RHEL5系统中如何安装配置Sendmail邮件服务器

作者：无视一个水阿哥_470 | 来源：互联网 | 2014-05-28 08:57

然后添加新行来允许转发的主机和网络，在这里允许station1和本地转发40☆postfix接收和转发的条件(1)默认情况下，postfix接收符合以下条件的邮件：41☆主配置文件main.cf修改/etc/postfix/main.cf的配置:设置由本台邮件主机寄出的每封邮件的

然后添加新行来允许转发的主机和网络，在这里允许station1和本地转发

40 ☆postfix接收和转发的条件
(1)默认情况下，postfix接收符合以下条件的邮件：

41 ☆主配置文件main.cf
修改/etc/postfix/main.cf的配置:

设置由本台邮件主机寄出的每封邮件的邮件头中mail from的地址

默认情况下，inet interfaces参数的值被设置为localhost，这表明只能在本地邮件主机上寄信。如果邮件主机上有多个网络接口，而又不想使全部的网络接口都开放Postfix服务，就可以用主机名指定需要开放的网络接口。不过，通常是将所有的网络接口都开放，以便接收从任何网络接口来的邮件，即将inet interfaces参数的值设置为“all”。

只有当发来的邮件的收件人地址与该参数值相匹配时，Postfix才会将该邮件接收下来。例如，这里将该参数值设置为$mydomain,$myhosname，表明无论来信的收件人地址是xxx@cngnu.org(其中，XXX表示某用户的邮件账户名)，还是xxx@mail.cngnu.org，Postfix都会接收这些邮件。

mynetworks_>

mynetworks = 127.0.0.0/8,192.168.1.0/24

设置可转发(Relay)哪些网络的邮件.可以使用mynetworks参数来设置。可将该参数值设置为所信任的某台主机的IP地址，也可设置为所信任的某个IP子网或多个IP子网(用“，”或者“”分隔)。这里，将mynetworks参数值设置为192.168.16.0／24，则表示这台邮件主机只转发子网192.168.16.0／24中的客户端所发来的邮件，而拒绝为其他子网转发邮件。

relay_domains = gdvcp.net

mynetworks参数是针对邮件来源的IP来设置的，而relay_domains参数则是针对邮件来源的域名或主机名来设置的。例如，将该参数值设置为gdvcp.net，则表示任何由域gdvcp.net发来的邮件都会被认为是信任的，Postfix会自动对这些邮件进行转发。

virtual_alias_domains = dzxx.cn,panda.com

用来指定虚拟别名域的名称

virtual_maps = hash:/etc/postfix/virtual #,mysql:/etc/postfix/virtual.mysql

含有虚拟别名域定义的文件路径。

alias_maps = hash:/etc/aliases

指定含有用户别名定义的文件路径

alias_database = hash:/etc/aliases

指定别名表数据库文件路径。

home_mailbox = Maildir/

mailbox_transport = cyrus

fallback_transport = cyrus

smtpd_sasl_auth_enable = yes

指定是否要启用SASL作为SMTP认证方式。默认不启用，这里必须将它启用，所以要将该参数值设置为“yes”。

smtpd_sasl_local_domain = ''

如果采用Cyrus-SASL V2版进行认证，那么这里不作设置。

smtpd_recipient_restrictiOns= permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination

表示通过收件人地址对客户端发来的邮件进行过滤。通常有以下几种限制规则。

permit_mynetworks:表示只要是收件人地址位于mynetworks参数中指定的网段就可以被转发邮件

permit_sasl_authenticated:表示允许转发通过SASL认证的邮件。

reject_unauth_destination:表示拒绝转发含未信任的目标地址的邮件。

broken_sasl_auth_clients = yes

表示是否兼容非标准的SMTP认证。有一些Microsoft的SMTP客户端(如Outlook Express 4.x)采用非标准的SMTP认证协议，只需将该参数设置为"yes"就可解决这类不兼容问题。

smtpd_client_restrictiOns= permit_sasl_authenticated

表示限制可以向postfix发起SMTP连接的客户端。如果要禁止未经过认证的客户端向postfix发起SMTP连接，则可将该参数值设置为permit_sasl_authenticated

