Відмінності між версіями «Email»

Матеріал з Wiki Welard
Перейти до навігації Перейти до пошуку
 
(Не показані 20 проміжних версій 2 користувачів)
Рядок 1: Рядок 1:
−
Налаштування Email-сервера
+
== Налаштування Email-сервера ==
  
−
'''
+
yum install postfix dovecot ntp
−
yum install postfix dovcote
+
groupadd -g 1000 vmail
−
'''
+
useradd -d /home/vmail/ -g 1000 -u 1000 vmail
 +
mkdir /etc/postfix/certs
 +
postmap /etc/postfix/transport
 +
openssl req -new -x509 -days 3650 -nodes -out /etc/postfix/certs/cert.pem -keyout /etc/postfix/certs/key.pem
 +
 
 +
iptables:
 +
 
 +
-A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
 +
-A INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT
 +
-A INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT
 +
-A INPUT -m state --state NEW -m tcp -p tcp --dport 465 -j ACCEPT
 +
-A INPUT -m state --state NEW -m tcp -p tcp --dport 587 -j ACCEPT
 +
-A INPUT -m state --state NEW -m tcp -p tcp --dport 993 -j ACCEPT
 +
-A INPUT -m state --state NEW -m tcp -p tcp --dport 995 -j ACCEPT
 +
 
 +
 
 +
Первірка портів
 +
netstat -tup
 +
 
 +
== Налаштування Postfix ==
 +
 
 +
'''main.cf''':
 +
 
 +
queue_directory = /var/spool/postfix
 +
command_directory = /usr/sbin
 +
daemon_directory = /usr/libexec/postfix
 +
data_directory = /var/lib/postfix
 +
mail_owner = postfix
 +
'''myhostname = mail.example.com'''
 +
'''mydomain = example.com'''
 +
inet_interfaces = all
 +
inet_protocols = ipv4
 +
mydestination = $myhostname, localhost.$mydomain, localhost
 +
local_recipient_maps = unix:passwd.byname $alias_maps
 +
transport_maps = hash:/etc/postfix/transport
 +
'''virtual_mailbox_domains = example.com'''
 +
virtual_transport = dovecot
 +
unknown_local_recipient_reject_code = 550
 +
'''mynetworks_style = host'''
 +
alias_maps = hash:/etc/aliases
 +
alias_database = hash:/etc/aliases
 +
debug_peer_level = 2
 +
debugger_command =
 +
<--> PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
 +
<--> ddd $daemon_directory/$process_name $process_id & sleep 5
 +
sendmail_path = /usr/sbin/sendmail.postfix
 +
newaliases_path = /usr/bin/newaliases.postfix
 +
mailq_path = /usr/bin/mailq.postfix
 +
setgid_group = postdrop
 +
html_directory = no
 +
manpage_directory = /usr/share/man
 +
sample_directory = /usr/share/doc/postfix-2.6.6/samples
 +
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
 +
smtp_sasl_auth_enable = no
 +
smtpd_sasl_auth_enable = yes
 +
smtpd_sasl_type = dovecot
 +
smtpd_sasl_path = private/auth
 +
smtpd_sasl_security_options=noanonymous
 +
smtpd_sasl_tls_security_options=$smtpd_sasl_security_options
 +
smtp_sasl_mechanism_filter = !plain, static:rest
 +
biff = no
 +
 +
# TLS
 +
# ============================================================
 +
smtp_tls_security_level = may
 +
smtpd_tls_security_level = may
 +
smtpd_tls_loglevel = 1
 +
smtpd_tls_received_header = yes
 +
smtpd_tls_session_cache_timeout = 3600s
 +
smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
 +
'''smtpd_tls_key_file = /etc/postfix/certs/key.pem'''
 +
'''smtpd_tls_cert_file = /etc/postfix/certs/cert.pem'''
 +
tls_random_source = dev:/dev/urandom
 +
 +
# RESTRICTIONS
 +
 +
smtpd_discard_ehlo_keywords = etrn, silent-discard
 +
smtpd_forbidden_commands = CONNECT GET POST
 +
broken_sasl_auth_clients = yes
 +
smtpd_delay_reject = yes
 +
smtpd_helo_required = yes
 +
disable_vrfy_command = yes
 +
 +
smtpd_helo_restrictions = permit_mynetworks,
 +
                          permit_sasl_authenticated,
 +
                          reject_non_fqdn_helo_hostname,
 +
                          reject_invalid_helo_hostname
 +
 +
smtpd_data_restrictions = permit_mynetworks,
 +
                          permit_sasl_authenticated,
 +
                          reject_unauth_pipelining,
 +
                          reject_multi_recipient_bounce,
 +
 +
smtpd_sender_restrictions = permit_mynetworks,
 +
                            permit_sasl_authenticated,
 +
                            reject_non_fqdn_sender,
 +
                            reject_unknown_sender_domain
 +
 +
smtpd_recipient_restrictions = reject_non_fqdn_recipient,
 +
                                reject_unknown_recipient_domain,
 +
                                reject_multi_recipient_bounce,
 +
                                permit_mynetworks,
 +
                                permit_sasl_authenticated,
 +
                                reject_unauth_destination,
 +
#                              check_policy_service unix:/var/spool/postfix/postgrey/socket,
 +
                                #reject_rbl_client zen.spamhaus.org,
 +
                                #reject_rbl_client bl.spamcop.net,
 +
                                #reject_rbl_client dnsbl.sorbs.net,
 +
                                reject_invalid_hostname
 +
 
