Postfix 是一种电子邮件服务器,它是由任职于IBM华生研究中心 (T.J. Watson Research Center) 的荷兰籍研究员Wietse Venema为了改良sendmail邮件服务器而产生的.最早在1990年代晚期出现,是一个开放源代码的软件.
Postfix 是Wietse Venema在IBM的GPL协议之下开发的MTA(邮件传输代理)软件.postfix是Wietse Venema想要为使用最广泛的sendmail提供替代品的一个尝试,在Internet世界中,大部分的电子邮件都是通过sendmail来投递的,大约有100万用户使用sendmail,每天投递上亿封邮件.这真是一个让人吃惊的数字,Postfix试图更快、更容易管理、更安全,同时还与sendmail保持足够的兼容性.
生活中常用的邮件服务器
Sendmail: 资格最古老,运行稳定,但安全性欠佳.
Postfix: 采用模块化设计,在投递效率、稳定性、性能及安全性方面表现优秀,与sendmail保持足够的兼容性.
Qmail: 采用模块化设计,速度快、执行效率高,配置稍微复杂点.
Outook：是一个客户端代理.
FoxMail：也是客户端代理.
PostFix的特点
1.PostFix是免费,开源的,并且兼容sendmail
2.性能好,大约比sendmail快三倍,一台运行postfix的台式pc每天可收发上百万邮件.
3.安全性,PostFix具有多层防御结构,可以有效地抵御恶意入侵者,可以运行在较低的权限之下.
4.灵活性好,postfix是由超过一打的小程序组成的,每个程序完成特定功能.可以通过配置设置每个程序的运行参数.
5.健壮稳定,postfix被设计成在重负荷之下仍然可以正常工作.当系统运行超出了可用的内存或磁盘空间时,postfix会自动减少运行进程的数目.当处理的邮件数目增长时,Postfix运行的进程不会跟着增加.
PostFix工作流程图解
1.客户端通过Outlook或网页客户端软件，向邮件服务器发送一封邮件,首先邮件服务器会检查是发往本域,还是发往其他域.
2.如果发送到本域直接存放到Mailbox中,另外一个用户上线,需要收取这封邮件,借助dovecot软件,通过dovecot进入数据库验证身份,验证通过以后,就可以通过MRA调用POP3或者IMAP4的协议,进入邮箱收取邮件,并且将邮件转发给用户.
3.如果发送到其他域,转发之前验证用户身份,是否要为其转发邮件,验证的时候是用到了SASL函数库,用户的信息是放到了数据库中,此时我们需要一个中间层authlib,通过authlib替SASL函数库向数据库进行验证,做"发信认证",认证通过允许转发,验证不通过拒绝转发.
4.通过浏览器访问邮件服务器(EXtmall/FoxMali),转发到其他域,放到邮箱,到数据库验证.
关于邮件系统中的角色
MUA：邮件用户代理 (sendmail qmail postfix)
MTA：邮件传输代理 (outlook)
MDA：邮件分发代理 (maildrop)
MRA：邮件检索代理 (dovecot)
postfix: 实现邮件发送服务器的角色.
dovecot: 作为邮件接收服务器的角色.
extmail: 实现利用web界面收发信件.
extman: 用户注册同个extman的页面.
mysql: 存放用户的账户信息.
cyrus-sasl,courier-authlib: 实现用户的身份验证.
邮件应用使用协议
1.SMTP,简单邮件传输协议,TCP 25端口,加密时使用TCP 465端口,(发送邮件),客户端向其他服务器发送邮件或者服务器向其他服务器转发邮件,发送方使用的都是SMTP协议.
2.POP3,第3版邮局协议,TCP 110端口,加密时使用TCP 995端口,(收邮件) 收取邮件的时候,先将服务器的邮件下载到本地,所有的操作都是在本地完成.
3.IMAP4,第4版互联网消息访问协议,TCP 143端口,加密时使用 993端口,(比POP3灵活)接收邮件,客户端和服务器端交互了以后,在服务器端处理,好处能实现更多的功能,例如查看邮件的信息,但是消耗的系统的资越高.
