电子邮件系统概述
收发信服务（Postfix+Dovecot）
SMTP认证控制
#########################################################
一：准备搭建环境
邮件服务器：mail.tarena.com 192.168.4.2
邮件域：@tarena.com
邮件帐号：服务器的系统用户
发信服务软件：postfix
收信服务软件：dovecot
提供DNS域名解析：
[root@redhat6 ~]# yum -y install bind bind-chroot
.. ..
[root@redhat6 ~]# mv /etc/named.conf /etc/named.conf.origin
[root@redhat6 ~]# vim /var/named/chroot/etc/named.conf
.. ..
[root@redhat6 ~]# vim /var/named/chroot/var/named/tarena.com.zone
.. ..
@ IN MX 5 mail.tarena.com.
mail IN A 192.168.4.2
.. ..
[root@redhat6 ~]# service named restart
[root@redhat6 ~]# chkconfig named on
[root@redhat6 named]# host -t MX tarena.com //客户端检查MX记录
tarena.com mail is handled by 5 mail.tarena.com.
二：构建 postfix 发信服务器 【SMTP协议，TCP 25端口】
1. 安装 postfix 软件包
[root@redhat6 ~]# yum -y install postfix
[root@redhat6 ~]# chkconfig postfix on
2. 简化、调整主配置文件，启动 postfix 服务
[root@redhat6 ~]# cd /etc/postfix/
[root@redhat6 postfix]# postconf -n > tmp.txt
[root@redhat6 postfix]# mv main.cf main.cf.origin
[root@redhat6 postfix]# mv tmp.txt main.cf
[root@redhat6 ~]# vim /etc/postfix/main.cf
.. ..
#inet_interfaces = localhost //注释掉此行
myhostname = mail.tarena.com
mydomain = tarena.com //邮件域
myorigin = $mydomain //显示的发件域
mydestination = $mydomain, $myhostname //本地投递域
home_mailbox = Maildir/ //邮箱类型
.. ..
[root@redhat6 ~]# service postfix restart
[root@redhat6 ~]# chkconfig postfix on
[root@redhat6 ~]# netstat -antp | grep :25
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 5927/master
3. 添加电子邮箱账号
[root@redhat6 ~]# useradd nick
[root@redhat6 ~]# echo root | passwd --stdin nick
[root@redhat6 ~]# useradd hunter
[root@redhat6 ~]# echo root | passwd --stdin hunter
4. 使用 telnet 测试发信（nick给hunter）
[root@redhat6 ~]# yum -y install telnet
[root@svr6 ~]# telnet mail.tarena.com 25 //连接邮件服务器的25端口
Trying 192.168.4.5...
Connected to mail.tarena.com (192.168.4.5).
Escape character is '^]'.
220 mail.tarena.com.com ESMTP Postfix
HELO localhost //宣告客户端的主机地址
250 mail.tarena.com.com
MAIL FROM:nick@tarena.com //指定发件人地址
250 2.1.0 Ok
RCPT TO:hunter@tarena.com //指定收件人地址
250 2.1.5 Ok
DATA //表示要开始写邮件内容了
354 End data with<CR><LF>.<CR><LF>
Subject:Test mail 1. //指定邮件标题
No.1 mail document.. .. //输入文本邮件内容
. //独立的 . 表示输入完毕
250 2.0.0 Ok: queued as D4B5131D8B2
quit //断开telnet连接
221 2.0.0 Bye
Connection closed by foreign host.
[root@svr6 ~]#
5. 检查邮件投递结果
[root@redhat6 ~]# ls ~hunter/Maildir/new/ //新邮件列表
1379059530.V802I3ec129M716267.redhat6.tarena.com
[root@redhat6 ~]# cat~hunter/Maildir/new/1379059530.*
.. ..
Subject:Test mail 1.
No.1 mail document.. ..
Message-Id:<20130913080450.1514631DA0B@mail.benet.com>
Date: Fri, 13 Sep 2013 16:04:40 +0800 (CST)
From: nick@tarena.com
三：构建 dovecot 收信服务器 【POP3/IMAP4协议，TCP 110/143端口】
1. 安装 dovecot 软件包
[root@redhat6 ~]# yum -y install dovecot
[root@redhat6 ~]# chkconfig dovecot on
2. 调整 dovecot 服务配置、启动服务
[root@redhat6 ~]# vim /etc/dovecot/conf.d/10-auth.conf
disable_plaintext_auth = no //允许明文认证通信
.. ..