smtpd_sasl_security_optiOns= noanonymous

用来限制某些登录的方式。如果将该参数值设置为noanonymous，则表示禁止采用匿名登录方式。

permit_mynetworks,

permit_sasl_authenticated,

check_recipient_access mysql:/etc/postfix/filter.mysql,

reject_invalid_hostname,

reject_non_fqdn_hostname,

reject_unknown_sender_domain,

reject_non_fqdn_sender,

reject_non_fqdn_recipient,

reject_unknown_recipient_domain,

reject_unauth_pipelining,

reject_unauth_destination,

permit

如果希望支持更多的虚拟域，可以在mydestination参数后面加上你所要支持的域即可。

通过virtual和virtual.mysql为系统提供了邮箱本地查询表。

42 ☆virtual
/etc/postfix/virtual

虚拟别名实际名

@dzxx.cn @gdvcp.net

admin@panda.com lbt

st123@panda.com st123001,st123002,st123003

daliu@panda.com lbt,liu6812@163.com

43 ☆master.cf
由postfix运行的守护程序

44 ☆pcre_table
地址改写的或邮件路由的perl表达式

45 ☆postfix-files
postfix文件和权限

46 ☆postfix-script
管理postfix,类似start,stop

47 ☆regexp_table
从postfix查找账号的表

用postconf -m来检查

48 ☆relocated
用户转移到新位置,用这里来重定向

49 ☆transport
指定一个传输协议

50 ☆postconf
postconf

测试配置文件

postconf -n

看当前配置文件的路径

51 ☆重启postfix
修改main.cf和virtual,aliases后

postmap /etc/postfix/virtual

生成etc/postfix/virtual.db

postalias /etc/aliases

生成/etc/aliases.db

postfix reload

重载main.cf

52 ☆SMTP认证的配置
如果任何人都可以通过一台邮件服务器来转发邮件，会有什么后果呢?很可能这台邮件服务器就成为了各类广告与垃圾信件的集结地或中转站，网络带宽也会很快被耗尽。为了避免这种情况的出现，MTA默认不会对外开放转发功能，而仅对本机(1ocalhost)开放转发功能。但是，在实际应用中，必须在MTA主配置文件中通过设置mynetworks、relay domains参数来开放一些所信任的网段或网域，否则该邮件服务器几乎没有什么用途。在开放了这些所信任的网段或网域后，还可以通过设置SMTP认证，对要求转发邮件的客户端进行用户身份(用户账户名与密码)验证。只有通过了验证，才能接收该用户寄来的邮件并帮助转发。

目前，比较常用的SMTP认证机制是通过Cyrus-SASI.。包来实现的。

53 ☆Cyrus-SASL
是Cyrus Simple Authentication and Security Layer的简写，它最大的功能是为应用程序提供了认证函数库。应用程序可以通过函数库所提供的功能定义认证方式，并让SASL。通过与邮件服务器主机的沟通从而提供认证的功能。

54 ☆Cyrus-SASL安装
rpm -qa | grep sasl

55 ☆Cyrus-SASL启动
运行saslauthd守护进程

service saslauthd restart

56 ☆Cyrus-SASL认证机制
默认情况下，Cyrus-SASL V2版使用saslauthd这个守护进程进行密码认证，而密码认证的方法有多种，使用下面的命令可查看当前系统中的Cyrus-SASL V2所支持的密码验证机制。

[root@panda mail]# saslauthd -v

saslauthd 2.1.19

authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap

57 ☆saslauthd配置
配置saslauthd使用shadow认证方案:

/etc/sysconfig/saslauthd

MECH=shadow

配置saslauthd使用PAM认证方案(非默认,需要配置pam,否则测试失败):

/etc/sysconfig/saslauthd

MECH=pam

命令行方式启动验证方案:

saslauthd -a shadow

用shadow的用户和密码进行验证

58 ☆测试Cyrus-SASL
ps aux | grep saslauthd

service saslauthd restart

testsaslauthd -u userid -p password

[root@panda ~]# testsaslauthd -u student -p '111111'

0: OK "Success."

如果出现以上信息，就说明saslauthd正常运行了。表示认证功能有效

服务器启动后，可以用telnet连接服务器。

# telnet localhost 25

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

220 test.tigerhead ESMTP Sendmail 8.12.10/8.12.10; Tue, 30 Mar 2004 14:50:14 +0800

ehlo test (!!!!!!!!注意命令是ehlo)你输入的命令，按回车结束。

250-test.tigerhead Hello LOCALHOST.localdomain [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES

250-PIPELINING

250-8BITMIME

250-SIZE

250-DSN

250-ETRN

250-AUTH DIGEST-MD5 CRAM-MD5 LOGIN PLAIN #就表明SMTP认证成功

250-DELIVERBY

250 HELP

以250-开头的为服务器的响应信息。注意倒数第三行，这就是成功配置smtp验证的显示。

输入quit离开。

59 ☆Cyrus-SASL配置MTA
postfix中

更改main.cf中的配置

smtpd_sasl_auth_enable = yes

smtpd_sasl_local_domain =

smtpd_sasl_security_optiOns= noanonymous

broken_sasl_auth_clients = yes

建立/usr/lib/sasl2/smtpd.conf

设置Postfix使用SASL的saslauthd认证守护进程来支持smtp auth认证，并只打开了plain和login认证模块:

