RHCE课程-RH253Linux服务器架设笔记八-Postfix服务器配置.docx

RHCE课程-RH253Limx服务器架设笔记八-PoStfiX服务器配置2023-05-1816:24:51标签：1inuxPoStfiXdovecotRHCEmutt版权声明：原创作品，谢绝转载！否则将追究法律贲任。上次我们讲了SendnIail邮件服务器的配置，还有PoP3、imap的配置今日我们第一个任务就是postfix安装PoStfiX(rootaaslerdns*J11antcdroaScrverIcreppostfix-Trr-Xrr1rootroot37297582007-01-19potfiv-2.3.3-2.i3.rpB-r-xr-xr-x1rootroot503872007-01-19postfix-pf!ogsuur-2.3.3-2.i386.ra(rootMslerdns*)rpTth三ntcdroScrverposifix-2.3.3-2.i3S6.rpPrcperi11c."="=nssssxssss""WM3-igg=mw="ss1001ZpOStfiXsssszsssssssssssssssssssassssssxssIOOX(roolaaslcrds*sr-ivhlcdroScrvcrpo*lfix-pf!oj*u三-2.3.3-2.i3S6.rpPrcpi11C.BasBaBsaaBaasasaasBaiusasssassaasaBassassBaa(X)1：potfi-p11OgSUMkUBBBUSBaaBBBBBSBaBBBBBBSBSB8BBBBIHUlUaaaaa100Xj(rootaasIcrdns*,安装完成以后，进入etcpostfix书目修改POSlCX主配置文件main.Cf,现在我们要修改配置文件了，主要修改七个地方第一和其次个是设置主机名和域名第一个须要修改的参数是Hiyhostname,指向真正的域名mydomain参数指向根域文件®<m<i«y）终游标签稚助11lTheByho%tnaParaBCterspecificstheinternethostnaofthis6$naiI*yslca.TbcdefaultIstouseIhcful1)-queliTieddoaainru>ac66bPros(clhoslnnc().Sayhostnancisu»cdasadefaultlucfor»n),>"othercon*gurationparaactcrs.-i* » B)b >trc - 71oil .Bichacl .coa trtuol .<Joentn.t!d The B)domain poranctcr spccifics the local internet domain nac. The default is> to use Syho%tac atnus the first Coaponcnl.4 Ssydosatn is used as o practers.dc<u!l aluc for Rftny other conftguraliontchoclCOB79 。 SEXDIXG MAIL8! 8 Tbc ByorIKtn poranctcrEPCCmCS Ihc doaatn that Iocaa SaiI Appear% to coc fro. The default is to append Si3 *hich t fine for m!1 stlc* If you run a domin号1 Bldyj第三个是设置本机寄出去的邮件所运用的域名或主机名myorigin 和 mydestination 都可以指向 my domain假如你的邮件服务器有ip和干脆域名ip 一样，就可以运用$mydomin,假如不一样最好运用Smyhostnamerootmasterdnszetcpostfl×文件® 维6 M<）务标签鞘助时 *hich ts ftne for SBall sites. If you run a doaain with aulliplc 4 MKhlnC$ you should (1) ChftnaC tht« to Sa)doaain and (2) set up " a <k>Mn-*tdc alia* d«tabase that aliases CACh user Io1 b ucr*thal.users.Sftilbotl.S7 8*'S s For the sake of consistency 、 SOrifin al«o specifies the W) to recipient addresses that 91 between sender and recipient addrc»»es. default doaain nae that is appended have no doBain part.fortgin = Sayhoslnanc>rtgin Sa)doaatn=RECEIXG MMLparatcr specifies the network interfaceIaat1 systca receives eat 1 on. By default.Iall active interfaces on the chtr.r-.Ilh ° practcr also controls dcltvcr> of nnt 1 to u*cr<( tp.a1 J R J I I一 一J s The inet.interfaces .b s addresses that this 8 the softarc clat*% Scc also the prox)_interfaces paraactcr. for nctork 二注 2J Bl1设置postfix监听的接口，这里运用监听全部接口PoStfiX默认只监听本地地址，假如要与外界通信，就须要监听网K的全部IProot®masterdns:文件旧缰短6查看Q）终送标签带勖3仁二Receivixgmail“：8Tbetnel.inlcrfaccspAranclcrspecificsIbcnetworkinterface於addressesthatthist!syslcareceive*Mt1on.Bydefault,atbcsoftareelatesallftclieinterfacesonthena<htnc.The!