[root@redhat6 ~]# vim /etc/dovecot/conf.d/10-mail.conf
mail_location = maildir:~/Maildir //明确指定邮箱类型及路径
[root@redhat6 ~]# service dovecot restart
[root@redhat6 ~]# netstat -anpt | grep dovecot
tcp 0 0 :::110 :::* LISTEN 12694/dovecot
tcp 0 0 :::143 :::* LISTEN 12694/dovecot
3. 使用 telnet 测试收信（hunter）
[root@svr6 ~]# telnet mail.tarena.com 110 //连接邮件服务器的110端口
Trying 192.168.4.5...
Connected to mail.tarena.com (192.168.4.5).
Escape character is '^]'.
+OK Dovecot ready.
USER hunter //以用户hunter登录
+OK
PASS 1234567 //密码为1234567
+OK Logged in.
LIST //查看邮件列表
+OK 6 messages:
1 451
.
RETR 1 //获取编号为1的邮件
+OK 451 octets
Return-Path: <nick@tarena.com>
X-Original-To: hunter@tarena.com
Delivered-To: hunter@tarena.com
Received: from localhost (svr6.tarena.com[192.168.4.6])
by mail.tarena.com.com (Postfix) with SMTP id D4B5131D8B2
for <hunter@tarena.com>; Tue, 22 Oct 2013 14:58:46 +0800 (CST)
Subject:Test mail 1.
No.1 mail document.. ..
.
QUIT //断开telnet连接
+OK Logging out.
Connection closed by foreign host.
[root@svr6 ~]#
四：实现 SMTP 发信认证
1. 启动 saslauthd 认证服务
[root@redhat6 ~]# yum -y install cyrus-sasl //此包默认通常已安装
[root@redhat6 ~]# service saslauthd start
[root@redhat6 ~]# chkconfig saslauthd on
[root@redhat6 ~]# testsaslauthd -u hunter -p 1234567 -s smtp
0: OK "Success." //检查saslauthd服务
2. 调整 postfix 配置，启用SMTP认证
[root@redhat6 ~]# vim /etc/postfix/main.cf
.. ..
mynetworks = 127.0.0.1 //设置本地网络
smtpd_sasl_auth_enable = yes //启用SASL认证
smtpd_sasl_security_options =noanonymous //阻止匿名发信
smtpd_recipient_restrictions = //设置收件人过滤
permit_mynetworks, permit_sasl_authenticated,
reject_unauth_destination //拒绝向未授权的目标域发信
[root@redhat6 ~]# service postfix restart
3. 测试 SMTP 发信认证
1）以用户nick为例，未经过认证登录时，向外域发邮件会被拒绝
[root@svr6 ~]# telnet mail.tarena.com 25
Trying 192.168.4.5...
Connected to mail.tarena.com (192.168.4.5).
Escape character is '^]'.
220 mail.tarena.com ESMTP Postfix
HELO localhost //宣告本机地址
250 mail.tarena.com
MAIL FROM:nick@tarena.com //指定发件人地址
250 2.1.0 Ok
RCPT TO:TsengYia@126.com //指定收件人地址
454 4.7.1 <TsengYia@126.com>: Relayaccess denied
//发送外域的发信请求被拒绝
quit //断开telnet连接
221 2.0.0 Bye
Connection closed by foreign host.
[root@svr6 ~]#
2）为用户nick为例，生成用户名、密码的加密字串
[root@redhat6 ~]# printf "nick" | openssl base64
bmljaw==
[root@redhat6 ~]# printf "1234567" | openssl base64
MTIzNDU2Nw==
3）认证登录通过以后，才允许向外域发邮件
[root@svr6 ~]# telnet mail.tarena.com 25
Trying 192.168.4.5...
Connected to mail.tarena.com (192.168.4.5).
Escape character is '^]'.
220 mail.tarena.com ESMTP Postfix
EHLO localhost //加密宣告本机地址
250-mail.tarena.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
AUTH LOGIN //声明要执行认证登录
334 VXNlcm5hbWU6
bmljaw== //输入用户名nick的BASE64编码
334 UGFzc3dvcmQ6
MTIzNDU2Nw== //输入密码1234567的BASE64编码
235 2.7.0 Authentication successful
MAIL FROM:nick@tarena.com //指定发件人地址
250 2.1.0 Ok
RCPT TO:TsengYia@126.com //指定收件人地址
250 2.1.5 Ok
DATA //开始编写邮件内容
354 End data with<CR><LF>.<CR><LF>
Subject:SMTP Auth Test //指定邮件标题
Hello, here is a test mail. //输入文本邮件内容
. //独立的 . 表示输入完毕
250 2.0.0 Ok: queued as 8C48431D8B2
quit //断开telnet连接
221 2.0.0 Bye
Connection closed by foreign host.
