[postfix] Problem Z Konfiguracja Smtp I Pop3

[seawolf]

Witam!

 

Tak jak w temacie... Mam problem z konfiguracja Postfiksa. Może na początku zaczne od SMTP.

 

Postawiłem serwer pocztowy na POSTFIX. Chcę aby pocztę można było wysyłać z każdego IP, a nie tylko z tych które są zadeklarowane w linijce "mynetworks". Autoryzacje SMTP zrobiłem na SASL2 (mechanizm pam - hasło na SMTP jest te samo co dla usera w systemie) i działa ona. Można wysłać maila ale tylko z komputera który się znajduje w sieci oz zewnętrznym IP, który jest zadeklarowany w linijce "mynetworks" w main.cf. Jeżeli zahaszuje tą linijke, próbująć wysłać maila z jakiegoś klienta poczty (w moim przypadku opery) dostaje komunikat:

 

Poczta i czat
test@"domena".pl
Błąd wewnętrzny [554 5.7.1 <mail adresata>: Relay access denied]

 

Jak odhaszuje tą linijke to wszystko działa.

 

Mój config:

 

#soft_bounce = no

queue_directory = /var/spool/postfix

command_directory = /usr/sbin


daemon_directory = /usr/libexec/postfix


mail_owner = postfix

#default_privs = nobody


myhostname = "domena serwera"
#myhostname = virtual.domain.tld


mydomain = "domena serwera"


myorigin = $mydomain
#myorigin = $mydomain

inet_interfaces = all
#inet_interfaces = $myhostname
#inet_interfaces = $myhostname, localhost
#inet_interfaces = localhost

#proxy_interfaces =
#proxy_interfaces = 1.2.3.4

mydestination = $myhostname, localhost.$mydomain
#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
#mail.$mydomain, www.$mydomain, ftp.$mydomain


#local_recipient_maps = unix:passwd.byname $alias_maps
#local_recipient_maps = proxy:unix:passwd.byname $alias_maps
#local_recipient_maps =


unknown_local_recipient_reject_code = 550


#mynetworks_style = class
#mynetworks_style = subnet
#mynetworks_style = host


mynetworks = "moje ip"
#mynetworks = $config_directory/mynetworks
#mynetworks = hash:/etc/postfix/network_table


#relay_domains = $mydestination


#relayhost = $mydomain
#relayhost = [gateway.my.domain]
#relayhost = [mailserver.isp.tld]
#relayhost = uucphost
#relayhost = [an.ip.add.ress]


#relay_recipient_maps = hash:/etc/postfix/relay_recipients


#in_flow_delay = 1s


#alias_maps = dbm:/etc/aliases
alias_maps = hash:/etc/aliases
#alias_maps = hash:/etc/aliases, nis:mail.aliases
#alias_maps = netinfo:/aliases

alias_database = dbm:/etc/aliases
#alias_database = dbm:/etc/mail/aliases
alias_database = hash:/etc/aliases
#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases

#recipient_delimiter = +

#home_mailbox = Mailbox
#home_mailbox = Maildir/

#mail_spool_directory = /var/mail
mail_spool_directory = /var/spool/mail


#mailbox_command = /some/where/procmail
mailbox_command = /usr/bin/procmail -a "$EXTENSION"
#mailbox_command = /usr/bin/procmail


#mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp


mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp

local_destination_recipient_limit = 300
local_destination_concurrency_limit = 5

#mailbox_transport = cyrus


fallback_transport = lmtp:unix:/var/lib/imap/socket/lmtp
#fallback_transport = /usr/bin/maildrop


#luser_relay = [email protected]
#luser_relay = [email protected]
#luser_relay = admin+$local


#header_checks = regexp:/etc/postfix/header_checks


#fast_flush_domains = $relay_domains


#smtpd_banner = $myhostname ESMTP $mail_name
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)


#local_destination_concurrency_limit = 2
#default_destination_concurrency_limit = 20


debug_peer_level = 2


#debug_peer_list = 127.0.0.1
#debug_peer_list = some.domain


debugger_command =
 PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
 xxgdb $daemon_directory/$process_name $process_id & sleep 5


