標籤: centos

CentOS 7 安裝postfix郵件伺服器簡易步驟

技術
本文章設定的郵件伺服器, 並不包含郵件過濾功能 , 帳號綁定windows網域 , 連線使用TLS加密連線

紅色的部份需要注意, 此外若出現 kafeiou.pw 請記得取代掉

#郵件過濾功能(mail gateway),請參考此文章

#2011年曾經寫過類似文章當時是CentOS6,應該大同小異

1. 修改 /etc/postfix/main.cf ,

###############################################################
myhostname = mail.kafeiou.pw
mydestination=/etc/postfix/local-host-names
inet_interfaces = all
# Enable IPv4, and IPv6 if supported
inet_protocols = all
mynetworks = 127.0.0.0/8,192.168.1.0/24
queue_directory = /var/spool/postfix
mail_owner = postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
unknown_local_recipient_reject_code = 550
home_mailbox = Maildir/
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man

###############################################################
smtpd_recipient_restrictions =
 permit_mynetworks,
 permit_sasl_authenticated,
 reject_non_fqdn_hostname,
 reject_non_fqdn_recipient,
 reject_unknown_sender_domain,
 reject_unknown_recipient_domain,
 reject_unauth_destination,

smtpd_client_restrictions =
 permit_sasl_authenticated,

smtpd_sender_restrictions =
 permit_mynetworks,
 reject_non_fqdn_sender,
 reject_unknown_sender_domain

###############################################################
message_size_limit = 150600000
mailbox_size_limit = 250600000
virtual_mailbox_limit = 250600000
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
bounce_queue_lifetime = 1d
###############################################################
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
###############################################################
smtpd_helo_required = yes
smtpd_delay_reject = yes
smtpd_helo_restrictions =
 permit_mynetworks,
 permit
##############################################################
virtual_mailbox_domains =  /etc/postfix/domains
virtual_mailbox_base = /home/vmail
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf
# 1001 is id of user  "vmail" created in linux
virtual_uid_maps = static:1001
virtual_gid_maps = static:1001
virtual_alias_maps = hash:/etc/aliases,ldap:/etc/postfix/ldap-aliases.cf
##############################################################
recipient_bcc_maps = hash:/etc/postfix/recipient_bcc
sender_bcc_maps = hash:/etc/postfix/sender_bcc
#inet_protocols = ipv4
smtpd_tls_security_level = may
smtpd_tls_key_file = /etc/letsencrypt/live/mail.kafeiou.pw/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.kafeiou.pw/fullchain.pem
# smtpd_tls_CAfile = /etc/pki/tls/root.crt
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_cache
tls_random_source = dev:/dev/urandom
tls_random_exchange_name = /var/lib/postfix/prng_exch

# 強制使用TLS
smtpd_tls_auth_only = yes
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes

#
# Disable SSLv2, SSLv3
#
smtpd_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_protocols = !SSLv2 !SSLv3
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
lmtp_tls_protocols = !SSLv2 !SSLv3
lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3

dovecot_destination_recipient_limit = 1

#performance
smtpd_error_sleep_time = 0
default_process_limit = 150
qmgr_message_active_limit = 40000
qmgr_message_recipient_limit = 40000
default_destination_concurrency_limit=100
default_destination_recipient_limit=100
default_process_limit=200
smtp_mx_session_limit=100
smtpd_client_connection_count_limit=100
smtp_destination_concurrency_limit=100
maximal_backoff_time = 1000s
minimal_backoff_time = 300s

2. 修改 /etc/postfix/local-host-names , 加上主機名稱 

mail.kafeiou.pw

3. 修改  /etc/postfix/domains , 加上網域

kafeiou.pw

4.新增使用者 vmail , 並紀錄該使用者id , 並更新到 main.cf 裡面的id(可參考步驟1)

useradd vmail

5. 綁定網域帳號

裡面的 mail=%s 代表郵件紀錄在網域的mail欄位

vi /etc/postfix/ldap-users.cf

server_host = <主機ip>
search_base = ou=taipei,dc=kafeiou,dc=pw
version = 3
query_filter = (&(objectclass=*)(mail=%s))
result_attribute = samaccountname  #Account from DC
result_format = %s/Maildir/
bind = yes
bind_dn = cn=ldap,cn=Users,dc=kafeiou,dc=pw
bind_pw = <cn=ldap的密碼>