[root@svr6 ~]#
#########################################################
五：SMTP认证与邮件过滤
1.根据客户端地址进行过滤
清楚main.cf的认证设置
[root@redhat6 ~]# service postfix restart
创建acs策略文件
[root@redhat6 ~]# vim /etc/postfix/acs
192.168.4.1 REJECT
192.168.4.3 OK
建立acs.db访问策略库
[root@redhat6 ~]# postmap /etc/postfix/acs
修改postfix配置文件，启用访问限制
[root@redhat6 ~]# vim /etc/postfix/main.cf
添加
mptd_client_restrictions=check_client_accesshash:/etc/postfix/acs
[root@redhat6 ~]# service postfix restart
验证（192.168.4.1）
首先查看服务器帐号hunter原有的邮件
[root@redhat6 ~]# ls /home/hunter/Maildir/new/
1409086385.V802I48453M880983.redhat6.tarena.com
1409086620.V802I48454M575804.redhat6.tarena.com
然后用192.168.4.1给hunter发邮件
[root@kvmsvr 桌面]# telnet mail.tarena.com 25
Trying 192.168.4.2...
Connected to mail.tarena.com.
Escape character is '^]'.
220 mail.tarena.com ESMTP Postfix
helo localhost
250 mail.tarena.com
mail from:nick@tarena.com
250 2.1.0 Ok
rcpt to:hunter@tarena.com
250 2.1.5 Ok
data
354 End data with<CR><LF>.<CR><LF>
Subject:fsfsfsjljljfsl.
fsjljlsfdjlfjlsjflsjfls...
.
250 2.0.0 Ok: queued as A8F3A83DA4
quit
221 2.0.0 Bye
Connection closed by foreign host.
验证hunter账户是否收到邮件
[root@redhat6 ~]# ls/home/hunter/Maildir/new/
结果显示没有收到邮件，拒绝了192.168.4.1这个地址发的邮件
2.根据发件人地址进行过滤
首先验证再没有限制的时候hunter能够接收nick的发信
[root@redhat6 ~]# ls/home/hunter/Maildir/new/
1409086385.V802I48453M880983.redhat6.tarena.com
1409086620.V802I48454M575804.redhat6.tarena.com
[root@redhat6 ~]# telnet mail.tarena.com 25
Trying 192.168.4.2...
Connected to mail.tarena.com.
Escape character is '^]'.
220 mail.tarena.com ESMTP Postfix
helo localhost
250 mail.tarena.com
mail from:nick@tarena.com
250 2.1.0 Ok
rcpt to:hunter@tarena.com
250 2.1.5 Ok
data
354 End data with<CR><LF>.<CR><LF>
Subjece:woshifengzhankui
lalallalalalalalal....
.
250 2.0.0 Ok: queued as 135CA80D30
quit
221 2.0.0 Bye
Connection closed by foreign host.
[root@redhat6 ~]# ls/home/hunter/Maildir/new/
1409086385.V802I48453M880983.redhat6.tarena.com
1409086620.V802I48454M575804.redhat6.tarena.com
1409127143.V802I48458M766240.redhat6.tarena.com
可见正常情况下hunter能够接收nick的信件
创建策略文件
[root@redhat6 ~]# vim/etc/postfix/sender_access
nick@tarena.com REJECT
生成发送策略库
[root@redhat6 ~]# postmap/etc/postfix/sender_access
[root@redhat6 ~]# vim /etc/postfix/main.cf
添加
smtpd_sender_restrictions=check_sender_accesshash:/etc/postfix/sender_access
[root@redhat6 ~]# service postfix restart
验证
[root@redhat6 ~]# telnet mail.tarena.com 25
Trying 192.168.4.2...
Connected to mail.tarena.com.
Escape character is '^]'.
220 mail.tarena.com ESMTP Postfix
helo localhost
250 mail.tarena.com
mail from:nick@tarena.com
250 2.1.0 Ok
rcpt to:hunter@tarena.com
554 5.7.1 <nick@tarena.com>: Senderaddress rejected: Access denied
由此可此发现nick@tarena.com地址已经被拒绝