# debugger_command =

# debugger_command =
#	PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen
#	-dmS $process_name gdb $daemon_directory/$process_name
#	$process_id & sleep 1


sendmail_path = /usr/sbin/sendmail.postfix


newaliases_path = /usr/bin/newaliases.postfix


mailq_path = /usr/bin/mailq.postfix


setgid_group = postdrop


html_directory = no


manpage_directory = /usr/share/man

sample_directory = /usr/share/doc/postfix-2.3.3/samples


readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES

#MOJE


#AUTORYZACJA SMTP
smtpd_sasl_auth_enable = yes
# wlaczona autoryzacja smtp
smtpd_sasl_security_options = noanonymous
# blokowanie polaczenia jako gosc
smtpd_sasl_local_domain = $myhostname
broken_sasl_auth_clients = yes
# pozwala na polaczenie starszym klientom pocztowym
smtpd_sasl_authenticated_header = yes
# Restrykcje
smtpd_sender_restrictions = 
   permit
smtpd_client_restrictions =
   permit_inet_interfaces,
   permit_sasl_authenticated,
   permit

 

 

A drug mój problem dotyczy pop3. Zainstalowałem paczke cyrus-imapd. Konfig wygląda tak:

 

imapd.conf

 

configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
sasl_mech_list:LOGIN
#tls_cert_file: /etc/openssl/cyrus-imapd/server.pem
#tls_key_file: /etc/openssl/cyrus-imapd/server.pem
#tls_ca_file: /etc/pki/tls/certs/ca-bundle.crt

 

cyrus.conf

 

# standard standalone server implementation

START {
 # do not delete this entry!
 recover	cmd="ctl_cyrusdb -r"

 # this is only necessary if using idled for IMAP IDLE
# idled		cmd="idled"
}

# UNIX sockets start with a slash and are put into /var/lib/imap/sockets
SERVICES {
 # add or remove based on preferences
#  imap		cmd="imapd" listen="imap" prefork=5
#  imaps	cmd="imapd -s" listen="imaps" prefork=1
 pop3		cmd="pop3d" listen="pop3" prefork=3
#  pop3s	cmd="pop3d -s" listen="pop3s" prefork=1
#  sieve	cmd="timsieved" listen="sieve" prefork=0

 # these are only necessary if receiving/exporting usenet via NNTP
#  nntp		cmd="nntpd" listen="nntp" prefork=3
#  nntps		cmd="nntpd -s" listen="nntps" prefork=1

 # at least one LMTP is required for delivery
#  lmtp		cmd="lmtpd" listen="lmtp" prefork=0
#  lmtpunix	cmd="lmtpd" listen="/var/lib/imap/socket/lmtp" prefork=1

 # this is only necessary if using notifications
#  notify	cmd="notifyd" listen="/var/lib/imap/socket/notify" proto="udp" prefork=1
}

EVENTS {
 # this is required
 checkpoint	cmd="ctl_cyrusdb -c" period=30

 # this is only necessary if using duplicate delivery suppression,
 # Sieve or NNTP
 delprune	cmd="cyr_expire -E 3" at=0400

 # this is only necessary if caching TLS sessions
 tlsprune	cmd="tls_prune" at=0400
}

 

Wycinek z maillog:

 