[root@mail root]# echo pwcheck_method:saslauthd > /usr/lib/sasl2/smtpd.conf

[root@mail root]# echo mech_list: plain login >> /usr/lib/sasl2/smtpd.conf

sendmail中

更改/etc/mail/sendmail.mc

去掉下面俩行的注释

TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

如果sendmail没办法收信,就把

DAEMON_OPTIONS(`Port=587, Name=MSA, M=Ea')dnl 改为

DAEMON_OPTIONS(`Port=25, Name=MSA')dnl (这一句不能和DAEMON_OPTIONS(`Port=25, Name=MTA')dnl

同时存在)

建立/usr/lib/sasl2/Sendmail.conf

当sendmail要使用SMTP认证时，必须创建一个SASL的配置文件来把MTA程序定义成一个SASL应用。配置文件名为Sendmail.conf(注意是大写的S),位于/usr/lib/sasl2目录中，也就是/usr/local/sasl2/lib/sasl2这个目录，记得上面新建的链接了吗？在该文件中你定义你希望使用的认证数据库方法，以下这个例子使用saslauthd来验证认证请求。

# echo 'pwcheck_method: saslauthd' > /usr/lib/sasl2/Sendmail.conf(注意大小写)

如果是pwcheck_method: pam的话是直接调用 pam认证

如果是pwcheck_method: saslauth的话要启用 saslauth -a pam ，让saslauth调用pam认证

将这个文件复制成smtpd.conf，即cp Sendmail.conf smtpd.conf，这个文件也要在/usr/lib/sasl2/目录下

在/etc/pam.d/目录下参照其它文件建立一个“smtp”文件(postfix的是smtp.postfix)，内容如下：

#%PAM-1.0

auth required pam_stack.so service=system-auth

account required pam_stack.so service=system-auth

60 ☆dovecot配置
postfix服务只是一个MTA(邮件传输代理)，它只提供SMTP服务，也就是只提供邮件的转发及本地的分发功能。要实现邮件的异地接收，还必须安装POP或IMAP服务。

dovecot提供了这些服务:POP3,POP3S,IMAP,IMAPS

编辑/etc/dovecot.conf文件

在protocols = 一行，加入你需要的的服务

缺省的ports:

imap: 143

imaps: 993

pop3: 110

pop3s: 995

ssl_cert_file 和 ssl_key_file,可以看到dovecot是拿什么文件来做ssl认证的，可以自己创建新的pem文件。

将disable_plaintext_auth 配置为no(非缺省)

将auth_mechanisms配置为plain(缺省的)

将auth_userdb配置为passwd

也就是说缺省为所有local user 都能登录。

将auth_passdb设置为shadow

或者将auth_passdb设置为pam

增加对pop3配置文件。（缺省没有，要自己建立）

/etc/pam.d/pop3文件内容如：

auth required /lib/security/pam_stack.so service=system-auth

auth required pam_unix.so

auth required pam_listfile.so item=user sense=deny file=/etc/security/dovecot.deny Onerr=fail

account required /lib/security/pam_stack.so service=system-auth

#account required pam_access.so

account required pam_unix.so

用了pam_listfile.so模块，当然也可以用pam_access.so模块来限定。

61 ☆dovecot.conf
## Dovecot 1.0 configuration file

# Default values are shown after each value, it's not required to uncomment

# any of the lines. Exception to this are paths, they're just examples

# with real defaults being based on configure options. The paths listed here

# are for configure --prefix=/usr --syscOnfdir=/etc --localstatedir=/var

# --with-ssldir=/usr/share/ssl

# 运行时存储数据的目录

#base_dir = /var/run/dovecot/

# 加入你需要的的服务:

# imap imaps pop3 pop3s

#protocols = imap imaps

# 监听的IP或者主机地址.

# It's not currently possible to specify multiple addresses.

# "*" 是指定监听所有IPv4的interfaces.

# "[::]" 监听所有IPv6的interfaces,可能会监听所有的IPv4的interfaces但是这个取决于操作系统

# 指定端口的格式是:"host:port".

imap_listen = [::]

pop3_listen = [::]

# 监听SSL连接的IP或主机地址.

# Defaults to above non-SSL equilevants if not specified.

#imaps_listen =

#pop3s_listen =

# 禁用SSL/TLS支持.

#ssl_disable = no

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before

# dropping root privileges, so keep the key file unreadable by anyone but

# root. Included doc/mkcert.sh can be used to easily generate self-signed

# certificate, 要保证在dovecot-openssl.cnf中更新域

#ssl_cert_file = /usr/share/ssl/certs/dovecot.pem

#ssl_key_file = /usr/share/ssl/private/dovecot.pem

# SSL parameter file. Master process generates this file for login processes.

# It contains Diffie Hellman and RSA parameters.

#ssl_parameters_file = /var/run/dovecot/ssl-parameters.dat

# How often to regenerate the SSL parameters file. Generation is quite CPU

# intensive operation. The value is in hours, 0 disables regeneration

# entirely.

#ssl_parameters_regenerate = 24

# Disable LOGIN command and all other plaintext authentications unless

# SSL/TLS is used (LOGINDISABLED capability). Note that 127.*.*.* and

# IPv6 ::1 addresses are considered secure, this setting has no effect if

# you connect from those addresses.

#disable_plaintext_auth = yes

# Use this logfile instead of syslog(). /dev/stderr can be used if you want to

# use stderr for logging (ONLY /dev/stderr - otherwise it is closed).

#log_path =

# For informational messages, use this logfile instead of the default

#info_log_path =

# Prefix for each line written to log file. % codes are in strftime(3)

# format.

#log_timestamp = "%b %d %H:%M:%S "

## Login processes

# Directory where authentication process places authentication UNIX sockets

# which login needs to be able to connect to. The sockets are created when

# running as root, so you don't have to worry about permissions. Note that

# everything in this directory is deleted when Dovecot is started.

login_dir = /var/run/dovecot-login

# chroot login process to the login_dir. Only reason not to do this is if you

# wish to run the whole Dovecot without roots.

#login_chroot = yes

## IMAP login process

# Executable location.

#login_executable = /usr/libexec/dovecot/imap-login

# User to use for the login process. Create a completely new user for this,

# and don't use it anywhere else. The user must also belong to a group where

# only it has access, it's used to control access for authentication process.

#login_user = dovecot

# Set max. process size in megabytes. If you don't use

# login_process_per_connection you might need to grow this.

#login_process_size = 32

# Should each login be processed in it's own process (yes), or should one

# login process be allowed to process multiple connections (no)? Yes is more

# secure, espcially with SSL/TLS enabled. No is faster since there's no need

# to create processes all the time.

#login_process_per_cOnnection= yes

# Number of login processes to create. If login_process_per_user is

# yes, this is the number of extra processes waiting for users to log in.

#login_processes_count = 3

# Maximum number of extra login processes to create. The extra process count

# usually stays at login_processes_count, but when multiple users start logging

# in at the same time more extra processes are created. To prevent fork-bombing

# we check only once in a second if new processes should be created - if all

# of them are used at the time, we double their amount until limit set by this

# setting is reached. This setting is used only if login_process_per_use is yes.

#login_max_processes_count = 128

# Maximum number of connections allowed in login state. When this limit is

# reached, the oldest connections are dropped. If login_process_per_user

# is no, this is a per-process value, so the absolute maximum number of users

# logging in actually login_processes_count * max_logging_users.

#login_max_logging_users = 256

## POP3 login process

# Settings default to same as above, so you don't have to set anything

# unless you want to override them.

# Exception to above rule being the executable location.

#login_executable = /usr/libexec/dovecot/pop3-login

## Mail processes

# Maximum number of running mail processes. When this limit is reached,

# new users aren't allowed to log in.

#max_mail_processes = 1024

# Show more verbose process titles (in ps). Currently shows user name and

# IP address. Useful for seeing who are actually using the IMAP processes

# (eg. shared mailboxes or if same uid is used for multiple accounts).

#verbose_proctitle = no

# Show protocol level SSL errors.

#verbose_ssl = no

# Valid UID range for users, defaults to 500 and above. This is mostly

# to make sure that users can't log in as daemons or other system users.

# Note that denying root logins is hardcoded to dovecot binary and can't

# be done even if first_valid_uid is set to 0.

#first_valid_uid = 500

#last_valid_uid = 0

# Valid GID range for users, defaults to non-root/wheel. Users having

# non-valid GID as primary group ID aren't allowed to log in. If user

# belongs to supplementary groups with non-valid GIDs, those groups are

# not set.

#first_valid_gid = 1

#last_valid_gid = 0

# Grant access to these extra groups for mail processes. Typical use would be

# to give "mail" group write access to /var/mail to be able to create dotlocks.

#mail_extra_groups =

# ':' separated list of directories under which chrooting is allowed for mail

# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too).

# This setting doesn't affect login_chroot or auth_chroot variables.

# WARNING: Never add directories here which local users can modify, that

# may lead to root exploit. Usually this should be done only if you don't

# allow shell access for users. See doc/configuration.txt for more information.

#valid_chroot_dirs =

# Default chroot directory for mail processes. This can be overridden by

# giving /./ in user's home directory (eg. /home/./user chroots into /home).

#mail_chroot =

# Default MAIL environment to use when it's not set. By leaving this empty

# dovecot tries to do some automatic detection as described in

# doc/mail-storages.txt. There's a few special variables you can use:

# %u - username

# %n - user part in user@domain, same as %u if there's no domain

# %d - domain part in user@domain, empty if user there's no domain

# %h - home directory

# You can also limit a width of string by giving the number of max. characters

# after the '%' character. For example %1u gives the first character of

# username. Some examples:

# default_mail_env = maildir:/var/mail/%1u/%u/Maildir

# default_mail_env = mbox:~/mail/:INBOX=/var/mail/%u

# default_mail_env = mbox:/var/mail/%d/%n/:INDEX=/var/indexes/%d/%n

#default_mail_env =

# Space-separated list of fields to cache for all mails. Currently these

# fields are allowed followed by a list of commands they speed up:

## Envelope - FETCH ENVELOPE and SEARCH FROM, TO, CC, BCC, SUBJECT,

# SENTBEFORE, SENTON, SENTSINCE, HEADER MESSAGE-ID,

# HEADER IN-REPLY-TO

# Body - FETCH BODY

# Bodystructure - FETCH BODY, BODYSTRUCTURE

# MessagePart - FETCH BODY[1.2.3] (ie. body parts), RFC822.SIZE,

# SEARCH SMALLER, LARGER, also speeds up BODY/BODYSTRUCTURE

# generation. This is always set with mbox mailboxes, and

# also default with Maildir.

# Different IMAP clients work in different ways, that's why Dovecot by default

# only caches MessagePart which speeds up most operations. Whenever client

# does something where caching could be used, the field is automatically marked

# to be cached later. For example after FETCH BODY the BODY will be cached

# for all new messages. Normally you should leave this alone, unless you know

# what most of your IMAP clients are. Caching more fields than needed makes

# the index files larger and generate useless I/O.

# With maildir there's one extra optimization - if nothing is cached, indexing

# the maildir becomes much faster since it's not opening any of the mail files.

# This could be useful if your IMAP clients access only new mails.

#mail_cache_fields = MessagePart

# Space-separated list of fields that Dovecot should never set to be cached.

# Useful if you want to save disk space at the cost of more I/O when the fields

# needed.

#mail_never_cache_fields =

# Workarounds for various client bugs:

# oe6-fetch-no-newmail:

# Never send EXISTS/RECENT when replying to FETCH command. Outlook Express

# seems to think they are FETCH replies and gives user "Message no longer

# in server" error. Note that OE6 still breaks even with this workaround

# if synchronization is set to "Headers Only".

# outlook-idle:

# Outlook and Outlook Express never abort IDLE command, so if no mail

# arrives in half a hour, Dovecot closes the connection. This is still

# fine, except Outlook doesn't connect back so you don't see if new mail

# arrives.

# outlook-pop3-no-nuls:

# Outlook and Outlook Express hang if mails contain NUL characters.

# This setting replaces them with 0x80 character.

#client_workarounds =

# Dovecot can notify client of new mail in selected mailbox soon after it's

# received. This setting specifies the minimum interval in seconds between

# new mail notifications to client - internally they may be checked more or

# less often. Setting this to 0 disables the checking.

# NOTE: Evolution client breaks with this option when it's trying to APPEND.

#mailbox_check_interval = 0

# Like mailbox_check_interval, but used for IDLE command.

#mailbox_idle_check_interval = 30

# Allow full filesystem access to clients. There's no access checks other than

# what the operating system does for the active UID/GID. It works with both

# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/

# or ~user/.

#mail_full_filesystem_access = no

# Maximum allowed length for custom flag name. It's only forced when trying

# to create new flags.

#mail_max_flag_length = 50

# Save mails with CR+LF instead of plain LF. This makes sending those mails

# take less CPU, especially with sendfile() syscall with Linux and FreeBSD.

# But it also creates a bit more disk I/O which may just make it slower.

#mail_save_crlf = no

# Use mmap() instead of read() to read mail files. read() seems to be a bit

# faster with my Linux/x86 and it's better with NFS, so that's the default.

#mail_read_mmaped = no

# By default LIST command returns all entries in maildir beginning with dot.

# Enabling this option makes Dovecot return only entries which are directories.

# This is done by stat()ing each entry, so it causes more disk I/O.

# (For systems setting struct dirent->d_type, this check is free and it's

# done always regardless of this setting)

#maildir_stat_dirs = no

# Copy mail to another folders using hard links. This is much faster than

# actually copying the file. This is problematic only if something modifies

# the mail in one folder but doesn't want it modified in the others. I don't

# know any MUA which would modify mail files directly. IMAP protocol also

# requires that the mails don't change, so it would be problematic in any case.

# If you care about performance, enable it.

#maildir_copy_with_hardlinks = no

# Check if mails' content has been changed by external programs. This slows

# down things as extra stat() needs to be called for each file. If changes are

# noticed, the message is treated as a new message, since IMAP protocol

# specifies that existing messages are immutable.

#maildir_check_content_changes = no

# Which locking methods to use for locking mbox. There's three available:

# dotlock: Create .lock file. This is the oldest and most NFS-safe

# solution. If you want to use /var/mail/ like directory, the users

# will need write access to that directory.

# fcntl : Use this if possible. Works with NFS too if lockd is used.

# flock : May not exist in all systems. Doesn't work with NFS.

# You can use both fcntl and flock too; if you do the order they're declared

# with is important to avoid deadlocks if other MTAs/MUAs are using both fcntl

# and flock. Some operating systems don't allow using both of them

# simultaneously, eg. BSDs. If dotlock is used, it's always created first.

mbox_locks = fcntl

# Should we create dotlock file even when we want only a read-lock? Setting

# this to yes hurts the performance when the mailbox is accessed simultaneously

# by multiple processes, but it's needed for reliable reading if no other

# locking methods are available.

#mbox_read_dotlock = no

# Maximum time in seconds to wait for lock (all of them) before aborting.

#mbox_lock_timeout = 300

# If dotlock exists but the mailbox isn't modified in any way, override the

# lock file after this many seconds.

#mbox_dotlock_change_timeout = 30

# umask to use for mail files and directories

#umask = 0077

# Drop all privileges before exec()ing the mail process. This is mostly

# meant for debugging, otherwise you don't get core dumps. Note that setting

# this to yes means that log file is opened as the logged in user, which

# might not work. It could also be a small security risk if you use single UID

# for multiple users, as the users could ptrace() each others processes then.

#mail_drop_priv_before_exec = no

## IMAP process

# Executable location

#imap_executable = /usr/libexec/dovecot/imap

# Set max. process size in megabytes. Most of the memory goes to mmap()ing

# files, so it shouldn't harm much even if this limit is set pretty high.

#imap_process_size = 256

# Support for dynamically loadable modules.

#imap_use_modules = no

#imap_modules = /usr/lib/dovecot/imap

## POP3 process

# Executable location

#pop3_executable = /usr/libexec/dovecot/pop3

# Set max. process size in megabytes. Most of the memory goes to mmap()ing

# files, so it shouldn't harm much even if this limit is set pretty high.

#pop3_process_size = 256

# Support for dynamically loadable modules.

#pop3_use_modules = no

#pop3_modules = /usr/lib/dovecot/pop3

## Authentication processes

# An Authentication process is a child process used by Dovecot that

# handles the authentication steps. The steps cover an authentication

# mechanism (auth_mechanisms, how the client authenticates in the IMAP or

# POP3 protocol), which password database should be queried (auth_passdb),

# and which user database should be queried (auth_userdb, to obtain

# UID, GID, and location of the user's mailbox/home directory).

# You can have multiple processes, though a typical configuration will

# have only one. Each time "auth = xx" is seen, a new process

# definition is started. The point of multiple processes is to be able

# to set stricter permissions. (See auth_user below.)

# Just remember that only one Authentication process is asked for the

# password, so you can't have different passwords accessible through

# different process definitions (unless they have different

# auth_mechanisms, and you're ok with having different password for

# each mechanisms).

# Authentication process name.

auth = default

# Specifies how the client authenticates in the IMAP protocol.

# Space separated list of permitted authentication mechanisms:

# anonymous plain digest-md5 cram-md5

# anonymous - No authentication required.

# plain - The password is sent as plain text. All IMAP/POP3 clients

# support this, and the password can be encrypted by Dovecot to match

# any of the encryption schemes used in password databases.

# digest-md5 and cram-md5 - both encrypt the password so it is more

# secure in transit, but are not well supported by clients, and

# require that the password database use a matching encryption

# scheme (or be in plaintext).

# See auth.txt for more details.

# If you are using SSL there is less benefit to digest-md5 and

# cram-md5 as the communication is already encrypted.

auth_mechanisms = plain

# Space separated list of realms for SASL authentication mechanisms that need

# them. You can leave it empty if you don't want to support multiple realms.

# Many clients simply use the first one listed here, so keep the default realm

# first.

#auth_realms =

# Default realm/domain to use if none was specified. This is used for both

# SASL realms and appending @domain to username in plaintext logins.

#auth_default_realm =

# Where user database is kept:

# passwd: /etc/passwd or similiar, using getpwnam()

# passwd-file : passwd-like file with specified location

# static uid= gid= home=

: static settings

# vpopmail: vpopmail library

# ldap : LDAP, see doc/dovecot-ldap.conf

# pgsql : a PostgreSQL database, see doc/dovecot-pgsql.conf

auth_userdb = passwd

# Where password database is kept:

# passwd: /etc/passwd or similiar, using getpwnam()

# shadow: /etc/shadow or similiar, using getspnam()

# pam [ | *]: PAM authentication

# passwd-file : passwd-like file with specified location

# vpopmail: vpopmail authentication

# ldap : LDAP, see doc/dovecot-ldap.conf

# pgsql : a PostgreSQL database, see doc/dovecot-pgsql.conf

#auth_passdb = pgsql /usr/local/etc/dovecot-pgsql.conf

auth_passdb = pam

#auth_executable = /usr/libexec/dovecot/dovecot-auth

# Set max. process size in megabytes.

#auth_process_size = 256

# User to use for the process. This user needs access to only user and

# password databases, nothing else. Only shadow and pam authentication

# requires roots, so use something else if possible. Note that passwd

# authentication with BSDs internally accesses shadow files, which also

# requires roots.

auth_user = root

# Directory where to chroot the process. Most authentication backends don't

# work if this is set, and there's no point chrooting if auth_user is root.

#auth_chroot =

# Number of authentication processes to create

#auth_count = 1

# List of allowed characters in username. If the user-given username contains

# a character not listed in here, the login automatically fails. This is just

# an extra check to make sure user can't exploit any potential quote escaping

# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,

# set this value to empty.

#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@

# Username to use for users logging in with ANONYMOUS SASL mechanism

#auth_anonymous_username = anonymous

# More verbose logging. Useful for figuring out why authentication isn't

# working.

#auth_verbose = no

# Even more verbose logging for debugging purposes. Shows for example SQL

# queries.

#auth_debug = no

# digest-md5 authentication process. It requires special MD5 passwords which

# /etc/shadow and PAM doesn't support, so we never need roots to handle it.

# Note that the passwd-file is opened before chrooting and dropping root

# privileges, so it may be 0600-root owned file.

#auth = digest_md5

#auth_mechanisms = digest-md5

#auth_realms =

#auth_userdb = passwd-file /etc/passwd.imap

#auth_passdb = passwd-file /etc/passwd.imap

#auth_user = imapauth

#auth_chroot =

# if you plan to use only passwd-file, you don't need the two auth processes,

# simply set "auth_methods = plain digest-md5"

62 ☆Mail测试
[root@mail root]# mail virtualuser@cngnu.org

Subject: test by me

this is a test.

CC:

[root@mail root]# mailq

Mail queue is empty

[root@mail root]# tail /var/log/maillog

使用mailq来查看邮件队列是否有错误，并查看/var/log/mail/*是否有错误信息。如果一切正常，说明信件已经发送到tester了。

63 ☆测试pop/imap

测试收信，先测试POP3:

telnet panda 110

然后输入：

user username

+OK

pass password (注意是pass)

如果LOGIN成功，会有提示。

+OK Logged in.

list

+OK 2 messages:

1 849

2 823

这样的返回信息说明已经一切正常，可以提供服务了。

STAT

+OK 2 1672

TOP 1

+OK

Return-Path:

Received: from panda ([192.168.152.1])

by panda.panda.com (8.13.1/8.13.1) with SMTP id k7KJE2DZ004002

for ; Mon, 21 Aug 2006 03:14:02 +0800

Date: Mon, 21 Aug 2006 03:14:02 +0800

From: student@panda.panda.com

Message-Id: <200608201914.k7KJE2DZ004002@panda.panda.com>

To:

Subject: =?utf-8?B?TWljcm9zb2Z0IE9mZmljZSBPdXRsb29rIOa1i+ivlea2iOaBrw==?=

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: 8bit

X-IMAPbase: 1154223507 6

Status: O

X-UID: 5

Content-Length: 120

X-Keywords:

DELE 1

+OK Marked to be deleted.

QUIT

+OK Sayonara

Connection closed by foreign host.

再测试IMAP:

imtest -m login -a panda@panda.panda.com localhost

C: C01 CAPABILITY

S: * OK mail.cngnu.org Cyrus IMAP4 v2.1.16 server ready

S: * CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ NAMESPACE UIDPLUS ID NO_ATOMIC_RENAME UNSELECT MULTIAPPEND SORT THREAD=ORDEREDSUBJECT THREAD=REFERENCES IDLE

S: C01 OK Completed

Password:

C: L01 LOGIN virtualuser {6}

+ go ahead

L01 OK User logged in

Authenticated.

