Logged in. quit +OK Logging out. quit ### logging 成功 8.配置 postfix 服务 shell $> vim /etc/postfix/main.cf smtpd_banner =/etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls =yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = dovecot smtpd_sasl_path = private/auth-client smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions 替换为 smtp inet n - n - - smtpd 9.重启 postfix 服务 /etc/init.d/postfix
sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop unknown_local_recipient_reject_code = 550 smtpd_client_connection_count_limit = 1024 smtpd_client_connection_rate_limit = 5 #Cyrus-SASL smtpd_client_restrictions = permit_sasl_authenticated smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination , reject_invalid_hostname smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_security_options
= dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination # add to the end smtpd_use_tls = yes smtpd_tls_cert_file = /etc/pki/tls/certs/server.crt smtpd_tls_key_file = /etc/pki/tls/certs/server.key smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_scache [ postfix/master.cf # line 26-28: uncomment smtps inet n - n - - smtpd
= permit_sasl_authenticated #指定可以向postfix发起SMTP连接的客户端的主机名或ip地址smtpd_recipient_restrictions = permit_mynetworks , permit_sasl_authenticated #此处permit_sasl_authenticated意思是允许通过了sasl认证的所有用户smtpd_sasl_auth_enable = yes #指定postfix使用sasl验证 通俗的将就是启用smtp并要求进行账号、密码校验smtpd_sasl_security_options = noanonymous #取消smtp的匿名登录 install cyrus-sasl cyrus-sasl-lib cyrus-sasl-plain cyrus-sasl-devel(6).编辑sasl2配置32位 vim /usr/lib/sasl2/smtpd.conf64 位 vim /etc/sasl2/smtpd.confpwcheck_method: auxpropauxprop_plugin: sasldbmech_list: plain login CRAM-MD5
smtpd_banner = $myhostname ESMTP unknow //568行,把前面的注释拿掉,然后把$mail_name ($mail_version)改成unknow //在main.cf 文件的底部加上以下内容 smtpd_sasl_auth_enable = yes //使用SMTP认证 broken_sasl_auth_clients = yes //让不支持RFC2554的smtpclient smtpd_sasl_local_domain = $myhostname 指定SMTP认证的本地域名 smtpd_sasl_security_options = noanonymous //取消匿名登陆方式 smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination socket/lmtp //设置连接cyrus-imapd的路径 如果不加local_recipient_maps这个配置,收邮件收不到, 2,cyrus-sasl配置 vim /etc/sasl2/smtpd.conf
=/etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls =yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = = permit_sasl_authenticated, permit_mynetworks smtpd_sasl_local_domain = $myhostname smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes # TLS settings smtpd_tls_security_level = may smtpd_tls_auth_only
= yes smtpd_sasl_security_options = noanonymous smtpd_recipient_restrictions = permit_sasl_authenticated = yes smtpd_sasl_security_options = noanonymous smtpd_recipient_restrictions = permit_sasl_authenticated = yes smtp_tls_note_starttls_offer = yes smtpd_tls_key_file = /etc/postfix/smtpd.pem smtpd_tls_cert_file = /etc/postfix/smtpd.pem smtpd_tls_CAfile = /etc/postfix/smtpd.pem smtpd_tls_loglevel = 1 smtpd_tls_received_header /master.cf文件,去掉以下内容的注释: #smtps inet n – n – – smtpd # -o smtpd_tls_wrappermode=yes # -o smtpd_sasl_auth_enable
home_mailbox = Maildir/ # 第571行: smtpd_banner = $myhostname ESMTP # 添加如下配置到文件末尾# 一封邮件大小限制为10M message_size_limit = 10485760 # 一个邮箱大小限制为1G mailbox_size_limit = 1073741824 # 配置SMTP-Auth采用dovecot的sasl功能 smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination
zimbra/conf/ldap-slm.cf +zimbraMtaSmtpdSenderRestrictions reject_authenticated_sender_login_mismatch 编辑文件smtpd_sender_restrictions 您需要编辑文件opt / zimbra / conf / zmconfigd / smtpd_sender_restrictions.cf并在permit_mynetworks之后添加行reject_sender_login_mismatch vi /opt/zimbra/conf/zmconfigd/smtpd_sender_restrictions.cf 应该是这样的 permit_mynetworks,reject_sender_login_mismatch
地址范围 设置可转发哪些主机的邮件 mynetworks = 127.0.0.0/8 # 419行: 取消注释,邮件保存目录 home_mailbox = Maildir/ # 571行: 添加 smtpd_banner = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname smtpd_recipient_restrictions = permit_mynetworks = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous unknown_local_recipient_reject_code = 550 3、验证测试 添加电子邮箱账号