6. 綁定aliases, 網域設定群組

vi /etc/postfix/ldap-aliases.cf

server_host = <主機ip>
search_base = ou=aliases,dc=kafeiou,dc=pw
#scope = sub
query_filter = (memberOf:1.2.840.113556.1.4.1941:=CN=%s,ou=aliases,dc=kafeiou,dc=pw)
result_attribute = mail
result_format = %s
version = 3
bind = yes
bind_dn = cn=ldap,cn=Users,dc=kafeiou,dc=pw
bind_pw = <cn=ldap的密碼>

7. 取得letsencrypt, 更新步驟1相關的證書

按此連結到本站能找到資源 , 記得輸入guest/guest

8. 設定收發備份

/etc/postfix/recipient_bcc  與  /etc/postfix/sender_bcc

william收發信都會備份到, public , 記得改完套用 postmap /etc/postfix/recipient_bcc  與  /etc/postfix/sender_bcc

william@kafeiou.pw  public@kafeiou.pw

9. 設定submission(TLS加密,使用587 port)

vi /etc/postfix/master.cf

submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

10, 修改 /etc/sysconfig/saslauthd

# Directory in which to place saslauthd's listening socket, pid file, and so
# on.  This directory must already exist.
SOCKETDIR=/run/saslauthd

# Mechanism to use when checking passwords.  Run "saslauthd -v" to get a list
# of which mechanism your installation was compiled with the ablity to use.
#MECH=pam
MECH=ldap

# Additional flags to pass to saslauthd on the command line.  See saslauthd(8)
# for the list of accepted flags.
FLAGS="-O /etc/postfix/saslauthd.conf -c -r"

11. 修改 /etc/postfix/saslauthd.conf

ldap_servers: ldap://<網域伺服器IP>:389/
ldap_search_base: ou=taipei,dc=kafeiou,dc=pw
ldap_auth_method: bind
ldap_version: 3
ldap_bind_dn: cn=ldap,cn=Users,dc=kafeiou,dc=pw
ldap_bind_pw: <cn=ldap的密碼>
ldap_filter: (sAMAccountName=%u)
#ldap_filter: (mail=%u)

以上應該就能夠讓smtp 綁定網域, 以及擁有TLS(port 587)功能

» Read more

Leave a comment , , , ,

linux防毒軟體clamav啟用google Safe Browsing

技術

偶的郵件伺服器使用postfix + amavisd-new+clamav

最近很不好意思的發現 clamav 很早以前就支援google Safe Browsing , 除了防毒外,還可以過濾掉一些不正當的連結, 作法如下:

1. 修改/etc/freshclam.conf  , 加上:

SafeBrowsing yes

2. 重啟clamav service, 或是postfix 透過amavisd不需要重啟service, 只要執行freshclam這個指令即可

Leave a comment , , , ,

安裝於linux的oracle 11g , 如何設定instance啟用方式

技術

oracle 11g是很久的資料庫, 當時是配合鼎新tiptop 5.1 GP版本安裝, 安裝於centos 5.5 final ,
tiptop系統分成topprod, topstd , 與toptest , 但是到最後很少用到 topstd與toptest,

所以可以預設停用這兩個用不到的instance,

我們可以修改 /etc/oratab 這個檔案, 長得如下:

toptest:/u2/oracle/product/11.2.0/db_1:Y
topstd:/u2/oracle/product/11.2.0/db_1:Y
topprod:/u2/oracle/product/11.2.0/db_1:Y

請停掉database後, 把Y改成N, 以後重啟就不會啟動用不到的instance

Leave a comment , , ,

esxi轉centos 5 到pve失敗,出現 mount could not find system /dev/root

技術

咖啡偶最近進行一系列從esxi轉到pve的工作, 其中出現轉CentOS 5這種老舊vm失敗的狀況, 錯誤如下:

Unable to access resume device (LABEL=SWAP-hda3)

mount: could not find filesystem ‘/dev/root’

測試過很多方式, 例如改ide, sata, scsi 等方式都不行,  最後終於找到重建開機程序 initrd 的方式解決,

解決方式如下:

  1. 下載相對應大版本OS , Centos 5.x 都可以
  2. 掛載 Centos 5開機片開機, 輸入 linux rescue(救援模式)
  3. 輸入 chroot /mnt/sysimage 讓系統暫時恢復成原系統的狀態
  4. 刪除/boot/initrd-xxx.img 開機檔案 xxx代表原系統開機時的版本號碼
  5. 查詢一下 /lib/module 是否有xxx版本號碼
  6. 重建開機檔案  mkinitrd /boot/initrd-xxx.img   xxx
  7. 重開機, 卸載Centos 5開機片, ,改由原系統開機測試是否能成功
Leave a comment , , , ,

openfire企業內部即時通訊

技術

若公司內部的訊息溝通, 須要考量資訊安全, 通常建議安裝一套企業內部即時通訊軟體,

在這裡介紹一款偶用了至少10以上的老牌開源即時通訊伺服器 - openfire

openfire支援XMPP標準通訊協定, 支援linux , window , 與 mac , 安裝也非常簡便,

能支援AD (LDAP) , 只要搭配支援 XMPP 的用戶端軟體 如 pidgin(洋涇浜) , jitsi desktop(神燈巨人) , 與 spark

咖啡偶在此強烈建議用戶端使用 jitsi desktop , 能撥打電話, 進行視訊會議, 或是分享桌面給IT人員, 非常適合小公司使用,

例如兩岸三地需要視訊會議(又不想使用 wechat , skype , line ) , 就可以自架設openfire + jitsti, 再 加上適當的攝像頭, 高感度麥克風, 就能輕鬆完成視訊需求.











 ,  








			

		

		
		
			
				Leave a comment			

				
					, , , , 				

			


	
		
	

		
		
CentOS 7.6(1810)更新遇到polkit的錯誤
		
		
 
	
		技術	



	
		

			
		
					

			
CentOS 7安裝完畢, 通常會再安裝EPEL, 然後再一起更新


yum install epel-release


但更新的時候遇到polkit這個錯誤


http://ftp.tc.edu.tw/Linux/CentOS/7.6.1810/updates/x86_64/Packages/polkit-0.112-18.el7_6.1.x86_64.rpm: [Errno 14] HTTP Error 416 - Requested Range Not SatisfiableA 
Trying other mirror.



我想說直接下載rpm安裝,但是遇到衝突


從 polkit-0.112-18.el7_6.1.x86_64 安裝的檔案 /usr/bin/pkaction 與來自套件 polkit-0.112-18.el7.x86_64 的檔案產生衝突


原來已經有安裝了, 所以到最後解法就是更新的時候, 要避開polkit這個套件


yum update --exclude=polkit


就能正確更新了








			

		

		
		
			
				Leave a comment			

				
									

			


	
		
			
	

		
		
CentOS 如何找出符合所有含有特定內容檔案,然後刪除掉
		
		
 
	
		技術	



	
		

			
		
					

			
找了好久, 都有效率不彰的問題, 最後試出來 locate 這指令很快, 以下是shell scripts:


#!/bin/bash

# 找出/home/vmail目錄以下所有含有1552047的檔案名稱,再過濾裡面是否有 5o6n6K+J6LWW55Cm54+K77yB 字串 
list=`locate /home/vmail 15520479 | grep -lr "5o6n6K+J6LWW55Cm54+K77yB" . 2>/dev/null`

if [[ -z "$list" ]]; then
  echo "No files matched, nothing to be done...";
  exit
fi

# delete files one by one
for match in $list
do
    echo "Removing matched file $match..."
    echo `rm $match`
    echo `updatedb`
done

echo "...done."









			

		

		
		
			
				Leave a comment			

				
					, 				

			


	
		
	
			  

					1
2
3
4