Jan 13 17:52:27 "domena" master[14662]: exiting on SIGTERM/SIGINT
Jan 13 17:52:30 "domena" master[15029]: process started
Jan 13 17:52:30 "domena" master[15031]: about to exec /usr/lib/cyrus-imapd/ctl_cyrusdb
Jan 13 17:52:30 "domena" ctl_cyrusdb[15031]: recovering cyrus databases
Jan 13 17:52:30 "domena" ctl_cyrusdb[15031]: skiplist: recovered /var/lib/imap/mailboxes.db (0 records, 144 bytes) in 0 seconds
Jan 13 17:52:30 "domena" ctl_cyrusdb[15031]: skiplist: recovered /var/lib/imap/annotations.db (0 records, 144 bytes) in 0 seconds
Jan 13 17:52:30 "domena" ctl_cyrusdb[15031]: done recovering cyrus databases
Jan 13 17:52:30 "domena" master[15029]: ready for work
Jan 13 17:52:30 "domena" master[15032]: about to exec /usr/lib/cyrus-imapd/ctl_cyrusdb
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: checkpointing cyrus databases
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: DBERROR: error listing log files: DB_NOTFOUND: No matching key/data pair found
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: DBERROR: archive /var/lib/imap/db: cyrusdb error
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: DBERROR: error listing log files: DB_NOTFOUND: No matching key/data pair found
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: DBERROR: archive /var/lib/imap/db: cyrusdb error
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: archiving database file: /var/lib/imap/annotations.db
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: archiving database file: /var/lib/imap/mailboxes.db
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: DBERROR: error listing log files: DB_NOTFOUND: No matching key/data pair found
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: DBERROR: archive /var/lib/imap/db: cyrusdb error
Jan 13 17:52:30 "domena" ctl_cyrusdb[15032]: done checkpointing cyrus databases
Jan 13 17:52:30 "domena" master[15029]: process 15032 exited, status 1
Jan 13 17:52:30 "domena" master[15033]: about to exec /usr/lib/cyrus-imapd/pop3d
Jan 13 17:52:30 "domena" master[15034]: about to exec /usr/lib/cyrus-imapd/pop3d
Jan 13 17:52:30 "domena" pop3[15033]: executed
Jan 13 17:52:30 "domena" pop3[15034]: executed
Jan 13 17:52:32 "domena" master[15035]: about to exec /usr/lib/cyrus-imapd/pop3d
Jan 13 17:52:32 "domena" pop3[15035]: executed
Jan 13 17:52:32 "domena" master[15036]: about to exec /usr/lib/cyrus-imapd/pop3d
Jan 13 17:52:32 "domena" master[15037]: about to exec /usr/lib/cyrus-imapd/pop3d
Jan 13 17:52:32 "domena" master[15038]: about to exec /usr/lib/cyrus-imapd/pop3d
Jan 13 17:52:32 "domena" pop3[15036]: executed
Jan 13 17:52:32 "domena" pop3[15038]: executed
Jan 13 17:52:32 "domena" pop3[15037]: executed
Jan 13 17:52:34 "domena" postfix/postfix-script: stopping the Postfix mail system
Jan 13 17:52:34 "domena" postfix/master[14013]: terminating on signal 15
Jan 13 17:52:34 "domena" postfix/postfix-script: starting the Postfix mail system
Jan 13 17:52:34 "domena" postfix/master[15102]: daemon started -- version 2.3.3, configuration /etc/postfix

 

Gdy opera próbuje się zalogować wyskakuje taki błąd:

 

Poczta i czat
[email protected]
Błąd z serwera: -ERR [SYS/PERM] Unable to locate maildrop: Mailbox does not exist. Czy twoje hasło zostało zmienione?

 

Czytałem troszkę niedokładnie z powodu brak czasu ostatnio, dokumentacje POSTFIKSA i cyrus-imapd. Przed rozpoczęciem tematu szukałem na googlach i na forum ale nic konkretnego nie znalazłem. Ma może ktoś pomysł jak powinienem poprawnie skonfigurować POSTFIKSA? Będę bardzo wdzięczny.

 

P.S.

Nie krzyczcie i nie bijcie.... jest to mój pierwszy serwer pocztowy jaki stawiam

[seawolf]

Problem z SMTP został rozwiązany.

 

Wystarczyło dodać w configu:

 

#AUTORYZACJA SMTP
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_recipient_restrictions = 
   permit_sasl_authenticated, 
   permit_mynetworks, 
   check_relay_domains

 

Te linijki powinno się dodać do pliku konfiguracyjnego (main.cf) jeżeli się chce aby z każdego IP możba było wysyłać e-maile przez nasz serwer.

 

Przy okazji rozwiązania problemu z wysyłaniem maili, wziąłem się za TSL'a przy połączeniu SMTP. Dodałem odpowiednie opcje w main.cf, wygenerowałem klucz oraz certyfikaty i działa wszystko. Wysyła maile bez problemu gdy jest TSL włączony, ale w logach zauważyłem takie coś:

 

Jan 14 00:24:06 "domena" postfix/smtpd[2460]: initializing the server-side TLS engine
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: connect from jakas domena[jakies IP]
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: setting up TLS connection from jakas domena[jakies IP]
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:before/accept initialization
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:error in SSLv2/v3 read client hello A
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:error in SSLv3 read client hello B
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:error in SSLv3 read client hello B
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 read client hello B
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 write server hello A
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 write certificate A
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 write key exchange A
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 write server done A
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 flush data
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:error in SSLv3 read client certificate A
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:error in SSLv3 read client certificate A
Jan 14 00:24:06 a"domena" postfix/smtpd[2460]: SSL_accept:SSLv3 read client key exchange A
Jan 14 00:24:06 "domena" postfix/smtpd[2460]: SSL_accept:error in SSLv3 read certificate verify A
Jan 14 00:24:07 "domena" last message repeated 3 times
Jan 14 00:24:07 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 read finished A
Jan 14 00:24:07 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 write change cipher spec A
Jan 14 00:24:07 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 write finished A
Jan 14 00:24:07 "domena" postfix/smtpd[2460]: SSL_accept:SSLv3 flush data
Jan 14 00:24:07 "domena" postfix/smtpd[2460]: TLS connection established from jakas domena[jakies IP]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Jan 14 00:24:07 "domena" postfix/smtpd[2460]: 4EC3D7EA812: client=jakas domena[jakies IP], sasl_method=LOGIN, sasl_username="e-mail nadawcy"
Jan 14 00:24:07 "domena" postfix/cleanup[2463]: 4EC3D7EA812: message-id=<[email protected]>
Jan 14 00:24:07 "domena" postfix/qmgr[2426]: 4EC3D7EA812: from=<"e-mail nadawcy">, size=868, nrcpt=1 (queue active)
Jan 14 00:24:07 "domena" postfix/smtpd[2460]: disconnect from jakas domena[jakies IP]
Jan 14 00:24:13 "domena" postfix/smtp[2464]: 4EC3D7EA812: to=<e-mail adresata">, relay=gmail-smtp-in.l.google.com[66.249.93.27]:25, delay=6.6, delays=0.27/0.01/5.5/0.84, dsn=2.0.0, status=sent (250 2.0.0 OK 1168730536 24si4302596ugf)
Jan 14 00:24:13 "domena" postfix/qmgr[2426]: 4EC3D7EA812: removed

 

Widać wywala jakiś błąd.

 

Wyłączyłem najpierw na chwilkę SELinuksa na serwerze i w konsoli wydałem komende:

 

openssl s_client -starttls smtp -connect (Ip hosta):25

 

Skutek był taki:

 

[seawolf@localhost ~]$ openssl s_client -starttls smtp -connect (IP serwera):25
CONNECTED(00000003)
depth=1 /C=PL/ST=Slask/O=ZS1/CN="domena"/[email protected]
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
0 s:/C=PL/ST=Slask/L=Tychy/O=ZS1/CN="domena"/[email protected]
  i:/C=PL/ST=Slask/O=ZS1/CN="domena"/[email protected]
1 s:/C=PL/ST=Slask/O=ZS1/CN="domena"/[email protected]
  i:/C=PL/ST=Slask/O=ZS1/CN="domena"/[email protected]
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC7DCCAlWgAwIBAgIBATANBgkqhkiG9w0BAQUFADB1MQswCQYDVQQGEwJQTDEO
MAwGA1UECBMFU2xhc2sxDDAKBgNVBAoTA1pTMTEkMCIGA1UEAxMbYXJyMTMxLmlu
dGVybmV0ZHNsLnRwbmV0LnBsMSIwIAYJKoZIhvcNAQkBFhNzZWF3b2xmODlAZ21h
aWwuY29tMB4XDTA3MDExMzIyNTgzMVoXDTA4MDExMzIyNTgzMVowgYUxCzAJBgNV
BAYTAlBMMQ4wDAYDVQQIEwVTbGFzazEOMAwGA1UEBxMFVHljaHkxDDAKBgNVBAoT
A1pTMTEkMCIGA1UEAxMbYXJyMTMxLmludGVybmV0ZHNsLnRwbmV0LnBsMSIwIAYJ
KoZIhvcNAQkBFhNzZWF3b2xmODlAZ21haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
A4GNADCBiQKBgQCefNDPFKL+Fbr1h9868kawvFOuRqf1KGl2nVjKuSvmI8fmrV73
6rH2XOxiWDpZmeYlSRPs3qvqEq0rRqca6siBNKnU0Rue7Zt7oa6cjSavJ0Ye343v
t/Js1SYGpy/WkQlEb7qZLnHKCB/hy/nXGE0cwPh2I+f0RmY4x0oGfzIDZwIDAQAB
o3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRl
ZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUd3+RBHj1SD2ishA3LvRBazGgnSYwHwYD
VR0jBBgwFoAU+rW7NKUK5y9AShM8VRWTazLdZLowDQYJKoZIhvcNAQEFBQADgYEA
Ud3Mwi+m/6dRBs2TS//peNZ7QZDFM9zcMhvvG1NODgevPrLMmtmRf/8j34b0rAUd
s9t39AsB0EJSxRn+uiwjwOt558bsZjP6d8krQLAo+i4B3ur6SFnGbdMGgfB5zGXm
o3HNTxFwjloN/QncMKdy7raxxkVw0mfzyd2cb8PeqFE=
-----END CERTIFICATE-----
subject=/C=PL/ST=Slask/L=Tychy/O=ZS1/CN="domena"/[email protected]
issuer=/C=PL/ST=Slask/O=ZS1/CN="domena"/[email protected]
---
No client certificate CA names sent
---
SSL handshake has read 2158 bytes and written 350 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
   Protocol  : TLSv1
   Cipher    : DHE-RSA-AES256-SHA
   Session-ID: 9F7279D2A3422067A7BE99FCFA82139EBBE20179B052DEE225A515D7F4E4C50B
   Session-ID-ctx:
   Master-Key: F61501B1BF946372953662C0F31AF4C600C2777DFFAEE3E104E6C377C24D2A49455219F8D923094C6D698B45EA255B9C
   Key-Arg   : None
   Krb5 Principal: None
   Start Time: 1168783222
   Timeout   : 300 (sec)
   Verify return code: 19 (self signed certificate in certificate chain)
---
220 "domena" ESMTP Microsoft ShittyServer 2.6 (2.3.3)

 

Jak widać rzuca się o to że certyfikat jest podpisany własoręcznie a nie przez jakaś firmę zajmującym się tym. Chce się po prostu upewnić, że to nic takiego ważnego, te komunikaty o błędzie w logach.

 

A oto wycinek z konfiga main.cf dotyczący TSL'a:

 

#SZYFROWANIE
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/openssl/postfix/key.pem
smtpd_tls_cert_file = /etc/openssl/postfix/cert.pem
smtpd_tls_CAfile = /etc/openssl/postfix/CA.pem
#smtpd_tls_loglevel = 2
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

 

A gdy telnetuje się na serwer wyrzuca takie coś konsola:

 

[seawolf@localhost ~]$ telnet "IP serwera" 25
Trying "IP serwera"...
Connected to "IP serwera".
Escape character is '^]'.
220 "domena" ESMTP Microsoft ShittyServer 2.6 (2.3.3)
ehlo "IP serwera"
250-"domena"
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye
Connection closed by foreign host.
[seawolf@localhost ~]$

 

Czyli wszystko OK.

 

Może się to komuś przyda w przyszłości. Został mi do rozwiązania tylko problem z POP3.

[marcin_tedora6]

Tylko interesuje mnie co ci sie stalo z linijkami o AUTH LOGIN PLAIN? w telenetowaniu sie masz informacje o certyfikacje wlaczonego autha w konfigu postfixa ale nie masz o tym info w telenecie. mialem podobny problem po wylaczeniu tsla pokazalo mi w telenet na port 25 wpisy o 250 AUTH LOGIN PLAIN.

 

Chcialbym sie dowiedziec jak wygladalby komunikat

 

ehlo strona......pl

po komencie

 

openssl s_client -starttls smtp -connect (Ip hosta):25