Extended-Authorisation-Info, MMHS-Handling-Instructions, MMHS-Message-Instructions, MMHS-Message-Type, MMHS-Originator-PLAD, MMHS-Originator-Reference, MMHS-Other-Recipients-Indicator-CC, MMHS-Other-Recipients-Indicator-To, MMHS-Primary-Precedence, MMHS-Subject-Indicator-Codes, Organization, Privicon, Resent-Reply-To, SIO-Label, SIO-Label-History, X-Archived-At, X-Mittente, X-Ricevuta, X-Riferimento-Message-ID, X-TipoRicevuta, X-Trasporto, X-VerificaSicurezza, X400-Content-Identifier, X400-Content-Return, X400-Content-Type, X400-MTS-Identifier, X400-Originator, X400-Received, X400-Recipients, X400-Trace.