{"id":62,"date":"2019-04-16T10:52:39","date_gmt":"2019-04-16T10:52:39","guid":{"rendered":"http:\/\/pro369.com\/linux\/?p=62"},"modified":"2019-04-16T10:52:39","modified_gmt":"2019-04-16T10:52:39","slug":"%e5%9c%a8linux%e4%b8%bb%e6%a9%9f%e4%b8%8b%ef%bc%8cpostfix-smtp-server%e3%80%90mailserver%e3%80%91%e4%b9%8b%e5%ae%89%e8%a3%9d","status":"publish","type":"post","link":"https:\/\/por.tw\/linux\/%e5%9c%a8linux%e4%b8%bb%e6%a9%9f%e4%b8%8b%ef%bc%8cpostfix-smtp-server%e3%80%90mailserver%e3%80%91%e4%b9%8b%e5%ae%89%e8%a3%9d\/","title":{"rendered":"\u5728Linux\u4e3b\u6a5f\u4e0b\uff0cPostfix SMTP Server\u3010MailServer\u3011\u4e4b\u5b89\u88dd"},"content":{"rendered":"

\u5728Linux\u4e3b\u6a5f\u4e0bPostfix \u662f\u4e00\u5957\u76f8\u5bb9\u65bc Sendmail \u7684\u90f5\u4ef6\u4f3a\u670d\u5668\u3002<\/font>
\u7531\u65bcPostfix\u8a2d\u5b9a\u8f03\u7c21\u6613\u4e14\u529f\u80fd\u5f37\u5927\u5b89\u5168\u6027\u66f4\u9ad8\uff0c\u56e0\u6b64\u5728\u76ee\u524d\u4f7f\u7528\u7a0b\u5ea6\u5ee3\u6cdb\uff0c\u4e14\u76f8\u95dc\u652f\u63f4\u6587\u4ef6\u4e5f\u5f88\u9f4a\u5168\u3002<\/font><\/strong>
———————————————————
Postfix\u5b89\u88dd\uff1a<\/strong><\/font>
$sudo aptitude install postfix libsasl2 libsasl2-modules sasl2-bin dovecot-common dovecot-imapd dovecot-pop3d
\u4e0a\u9762\u6307\u4ee4\u5c07\u6703\u5b89\u88dd postfix\uff0c\u4e14\u6703\u4e00\u4f75\u5b89\u88dd dovecot \u4f86\u4f5c pop3\/imap \u6536\u4fe1\u4ee5\u53ca SASL \u8ca0\u8cac relay \u7684\u9a57\u8b49\u3002
———————————————————
Postfix\u8a2d\u5b9a\uff1a<\/strong><\/font>
postfix \u7684\u4e3b\u8981\u8a2d\u5b9a\u6a94\u70ba \/etc\/postfix\/main.cf\uff0c\u4ee5\u4e0b\u5217\u51fa\u5e38\u7528\u8a2d\u5b9a\u503c\u3002<\/strong>
———————————————————
# \u4e3b\u6a5f\u540d\u7a31\uff0c\u5fc5\u9808\u8207 DNS \u7684 MX \u4e3b\u6a5f\u540d\u7a31\u5c0d\u61c9
myhostname = aaa.bbb.ccc.ddd
# \u7db2\u57df\u540d\u7a31
mydomain = bbb.ccc.ddd
# \u63a5\u53d7 relay \u7684\u7db2\u57df
mydestination = bbb.ccc.ddd, localhost.localdomain, localhost
# \u63a5\u53d7 relay \u7684\u7db2\u57df\u4e3b\u6a5f
relay_domain = xxx.bbb.ccc.ddd
# \u82e5\u8981 smarthost \u6642\uff0crelay \u7684\u4e3b\u6a5f\uff0c\u4e00\u822c\u8a2d\u5b9a\u6210 isp \u7684 mail \u4e3b\u6a5f\u5373\u53ef\u3002
# \u5982\u4e0d\u8a2d\u5b9a\u4f3c\u4e4e\u5728\u5bc4\u7d66\u67d0\u4e9b mail server \u6703\u6709\u7de8\u865f 550-5.7.1 \u7684\u554f\u984c\u800c\u7121\u6cd5\u5bc4\u51fa\uff0c\u5982 gmail\u3002
# \u4e0b\u9762 ip \u70ba hinet ms23.hinet.net \u4e3b\u6a5f
relayhost = 168.95.4.23
# \u5167\u90e8\u7db2\u8def
mynetworks = 127.0.0.0\/8
# \u8a2d\u5b9a\u4fe1\u7bb1\u5b58\u653e\u76ee\u9304
mail_spool_directory = \/var\/mail
# \u4fe1\u7bb1\u5927\u5c0f\u9650\u5236\uff0c\u55ae\u4f4d bytes\uff0c0 \u70ba\u4e0d\u9650\u3002
mailbox_size_limit = 0
# \u55ae\u5c01\u4fe1\u4ef6\u5927\u5c0f\u9650\u5236\uff0c\u55ae\u4f4d bytes
message_size_limit = 10240000
———————————————————
\u5099\u8a3b\uff1a\u82e5\u7121\u8a2d\u5b9a DNS MX \u7d00\u9304\u7684\u5c0d\u61c9\uff0c\u5247\u7121\u6cd5\u6b63\u5e38 relay \u5230\u67d0\u4e9b\u9060\u7aef\u4e3b\u6a5f\u3002<\/strong>
———————————————————
\u8a2d\u5b9a SASL \u8a8d\u8b49\u652f\u63f4<\/strong><\/font>
SASL \u70ba\u7b26\u5408 RFC 2222 \u6a19\u6e96\u7684\u8a8d\u8a3c\u6a5f\u5236\uff0c\u6b64\u4f5c\u7528\u53ef\u9632\u6b62\u4efb\u610f\u4f7f\u7528\u8005\u767b\u5165\u4f7f\u7528\u90f5\u4ef6\u4f3a\u670d\u5668\u4e82\u767c\u90f5\u4ef6\u3002\u76ee\u524d\u5e7e\u4e4e\u5927\u90e8\u5206\u7684 MTA Server \u5167\u5b9a\u90fd\u95dc\u6389 OpenRelay \u529f\u80fd\uff0c\u6539\u7528 SMTP \u8a8d\u8b49\u4f86\u9a57\u8b49\u4f7f\u7528\u8005\u662f\u5426\u53ef\u9032\u884c mail relay\u3002
———————————————————
\u8a2d\u5b9a SASL<\/strong><\/font>
\u4fee\u6539 \/etc\/default\/saslauthd \u6a94\uff0c\u8a2d\u5b9a saslauthd \u4f7f\u7528\u7684\u8a8d\u8b49\u65b9\u5f0f\u8207\u958b\u6a5f\u81ea\u52d5\u555f\u52d5\u3002
———————————————————
# \u8b93 saslauthd \u4e00\u958b\u6a5f\u5c31\u555f\u52d5
# This needs to be uncommented before saslauthd will be run automatically
START=yes
# \u8b93 saslauthd \u63a1\u7528 linux \u7684\u7cfb\u7d71\u5e33\u865f\u5bc6\u78bc\u6a94\u4f5c\u9a57\u8b49
# Which authentication mechanisms should saslauthd use? (default: pam)
#
# Available options in this Debian package:
# getpwent  — use the getpwent() library function
# kerberos5 — use Kerberos 5
# pam       — use PAM
# rimap     — use a remote IMAP server
# shadow    — use the local shadow password file
# sasldb    — use the local sasldb database file
# ldap      — use LDAP (configuration is in \/etc\/saslauthd.conf)
#
# Only one option may be used at a time. See the saslauthd man page
# for more information.
#
# Example: MECHANISMS="pam"
MECHANISMS="pam"<\/p>\n

