基于虚拟用户的邮件系统配置

#cd /var/named/
#vim zengx.com.zone
$TTL 86400
@      IN   SOA  ns.magedu.com. admin.magedu.com. (
                2015113001
                2H  //刷新时间
                10M  //重试时间
                3D   //过期时间
                1D)  //否定TTL值
       IN   NS   ns
       IN   MX  10 mail
ns     IN   A    192.168.3.3
mail   IN   A    192.168.3.3
www    IN   A    1192.168.3.3
#vim 192.168.3.zone
$TTL 86400
@      IN   SOA  ns.magedu.com. admin.magedu.com. (
                2013041501
                2H
                10M
                3D
                1D)
       IN   NS   ns.magedu.com.
3      IN   PTR  ns.magedu.com.
3      IN   PTR  mail.magedu.com.
3      IN   PTR  www.magedu.com.
:wq 保存退出
# named-checkzone "zengx.com.zone" zengx.com.zone
zone zengx.com.zone/IN: loaded serial 2015113001
OK
# named-checkzone "192.168.3.in-addr-arpa" 192.168.3.zonezone 192.168.3.in-addr-arpa/IN: loaded serial 2015113001
OK

# vim /etc/resolv.conf  //修改DNS服务IP为192.168.3.3
nameserver 192.168.3.3
# dig -t MX zengx.com @192.168.3.3

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-6.P2.el5_7.4 <<>> -t MX zengx.com @192.168.3.3
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42182
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; QUESTION SECTION:
;zengx.com.INMX
;; ANSWER SECTION:
zengx.com.    86400  IN MX   10   mail.zengx.com.
;; AUTHORITY SECTION:
zengx.com.    86400  IN  NS  ns.zengx.com.
;; ADDITIONAL SECTION:
mail.zengx.com.  86400  IN  A  192.168.3.3
ns.zengx.com.   86400    IN  A  192.168.3.3
;; Query time: 3 msec
;; SERVER: 192.168.3.3#53(192.168.3.3)
;; WHEN: Mon Nov 30 12:40:20 2015
;; MSG SIZE  rcvd: 97
INA192.168.3.3
# dig -t A mail.zengx.com @192.168.3.3

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-6.P2.el5_7.4 <<>> -t A mail.zengx.com @192.168.3.3
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46849
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;mail.zengx.com.       IN        A
;; ANSWER SECTION:
mail.zengx.com.  86400  IN        A      192.168.3.3
;; AUTHORITY SECTION:
zengx.com.     86400     IN       NS    ns.zengx.com.
;; ADDITIONAL SECTION:
ns.zengx.com.   86400    IN      A     192.168.3.3
;; Query time: 3 msec
;; SERVER: 192.168.3.3#53(192.168.3.3)
;; WHEN: Mon Nov 30 12:42:02 2015
;; MSG SIZE  rcvd: 81
# dig -x 192.168.3.3 @192.168.3.3

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-6.P2.el5_7.4 <<>> -x 192.168.3.3 @192.168.3.3
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4837
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;3.3.168.192.in-addr.arpa.INPTR
;; ANSWER SECTION:
3.3.168.192.in-addr.arpa.  86400   IN  PTR mail.magedu.com.
3.3.168.192.in-addr.arpa.  86400   IN  PTR ns.magedu.com.
3.3.168.192.in-addr.arpa.  86400   IN  PTR  www.magedu.com.
;; AUTHORITY SECTION:
3.168.192.in-addr.arpa.  86400  IN  NS  ns.magedu.com.
;; Query time: 4 msec
;; SERVER: 192.168.3.3#53(192.168.3.3)
;; WHEN: Mon Nov 30 12:43:10 2015
;; MSG SIZE  rcvd: 120

#vim /etc/sysconfig/network
HOSTNAME=mail.zengx.com
#hostname mail.zengx.com   //立即生效
#vim /etc/hosts
192.168.3.3   mail.zengx.com
# ping mail.zengx.com
PING mail.zengx.com (192.168.3.3) 56(84) bytes of data.
64 bytes from ns.magedu.com (192.168.3.3): icmp_seq=1 ttl=64 time=0.028 ms
64 bytes from ns.magedu.com (192.168.3.3): icmp_seq=2 ttl=64 time=0.049 ms
64 bytes from ns.magedu.com (192.168.3.3): icmp_seq=3 ttl=64 time=0.047 ms