<>'三paraaelcralsocontrolsde!KeryofsatItoser(ip.address).IOI"10.3Seealsotheprox).interfacesparactcr.fornetworkaddressesthat10'aereforvardedtousvtaaproxyornclorkaddresstranslator.104三I11'三Note：youneedtotopstartPostfixbcnthisparaactcrchanges.106I07inet.interfaces三al",lk=inet_tnterfa<c三Seyho&tnaae!09inet-inlcrfftce*=Sayhoslnanc.!oclbo*t111nct.tnlcrfAces三localhost112sIbcprox>.,interfaceiParaactorSPCUfieSthenctorkinterfaceIL：saddressesthatthissail*ysteareceivesailonbyayofa：】三proxyorncl<>rkaddresstranslationunit.Ihiscttt"<,cxt£r>5115theaddressHstspecifiedwithIbcinet.interfaces116«拉朱掰客肥117»Youa>ustspecifyyourproxy/XATaddresseswhenyour人可以接受的主机名或者域名的邮件,这里只能写自己的主机名和域名，比如写入163,那么给163发送邮件，自己就会收到rootmasterdns:-文件0三tt<<y）终端标签处砧勖包）146»SpccifyaItstofhostordoeatnnoses./ilcnaacorIypcHablc14bpattern%,separatedb)coaaasand/or*httcspacc.Afilcna149三patternisreplacedbyitscontents:atype：tableisBatChedthenIV1三anonenatchc*alookupkey(theright-handsideisignored).ISlContinuelonglinesbyStartIngthenextlineilhhtIcspacc.1321S3«Secalsobe!o.sectioneREJECTlXGMAILFORIXKXOWNLOCALVSERS*.4L=Srh.、r：'nr1aydcstInelion:Seyboslnatc-.!ocathost.SeyJJbtatn.localhost.SaydoMtn)57saydesli11Alion=SayhostnaK.localho&t.St)doaatn.localhost.S)doatn.!38nail.Sa)doaain.Saydonatn.ftp.Saydoaatn15916<'三REJECTINGMAILFORCXKN015LOCALCSERSSSIhclocal.rccipicnl.oapsParaBCkrspecific*optionalIookUPtableswithall11abcsoraddressesofusersthatarclocalvtlhrespecttoSaydcstinalion.Sinet-interfccsorSprox>_inlcrfaces.Ifthisparanclerisdefined,thentheSMTPserveriIP'fIlnlbat1forunknownlocalu&crs.Thisparameteris<kfr,UJ.一播入一技术陆客肿（可转发哪些网络的邮件，一般都只转发信任网络的邮件rootmtterdns:*文件9婚Ie)1«<)穷9KP标空(8)勖244Ulernaliely«>©cmpec>theS)mlorklitb)haMinJ-I'awhichcasePostfixignore*tbc>networkswst>lcsetting.246,J17SpecifynexplicitlistofnctorkxL,kpotlems.wherethe.；fcaMkpectftetthenubc*rofbtt«tnthenctorlpartofbot249Wres250.J'I1ucanlopc<t>tbrbMlutPeQhneXofpatternfileinstead：oflistingIbcpttlermberc.SpeciyIypestablcfortab!e¼a*edlkup>t三(thevalueMtbctabler<hl«Scitnotucd).：，.：1.、/1；-)11ct.rknfc_Jircctor)>networksFnCtgfbk三hath：eU/po«tft¾t>ctork.tab!c4Tbcrcla>wdoaintparAKtcrrestrict*watdestination*this>ystcvillr<la>Milto.Scctbc«StpdaeFcciptent.restricttonsdescriptionin1potlconf(三)fordetailednforMli<m，、R>dcfMlt.h>sl11%reU)Mil：c4-fro*tru*lcdc!tcnt(IPaddrc»»anlcheSiB)nel«ork%)t<s-rounirutted*clientstodcttMto<HthatmtchSrly.doaMbdoMinsthereof,exceptaddrctcsMtbXnderrPCCQCCdr'uF"Vij91日IOgPoStfiX默认将子网内的机器设置为可信任机器，假如只信任本机，就设置为host：mynetworks_style=host配置哪些地址的邮件能够被Postfix转发，当然是mydomain的才能转发，否则其他人都可以用这台邮件服务器转发垃圾邮件了：relay_domains=Smydomain可转发哪些网络域的邮件，这个是函数mydestination,刚才我们设置过mydestination,也就是只转发本地域的邮件，这个是为了防止垃圾邮件的策略root®masterdns:-文件6图错6壹看出）络辫S标签）带助电）_Ia-destinationsthatBatchSvtrlual_aai1box.doain&.9Thesedestination，donotneedtobelistedinSrelAy.doaatn*.27"'一：SpedyaHstofhostsordoaatns.11lcnapatternsortypc：nanc2-8lookuptables,separatedbyCoUaSand/or*hitcspftcc.Continue-79longIinCSbystarlingthenextlinewith«hiIcspacc.fiIenastsreplacedbyitscontents：typc：naactableisBatChCd«bcna281(parent)doaainAppearsas100kUPkey.2829->OTE：Postfix«t11notauloaatica11yforwardnailfordoainsthat>4,listtht*sy*tcBasIbcirprtmryorbackupMXhost.Sccthe-、，pcrait.a.bftckuprestrictiondescriptioninposlconf(三).286Arc!n)_!mt三SejdcklinotJon2S289«(TERXCTORIXTRViET二步nnorelayhostisciven.BailOnanintranet.SPCCirytheThercla)hostporaaclcrspecificsIbCdefaulthosttosendsailto«hcnnoentryisaatcbedtntheoptionaltransport(5)table.IhcntsrouteddirectlytotheOrgantzftttormldosainrwte«internalDXSu&esnoMXrecords,specifythenacof拄米博客Wq基本设置就这么多，然后保存退出由于我们的服务器现在正在运行Sendmail,所以我们要关闭Sendmai1,这样postfix才能正常运行,切忌要运用kill吩咐杀掉Sendmail的进程，因为系统运用的Sendmail来通知系统状态然后启动postfixrootmasterdns:*文件6缜靖®S«<V)终端标签辅助®rootMstcrdns,-Jviactcpostftaain.cfrootaastcrdnsservicescndaatlstatusScndMil(Pid26212599)正在送忏.root*nastcrdns'J三ChkCOnfiC-list|“epSendIBilScndMil0：关闭I：关闭2：启甫3:启用4：启用(root*a%tcrdnschkcon11gscrxJailoffrootaasterdns*jHllall-9sendaailIroOl-ft*ICrdn$*servicescndsfttlstatusSCndnMl已死.但ptd文件仍存(rootAmstcrdns*)Chkconfig-listIgrcpscndaai1scndMil?:关闭I：关闭2：关闭3:关闭4：美碉rool*mstcrdns*Chkconfig-listgrcppostfixrootImstcrdns')chkcon11c-level345postfixon(rootAaa&lerdns*JsChkCOnfig-listICrCPpostfixPOilfixO:关闭l:关闭2：关闭3:宿用4：启用rtaslcrdns-1servicepostfixstart自动posl11x:roolaasterdns*s5:自用6:关闭5:关闭6:关册看看25号端口是不是被master监听起来（IrootmlenM*ncllatr3tIgrcp2SOO0.0.0.0723180.0.0.0s*Lism21Mm<4O0z.o.o.nwO.O.0.Lisrtx7W<一.0.0-USTKX4M3urRe01ZT.0.0.1；3307Lism3X>3p>tboftO。：22:LismO000.0.0eC30.0.0.07Wr*c.>pt>*MSroot-O*terM00.0.0.0:631十0.0.0.012XKd起先测试,给51cto用户发了一封邮件。(rt*ftsterdns*-nail5lctoichAcl.cobSubject:Uslpostfixhello.thisispostfixtest!Ce:(rootaAstcrdnsw我们换成51cto用户接受试试胜利收到邮件启动dovecot服务servicedovecotstartIrWMtCrdM*jscrtccdo%ecotstart口动Doe<otImp(FootMfisterdns*J然后我们运用win下的工具试试,首先修改dns服务器地址测试能不能解析michael解析胜利测试POStfiX服务器25、HO端口工作正常哈打开OUtlOok我们用OUtIOok给root发送邮件试试<RK)邮件内容没有显示，看来是字符编码的问题了，服务器是没问题的，主要是服务器的编码显示不出来,服务器是utf8的编码，WIN2023是gb2312的编码,但是client和client之间是没问题的，假如想在服务器上看邮件，须要修改下字符集也可以运用我们讲过的mutt工具运用mutt可以正常杳看邮件内容哈下面说说postfix的访问限制和别名配置打开etcpostfixaccess文件这个文件的精华就在这里root3msterdns:*_O上面一句是须要加到etcpostfixmain.cf中去，他已经说明。