面试技巧
SMTP 简单邮件传输协议（发邮件）TCP 25端口，加密时使用TCP 465端口
POP3 第三版邮局协议（收邮件）TCP 110 端口，加密时使用 TCP 995端口
IMAP4 第四版互联网邮件访问协议（收邮件）TCP 143端口，加密时使用TCP 993端口
配置DNS域名解析
首先我们需要配置bind为客户端提供dns域名解析
1.安装bind,为客户提供解析服务
[root@localhost ~]# yum install -y bind Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Server 00:00:00 Resolving Dependencies --> Running transaction check ---> Package bind.x86_64 32:9.9.4-61.el7 will be installed --> Processing Dependency: bind-libs = 32:9.9.4-61.el7 ...... Installed: bind.x86_64 32:9.9.4-61.el7 Dependency Installed: bind-libs.x86_64 32:9.9.4-61.el7 Complete! [root@localhost ~]#
2.修改dns主配置文件,区域文件和域名配置文件等
[root@localhost ~]# vim /etc/named.conf
12 options {
13 listen-on port 53 { any; }; #修改IPV4的侦听端口
14 listen-on-v6 port 53 { ::any; }; #修改IPV6的侦听端口
15 directory "/var/named";
16 dump-file "/var/named/data/cache_dump.db";
17 statistics-file "/var/named/data/named_stats.txt";
18 memstatistics-file "/var/named/data/named_mem_stats.txt";
19 allow-query { any; }; #允许迭代
20
21 /*
3.修改named.rfc1912.zones区域配置文件,或者写在named.conf的底部也可以
[root@localhost ~]# vim /etc/named.rfc1912.zones
42
43 zone "lyshark.com" IN { #添加此处区域文件
44 type master; #声明为主dns
45 file "lyshark.com.zone"; #声明区域配置文件名称
46 allow-update {none;}; #是否迭代
47 };
4.拷贝默认区域配置文件,修改成lyshark.com.zone并做邮件交换记录配置
[root@localhost ~]# cd /var/named/ [root@localhost named]# [root@localhost named]# ls data dynamic named.ca named.empty named.localhost named.loopback slaves [root@localhost named]# [root@localhost named]# cp -a named.localhost lyshark.com.zone [root@localhost named]# [root@localhost named]# ls data dynamic lyshark.com.zone named.ca named.empty named.localhost named.loopback slaves [root@localhost named]# [root@localhost named]# vim lyshark.com.zone 1 $TTL 1D 2 @ IN SOA dns.lyshark.com. root.lyshark.com. ( 3 0 ; serial 4 1D ; refresh 5 1H ; retry 6 1W ; expire 7 3H ) ; minimum 8 NS dns.lyshark.com. 9 MX 3 mail.lyshark.com. 10 dns A 127.0.0.1 11 mail A 192.168.1.20 12 AAAA ::1
5.重启named解析服务,并设置成开机自启动
[root@localhost named]# systemctl restart named [root@localhost named]# systemctl enable named
6.此处在其他电脑配置好,dns解析地址,解析到本机,并测试是否能解析
C:\Users\LyShark>ping 192.168.1.20
正在 Ping 192.168.1.20 具有 32 字节的数据:
来自 192.168.1.20 的回复: 字节=32 时间<1ms TTL=64
C:\Users\LyShark>nslookup mail.lyshark.com
服务器: UnKnown
Address: 192.168.1.20
名称: mail.lyshark.com
Addresses: ::1
192.168.1.20
C:\Users\LyShark>
配置PostFix服务程序
postfix是由IBM赞助研发的一款免费开源的电子邮件服务程序,它能够很好的兼容sendmail,可以很方便的将sendmail用户迁移到postfix服务上,postfix服务的收发邮件能力强于sendmail,而且能够自动,增加,减少进程的数量来保证邮件服务器的高性能运转,postfix有许多小模块组成,方便了功能的添加,拓展和删除,提高了可用性,用户可以灵活搭配使用.
