- Kodas: Pasirinkti visus
cyrus-sasl cyrus-sasl-devel cyrus-sasl-gssapi cyrus-sasl-md5 cyrus-sasl-plain postfix
Dabar nustatome SMTP-AUTH ir TLS:
- Kodas: Pasirinkti visus
postconf -e 'smtpd_sasl_local_domain ='
postconf -e 'smtpd_sasl_auth_enable = yes'
postconf -e 'smtpd_sasl_security_options = noanonymous'
postconf -e 'broken_sasl_auth_clients = yes'
postconf -e 'smtpd_sasl_authenticated_header = yes'
postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'
postconf -e 'inet_interfaces = all'
postconf -e 'mynetworks = 127.0.0.0/8'
Pakeičiame /usr/lib/sasl2/smtpd.conf kad postfix leistų PLAIN ir LOGIN prisijungimus (64bit sistemose failas turėtų būti šis - /usr/lib64/sasl2/smtpd.conf). Tai turi atrodyti taip:
- Kodas: Pasirinkti visus
vi /usr/lib/sasl2/smtpd.conf
- Kodas: Pasirinkti visus
pwcheck_method: saslauthd
mech_list: plain login
Poto sukūriame TLS sertifikatus:
- Kodas: Pasirinkti visus
mkdir /etc/postfix/ssl
cd /etc/postfix/ssl/
openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024
- Kodas: Pasirinkti visus
chmod 600 smtpd.key
openssl req -new -key smtpd.key -out smtpd.csr
- Kodas: Pasirinkti visus
openssl x509 -req -days 3650 -in smtpd.csr -signkey smtpd.key -out smtpd.crt
- Kodas: Pasirinkti visus
openssl rsa -in smtpd.key -out smtpd.key.unencrypted
- Kodas: Pasirinkti visus
mv -f smtpd.key.unencrypted smtpd.key
openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650
Toliau nustatome postfix, kad veiktų su TLS:
- Kodas: Pasirinkti visus
postconf -e 'smtpd_tls_auth_only = no'
postconf -e 'smtp_use_tls = yes'
postconf -e 'smtpd_use_tls = yes'
postconf -e 'smtp_tls_note_starttls_offer = yes'
postconf -e 'smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key'
postconf -e 'smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt'
postconf -e 'smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem'
postconf -e 'smtpd_tls_loglevel = 1'
postconf -e 'smtpd_tls_received_header = yes'
postconf -e 'smtpd_tls_session_cache_timeout = 3600s'
postconf -e 'tls_random_source = dev:/dev/urandom'
Tada nustatome "hostname" mūsų postfix instaliacijoje (pakeiskite server1.example.com į jūsų "hostname"):
- Kodas: Pasirinkti visus
postconf -e 'myhostname = server1.example.com'
Po visų nustatymo žingsnių /etc/postfix/main.cf turi atrodyti taip (komentarai panaikinti):
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost
unknown_local_recipient_reject_code = 550
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.5.1/samples
readme_directory = /usr/share/doc/postfix-2.5.1/README_FILES
inet_protocols = all
smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
mynetworks = 127.0.0.0/8
smtpd_tls_auth_only = no
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
myhostname = server1.example.com
Galite paleisti postfix serverį (nepamirškite prieš tai išjungti kitus pašto serverius tokius kaip sendmail)
- Kodas: Pasirinkti visus
chkconfig --levels 235 sendmail off
chkconfig --levels 235 postfix on
chkconfig --levels 235 saslauthd on
chkconfig --levels 235 dovecot on
/etc/init.d/sendmail stop
/etc/init.d/postfix start
/etc/init.d/saslauthd start
/etc/init.d/dovecot start
Kad patikrintumėte ar viskas veikia tvarkingai, paleiskite:
- Kodas: Pasirinkti visus
telnet localhost 25
Kai susijungimas įvyks, įvykdykite šią komandą:
- Kodas: Pasirinkti visus
ehlo localhost
Jei matote eilutes
250-STARTTLS
ir
250-AUTH PLAIN LOGIN
vadinasi viskas tvarkoje.
[root@server1 ssl]# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 server1.example.com ESMTP Postfix
ehlo localhost
250-server1.example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye
Connection closed by foreign host.
[root@server1 ssl]#
Informacija paimta iš http://www.howtoforge.com/perfect-server-fedora9-p5