下面一句是client端描述方式tEsmtpd_client_restrictions=check_client_accesshash:etcpostfixaccess这句力到main,cf的最终面我们禁止192.168.8.88运用postfix邮件服务刚才我的outlook是可以收发邮件的,现在我们试试看还可以不修改了access后，须要运用这个吩咐更新数据库postmapetcpostfix/access然后重新启动postfix(rootmUrdn*7/etcpottixc<ct【定1Iroot<n*tcrdn*"potaepctcpoBttxftcccs(rootMatcrdm*Jtcriccpostfixrestart美ft)postfix：13动postfix：(rootMastcrdns*不能发送了«<WM>¾)XJ我们把刚才的设置取消试试rootmsterdns:-文件®<M<D1<y>蜉粼D标签稼勒时9ctto<arcIbeWUBCitbtMexedfilelookups.«EXAMPLEThefollowingcxaaplcue*Anindexedfilc»othatthesorderoftabicentrtCBdoc*notMttcr.TheCxMP1。per- ttacccMbyIbccliental<mMcbl.234ttrejectat!otherclientsinL230/24Insteadofhash!kuptablet,oc)tcMucdb.l%ctheCgMnd*pottconf Ttofindoutthat!kuptablesPostfixsupportsOcl9 >oursytl10 ctcpotftMtn<f：stpdwcllentjeBlrictioncbeek*11ent.(ccshath:/et</postftxcccm/etc/postftacccs:»123REJEcTk23.4OK町%.1M.RMWJECTExecutetbcCQMandpotMp/ctcpotfIxa<cct*ftrreditingtbcfile.BlGSTbctblcf<>rMtdoct>otUMCrlMquotingconventtons.SEEUOpotmp(1)PbBIr1、lookuptableMMger*tpd(8).SMTPcrcrPOBtcoof(三)coo11curlionprMctcrtMsporl(5)vtransport：nexlhop>nlaxREWMEFILES5InLL见山技术博客”9IscepotUoafrcdec.<itr<toryor*poBtc<mfhtl.dire<- tory*tolocatethistnforMlt<M>.®SMTPO.CCESS.REWME.built-inSMTPtenet<<eBcontrol D11BSEJKU>ME.PbBlftx100MPtableOtcrvicv-MA-一定1 陵1roottteNn'J=*iatcpoktftccet(rtaatcrdn'poitaapctcpostfxccc*sIrootMaticrdiM*jwt<r*iccp0*tfixrcirtXWpostfix：口坊postfix：(root*BstcrdtM"正常发送了root用户也正常接收下面的内容是别名列表，这个别名列表和Sendmail的别名列表一样，修改的文件也是一样etcaliases,修改完成运用posaliasetcaliases可以参考Sendmail课程的内容，RHCE课程-RH253Linux服务器架设笔记七-Sendmail服务器配置vimetcaliasespostaliasetcaliases(roolaaterdns*)三viaetcaliaesYouhaeBailinvArApoo!mai1/root(rt*aatcrdn*JspostaltasctcHates(rtaslcrdnsw测试一下(rool*Aslcrdns*smailstuf4ichacl.coaSubject：testaliascssluffok?Ce:(root*«a«terdns尸，michael帐号正常接收(root*aaslcrdns*)ssu-aichftc!(BichaclAMstcrdns'JSBatlMai1version8.16/6/93.Type?forhelp.varspoolMil/aichael*:2esM(es1neIMILER-DAEMOX*m11.bSun3)0315:0213/552,DON'TDaeTETHISMES'>X2rootatlerdn.ichaMonMay1815:5318/675,tcstaliascsstuff,5IniI则1技木除雪叫gOUcssasc2：Froaroot««Mkstcrdns.Btchacl.coaMonMay1815:53:212009X-Orifinal-To:StuffAaichAel.coaDelivercd-To:stuff*tchftc!.cobDate：Mon.18May200915:53:21*0800Fro三:root<rlalerdns.Bichacl.cob>To:StuffAeichoel.coaSubjcct：testalittcssluffok?51ct。