Linux学习-postfix+sasl2配置

本文基于postfix2.11.11和sasl2
postfix的安装详见：postfix安装
为postfix开启基于cyrus-sasl的认证功能

#验证postfix是否支持cyrus风格的sasl认证，如果输出结果如下，表示支持
[root@mail ~]# postconf -a
cyrus
dovecot
#修改/etc/postfix/main.cf
# sasl configuration
broken_sasl_auth_clients = yes
#permit_mynetworks：允许本地网络
#permit_sasl_authenticated：允许sasl验证通过的用户
#reject_invalid_hostname：拒绝不合法的主机名收发邮件
#reject_non_fqdn_hostname：拒绝主机名非FQDN格式的用户
#reject_unknown_sender_domain：拒绝未知的发件人域
#reject_non_fqdn_sender：没有FQDN用户
#reject_non_fqdn_recipient：非FQDN的接收者
#reject_unknown_recipient_domain：无法识别的收件人域
#reject_unauth_pipelining：无法验证的管道
#reject_unauth_destination：无法认证的目标地址，放最后
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_invalid_hostname,reject_non_fqdn_hostname,reject_unknown_sender_domain,reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unknown_recipient_domain,reject_unauth_pipelining,reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname
#安全选项，不直接匿名用户
smtpd_sasl_security_options = noanonymous
#The name of the configuration file (default: smtpd.conf) is configurable. It is a concatenation from a value that the Postfix SMTP server sends to the Cyrus SASL library, and the suffix .conf, added by Cyrus SASL.
#哪个应用程序使用sasl功能
smtpd_sasl_path = smtpd
#欢迎信息
smtpd_banner = Welcome to our $myhostname ESMTP,Warning:Version not Available!

[root@mail ~]# vim /usr/lib64/sasl2/smtpd.conf
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN
#修改/etc/postfix/main.cf
mynetworks = 127.0.0.0/8
#重新启动postfix
[root@mail ~]# service postfix restart
Shutting down postfix:                                     [  OK  ]
Starting postfix                                           [  OK  ]

#测试外发邮件不能中继
[C:\~]$ telnet 192.168.88.135 25
Connecting to 192.168.88.135:25...
Connection established.
To escape to local shell, press 'Ctrl+Alt+]'.
220 Welcome to our mail.tye.com ESMTP,Warning:Version not Available!
ehlo mail.tye.com
250-mail.tye.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from:abc
250 2.1.0 Ok
rcpt to:abc@163.com
**454 4.7.1 <abc@163.com>: Relay access denied**


#先通过saslpasswd2来为要认证的用户生成密码
[root@mail ~]# saslpasswd2 root
Password: 
Again (for verification): 
#测试sasl认证用户
[root@mail ~]# testsaslauthd -u root -p 123456
0: OK "Success."

#认证登录时，用户名和密码必须是base64编码的
#默认echo有换行符，使用-n选项，不使用换行符
[root@mail ~]# echo -n "root" | openssl base64
cm9vdA==
[root@mail ~]# echo -n "123456" | openssl base64
MTIzNDU2

[C:\~]$ telnet 192.168.88.135 25

Connecting to 192.168.88.135:25...
Connection established.
To escape to local shell, press 'Ctrl+Alt+]'.
220 Welcome to our mail.tye.com ESMTP,Warning:Version not Available!
ehlo mail.tye.com
250-mail.tye.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
auth login
334 VXNlcm5hbWU6
cm9vdA==
334 UGFzc3dvcmQ6
MTIzNDU2
**235 2.7.0 Authentication successful**
mail from: tye
250 2.1.0 Ok
rcpt to: xuwenpeng3@163.com
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
123
.
250 2.0.0 Ok: queued as C909EBF31C
quit221 2.0.0 Bye
Connection closing...Socket close.
#查看发送日志
[root@mail ~]# tail /var/log/maillog
Apr 23 07:05:50 mail postfix/anvil[2509]: statistics: max cache size 1 at Apr 23 06:55:50
Apr 23 07:06:59 mail postfix/smtpd[2507]: warning: unknown[192.168.88.1]: SASL login authentication failed: bad protocol / cancel
Apr 23 07:07:13 mail postfix/smtpd[2507]: warning: unknown[192.168.88.1]: SASL login authentication failed: another step is needed in authentication
Apr 23 07:15:03 mail postfix/smtpd[2507]: warning: unknown[192.168.88.1]: SASL login authentication failed: bad protocol / cancel
Apr 23 07:19:57 mail postfix/smtpd[2507]: C909EBF31C: client=unknown[192.168.88.1], sasl_method=login, sasl_username=root@mail.tye.com
Apr 23 07:20:13 mail postfix/cleanup[2568]: C909EBF31C: message-id=<>
Apr 23 07:20:13 mail postfix/qmgr[2504]: C909EBF31C: from=<tye@tye.com>, size=181, nrcpt=1 (queue active)
Apr 23 07:20:14 mail postfix/smtpd[2507]: disconnect from unknown[192.168.88.1]
Apr 23 07:20:22 mail postfix/smtp[2569]: C909EBF31C: host 163mx03.mxmail.netease.com[220.181.14.156] said: 451 DT:SPM 163 mx38,WMCowACHqnRNlIFgpxfPIA--.238S2 1619104855, please try again 15min later (in reply to end of DATA command)
Apr 23 07:20:30 mail postfix/smtp[2569]: C909EBF31C: to=<xuwenpeng3@163.com>, relay=163mx03.mxmail.netease.com[220.181.14.164]:25, delay=45, delays=28/0/17/0.06, dsn=4.0.0, status=deferred (host 163mx03.mxmail.netease.com[220.181.14.164] said: 451 DT:SPM 163 mx49,Y8CowADHorRXlIFgntOuIA--.69S2 1619104862, please try again 15min later (in reply to end of DATA command))

别名配置：

[root@mail ~]# vim /etc/aliases
# 发送给test的邮件将都发送至hadoop信箱
test:       hadoop
#执行newaliases
[root@mail ~]# newaliases
#重新启动postfix
[root@mail ~]# service postfix restart
Shutting down postfix:                                     [  OK  ]
Starting postfix                                           [  OK  ]
#添加test用户
[root@mail ~]# useradd test
#测试发送邮件给test
[root@mail ~]# telnet mail.tye.com 25
Trying 127.0.0.1...
Connected to mail.tye.com.
Escape character is '^]'.
220 Welcome to our mail.tye.com ESMTP,Warning:Version not Available!
helo mail.tye.com
250 mail.tye.com
mail from:abc
250 2.1.0 Ok
rcpt to: test               
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
abc
.
250 2.0.0 Ok: queued as 33FD2BF31C
quit
221 2.0.0 Bye
Connection closed by foreign host.
#查看发送邮件日志，日志中显示发送给test的邮件其实是发送给了hadoop
[root@mail ~]# tail /var/log/maillog
Apr 23 06:23:39 mail postfix/master[2146]: daemon started -- version 2.11.11, configuration /etc/postfix
Apr 23 06:24:48 mail postfix/smtpd[2156]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
Apr 23 06:24:48 mail postfix/smtpd[2156]: connect from localhost[127.0.0.1]
Apr 23 06:25:19 mail postfix/smtpd[2156]: 33FD2BF31C: client=localhost[127.0.0.1]
Apr 23 06:25:26 mail postfix/cleanup[2159]: 33FD2BF31C: message-id=<20210422222519.33FD2BF31C@mail.tye.com>
Apr 23 06:25:26 mail postfix/qmgr[2149]: 33FD2BF31C: from=<abc@tye.com>, size=282, nrcpt=1 (queue active)
Apr 23 06:25:26 mail postfix/local[2160]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
**Apr 23 06:25:26 mail postfix/local[2160]: 33FD2BF31C: to=<hadoop@tye.com>, orig_to=<test>, relay=local, delay=23, delays=23/0.04/0/0.02, dsn=2.0.0, status=sent (delivered to mailbox)**
Apr 23 06:25:26 mail postfix/qmgr[2149]: 33FD2BF31C: removed
Apr 23 06:25:28 mail postfix/smtpd[2156]: disconnect from localhost[127.0.0.1]

报错信息

[C:\~]$ telnet 192.168.88.135 25


Connecting to 192.168.88.135:25...
Connection established.
To escape to local shell, press 'Ctrl+Alt+]'.
220 Welcome to our mail.tye.com ESMTP,Warning:Version not Available!
ehlo mail.tye.com
250-mail.tye.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
auth login
334 VXNlcm5hbWU6
cm9vdA==
535 5.7.8 Error: authentication failed: bad protocol / cancel
/
502 5.5.2 Error: command not recognized
auth login
334 VXNlcm5hbWU6
cm9vdA==
**535 5.7.8 Error: authentication failed: bad protocol / cancel**

解决方法：

#先通过saslpasswd2来为要认证的用户生成密码
[root@mail ~]# saslpasswd2 root
Password: 
Again (for verification):