 +
 
 +
'''master.cf'''
 +
 
 +
smtp = SMTP
 +
 
 +
submission = STARTTLS
 +
 
 +
smtps = SSL/TSL
 +
 
 +
# ==========================================================================
 +
# service type  private unpriv  chroot  wakeup  maxproc command + args
 +
#              (yes)  (yes)  (yes)  (never) (100)
 +
# ==========================================================================
 +
 +
'''smtp'''      inet  n      -      n      -      -      smtpd
 +
'''submission''' inet n      -      n      -      -      smtpd
 +
  -o smtpd_tls_security_level=encrypt
 +
  -o smtpd_sasl_auth_enable=yes
 +
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
 +
  -o milter_macro_daemon_name=ORIGINATING
 +
'''smtps'''    inet  n      -      n      -      -      smtpd
 +
  -o smtpd_tls_wrappermode=yes
 +
  -o smtpd_sasl_auth_enable=yes
 +
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
 +
  -o milter_macro_daemon_name=ORIGINATING
 +
'''dovecot''' unix    -      n      n      -      -      pipe
 +
  flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -d ${recipient}
 +
pickup    fifo  n      -      n      60      1      pickup
 +
cleanup  unix  n      -      n      -      0      cleanup
 +
qmgr      fifo  n      -      n      300    1      qmgr
 +
tlsmgr    unix  -      -      n      1000?  1      tlsmgr
 +
rewrite  unix  -      -      n      -      -      trivial-rewrite
 +
bounce    unix  -      -      n      -      0      bounce
 +
defer    unix  -      -      n      -      0      bounce
 +
trace    unix  -      -      n      -      0      bounce
 +
verify    unix  -      -      n      -      1      verify
 +
flush    unix  n      -      n      1000?  0      flush
 +
proxymap  unix  -      -      n      -      -      proxymap
 +
proxywrite unix -      -      n      -      1      proxymap
 +
smtp      unix  -      -      n      -      -      smtp
 +
relay    unix  -      -      n      -      -      smtp
 +
<-->-o smtp_fallback_relay=
 +
showq    unix  n      -      n      -      -      showq
 +
error    unix  -      -      n      -      -      error
 +
retry    unix  -      -      n      -      -      error
 +
discard  unix  -      -      n      -      -      discard
 +
local    unix  -      n      n      -      -      local
 +
virtual  unix  -      n      n      -      -      virtual
 +
lmtp      unix  -      -      n      -      -      lmtp
 +
anvil    unix  -      -      n      -      1      anvil
 +
scache    unix  -      -      n      -      1      scache
 +
 
 +
transport:
 +
example.com <-> dovecot:
 +
 
 +
postmap /etc/postfix/transport
 +
 
 +
== Налаштування Dovecot ==
 +
 
 +
'''/etc/dovecot/dovecot.conf:'''
 +
 
 +
protocols = imap pop3
 +
listen = *
 +
 
 +
'''/etc/dovecot/users:'''
 +
 
 +
[email protected]:{PLAIN}pass:1000:1000::/home/vmail/info
 +
 
 +
'''/etc/dovecot/conf.d/10-auth.conf:'''
 +
 
 +
disable_plaintext_auth = no
 +
auth_mechanisms = plain login
 +
!include auth-passwdfile.conf.ext
 +
 
