本文章設定的郵件伺服器, 並不包含郵件過濾功能 , 帳號綁定windows網域 , 連線使用TLS加密連線
紅色的部份需要注意, 此外若出現 kafeiou.pw 請記得取代掉
#郵件過濾功能(mail gateway),請參考此文章
#2011年曾經寫過類似文章當時是CentOS6,應該大同小異
1. 修改 /etc/postfix/main.cf ,
############################################################### myhostname = mail.kafeiou.pw mydestination=/etc/postfix/local-host-names inet_interfaces = all # Enable IPv4, and IPv6 if supported inet_protocols = all mynetworks = 127.0.0.0/8,192.168.1.0/24 queue_directory = /var/spool/postfix mail_owner = postfix command_directory = /usr/sbin daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix unknown_local_recipient_reject_code = 550 home_mailbox = Maildir/ sendmail_path = /usr/sbin/sendmail.postfix newaliases_path = /usr/bin/newaliases.postfix mailq_path = /usr/bin/mailq.postfix setgid_group = postdrop html_directory = no manpage_directory = /usr/share/man ############################################################### smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, smtpd_client_restrictions = permit_sasl_authenticated, smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain ############################################################### message_size_limit = 150600000 mailbox_size_limit = 250600000 virtual_mailbox_limit = 250600000 disable_vrfy_command = yes strict_rfc821_envelopes = yes bounce_queue_lifetime = 1d ############################################################### smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = ############################################################### smtpd_helo_required = yes smtpd_delay_reject = yes smtpd_helo_restrictions = permit_mynetworks, permit ############################################################## virtual_mailbox_domains = /etc/postfix/domains virtual_mailbox_base = /home/vmail virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf # 1001 is id of user "vmail" created in linux virtual_uid_maps = static:1001 virtual_gid_maps = static:1001 virtual_alias_maps = hash:/etc/aliases,ldap:/etc/postfix/ldap-aliases.cf ############################################################## recipient_bcc_maps = hash:/etc/postfix/recipient_bcc sender_bcc_maps = hash:/etc/postfix/sender_bcc #inet_protocols = ipv4 smtpd_tls_security_level = may smtpd_tls_key_file = /etc/letsencrypt/live/mail.kafeiou.pw/privkey.pem smtpd_tls_cert_file = /etc/letsencrypt/live/mail.kafeiou.pw/fullchain.pem # smtpd_tls_CAfile = /etc/pki/tls/root.crt smtpd_tls_loglevel = 1 smtpd_tls_session_cache_timeout = 3600s smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_cache tls_random_source = dev:/dev/urandom tls_random_exchange_name = /var/lib/postfix/prng_exch # 強制使用TLS smtpd_tls_auth_only = yes smtp_use_tls = yes smtpd_use_tls = yes smtp_tls_note_starttls_offer = yes # # Disable SSLv2, SSLv3 # smtpd_tls_protocols = !SSLv2 !SSLv3 smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3 smtp_tls_protocols = !SSLv2 !SSLv3 smtp_tls_mandatory_protocols = !SSLv2 !SSLv3 lmtp_tls_protocols = !SSLv2 !SSLv3 lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3 dovecot_destination_recipient_limit = 1 #performance smtpd_error_sleep_time = 0 default_process_limit = 150 qmgr_message_active_limit = 40000 qmgr_message_recipient_limit = 40000 default_destination_concurrency_limit=100 default_destination_recipient_limit=100 default_process_limit=200 smtp_mx_session_limit=100 smtpd_client_connection_count_limit=100 smtp_destination_concurrency_limit=100 maximal_backoff_time = 1000s minimal_backoff_time = 300s
2. 修改 /etc/postfix/local-host-names , 加上主機名稱
mail.kafeiou.pw
3. 修改 /etc/postfix/domains , 加上網域
kafeiou.pw
4.新增使用者 vmail , 並紀錄該使用者id , 並更新到 main.cf 裡面的id(可參考步驟1)