帐号正常接收府看配置信息postconf-nrootma$terdns:文件0x«(y)然说标缶鞘勖红)(roolsasterdns*jpostconf-naBtts.databosc=hahsctcaltascsalias.aaps=hash：/ctc/aliascscoaaand.directory三usrsbinconfig-directory三eupo*lfixdceon-dircclory三usrlibcxcc/postfix<Jcbj,pccr-Ievcl2hla!.directory三noinet.inlcrfcc=alla，LOWnCr三postfixailq_path=/usr/bin/aailq.postfixBanPagJdireCIOry«u*rsharc三anB)destination三Sayhostnase.SBydoaatnydosatn=mchac!.coayho%lnBe三aatI.Bichacl.coynetworks三192.168.8.0/24yorigin三Saydoaainncttliftscsj>ath三usrAi1111caHttscs.postfixqueue.directory=varspoolpostfixreadac-direclor)三usrsharedocpostfix-2.3.3REMlE.FILESrclay-doBains三Seydcstinolionsasplc.directory=usrshrcdocposlfix-2.3.3seap!csSend1IJ)Ath三/u&r/sbtn/scndaat1.postfixselgid_(roup三POSldroP«alpd_clicnt_rcslrictions三chcck_cHenl_occcBCunkf>n.locl.rccipientireJcct_codc三550(rtaastcrdnswJs岫坤曲曲#游附耶加#MiChael分割线#耶#押加#耶冲抨Postfix已经基本配置完成，我们须要对邮件的发送进行限制：对于外域到本域的邮件，必需接收，否则，收不到任何来自外部的邮件:对于本域到外域的邮件，只允许从本机发出，否则，其他人通过伪造本域地址就可以向外域发信;对于外域到外域的邮件，干脆拒绝，否则我们的邮件服务器就是OPenRelay,将被视为垃圾邮件服务器。先设置发件人的规则：smtpd_sender_restrictions=permit-三ynetworks,check_sender_accesshash:etcpostfix/sender_access,permit以上规则先推断是否是本域地址，假如是，允许，然后再从SendeJaCCeSS文件里检查发件人是否存在，拒绝存在的发件人，最终允许其他发件人然后设置收件人规则：smtpd_recipient_restrictions=permit_mynetworks,check_recipient_accesshash:etcpostfixrecipient-access,reject以上规则先推断是否是本域地址，假如是，允许，然后再从recipienjaccess文件里检杳收件人是否存在，允许存在的收件人，最终拒绝其他收件人。rootmasterdns:Irootaslcrdn* (rootatcrdns (root*aBtcrdn* 总计320Ittttttttttttt IMt t rooOOOO3OOrOOroorooOOrooroorooOOroorooroo叠务 标釜 VM<h) touch ctcpo*tfi x/scndcr.acccss touch cl<po*tfi x/rcc t picnt-cccs* 11 elcpo*tfix/root 17872 05-18 16:03 access rl 12288 05-18 16:07 access.db root 3550 2006-09-02 bounce.cf.default root i75 2006-09-02 canonical root 9920 2006-09-02 generic root 16838 2006-09-02 Keadejchecks root !1942 2006-09-02 LICENSE root 26994 05-19 !0：l2 aatn.cf tool !798l 2006-09-02 Min.cf.dcull root 958 2006-09-02 akedcfs.out root 4137 2006-09-02 easier.cf root 17639 2006-09-02 postfix-files root 6366 200-09-02 poitf script root 22564 2006-09-02 POZrnSlaIl root 0 0579 10:13 reciptenl _accc、 root 680S 2006-i relocated root 0 05-19 10：>3 »endcr.»cce»s-r-r I root root 1629 3006-09-02 TL5-LICESe-r-rr- I root root 12081 2006-09-02 transport-r-r- 1 root rool 11984 2006-09-02 virtual rootBstcrdns * I刃期隹泰博客啊/etc/postfix/sender_access的内容:michaelREJECTrootmasterdnsz- ×目的是防止其他用户从外部身份发送邮件，但登录到本机再发送则不受影响，因为第一条规则Permitjnynetworks允许本机登录用户发送邮件。etcpostfixrecipient-access的内容：OKOKrootmasterdns:-*文件6僦直g终标蜜也助BichftelAaichael.coaOKSlclotaichacl.cob32.20 金那R*ctcpotfix/re<ipienlacce«*2L.44C因此，外域只能发送给以上两个Email地址，其他任何地址都将被拒绝。但本机到本机发送不受影响。最终用postmap生成hash格式的文件:#postmapsender_access#postmaprecipient_accessrootmasterdns:文件0缭161&终端标答本助3Iroolastcrdns'viactcpostfix/rcciptent.access(rootAaatlcrdns'spostaapctcpostftxkcndcr-acccs*(root*AStcrdn*postaapctcpostfixrccipicnt.*cccss(rootatcrdnssservicepostfixrestart关闭postfix:定启动PoZ门X：.立定rootaasterdns产发送正常V!