# \u8b93 saslauthd \u652f\u63f4 postfix \u9810\u8a2d\u5b89\u88dd\u7684 chroot \u6a21\u5f0f
# Other options (default: -c)
# See the saslauthd man page for information about these options.
#
# Example for postfix users: "-c -m \/var\/spool\/postfix\/var\/run\/saslauthd"
# Note: See \/usr\/share\/doc\/sasl2-bin\/README.Debian
OPTIONS="-c -m \/var\/spool\/postfix\/var\/run\/saslauthd"
———————————————————
\u6700\u5f8c\u4f7f\u7528 dpkg-statoverride \u4f86\u5efa\u7acb saslauthd \u7684\u57f7\u884c\u6642\u671f\u76ee\u9304<\/strong><\/font>
$sudo  dpkg-statoverride –add root sasl 710 \/var\/spool\/postfix\/var\/run\/saslauthd<\/p>\n

———————————————————
\u8a2d\u5b9a Postfix \u4f7f\u7528 SASL<\/strong><\/font>
\u7de8\u8f2f \/etc\/postfix\/sasl\/smtpd.conf \u8b93 postfix \u4f7f\u7528 saslauthd \u4f86\u8a8d\u8b49\u3002<\/span><\/strong>
# log \u6a94\u7684\u7d00\u9304\u7b49\u7d1a
log_level: 3
# \u8a2d\u5b9a\u5bc6\u78bc\u6aa2\u9a57\u4f7f\u7528\u54ea\u7a2e\u670d\u52d9
pwcheck_method: saslauthd
# \u8a2d\u5b9a\u6240\u4f7f\u7528\u7684\u8a8d\u8b49\u6a5f\u5236
mech_list: PLAIN LOGIN
———————————————————
\u63a5\u8457\u628a postfix \u52a0\u5165\u5230 sasl \u7684\u7fa4\u7d44\u4e2d\uff0c\u624d\u80fd\u4f7f\u7528 saslauthd \u4f86\u8a8d\u8b49\u3002<\/strong>
$sudo addgroup postfix sasl
———————————————————
\u63a5\u8457\u4fee\u6539 postfix \u8a2d\u5b9a\u6a94 \/etc\/postfix\/main.cf\uff0c\u555f\u7528 SMTP \u53ca SASL \u8a8d\u8b49\u6a5f\u5236\u3002<\/strong>
# \u8a2d\u5b9a Postfix \u4f7f\u7528 SASL \u8a8d\u8a3c\u3002
smtpd_sasl_auth_enable = yes
# \u8a2d\u5b9a SASL \u652f\u63f4\u975e\u6a19\u6e96 E-mail Client \u7684\u8a8d\u8a3c\u52d5\u4f5c\u3002
broken_sasl_auth_clients = yes
# \u4e0d\u4f7f\u7528 ANONYMOUS \u9019\u500b\u8a8d\u8a3c\u3002
smtpd_sasl_security_options = noanonymous
# \u8a2d\u5b9a SASL \u7684\u8a8d\u8a3c\u65b9\u6cd5
# permit_sasl_authenticated        \u5141\u8a31\u901a\u904e SASL \u8a8d\u8a3c\u8005\u53ef relay
# permit_mynetworks                   mynetworks \u5167\u4f7f\u7528\u8005\u53ef relay
# check_relay_domains               \u6aa2\u67e5\u53ef\u9032\u884c ralay \u7684 domains
# reject_unauth_destination         \u672a\u901a\u904e\u8a8d\u8b49\u4e0d\u4e88\u63a5\u6536
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, check_relay_domains, reject_unauth_destination
# \u9650\u5236\u672a\u7d93\u4fe1\u4efb\u7684 client \u767b\u5165\u5c31\u555f\u52d5 sasl \u8a8d\u8b49
smtpd_client_restrictions = permit_sasl_authenticated
———————————————————
\u91cd\u65b0\u555f\u52d5\u670d\u52d9<\/strong><\/font>
\u505a\u597d\u4e0a\u8ff0\u8a2d\u5b9a\u5f8c\uff0c\u6700\u5f8c\u91cd\u65b0\u555f\u52d5\u5404\u9805\u670d\u52d9\u6216\u662f\u91cd\u958b\u6a5f\u4ee5\u4f7f\u8a2d\u5b9a\u751f\u6548\u3002<\/strong>
$sudo \/etc\/init.d\/saslauthd restart
$sudo \/etc\/init.d\/postfix restart
———————————————————
\u6700\u5f8c\u6e2c\u8a66<\/strong><\/font>
\u5728\u91cd\u65b0\u555f\u52d5\u670d\u52d9\u5f8c\uff0c\u53ef\u7528\u4ee5\u4e0b\u65b9\u5f0f\u4f86\u6e2c\u8a66 saslauthd \u670d\u52d9\u662f\u5426\u6b63\u5e38\u904b\u4f5c\u3002<\/strong>
$sudo testsaslauthd -u \u4f7f\u7528\u8005\u540d\u7a31 -p \u5bc6\u78bc
\u56de\u50b3\u70ba\u300c0: OK “Success.“\u300d\u4ee3\u8868\u6b63\u5e38\uff0c\u53cd\u4e4b\u5247\u6aa2\u67e5 saslauthd \u670d\u52d9\u662f\u5426\u555f\u52d5\uff1b
\u63a5\u8457\u767b\u5165 postfix \u6e2c\u8a66 sasl \u662f\u5426\u904b\u4f5c\u3002
$ perl -MMIME::Base64 -e 'print encode_base64("\ufffd\u4f7f\u7528\u8005\u5e33\u865f\ufffd\u5bc6\u78bc");'
\u57f7\u884c\u4e4b\u5f8c\u6703\u7522\u751f\u4e00\u7d44 base64 \u7de8\u78bc\uff0c\u7a0d\u5f8c\u6703\u7528\u5230\uff1b\u63a5\u8457 telnet postfix\u3002
$telnet 127.0.0.1 25
\u51fa\u73fe\u4e0b\u9762\u8a0a\u606f\uff1a
Trying 127.0.0.1…
Connected to 127.0.0.1.