groupadd vmail -g 1001; useradd vmail -u 1001 -g 1001
5. 綁定網域帳號
裡面的 mail=%s 代表郵件紀錄在網域的mail欄位
vi /etc/postfix/ldap-users.cf
server_host = <主機ip> search_base = ou=taipei,dc=kafeiou,dc=pw version = 3 query_filter = (&(objectclass=*)(mail=%s)) result_attribute = samaccountname #Account from DC result_format = %s/Maildir/ bind = yes bind_dn = cn=ldap,cn=Users,dc=kafeiou,dc=pw bind_pw = <cn=ldap的密碼>
6. 綁定aliases, 網域設定群組
vi /etc/postfix/ldap-aliases.cf
server_host = <主機ip> search_base = ou=aliases,dc=kafeiou,dc=pw #scope = sub query_filter = (memberOf:1.2.840.113556.1.4.1941:=CN=%s,ou=aliases,dc=kafeiou,dc=pw) result_attribute = mail result_format = %s version = 3 bind = yes bind_dn = cn=ldap,cn=Users,dc=kafeiou,dc=pw bind_pw = <cn=ldap的密碼>
7. 取得letsencrypt, 更新步驟1相關的證書
按此連結到本站能找到資源 , 記得輸入guest/guest
8. 設定收發備份
/etc/postfix/recipient_bcc 與 /etc/postfix/sender_bcc
william收發信都會備份到, public , 記得改完套用 postmap /etc/postfix/recipient_bcc 與 /etc/postfix/sender_bcc
william@kafeiou.pw public@kafeiou.pw
9. 設定submission(TLS加密,使用587 port)
vi /etc/postfix/master.cf
submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_reject_unlisted_recipient=no # -o smtpd_client_restrictions=$mua_client_restrictions # -o smtpd_helo_restrictions=$mua_helo_restrictions # -o smtpd_sender_restrictions=$mua_sender_restrictions -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
10, 修改 /etc/sysconfig/saslauthd
# Directory in which to place saslauthd's listening socket, pid file, and so # on. This directory must already exist. SOCKETDIR=/run/saslauthd # Mechanism to use when checking passwords. Run "saslauthd -v" to get a list # of which mechanism your installation was compiled with the ablity to use. #MECH=pam MECH=ldap # Additional flags to pass to saslauthd on the command line. See saslauthd(8) # for the list of accepted flags. FLAGS="-O /etc/postfix/saslauthd.conf -c -r"
11. 修改 /etc/postfix/saslauthd.conf
ldap_servers: ldap://<網域伺服器IP>:389/ ldap_search_base: ou=taipei,dc=kafeiou,dc=pw ldap_auth_method: bind ldap_version: 3 ldap_bind_dn: cn=ldap,cn=Users,dc=kafeiou,dc=pw ldap_bind_pw: <cn=ldap的密碼> ldap_filter: (sAMAccountName=%u) #ldap_filter: (mail=%u)
以上應該就能夠讓smtp 綁定網域, 以及擁有TLS(port 587)功能
接下來 設定dovecot 使用993,995收信
1. 修改/etc/dovecot/conf.d/10-auth.conf
找到 #!include auth-ldap.conf.ext 拿掉 #
2. 修改/etc/dovecot/conf.d/10-mail.conf , 確保設定如下
mail_location = maildir:/home/vmail/%u/Maildir
3. 修改 /etc/dovecot/conf.d/auth-ldap.conf.ext, 確保設定如下
passdb {
driver = ldap
# Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext
args = /etc/dovecot/dovecot-ldap.conf.ext
}
userdb {
driver = static
args = uid=vmail gid=vmail home=/home/vmail/%u/Maildir
}
4. 修改 /etc/dovecot/dovecot-ldap.conf.ext, 確保設定如下
ldap_version = 3 auth_bind = yes # This tells Dovecot to search all entries that fall below the base entry. # If it were set to "onelevel", Dovecot would search only entries one levely. # If it were set to "base", Dovecot would search only the base entry. scope = subtree # If you are referencing and dereferencing aliases, # then you know a lot more about LDAP than I do. deref = never pass_attrs = userPassword=password default_pass_scheme = CRYPT hosts = <網域伺服器IP>:389 base= ou=taipei,dc=kafeiou,dc=pw dn = cn=ldap,cn=users,dc=kfafeiou,dc=pw dnpass = <cn=ldap的密碼> #pass_filter = (&(mail=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_filter = (&(samaccountname=%u)(objectClass=person))
}
5. 修改 /etc/dovecot/conf.d/10-ssl.conf, 確保設定如下
ssl = required ssl_cert = </etc/letsencrypt/live/mail.kafeiou.pw/fullchain.pem ssl_key = </etc/letsencrypt/live/mail.kafeiou.pw/privkey.pem
這樣重啟 dovecot , 與 postfix 服務應該就能進行測試與微調了
在windows建立帳號的時候, 請一律小寫建立 (因為dovecot也一律小寫)