 +
'''/etc/dovecot/conf.d/10-mail.conf'''
 +
mail_location = maildir:/home/vmail/%u
 +
mail_uid = 1000
 +
mail_gid = 1000
 +
mbox_write_locks = fcntl
 +
 
 +
'''/etc/dovecot/conf.d/10-master.conf:'''
 +
 
 +
default_internal_user = vmail
 +
 +
service imap-login {
 +
  inet_listener imap {
 +
    port = 143
 +
  }
 +
  inet_listener imaps {
 +
    port = 993
 +
    ssl = yes
 +
  }
 +
}
 +
 +
service pop3-login {
 +
  inet_listener pop3 {
 +
    port = 110
 +
  }
 +
  inet_listener pop3s {
 +
    port = 995
 +
    ssl = yes
 +
  }
 +
}
 +
 +
service lmtp {
 +
  unix_listener lmtp {
 +
    #mode = 0666
 +
  }
 +
 +
}
 +
 +
service imap {
 +
}
 +
 +
service pop3 {
 +
}
 +
service auth {
 +
  unix_listener auth-userdb {
 +
    mode = 0600
 +
    user = vmail
 +
    group = vmail
 +
  }
 +
 +
  # Postfix smtp-auth
 +
  unix_listener /var/spool/postfix/private/auth {
 +
    mode = 0666
 +
    user = postfix
 +
    group = postfix
 +
  }
 +
  unix_listener auth-master {
 +
      mode = 0660
 +
      group = mail
 +
      user = vmail
 +
  }
 +
  # Auth process is run as this user.
 +
  user = $default_internal_user
 +
}
 +
 +
service auth-worker {
 +
}
 +
 +
service dict {
 +
  unix_listener dict {
 +
  }
 +
}
 +
 
 +
'''/etc/dovecot/conf.d/10-ssl.conf:'''
 +
 
 +
ssl = yes
 +
ssl_cert = </etc/postfix/certs/cert.pem
 +
ssl_key = </etc/postfix/certs/key.pem
 +
 
 +
'''/etc/dovecot/conf.d/15-lda.conf:'''
 +
protocol lda {
 +
  mail_plugins = $mail_plugins autocreate
 +
}
 +
 
 +
'''/etc/dovecot/conf.d/90-plugin.conf:'''
 +
plugin {
 +
  autocreate = Trash
 +
  autocreate2 = sent-mail
 +
  autocreate3 = drafts
 +
  autosubscribe = Trash
 +
  autosubscribe2 = sent-mail
 +
  autosubscribe3 = drafts
 +
}
 +
 
 +
'''/etc/dovecot/conf.d/auth-passwdfile.conf.ext:'''
 +
passdb {
 +
  driver = passwd-file
 +
  args = scheme=CRYPT username_format=%u /etc/dovecot/users
 +
}
 +
 
 +
userdb {
 +
  driver = passwd-file
 +
  args = username_format=%u /etc/dovecot/users
 +
}

Поточна версія на 11:57, 4 листопада 2014

Налаштування Email-сервера

yum install postfix dovecot ntp
groupadd -g 1000 vmail
useradd -d /home/vmail/ -g 1000 -u 1000 vmail
mkdir /etc/postfix/certs
postmap /etc/postfix/transport 
openssl req -new -x509 -days 3650 -nodes -out /etc/postfix/certs/cert.pem -keyout /etc/postfix/certs/key.pem

iptables: 

-A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 465 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 587 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 993 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 995 -j ACCEPT


Первірка портів 

netstat -tup

Налаштування Postfix

main.cf: 

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = mail.example.com
mydomain = example.com
inet_interfaces = all
inet_protocols = ipv4
mydestination = $myhostname, localhost.$mydomain, localhost
local_recipient_maps = unix:passwd.byname $alias_maps
transport_maps = hash:/etc/postfix/transport
virtual_mailbox_domains = example.com
virtual_transport = dovecot
unknown_local_recipient_reject_code = 550
mynetworks_style = host
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
debug_peer_level = 2
debugger_command =
<--> PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
<--> ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.6.6/samples
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
smtp_sasl_auth_enable = no
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options=noanonymous
smtpd_sasl_tls_security_options=$smtpd_sasl_security_options
smtp_sasl_mechanism_filter = !plain, static:rest
biff = no

# TLS
# ============================================================
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
smtpd_tls_key_file = /etc/postfix/certs/key.pem
smtpd_tls_cert_file = /etc/postfix/certs/cert.pem
tls_random_source = dev:/dev/urandom

# RESTRICTIONS

smtpd_discard_ehlo_keywords = etrn, silent-discard
smtpd_forbidden_commands = CONNECT GET POST
broken_sasl_auth_clients = yes
smtpd_delay_reject = yes
smtpd_helo_required = yes
disable_vrfy_command = yes

smtpd_helo_restrictions = permit_mynetworks,
                          permit_sasl_authenticated,
                          reject_non_fqdn_helo_hostname,
                          reject_invalid_helo_hostname

smtpd_data_restrictions = permit_mynetworks,
                          permit_sasl_authenticated,
                          reject_unauth_pipelining,
                          reject_multi_recipient_bounce,

smtpd_sender_restrictions = permit_mynetworks,
                            permit_sasl_authenticated,
                            reject_non_fqdn_sender,
                            reject_unknown_sender_domain

smtpd_recipient_restrictions = reject_non_fqdn_recipient,
                               reject_unknown_recipient_domain,
                               reject_multi_recipient_bounce,
                               permit_mynetworks,
                               permit_sasl_authenticated,
                               reject_unauth_destination,
#                               check_policy_service unix:/var/spool/postfix/postgrey/socket,
                               #reject_rbl_client zen.spamhaus.org,
                               #reject_rbl_client bl.spamcop.net,
                               #reject_rbl_client dnsbl.sorbs.net,
                               reject_invalid_hostname


master.cf

smtp = SMTP

submission = STARTTLS

smtps = SSL/TSL 

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================

smtp      inet  n       -       n       -       -       smtpd
submission inet n       -       n       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
dovecot unix    -       n       n       -       -      pipe
  flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -d ${recipient}
pickup    fifo  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
<-->-o smtp_fallback_relay=
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache

transport: 

example.com <-> dovecot:

postmap /etc/postfix/transport

Налаштування Dovecot

/etc/dovecot/dovecot.conf: 

protocols = imap pop3
listen = *

/etc/dovecot/users: 

[email protected]:{PLAIN}pass:1000:1000::/home/vmail/info

/etc/dovecot/conf.d/10-auth.conf: 

disable_plaintext_auth = no
auth_mechanisms = plain login
!include auth-passwdfile.conf.ext

/etc/dovecot/conf.d/10-mail.conf 

mail_location = maildir:/home/vmail/%u
mail_uid = 1000
mail_gid = 1000
mbox_write_locks = fcntl

/etc/dovecot/conf.d/10-master.conf: 

default_internal_user = vmail

service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}

service pop3-login {
  inet_listener pop3 {
    port = 110
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}

service lmtp {
  unix_listener lmtp {
    #mode = 0666
  }

}

service imap {
}

service pop3 {
}
service auth {
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
    group = vmail
  }

  # Postfix smtp-auth
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
    group = postfix
  }
 unix_listener auth-master {
     mode = 0660
     group = mail
     user = vmail
  }
  # Auth process is run as this user.
  user = $default_internal_user
}

service auth-worker {
}

service dict {
  unix_listener dict {
  }
}

/etc/dovecot/conf.d/10-ssl.conf: 

ssl = yes
ssl_cert = </etc/postfix/certs/cert.pem
ssl_key = </etc/postfix/certs/key.pem

/etc/dovecot/conf.d/15-lda.conf: 

protocol lda {
  mail_plugins = $mail_plugins autocreate
}

/etc/dovecot/conf.d/90-plugin.conf: 

plugin {
  autocreate = Trash
  autocreate2 = sent-mail
  autocreate3 = drafts
  autosubscribe = Trash
  autosubscribe2 = sent-mail
  autosubscribe3 = drafts
}

/etc/dovecot/conf.d/auth-passwdfile.conf.ext: 

passdb {
  driver = passwd-file
  args = scheme=CRYPT username_format=%u /etc/dovecot/users
}

userdb {
  driver = passwd-file
  args = username_format=%u /etc/dovecot/users
}
Отримано з https://wiki.welard.com/index.php?title=Email&oldid=2152