 install_root: [/] /
   tempdir: [/root/postfix-2.9.6] 
   config_directory: [/etc/postfix] 
   command_directory: [/usr/sbin] 
   daemon_directory: [/usr/libexec/postfix] 
   data_directory: [/var/lib/postfix] 
   html_directory: [no] 
   mail_owner: [postfix] 
   mailq_path: [/usr/bin/mailq] 
   manpage_directory: [/usr/local/man] 
   newaliases_path: [/usr/bin/newaliases] 
   queue_directory: [/var/spool/postfix] 
   readme_directory: [no] 
   sendmail_path: [/usr/sbin/sendmail] 
   setgid_group: [postdrop]

vim /etc/init.d/postfix
#!/bin/bash
#
# postfix      Postfix Mail Transfer Agent
#
# chkconfig: 2345 80 30
# description: Postfix is a Mail Transport Agent, which is the program \
#              that moves mail from one machine to another.
# processname: master
# pidfile: /var/spool/postfix/pid/master.pid
# config: /etc/postfix/main.cf
# config: /etc/postfix/master.cf

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ $NETWORKING = "no" ] && exit 3

[ -x /usr/sbin/postfix ] || exit 4
[ -d /etc/postfix ] || exit 5
[ -d /var/spool/postfix ] || exit 6

RETVAL=0
prog="postfix"

start() {
  # Start daemons.
  echo -n $"Starting postfix: "
        /usr/bin/newaliases >/dev/null 2>&1
  /usr/sbin/postfix start 2>/dev/null 1>&2 && success || failure $"$prog start"
  RETVAL=$?
  [ $RETVAL -eq 0 ] && touch /var/lock/subsys/postfix
        echo
  return $RETVAL
}

stop() {
  # Stop daemons.
  echo -n $"Shutting down postfix: "
  /usr/sbin/postfix stop 2>/dev/null 1>&2 && success || failure $"$prog stop"
  RETVAL=$?
  [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/postfix
  echo
  return $RETVAL
}

reload() {
  echo -n $"Reloading postfix: "
  /usr/sbin/postfix reload 2>/dev/null 1>&2 && success || failure $"$prog reload"
  RETVAL=$?
  echo
  return $RETVAL
}

abort() {
  /usr/sbin/postfix abort 2>/dev/null 1>&2 && success || failure $"$prog abort"
  return $?
}

flush() {
  /usr/sbin/postfix flush 2>/dev/null 1>&2 && success || failure $"$prog flush"
  return $?
}

check() {
  /usr/sbin/postfix check 2>/dev/null 1>&2 && success || failure $"$prog check"
  return $?
}

restart() {
  stop
  start
}

# See how we were called.
case "$1" in
  start)
  start
  ;;
  stop)
  stop
  ;;
  restart)
  stop
  start
  ;;
  reload)
  reload
  ;;
  abort)
  abort
  ;;
  flush)
  flush
  ;;
  check)
  check
  ;;
  status)
    status master
  ;;
  condrestart)
  [ -f /var/lock/subsys/postfix ] && restart || :
  ;;
  *)
  echo $"Usage: $0 {start|stop|restart|reload|abort|flush|check|status|condrestart}"
  exit 1
esac

exit $?

# END

#chmod +x /etc/init.d/postfix
#chkconfig --add postfix
#chkconfig --list postfix

/*添加两个用户*/
#useradd openstack   
#useradd hadoop

# telnet mail.zengx.com 25
Trying 192.168.3.3...
Connected to mail.zengx.com (192.168.3.3).
Escape character is '^]'.
220 mail.zengx.com ESMTP Postfix
ehlo mail.zengx.com
250-mail.zengx.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from:root@zengx.com
250 2.1.0 Ok
rcpt to:hadoop@zengx.com
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
Subject:hello
hello
.
250 2.0.0 Ok: queued as BBD711A1002B
quit
221 2.0.0 Bye

# tail /var/log/maillog
localhost postfix/qmgr[7571]: BBD711A1002B: from=<root@zengx.com>, size=325, nrcpt=1 (queue active)
localhost postfix/local[7853]: BBD711A1002B: to=<hadoop@zengx.com>, relay=local, delay=58, delays=58/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
localhost postfix/qmgr[7571]: BBD711A1002B: removed
localhost postfix/smtpd[7842]: disconnect from mail.zengx.com[192.168.3.3]

#yum list all | grep ltdl //确认是否安装,否则安装
#yum install libtool-ltdl libtool-ltdl-devel  //安装ltdl
#yum install expect  //这个也需要安装好
# tar jxvf courier-authlib-0.64.0.tar.bz2
# cd courier-authlib-0.64.0
#./configure \
    --prefix=/usr/local/courier-authlib \
    --sysconfdir=/etc \
    --without-authpam \
    --without-authshadow \
    --without-authvchkpw \
    --without-authpgsql \
    --with-sqlite-libs=/usr/lib64 \
    --with-sqlite-includes=/usr/include \
    --with-authmysql \
    --with-mysql-libs=/usr/lib64/mysql \
    --with-mysql-includes=/usr/include/mysql \
    --with-redhat \  -->不是红帽系统，这个就不需要。
    --with-authmysqlrc=/etc/authmysqlrc \
    --with-authdaemonrc=/etc/authdaemonrc \
    --with-mailuser=postfix \
    --with-mailgroup=postfix \
    --with-ltdl-lib=/usr/lib64 \
    --with-ltdl-include=/usr/include
#make
#make install

########################Virtual Mailbox Settings########################
virtual_mailbox_base = /var/mailbox
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_alias_domains =
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_uid_maps = static:2525
virtual_gid_maps = static:2525
virtual_transport = virtual
##########################QUOTA Settings########################
message_size_limit = 14336000
virtual_mailbox_limit = 20971520
#postconf -n  //检查配置文件

#myhostname = mail.zengx.com
#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,ns.$mydomain
#mydomain = zengx.com
#myorigin = $mydomain

#service postfix restart //启动postfix服务

[root@mail ~]# telnet 192.168.3.3 25 //测试是否可以认证
Trying 192.168.3.3...
Connected to mail.zengx.com (192.168.3.3).
Escape character is '^]'.
220 Welcome to our mail.zengx.com ESMTP,Warning: Version not Available!
EHLO mail.zengx.com 
250-mail.zengx.com
250-PIPELINING
250-SIZE 14336000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from:root@zengx.com 
250 2.1.0 Ok
rcpt to:hadoop@zengx.com
554 5.7.1 <hadoop@zengx.com>: Relay access denied

#mkdir /etc/dovecot/ssl -pv
#cd /etc/dovecot/ssl 
#(umask 077;openssl genrsa 1024 > dovecot.key) -->生成私钥
#openssl req -new -key dovecot.key -out dovecot.csr -->生成证书签署请求
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:beijing
Locality Name (eg, city) [Newbury]:fengtai
Organization Name (eg, company) [My Company Ltd]:Zengx
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:mail.zengx.com
Email Address []:postadmin@zengx.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

#cd /etc/pki/CA
#mkdir certs newcerts crl
#touch index.txt
#echo 01 > serial
#cd /etc/dovecot/ssl/
#openssl ca -in dovecot.csr -out dovecot.crt -days 3656
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Dec  3 05:14:06 2015 GMT
            Not After : Dec  6 05:14:06 2025 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = beijing
            organizationName          = Zengx
            organizationalUnitName    = Tech
            commonName                = mail.zengx.com
            emailAddress              = postadmin@zengx.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                62:28:07:AA:FA:44:45:1E:31:CD:DE:4F:1F:8D:AB:C9:4F:0F:52:BB
            X509v3 Authority Key Identifier: 
                keyid:9E:07:93:EA:CD:3E:F0:3A:DF:9A:84:18:87:61:78:F9:08:87:3D:37
Certificate is to be certified until Dec  6 05:14:06 2025 GMT (3656 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

#vim /etc/dovecot.conf
protocols = pop3 pop3s
ssl_disable = no
ssl_cert_file = /etc/dovecot/ssl/dovecot.crt
ssl_key_file = /etc/dovecot/ssl/dovecot.key
:wq 保存退出
#service dovecot restart  //重启服务
#netstat -tnlp  //查看端口是否被监听了
tcp        0      0 :::995        :::*          LISTEN      5620/dovecot        
tcp        0      0 :::110        :::*          LISTEN      5620/dovecot

#openssl s_client -connect mail.zengx.com:995
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 84B3ED780437136624195FA74EF84858DD5DD523153B2790B27769A0633CA6A4
    Session-ID-ctx: 
    Master-Key: 2C97D2DE1C19F02A327B0D119B13F8851F4792E3C3FDB42A03D3A4C98C9723820235E753BAFBEBCD28F95879686C9A73
    Key-Arg   : None
    Krb5 Principal: None
    Start Time: 1449120852
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
+OK Dovecot ready.
USER hadoop@magedu.com
PASS hadoop
LIST