1.安装postfix服务程序,rhel7系统默认集成,这里只做演示
[root@localhost ~]# yum install -y postfix Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 2:postfix-2.10.1-6.el7.x86_64 already installed and latest version Nothing to do
2.配置邮局系统的主机名,在第76行,一个名为myhostname的变量,用来保存服务器主机名
[root@localhost ~]# vim /etc/postfix/main.cf 68 # INTERNET HOST AND DOMAIN NAMES 69 # 70 # The myhostname parameter specifies the internet hostname of this 71 # mail system. The default is to use the fully-qualified domain name 72 # from gethostname(). $myhostname is used as a default value for many 73 # other configuration parameters. 74 # 75 #myhostname = host.domain.tld 76 myhostname = mail.lyshark.com #解除注释,定义服务器主机名 77
3.配置邮局系统的域名,在第83行,一个名为mydomain的变量,用来定义邮件域
[root@localhost ~]# vim /etc/postfix/main.cf 78 # The mydomain parameter specifies the local internet domain name. 79 # The default is to use $myhostname minus the first component. 80 # $mydomain is used as a default value for many other configuration 81 # parameters. 82 # 83 mydomain = lyshark.com #解除注释,指定邮件域 84
4.配置本机发出的域名称,在第99行,一个名为myorigin的变量,用来定义邮件域
[root@localhost ~]# vim /etc/postfix/main.cf 94 # For the sake of consistency between sender and recipient addresses, 95 # myorigin also specifies the default domain name that is appended 96 # to recipient addresses that have no @domain part. 97 # 98 myorigin = $myhostname #解除注释,设置允许发信的用户的邮件域 99 myorigin = $mydomain #解除注释,例：admin@lyshark.com 100
5.配置侦听网卡接口,在第116行,一个名为inet_interfaces的变量,用来定义网卡接口
[root@localhost ~]# vim /etc/postfix/main.cf 108 # See also the proxy_interfaces parameter, for network addresses that 109 # are forwarded to us via a proxy or network address translator. 110 # 111 # Note: you need to stop/start Postfix when this parameter changes. 112 # 113 inet_interfaces = all #解除注释,设置所有IP都提供邮件服务 114 #inet_interfaces = $myhostname 115 #inet_interfaces = $myhostname, localhost 116 #inet_interfaces = localhost #注释掉 117
6.配置接收邮件的主机名或域名,在第164行,一个名为mydestination的变量,用来定义可接收邮件的主机名或域名列表,这里可以直接调用前面的两个变量myhostname和mydomain变量(如果不想调用变量,也可直接调用变量中的值)
[root@localhost ~]# vim /etc/postfix/main.cf 156 # Specify a list of host or domain names, /file/name or type:table 157 # patterns, separated by commas and/or whitespace. A /file/name 158 # pattern is replaced by its contents; a type:table is matched when 159 # a name matches a lookup key (the right-hand side is ignored). 160 # Continue long lines by starting the next line with whitespace. 161 # 162 # See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS". 163 # 164 #mydestination = $myhostname, localhost.$mydomain, localhost #注释掉,设置取出那些邮件 165 mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain #解除注释 166 #mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, 167 # mail.$mydomain, www.$mydomain, ftp.$mydomain
7.配置邮件存储位置,在第619行,一个名为home_mailbox的变量,用来定义邮件保存位置
[root@localhost ~]# vim /etc/postfix/main.cf 413 # The home_mailbox parameter specifies the optional pathname of a 414 # mailbox file relative to a user's home directory. The default 415 # mailbox file is /var/spool/mail/user or /var/mail/user. Specify 416 # "Maildir/" for qmail-style delivery (the / is required). 417 # 418 #home_mailbox = Mailbox 419 home_mailbox = Maildir/ #解除注释 420
8.最后,创建一个邮件测试账号admin,重启postfix服务,并设置成开机自启动
[root@localhost ~]# useradd -s /sbin/nologin admin [root@localhost ~]# passwd admin Changing password for user admin. New password: BAD PASSWORD: The password is shorter than 8 characters Retype new password: passwd: all authentication tokens updated successfully. [root@localhost ~]# [root@localhost ~]# systemctl restart postfix [root@localhost ~]# systemctl enable postfix
配置Dovecot服务程序
dovecot是一款能够为linux系统提供IMAP和POP3电子邮件服务的开源服务程序,安全性极高,配置简单,执行效率高,而且占用服务器资源极低,是一款很好的收件服务器.
1.通过yum安装dovecot服务程序的软件包,和依赖
[root@localhost ~]# yum install -y dovecot dovecot-devel clucene-core Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager . Package 1:dovecot-2.2.10-8.el7.x86_64 already installed and latest version Package clucene-core-2.3.3.4-11.el7.x86_64 already installed and latest version Nothing to do
2.配置dovecot服务,在第24行,把服务的电子邮件协议改为 imap,pop3和lmtp,在这一行下面添加 disable_plaintext_auth 允许用户明文使用邮件系统.
[root@localhost ~]# vim /etc/dovecot/dovecot.conf
16 # Default values are shown for each setting, it's not required to uncomment
17 # those. These are exceptions to this though: No sections (e.g. namespace {})
18 # or plugin settings are added by default, they're listed only as examples.