Escape character is '^]'.
220 aaa.bbb.ccc.ddd ESMTP Postfix (Debian\/GNU)
———————————————————
\u8f38\u5165\u4ee5\u4e0b\u6307\u4ee4\uff1a<\/strong><\/font>
ehlo aaa <- aaa \u70ba hostname
\u51fa\u73fe\u4e0b\u9762\u8a0a\u606f\uff1a
250-aaa.bbb.ccc.ddd
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
———————————————————
\u8f38\u5165\u4ee5\u4e0b\u6307\u4ee4\uff1a<\/strong><\/font>
auth plain xxxxxxxxxxxxxxxxxx <-\u525b\u525b\u7528 perl \u7b97\u51fa\u7684 base64 \u503c
\u82e5\u51fa\u73fe\u300c235 2.0.0 Authentication successful\u300d\u4ee3\u8868 sasl \u8a8d\u8b49\u6210\u529f\uff0c
\u53cd\u4e4b\u5982\u679c\u9a57\u8b49\u5931\u6557\u5247\u6aa2\u67e5\u8a2d\u5b9a\u6b65\u9a5f\u662f\u5426\u6709\u8aa4\u3002
———————————————————
\u8a2d\u5b9a dovecot<\/strong><\/font>
dovecot \u8a2d\u5b9a\u6a94\u70ba \/etc\/dovecot\/dovecot.conf<\/strong>
———————————————————
# \u8a2d\u5b9a\u652f\u63f4\u54ea\u4e9b\u5354\u5b9a\uff0c\u5728\u6b64\u70ba IMAP \u8207 POP3 \u5169\u500b
# Protocols we want to be serving: imap imaps pop3 pop3s
# If you only want to use dovecot-auth, you can set this to "none".
#protocols = imap imaps
protocols = imap pop3
# \u8a2d\u5b9a\u76e3\u807d\u7684 ip \u8207 port\uff0c\u53ef\u500b\u5225\u6307\u5b9a imap \u8207 pop3 \u7684\u76e3\u807d\u4ecb\u9762
# If you want to specify ports for each service, you will need to configure
# these settings inside the protocol imap\/pop3 { … } section, so you can
# specify different ports for IMAP\/POP3. For example:
#   protocol imap {
#     listen = *:10143
#     ssl_listen = *:10943
#     ..
#   }
#   protocol pop3 {
#     listen = *:10100
#     ..
#   }
listen = *
# \u8a2d\u5b9a\u555f\u52d5\u8a8d\u8b49
# Disable LOGIN command and all other plaintext authentications unless
# SSL\/TLS is used (LOGINDISABLED capability). Note that if the remote IP
# matches the local IP (ie. you're connecting from the same computer), the
# connection is considered secure and plaintext authentication is allowed.
disable_plaintext_auth = no
# \u8a8d\u8b49\u6a5f\u5236
# Space separated list of wanted authentication mechanisms:
#   plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi
# NOTE: See also disable_plaintext_auth setting.
mechanisms = plain login
———————————————————
\u81f3\u6b64\u5df2\u5b8c\u6210 debian \u4e0a\u6574\u500b mail server \u7684\u67b6\u8a2d\uff0cclient  \u7aef\u7684\u5e33\u865f\u8a2d\u5b9a\u90e8\u4efd\u8981\u8a18\u5f97\u5728\u5916\u5bc4\u4f3a\u670d\u5668\u8981\u52fe\u9078\u9a57\u8b49\u3002<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

\u5728Linux\u4e3b\u6a5f\u4e0bPostfix \u662f\u4e00\u5957\u76f8\u5bb9\u65bc Sendmail \u7684\u90f5\u4ef6\u4f3a\u670d\u5668\u3002 \u7531\u65bcPostfix\u8a2d\u5b9a\u8f03\u7c21\u6613 […]<\/p>\n","protected":false},"author":1,"featured_media":505,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-62","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-postfix-smtp-server"],"_links":{"self":[{"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/posts\/62"}],"collection":[{"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/comments?post=62"}],"version-history":[{"count":0,"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/posts\/62\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/media\/505"}],"wp:attachment":[{"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/media?parent=62"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/categories?post=62"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/por.tw\/linux\/wp-json\/wp\/v2\/tags?post=62"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}