: ############################CYRUS-SASL############################ broken_sasl_auth_clients = yes smtpd_recipient_restrictions reject_non_fqdn_recipient,reject_unknown_recipient_domain,reject_unauth_pipelining,reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_security_options = noanonymous smtpd_sasl_application_name = smtpd smtpd_banner = Welcome to our $myhostname ESMTP,Warning: Version not Available! #vim /usr/local/lib/sasl2/smtpd.conf(可能是vim /usr/ lib/sasl2/smtpd.conf) 添加如下内容: pwcheck_method: saslauthd
= dovecot' postconf -e 'smtpd_sasl_path = private/auth' postconf -e 'smtpd_sasl_auth_enable = yes' postconf ' postconf -e 'smtpd_use_tls = yes' postconf -e 'smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable smtps inet n - - - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode =yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject
= inet:127.0.0.1:8891 non_smtpd_milters = $smtpd_milters milter_default_action = accept 测试 /var/log/maillog Aug 26 03:02:03 localhost postfix/smtpd[5837]: connect from unknown[155.133.82.144 [5837]: lost connection after AUTH from unknown[155.133.82.144] Aug 26 03:02:04 localhost postfix/smtpd [5837]: disconnect from unknown[155.133.82.144] Aug 26 03:02:09 localhost postfix/smtpd[5837]: connect from unknown[202.130.101.34] Aug 26 03:02:10 localhost postfix/smtpd[5837]: 27EEC802C1C5: client=unknown
############################CYRUS-SASL############################ broken_sasl_auth_clients = yes smtpd_recipient_restrictions reject_non_fqdn_recipient,reject_unknown_recipient_domain,reject_unauth_pipelining,reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_security_options = noanonymous smtpd_sasl_application_name = smtpd smtpd_banner = Welcome to our $myhostname ESMTP,Warning: Version not Available!
/privkey.pem smtpd_use_tls=yes smtpd_tls_auth_only = yes smtp_tls_security_level = may smtpd_tls_security_level = may smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable =yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_reject_unlisted_recipient =yes -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth
取消注释,指定内网和本地的IP地址范围 mynetworks = 127.0.0.0/8# 419行: 取消注释,邮件保存目录 home_mailbox = Maildir/ # 571行: 添加 smtpd_banner 规定邮件最大尺寸为10M message_size_limit = 10485760 # 规定收件箱最大容量为1G mailbox_size_limit = 1073741824 # SMTP认证 smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yessmtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination
2.对于来自于网络的邮件:smtpd进程负责接收来自于网络的邮件,并且进行安全性检测。可以通过UCE(unsolicited commercial email)控制smtpd的行为。 = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated , reject_unauth_destination smtpd_use_tls = yes smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem smtpd_tls_key_file = /etc/pki/dovecot/private/dovecot.pem 配置smtps 部分邮件客户端依赖于使用 465 端口提供加密连接,所以我们修改配置
然后加入如下的配置: # 使用自己的ssl证书 smtpd_tls_cert_file=/etc/letsencrypt/live/test.com/fullchain.pem smtpd_tls_key_file =/etc/letsencrypt/live/test.com/privkey.pem smtpd_use_tls=yes smtpd_tls_auth_only = yes # 使用dovecot来做身份认证 smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions
日志示例: Aug 12 14:01:45 mailserver postfix/smtpd[23891]: NOQUEUE: reject: RCPT from unknown[192.168.1.1 domain.com> to=<victim@domain.com> proto=SMTP helo=<attacker.domain.com> Aug 12 14:02:15 mailserver postfix/smtpd 日志示例: Aug 12 14:10:22 mailserver postfix/smtpd[23891]: warning: unknown[192.168.1.1]: SASL LOGIN authentication failed: authentication failure Aug 12 14:11:01 mailserver postfix/smtpd[23891]: warning: unknown[192.168.1.1
, $mydomain mynetworks = 0.0.0.0/0 //允许接收所有网段发来的邮件,根据情况自行修改 relay_domains =$mydestination 在最后增加 smtpd_banner = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_application_name = smtpd broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination smtpd_client_restrictions = permit_sasl_authenticated 保存退出 service postfix restart 安装cyrus-sasl MECH=shadow 修改 vi /etc/sasl2/smtpd.conf pwcheck_method: saslauthd mech_list: plain login 测试 saslauthd