19 # Paths are also just examples with the real defaults being based on configure
20 # options. The paths listed here are for configure --prefix=/usr
21 # --sysconfdir=/etc --localstatedir=/var
22
23 # Protocols we want to be serving.
24 protocols = imap pop3 lmtp #取消注释,开启验证类型
25 disable_plaintext_auth = no #添加字段,开启允许使用明文传输
3.配置允许登陆的网段,在第48行,设置允许来自于指定网段的主机使用,如果想任何人则无需修改本参数
[root@localhost ~]# vim /etc/dovecot/dovecot.conf 45 # Space separated list of trusted network ranges. Connections from these 46 # IPs are allowed to override their IP addresses and ports (for logging and 47 # for authentication checks). disable_plaintext_auth is also ignored for 48 # these networks. Typically you'd specify your IMAP proxy servers here. 49 login_trusted_networks = 192.168.1.0/24 #允许指定网段使用,屏蔽掉默认all 50
4.配置邮箱位置,子配置文件中,在第24行
[root@localhost ~]# vim /etc/dovecot/conf.d/10-mail.conf 22 # See doc/wiki/Variables.txt for full list. Some examples: 23 # 24 mail_location = maildir:~/Maildir #解除注释 25 # mail_location = mbox:~/mail:INBOX=/var/mail/%u 26 # mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n
5.重启收件服务器,并设置开机自启动
[root@localhost ~]# systemctl restart dovecot [root@localhost ~]# systemctl enable dovecot
配置SSL加密传输
由于上面的过程配置的邮件服务器使用的是明文传输,无法将其用于生产环境,下面的步骤将开启邮件服务器的SSL加密模式,让其可以在生产环境中使用
1.生成SSL密钥文件,并自行放入合适的位置
[root@localhost ~]# openssl genrsa -des3 -out server.key 1024 [root@localhost ~]# openssl req -new -key server.key -out server.csr [root@localhost ~]# openssl x509 -req -days 365 -sha256 -in server.csr -signkey server.key -out servernew.crt [root@localhost ~]# ls server.csr server.key servernew.crt [root@localhost ~]# cp -a * /etc/pki/CA/certs/ [root@localhost ~]# ls /etc/pki/CA/certs/ server.csr server.key servernew.crt
2.修改PostFix配置文件,在文件中修改以下几个位置,启用SSL加密参数
[root@localhost ~]# vim /etc/postfix/main.cf 681 # SSL CRT 添加如下配置到末尾 682 683 smtpd_use_tls = yes 684 smtpd_tls_cert_file = /etc/pki/CA/certs/servernew.crt 685 smtpd_tls_key_file = /etc/pki/CA/certs/server.key 686 smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_scache [root@localhost ~]# vim /etc/postfix/master.cf 25 # -o milter_macro_daemon_name=ORIGINATING 26 smtps inet n - n - - smtpd 27 # -o syslog_name=postfix/smtps 28 -o smtpd_tls_wrappermode=yes
3.接着修改dovecot额配置文件,指定开启SSL模式,并指定证书位置.
[root@localhost ~]# vim /etc/dovecot/conf.d/10-ssl.conf 5 # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt> 6 # disable plain pop3 and imap, allowed are only pop3+TLS, pop3s, imap+TLS and imaps 7 # plain imap and pop3 are still allowed for local connections 8 ssl = yes 9 10 # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before 11 # dropping root privileges, so keep the key file unreadable by anyone but 12 # root. Included doc/mkcert.sh can be used to easily generate self-signed 13 # certificate, just make sure to update the domains in dovecot-openssl.cnf 14 ssl_cert = </etc/pki/CA/certs/dovecot.pem 15 ssl_key = </etc/pki/CA/private/dovecot.pem
4.重启PostFix和Dovecot服务,并设置开机自启动.
[root@localhost ~]# systemctl restart postfix [root@localhost ~]# systemctl restart dovecot [root@localhost ~]# systemctl enable postfix [root@localhost ~]# systemctl enable dovecot
5.如果iptables在开启状态,那么设置iptables开放SMTPS/POP3S/IMAPS的端口.
[root@localhost ~]# iptables -I INPUT 1 -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT [root@localhost ~]# iptables -I INPUT 2 -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT [root@localhost ~]# iptables -I INPUT 3 -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT