GentooVirtual Mailhosting System with Postfix Guide.docx

1、GentooVirtual Mailhosting System with Postfix GuideVirtual Mailhosting System with Postfix Guide窗体顶端Content: 窗体底端1. IntroductionFor most Gentoo users, a simple mail client and fetchmail will do. However, if youre hosting a domain with your system, youll need a full blown MTA (Mail Transfer Agent). A

2、nd if youre hosting multiple domains, then youll definitely need something more robust to handle all of the email for your users. This system was designed to be an elegant solution to that problem. A virtual mail system needs to be able to handle email for numerous domains with multiple users over a

3、 variety of interfaces. This presents some issues that must be dealt with. For instance, what if you have two users on different domains that want the same user name? If you are providing imap access and smtp-auth, how do combine the various authentication daemons into a single system? How do you pr

4、ovide security for the numerous components that comprise the system? How do you manage it all? This howto will show you how to set up with a mail system capable of handling mail for as many domains as your hardware can handle, supports virtual mail users that dont require shell accounts, has domain

5、specific user names, can authenticate web, imap, smtp, and pop3 clients against a single database, utilizes ssl for transport layer security, has a web interface, can handle mailing lists for any domain on the machine, and is controlled by a nice, central and easy mysql database. There are quite a v

6、ariety of ways to go about setting up a virtual mailhosting system. With so may options, another may be the best choice for your specific needs. Consider investigating http:/www.qmail.org/ and http:/www.exim.org/ to explore your options. The following packages are used in this setup: apache, courier

7、-imap, courier-authlib postfix, mod_php, phpmyadmin, squirrelmail, cyrus-sasl, mysql, php, and mailman. Make sure to turn on the following USE variables in /etc/make.conf before compiling the packages: USE=mysql imap libwww maildir sasl ssl. Otherwise you will most likely have to recompile things to

8、 get the support you need for all the protocols. Further, its a good idea to turn off any other mail and network variables, like ipv6. Important: You need a domain name to run a public mail server, or at least an MX record for a domain. Ideally you would have control of at least two domains to take

9、advantage of your new virtual domain functionality. Important: Make sure /etc/conf.d/hostname is set to the right hostname for your mail server. You can apply any changes you make to this file by running /etc/init.d/hostname restart. Verify your hostname is set correctly with hostname. Also verify t

10、hat there are no conflicting entries in /etc/hosts. Note: It is recommended that you read this entire document and familiarize yourself with all the steps before attempting the install. If you run into problems with any of the steps, check the troubleshooting guide at the end of this document. Also,

11、 not all the referenced packages are necessary, this set up is very flexible. For instance, if you do not desire a web interface, feel free to skip the squirrelmail section. 2. Postfix BasicsCode Listing2.1: Install postfix# emerge postfixWarning: Verify that you have not installed any other MTA, su

12、ch as ssmtp, exim, or netqmail, or you will surely have BIG problems. After postfix is installed, its time to configure it. Change the following options in /etc/postfix/main.cf. Remember to replace $variables with your own names. Code Listing2.2: /etc/postfix/main.cfmyhostname = $host.domain.namemyd

13、omain = $domain.nameinet_interfaces = allmydestination = $myhostname, localhost.$mydomain $mydomainmynetworks = .work/24, 127.0.0.0/8home_mailbox = .maildir/local_destination_concurrency_limit = 2default_destination_concurrency_limit = 10Next change the following in /etc/postfix/master.cf. This will

14、 turn on verbose output for debugging: Code Listing2.3: /etc/postfix/master.cf# service type private unpriv chroot wakeup maxproc command + args# (yes) (yes) (yes) (never) (50)#=(Just add the -v after the smtpd in the following line)smtp inet n - n - - smtpd -vNext, edit /etc/mail/aliases to add you

15、r local aliases. There should at least be an alias for root like: root: youremail.address. Code Listing2.4: Starting postfix for the first time# /usr/bin/newaliases(This will install the new aliases. You only need to do thiswhen you update or install aliases.)# /etc/init.d/postfix startNow that post

16、fix is running, fire up your favorite console mail client and send yourself an email. I use mutt for all my console mail. Verify that postfix is delivering mail to local users, once thats done, were on to the next step. Note: I strongly recommend that you verify this basic postfix setup is functioni

17、ng before you progress to the next step of the howto. 3. Courier-imapCode Listing3.1: Install courier-imap and courier-authlib# emerge courier-imap courier-authlibCode Listing3.2: Courier-imap configuration# cd /etc/courier-imap(If you want to use the ssl capabilities of courier-imap or pop3,youll n

18、eed to create certs for this purpose.This step is recommended. If you do not want to use ssl, skip this step.)# nano -w f# nano -w f(Change the C, ST, L, CN, and email parameters to match your server.)# mkpop3dcert# mkimapdcertCode Listing3.3: Start the courier services you need.# /etc/init.d/courie

19、r-imapd start# /etc/init.d/courier-imapd-ssl start# /etc/init.d/courier-pop3d start# /etc/init.d/courier-pop3d-ssl startStart up your favorite mail client and verify that all connections youve started work for receiving and sending mail. Of course, you wont be able to log on to any of the services b

20、ecause authentication hasnt been configured yet, but it is wise to check if the connections themselves work or not. Now that the basics work, were going to do a whole bunch of stuff at once to get the rest of the system running. Again, please verify that what weve installed already works before prog

21、ressing. 4. Cyrus-saslNext were going to install cyrus-sasl. Sasl is going to play the role of actually passing your auth variables to courier-auth, which will in turn pass that information to mysql for authentication of smtp users. For this howto, well not even try to verify that sasl is working un

22、til mysql is set up and contains a test user. Which is fine since well be authenticating against mysql in the end anyway. Code Listing4.1: Configuring and installing the cyrus-sasl ebuild# emerge cyrus-saslNext, edit /etc/sasl2/smtpd.conf. Code Listing4.2: Starting sasl# nano -w /etc/sasl2/smtpd.con

23、fmech_list: PLAIN LOGINpwcheck_method: saslauthd# nano -w /etc/conf.d/saslauthdSASLAUTHD_OPTS=$SASLAUTH_MECH -a rimap -rSASLAUTHD_OPTS=$SASLAUTHD_OPTS -O localhost# /etc/init.d/saslauthd start5. SSL Certs for Postfix and ApacheNext were going to make a set of ssl certificates for postfix and apache.

24、 Code Listing5.1: Making ssl certicates# cd /etc/ssl/# nano -w fChange the following default values for your domain:countryName_defaultstateOrProvinceName_defaultlocalityName_default0.organizationName_defaultcommonName_defaultemailAddress_default.(If the variables are not already present, just add t

25、hem in a sensible place.)# cd misc# ./CA.pl -newreq-nodes# ./CA.pl -newca# ./CA.pl -sign# cp newcert.pem /etc/postfix# cp newkey.pem /etc/postfix# cp demoCA/cacert.pem /etc/postfix(Now we do the same thing for apache.)# openssl req -new new.cert.csr# openssl rsa -in privkey.pem -out new.cert.key# op

26、enssl x509 -in new.cert.csr -out new.cert.cert -req -signkey new.cert.key -days 365(Just leave the resulting certificates here for now.Well install them after Apache is installed.)6. Adding SSL and SASL support to PostfixNow edit the postfix configs to make it aware of your new sasl and ssl capabili

27、ties. Add the following parameters to the end of the file where they will be easy to find. Code Listing6.1: /etc/postfix/main.cf# nano -w /etc/postfix/main.cfsmtpd_sasl_auth_enable = yessmtpd_sasl2_auth_enable = yessmtpd_sasl_security_options = noanonymousbroken_sasl_auth_clients = yessmtpd_sasl_loc

28、al_domain =(The broken_sasl_auth_clients option and the login auth methodare for outlook and outlook express only and are undocumented.Isnt having to hack software for stupid, broken, M$ BS great?smtpd_sasl_local_domain appends a domain name to clients usingsmtp-auth. Make sure its blank or your use

29、r names will getmangled by postfix and be unable to auth.)smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination(The next two options enable outgoing encryption.)smtp_use_tls = yessmtp_tls_note_starttls_offer = yessmtpd_use_tls = yes#smtpd_tls_auth_onl

30、y = yessmtpd_tls_key_file = /etc/postfix/newkey.pemsmtpd_tls_cert_file = /etc/postfix/newcert.pemsmtpd_tls_CAfile = /etc/postfix/cacert.pemsmtpd_tls_loglevel = 3smtpd_tls_received_header = yessmtpd_tls_session_cache_timeout = 3600stls_random_source = dev:/dev/urandom(smtpd_tls_auth_only is commented

31、 out to ease testing the system.You can turn this on later if you desire.)# postfix reloadNow were going to verify that the configs we added were picked up by postfix. For this we are going to use telnet (provided by for instance net-misc/netkit-telnetd) although you can also use nc (provided by net-analyzer/netcat): Code Listing6.2: Verifying sasl and tls support# telnet localhost 25Trying 127.0.0.1.Connected to localhost.Escape character is .220 ESMTP PostfixEHLO