Postfix 是一种电子邮件服务器，它是由任职于IBM华生研究中心（T.J. Watson Research Center）的荷兰籍研究员Wietse Venema为了改良sendmail邮件服务器而产生的。最早在1990年代晚期出现，是一个开放源代码的软件。
Postfix 是Wietse Venema在IBM的GPL协议之下开发的MTA（邮件传输代理）软件。postfix是Wietse Venema想要为使用最广泛的sendmail提供替代品的一个尝试。在Internet世界中，大部分的电子邮件都是通过sendmail来投递的，大约有100万用户使用sendmail，每天投递上亿封邮件。这真是一个让人吃惊的数字。Postfix试图更快、更容易管理、更安全，同时还与sendmail保持足够的兼容性。
邮件服务器概述
◆常用的邮件服务器◆
Sendmail: 资格最古老,运行稳定,但安全性欠佳.
Postfix: 采用模块化设计,在投递效率、稳定性、性能及安全性方面表现优秀,与sendmail保持足够的兼容性.
Qmail: 采用模块化设计,速度快、执行效率高,配置稍微复杂点.
◆PostFix的特点◆
1.PostFix是免费,开源的,并且兼容sendmail
2.性能好,大约比sendmail*倍,一台运行postfix的台式pc每天可收发上百万邮件.
3.安全性,PostFix具有多层防御结构,可以有效地抵御恶意入侵者,可以运行在较低的权限之下.
4.灵活性好,postfix是由超过一打的小程序组成的,每个程序完成特定功能.可以通过配置设置每个程序的运行参数.
5.健壮稳定,postfix被设计成在重负荷之下仍然可以正常工作.当系统运行超出了可用的内存或磁盘空间时,postfix会自动减少运行进程的数目.当处理的邮件数目增长时,Postfix运行的进程不会跟着增加.
◆PostFix工作流程图解◆
1.客户端通过Outlook或网页客户端软件，向邮件服务器发送一封邮件,首先邮件服务器会检查是发往本域,还是发往其他域.
2.如果发送到本域直接存放到Mailbox中,另外一个用户上线,需要收取这封邮件,借助dovecot软件,通过dovecot进入数据库验证身份,验证通过以后,就可以通过MRA调用POP3或者IMAP4的协议,进入邮箱收取邮件,并且将邮件转发给用户.
3.如果发送到其他域,转发之前验证用户身份,是否要为其转发邮件,验证的时候是用到了SASL函数库,用户的信息是放到了数据库中,此时我们需要一个中间层authlib,通过authlib替SASL函数库向数据库进行验证,做"发信认证",认证通过允许转发,验证不通过拒绝转发.
4.通过浏览器访问邮件服务器(EXtmall/FoxMali),转发到其他域,放到邮箱,到数据库验证.
◆关于邮件系统中的角色◆
MUA：邮件用户代理 (sendmail qmail postfix)
MTA：邮件传输代理 (outlook)
MDA：邮件分发代理 (maildrop)
MRA：邮件检索代理 (dovecot)
postfix: 实现邮件发送服务器的角色.
dovecot: 作为邮件接收服务器的角色.
extmail: 实现利用web界面收发信件.
extman: 用户注册同个extman的页面.
mysql: 存放用户的账户信息.
cyrus-sasl,courier-authlib: 实现用户的身份验证.
◆邮件应用使用协议◆
1.SMTP,简单邮件传输协议,TCP 25端口,加密时使用TCP 465端口,(发送邮件),客户端向其他服务器发送邮件或者服务器向其他服务器转发邮件,发送方使用的都是SMTP协议.
2.POP3,第3版邮局协议,TCP 110端口,加密时使用TCP 995端口,(收邮件) 收取邮件的时候,先将服务器的邮件下载到本地,所有的操作都是在本地完成.
3.IMAP4,第4版互联网消息访问协议,TCP 143端口,加密时使用 993端口,(比POP3灵活)接收邮件,客户端和服务器端交互了以后,在服务器端处理,好处能实现更多的功能,例如查看邮件的信息,但是消耗的系统的资越高.
[简单记忆]
SMTP 简单邮件传输协议（发邮件）TCP 25端口，加密时使用TCP 465端口
POP3 第三版邮局协议（收邮件）TCP 110 端口，加密时使用 TCP 995端口
IMAP4 第四版互联网邮件访问协议（收邮件）TCP 143端口，加密时使用TCP 993端口
Postfix+Dovecot 部署邮件系统
◆配置DNS域名解析◆
首先我们需要配置bind为客户端提供dns域名解析
1.安装bind,为客户提供解析服务
[root@localhost ~]# yum install -y bind
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager.
Server 00:00:00
Resolving Dependencies
--> Running transaction check
---> Package bind.x86_64 32:9.9.4-61.el7 will be installed
--> Processing Dependency: bind-libs = 32:9.9.4-61.el7
......
Installed:
bind.x86_64 32:9.9.4-61.el7
Dependency Installed:
bind-libs.x86_64 32:9.9.4-61.el7
Complete!
[root@localhost ~]#2.修改dns主配置文件,区域文件和域名配置文件等
[root@localhost ~]# vim /etc/named.conf
12 options {
13 listen-on port 53 { any; }; #修改IPV4的侦听端口
14 listen-on-v6 port 53 { ::any; }; #修改IPV6的侦听端口
15 directory "/var/named";
16 dump-file "/var/named/data/cache_dump.db";
17 statistics-file "/var/named/data/named_stats.txt";
18 memstatistics-file "/var/named/data/named_mem_stats.txt";
19 allow-query { any; }; #允许迭代
20
21 /*
3.修改named.rfc1912.zones区域配置文件,或者写在named.conf的底部也可以
[root@localhost ~]# vim /etc/named.rfc1912.zones
42
43 zone "lyshark.com" IN { #添加此处区域文件
44 type master; #声明为主dns
45 file "lyshark.com.zone"; #声明区域配置文件名称
46 allow-update {none;}; #是否迭代
47 };4.拷贝默认区域配置文件,修改成lyshark.com.zone并做邮件交换记录配置
[root@localhost ~]# cd /var/named/
[root@localhost named]#
[root@localhost named]# ls
data dynamic named.ca named.empty named.localhost named.loopback slaves
[root@localhost named]#
[root@localhost named]# cp -a named.localhost lyshark.com.zone
[root@localhost named]#
[root@localhost named]# ls
data dynamic lyshark.com.zone named.ca named.empty named.localhost named.loopback slaves
[root@localhost named]#
[root@localhost named]# vim lyshark.com.zone
1 $TTL 1D
2 @ IN SOA dns.lyshark.com. root.lyshark.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.lyshark.com.
9 MX 3 mail.lyshark.com.
10 dns A 127.0.0.1
11 mail A 192.168.1.20
12 AAAA ::15.重启named解析服务,并设置成开机自启动
[root@localhost named]# systemctl restart named
[root@localhost named]# systemctl enable named6.此处在其他电脑配置好,dns解析地址,解析到本机,并测试是否能解析
C:\Users\LyShark>ping 192.168.1.20
正在 Ping 192.168.1.20 具有 32 字节的数据:
来自 192.168.1.20 的回复: 字节=32 时间<1ms TTL=64
C:\Users\LyShark>nslookup mail.lyshark.com
服务器: UnKnown
Address: 192.168.1.20
名称: mail.lyshark.com
Addresses: ::1
192.168.1.20
C:\Users\LyShark>◆配置PostFix服务程序◆
postfix是由IBM赞助研发的一款免费开源的电子邮件服务程序,它能够很好的兼容sendmail,可以很方便的将sendmail用户迁移到postfix服务上,postfix服务的收发邮件能力强于sendmail,而且能够自动,增加,减少进程的数量来保证邮件服务器的高性能运转,postfix有许多小模块组成,方便了功能的添加,拓展和删除,提高了可用性,用户可以灵活搭配使用.
1.安装postfix服务程序,rhel7系统默认集成,这里只做演示
[root@localhost ~]# yum install -y postfix
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager.
Package 2:postfix-2.10.1-6.el7.x86_64 already installed and latest version
Nothing to do2.配置邮局系统的主机名,在第76行,一个名为myhostname的变量,用来保存服务器主机名
[root@localhost ~]# vim /etc/postfix/main.cf
68 # INTERNET HOST AND DOMAIN NAMES
69 #
70 # The myhostname parameter specifies the internet hostname of this
71 # mail system. The default is to use the fully-qualified domain name
72 # from gethostname(). $myhostname is used as a default value for many
73 # other configuration parameters.
74 #
75 #myhostname = host.domain.tld
76 myhostname = mail.lyshark.com #解除注释,定义服务器主机名
773.配置邮局系统的域名,在第83行,一个名为mydomain的变量,用来定义邮件域
[root@localhost ~]# vim /etc/postfix/main.cf
78 # The mydomain parameter specifies the local internet domain name.
79 # The default is to use $myhostname minus the first component.
80 # $mydomain is used as a default value for many other configuration
81 # parameters.
82 #
83 mydomain = lyshark.com #解除注释,指定邮件域
844.配置本机发出的域名称,在第99行,一个名为myorigin的变量,用来定义邮件域
[root@localhost ~]# vim /etc/postfix/main.cf
94 # For the sake of consistency between sender and recipient addresses,
95 # myorigin also specifies the default domain name that is appended
96 # to recipient addresses that have no @domain part.
97 #
98 myorigin = $myhostname #解除注释,设置允许发信的用户的邮件域
99 myorigin = $mydomain #解除注释,例：admin@lyshark.com
1005.配置侦听网卡接口,在第116行,一个名为inet_interfaces的变量,用来定义网卡接口
[root@localhost ~]# vim /etc/postfix/main.cf
108 # See also the proxy_interfaces parameter, for network addresses that
109 # are forwarded to us via a proxy or network address translator.
110 #
111 # Note: you need to stop/start Postfix when this parameter changes.
112 #
113 inet_interfaces = all #解除注释,设置所有IP都提供邮件服务
114 #inet_interfaces = $myhostname
115 #inet_interfaces = $myhostname, localhost
116 #inet_interfaces = localhost #注释掉
1176.配置接收邮件的主机名或域名,在第164行,一个名为mydestination的变量,用来定义可接收邮件的主机名或域名列表,这里可以直接调用前面的两个变量myhostname和mydomain变量(如果不想调用变量,也可直接调用变量中的值)
[root@localhost ~]# vim /etc/postfix/main.cf
156 # Specify a list of host or domain names, /file/name or type:table
157 # patterns, separated by commas and/or whitespace. A /file/name
158 # pattern is replaced by its contents; a type:table is matched when
159 # a name matches a lookup key (the right-hand side is ignored).
160 # Continue long lines by starting the next line with whitespace.
161 #
162 # See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".
163 #
164 #mydestination = $myhostname, localhost.$mydomain, localhost #注释掉,设置取出那些邮件
165 mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain #解除注释
166 #mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
167 # mail.$mydomain, www.$mydomain, ftp.$mydomain7.配置邮件存储位置,在第619行,一个名为home_mailbox的变量,用来定义邮件保存位置
[root@localhost ~]# vim /etc/postfix/main.cf
413 # The home_mailbox parameter specifies the optional pathname of a
414 # mailbox file relative to a user's home directory. The default
415 # mailbox file is /var/spool/mail/user or /var/mail/user. Specify
416 # "Maildir/" for qmail-style delivery (the / is required).
417 #
418 #home_mailbox = Mailbox
419 home_mailbox = Maildir/ #解除注释
4208.最后,创建一个邮件测试账号admin,重启postfix服务,并设置成开机自启动
[root@localhost ~]# useradd -s /sbin/nologin admin
[root@localhost ~]# passwd admin
Changing password for user admin.
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: all authentication tokens updated successfully.
[root@localhost ~]#
[root@localhost ~]# systemctl restart postfix
[root@localhost ~]# systemctl enable postfix◆配置Dovecot服务程序◆
dovecot是一款能够为linux系统提供IMAP和POP3电子邮件服务的开源服务程序,安全性极高,配置简单,执行效率高,而且占用服务器资源极低,是一款很好的收件服务器.
1.通过yum安装dovecot服务程序的软件包,和依赖
[root@localhost ~]# yum install -y dovecot dovecot-devel clucene-core
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager .
Package 1:dovecot-2.2.10-8.el7.x86_64 already installed and latest version
Package clucene-core-2.3.3.4-11.el7.x86_64 already installed and latest version
Nothing to do2.配置dovecot服务,在第24行,把服务的电子邮件协议改为 imap,pop3和lmtp,在这一行下面添加 disable_plaintext_auth 允许用户明文使用邮件系统.
[root@localhost ~]# vim /etc/dovecot/dovecot.conf
16 # Default values are shown for each setting, it's not required to uncomment
17 # those. These are exceptions to this though: No sections (e.g. namespace {})
18 # or plugin settings are added by default, they're listed only as examples.
19 # Paths are also just examples with the real defaults being based on configure
20 # options. The paths listed here are for configure --prefix=/usr
21 # --sysconfdir=/etc --localstatedir=/var
22
23 # Protocols we want to be serving.
24 protocols = imap pop3 lmtp #取消注释,开启验证类型
25 disable_plaintext_auth = no #添加字段,开启允许使用明文传输3.配置允许登陆的网段,在第48行,设置允许来自于指定网段的主机使用,如果想任何人则无需修改本参数
[root@localhost ~]# vim /etc/dovecot/dovecot.conf
45 # Space separated list of trusted network ranges. Connections from these
46 # IPs are allowed to override their IP addresses and ports (for logging and
47 # for authentication checks). disable_plaintext_auth is also ignored for
48 # these networks. Typically you'd specify your IMAP proxy servers here.
49 login_trusted_networks = 192.168.1.0/24 #允许指定网段使用,屏蔽掉默认all
504.配置邮箱位置,子配置文件中,在第24行
[root@localhost ~]# vim /etc/dovecot/conf.d/10-mail.conf
22 # See doc/wiki/Variables.txt for full list. Some examples:
23 #
24 mail_location = maildir:~/Maildir #解除注释
25 # mail_location = mbox:~/mail:INBOX=/var/mail/%u
26 # mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n5.重启收件服务器,并设置开机自启动
[root@localhost ~]# systemctl restart dovecot
[root@localhost ~]# systemctl enable dovecot◆配置PostFix和Dovecot 启用SSL加密◆
由于上面的过程配置的邮件服务器使用的是明文传输,无法将其用于生产环境,下面的步骤将开启邮件服务器的SSL加密模式,让其可以在生产环境中使用
1.生成SSL密钥文件,并自行放入合适的位置
openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -sha256 -in server.csr -signkey server.key -out servernew.crt
[root@localhost ~]# ls
server.csr server.key servernew.crt
[root@localhost ~]# cp -a * /etc/pki/CA/certs/
[root@localhost ~]# ls /etc/pki/CA/certs/
server.csr server.key servernew.crt2.修改PostFix与Dovecot配置文件,启用SSL加密参数
[root@localhost ~]# vim /etc/postfix/main.cf
681 # SSL CRT 添加如下配置到末尾
682
683 smtpd_use_tls = yes
684 smtpd_tls_cert_file = /etc/pki/CA/certs/servernew.crt
685 smtpd_tls_key_file = /etc/pki/CA/certs/server.key
686 smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_scache
[root@localhost ~]# vim /etc/postfix/master.cf
# 第127-28行: 去掉注释
26 #smtps inet n - n - - smtpd
27 -o syslog_name=postfix/smtps
28 -o smtpd_tls_wrappermode=yes
29 # -o smtpd_sasl_auth_enable=yes
[root@localhost ~]# vim /etc/dovecot/conf.d/10-ssl.conf
5 # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
6 # disable plain pop3 and imap, allowed are only pop3+TLS, pop3s, imap+TLS and imaps
7 # plain imap and pop3 are still allowed for local connections
8 ssl = yes
9
10 # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
11 # dropping root privileges, so keep the key file unreadable by anyone but
12 # root. Included doc/mkcert.sh can be used to easily generate self-signed
13 # certificate, just make sure to update the domains in dovecot-openssl.cnf
14 ssl_cert = </etc/pki/CA/certs/dovecot.pem
15 ssl_key = </etc/pki/CA/private/dovecot.pem3.重启PostFix和Dovecot服务
[root@localhost ~]# systemctl restart postfix
[root@localhost ~]# systemctl restart dovecot◆测试邮件服务器连通性◆
自行下载foxmail或者outlook进行测试
https://www.foxmail.com/
https://outlook.live.com/owa/