postfix2.10+ssl+dovecot 搭建邮件服务器

老李头运维研习社 2022-11-05

公司最近有项目需要使用邮件服务器，由于现在gmail服务器无法在国内连接，使用其他邮件服务器如163、腾讯、yahoo，无法使用自定义邮箱域名，客户不愿意花钱，所以只能自己搭建邮件服务器。

一般的linux系统都自带sendmail邮件服务，但是sendmail相对性能及使用体验都不是很好，這里选择搭建postfix。废话不多说，开始搭建。

开始搭建

　环境　

系统：centos7.0 core

postfix：2.10

openssl：1.0.0

cyrus-sasl：2.1.26

dovecot：

Domain:iyunwei.cc

hostname:mail.iyunwei.cc

准备工作

将所购买域名的MX记录及TXT记录解析好，注意TXT记录值中的spf，spf格式写不对，发送邮件时会返回554错误，spf格式规则参考：http://www.openspf.org/SPF_Record_Syntax，（对于测试的小伙伴，如果没有域名，可以自己搭建dns服务器）
解析好域名后，利用dig MX yourdomain +short @ns MX值 mail.yourdomain.查看是否解析成功，利用host your.subdomain ns 查看是否解析到你所解析的IP
域名解析如下：

安装Postfix

首先查询是否安装sendmail：rpm -qa |grep sendmail，如果安装，yum remove sendmail
查看是否已经安装postfix：rpm -qa |grep postfix，如果未安装，yum install postfix
安装好后，/etc/postfix/目录是postfix的配置目录，日志目录是/var/log/maillog
postfix主要的配置文件是main.cf，建议在修改之前备份一个原始文件

安装cyrus-sasl

安装cyrus-sasl认证机制
[root@mail postfix]# yum -y install cyrus-sasl-plain cyrus-sasl-devel
加入log_level
[root@mail postfix]# vim /etc/sasl2/smtpd.conf
启动并加入开机启动项
systemctl start saslauthd 启动
systemctl enable saslauthd.service 加入开机启动

安装openssl

安装openssl
[root@mail postfix]# yum -y install openssl openssl-devel
建立密钥与证书存放目录
[root@mail postfix]# mkdir /etc/tls/ -p
生成密钥与证书

a、运行CA.pl命令来生产根证书
./CA -newca
CA certificate filename (or enter to create)
　　直接回车，确认
　　Making CA certificate …
　　Generating a 1024 bit RSA private key
　　++++++
　　……++++++
　　writing new private key to './demoCA/private/cakey.pem'
　　Enter PEM pass phrase:
　　输入ca证书的密码，一定要牢记。
　　Verifying - Enter PEM pass phrase:
　　校验密码
　　-----
　　You are about to be asked to enter information that will be incorporated
　　into your certificate request.
　　What you are about to enter is what is called a Distinguished Name or a DN.
　　There are quite a few fields but you can leave some blank
　　For some fields there will be a default value,
　　If you enter '.', the field will be left blank.
　　-----
　　Country Name (2 letter code) [GB]:
　　输入国家的名字，CN
　　State or Province Name (full name) [Berkshire]:
　　输入省份，hebei
　　Locality Name (eg, city) [Newbury]:
　　输入城市，shijiazhuang
　　Organization Name (eg, company) [My Company Ltd]:
　　输入公司：anymacro
　　Organizational Unit Name (eg, section) []:
　　输入部门：tech
　　Common Name (eg, your name or your server's hostname) []:
　　输入你的名字：admin
　　Email Address []:
　　输入email地址
　　这样，就在demoCA目录下创建了CA的根证书

b、生成一个SMTP服务器用的证书请求
[root@mail misc]# openssl req -new -nodes -keyout mailkey.pem -out mailreg.pem -days 365
　　Generating a 1024 bit RSA private key
　　++++++
　　……++++++
　　writing new private key to 'mailkey.pem'
　　-----
　　You are about to be asked to enter information that will be incorporated
　　into your certificate request.
　　What you are about to enter is what is called a Distinguished Name or a DN.
　　There are quite a few fields but you can leave some blank
　　For some fields there will be a default value,
　　If you enter '.', the field will be left blank.
　　-----
　　Country Name (2 letter code) [GB]:CN
　　State or Province Name (full name) [Berkshire]:shandong
　　Locality Name (eg, city) [Newbury]:jinan
　　Organization Name (eg, company) [My Company Ltd]:test
　　Organizational Unit Name (eg, section) []:tech
　　Common Name (eg, your name or your server's hostname) []:admin
　　Email Address []:admin@test.com
　　Please enter the following 'extra' attributes
　　to be sent with your certificate request
　　A challenge password []:
　　An optional company name []:

c、用mailreg.pem签发SMTP服务器用证书
[root@mail misc]# openssl ca -out mail_signed_cert.pem -infiles mailreg.pem
　　Using configuration from /usr/share/ssl/openssl.cnf
　　Enter pass phrase for ./demoCA/private/cakey.pem:
　　Check that the request matches the signature
　　Signature ok
　　Certificate Details:
　　Serial Number: 1 (0x1)
　　Validity
　　Not Before: Apr 21 13:52:13 2010 GMT
　　Not After : Apr 21 13:52:13 2011 GMT
　　Subject:
　　countryName = CN
　　stateOrProvinceName = shandong
　　organizationName = test
　　organizationalUnitName = tech
　　commonName = admin
　　emailAddress = admin@test.com
　　X509v3 extensions:
　　X509v3 Basic Constraints:
　　CA:FALSE
　　Netscape Comment:
　　OpenSSL Generated Certificate
　　X509v3 Subject Key Identifier:
　　F5:7E:E0:B8:7B:98:63:078:59:B5:89:98:AA:AF:78:F9:45:3F:6C
　　X509v3 Authority Key Identifier:
　　keyid:17:F3:17:64:4A:AE:0C:CE:79:FB:96:24:61:E4:EE:00:40:9D:39:38
　　DirName:/C=CN/ST=shandong/L=jinan/O=anymacro/OU=tech/CN=admin/emailAddress=admin@test.com
　　serial:00
　　Certificate is to be certified until Apr 21 13:52:13 2011 GMT (365 days)
　　Sign the certificate? [y/n]:y
　　1 out of 1 certificate requests certified, commit? [y/n]y
　　Write out database with 1 new entries
　　Data Base Updated
這里如果遇到openssl TXT_DB error number 2 failed to update database错误，修改CA下的index.txt.attr文件，unique_subject = yes改为no，重新生成证书
按要求输入后生成证书文件

4. 设定权限

[root@mail tls]# chmod 0600 privkey.pem

配置Postfix

配置main.cf

vim /etc/postfix/main.cf

#SSL/TSL 配置

smtp_use_tls = yes

smtpd_use_tls = yes

smtp_tls_note_starttls_offer = yes

smtpd_tls_security_level = may

smtpd_tls_loglevel=3

smtpd_tls_session_cache_timeout = 3600s

#smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache

smtpd_tls_cert_file = /etc/postfix/mail_signed_cert.pem

smtpd_tls_key_file = /etc/postfix/mailkey.pem

smtpd_tls_CAfile = /etc/postfix/cacert.pem

smtpd_tls_received_header = yes

#tls_random_source = dev:/dev/urandom

#tls_daemon_random_source = dev:/dev/urandom

smtpd_tls_auth_only = no 强制启用TLS

#SMTP 认证配置

smtpd_sasl_auth_enable = yes

smtpd_sasl_type = cyrus

smtpd_sasl_security_options = noanonymous

broken_sasl_auth_clients = yes

smtpd_sasl_authenticated_header = yes

smtpd_recipient_restrictions =

permit_mynetworks,

permit_sasl_authenticated,

reject_unknown_sender_domain,

reject_unknown_recipient_domain,

reject_unauth_destination

2. 配置master.cf

vim /etc/postfix/master.cf

3. 重启或启动postfix

[root@mail postfix]# systemctl restart postfix

ca证书路径： /etc/pki/tls/misc/

ca证书密码：tripshow

4. 查看监听的端口

netstat -antpl |grep master

本地连上25端口测试

查看已支持TLS

安装配置dovecot

安装doveot
[root@mail postfix]# yum -y install dovecot
[root@mail postfix]# vim /etc/dovecot/conf.d/10-ssl.conf
配置收件目录
[root@mail postfix]# vim /etc/dovecot/conf.d/10-mail.conf
mail_location = maildir:~/Maildir
取消pop3s imaps注释信息
[root@mail postfix]# vim /etc/dovecot/conf.d/10-master.conf

inet_listener imaps {

port = 993

ssl = yes

}

inet_listener pop3s {

port = 995

ssl = yes

}

重新启动dovecot并加入开机列表

[root@mail postfix]# systemctl restart dovecot.service

[root@mail postfix]# systemctl enable dovecot.service

查看监听端口