Security strength factor: 0

. select inbox

* FLAGS (\Answered \Flagged \Draft \Deleted \Seen)

* OK [PERMANENTFLAGS (\Answered \Flagged \Draft \Deleted \Seen \*)]

* 1 EXISTS

* 1 RECENT

* OK [UIDVALIDITY 1021736432]

* OK [UIDNEXT 3]

. OK [READ-WRITE] Completed

. fetch 1:1 (FLAGS BODY[HEADER.FIELDS (DATE FROM)])

* 1 FETCH (FLAGS (\Seen) BODY[HEADER.FIELDS (DATE FROM)] {68}

Date: Mon, 20 May 2002 09:26:09 +0800 (CST)

From: wxy@cngnu.org

)

. OK Completed

. logout

* BYE LOGOUT received

. OK Completed

64 ☆procmail
邮件分拣

Linux的sendmail使用procmail作为信件的最终投递代理。这个程序有一些非常有用的，对于我们来说，最重要的功能是信件的自动过滤和分拣功能。

信件分拣大概是用户最希望的功能，它按照邮件的文件头(发信地址，收信地址等等 )甚至邮件的正文进行归类，并且可以自动存放在各个文件中或者转发给别的用户账号。马上我们会看到，用procmail配置自动分拣是一件非常容易的事情。

通常的sendmail配置中已经使用了procmail作为邮件最终投递代理，如果你的sendmail已经改乱了，可以使用FEATURE(local_procmail)设置这个功能。

procmail主要依靠用户宿主目录下面的.procmailrc中的信息来处理邮件.如果这个配制文件不存在,则procmail只是简单的将邮件保存到用户的信箱中.

一般来说，.procmailrc文件由配置行和行为规则组成，规则的一般格式是

0 选项

[零个或多个条件,每个一行]

[动作命令] [动作命令]

0表示开始一条规则，后面可以加上一些单字符的选项，选项主要有下面的一些:

H 搜索匹配邮件头部

B 搜索匹配整个邮件

D 匹配时区分大小写

A 如果前面最近的一个没有A或a选项的规则执行,执行本规则

a 如果上面一条规则执行,则本规则执行

E 同A相反,前面最近的没有E或e选项的规则没有执行,则执行本规则

e 同a相反

h 通过管道传送邮件首部(缺省)

b 通过管道传送邮件主体(缺省)

c 复制一个邮件

I 忽略所有写操作中的错误

r 原始模式,即procmail不对mail进行任何模式的处理

条件用一个*号开始，后面跟上正则表达式

动作命令就是procmail在规则成功之后使用的命令，一般的命令有下面一些:

{}

开始一个语句段，表示把一组命令集合成一个动作。如果你要嵌套处理规则，(例如，对于来自test的邮件，区分是含有computer字符串还是含有physics字符串)那么必须使用语句段把子规则括起来。

转发信件给某个用户

启用管道将邮件传送给后面的程序，例如|auto-reply表示启动auto-reply程序并且将邮件内容作为标准输入传递给它。

任意文件名

将邮件存入某个文件。如果文件已经存在，就添加在文件的末尾。

对于熟悉perl或C语言的的用户，很容易用procmail的管道功能做出邮件的自动回复程序，这里不再介绍了，想进一步了解procmail的用户可以用

65 ☆使用POP客户端
所有的现在的邮件用户代理（MUA），例如netscape,elm,Outlook,pine和mutt都是使用POP的，可以被用作POP的客户端。每一个的配置都有所不同。同样有一个流行字符界面的的POP客户端叫做fetchmail。fetchmail是高度的可配置的，可以查询多个邮箱，可以作为守护进程运行，这样使得其每五分钟查询用户的邮箱。fetchmail在主机上递送邮件到邮件传送代理（MTA），例如sendmail。我们将勾画出以后如何安装fetchmail和使用其来查询我们装过的POP服务器。

注意到有很多选项可以影响fetchmail的行为。建立一个~/.fetchmailrc文件如下所示:

~student/.fetchmailrc

poll stationX.exmaple.com with protocol pop3: user studentXX there is user studentXX here password "password"

由于密码存储在该文件中，因此fetchmail将会拒绝运行除非您把该文件的属性设定为对于仅仅文件的所有者只读。注意还可以使用chown改变由root创建的文件的所有者为studentXX。

chmod 600 ~student/.fetchmailrc

chown student.student ~student/.fetchmailrc

尝试使用studentXX登陆到POP3邮箱

echo "hello student" | mail -s "Hola" student

su - student

fetchmail -v

exit

fetchmail能不能接收到student的POP邮件？将递送student的邮件到哪里？比从本地获取POP邮件有意义么？

让您的伙伴在另外一台机器上建立相同的~/.fetchmailrc文件（或者配置其它诸如mozilla的MTA）试图从您的服务器上进行收信。

66 ☆fetchmail
许多用户有多个邮件账户，有些在你的管理范围之内，有些在别的服务器上面。管理所有这些邮件是非常恶心的事情。另外，也许你的系统仅仅是一个拨号代理(参考第八章)，不可能始终接在internet上面。你需要的是在系统连接到internet的时候发出电子邮件，同时自动去接收电子邮件。在国内，典型的做法是每人申请一个本地电子邮件账户和一个免费电子邮件账号，问题就是，如何从另外的ISP提供的电子邮件账号哪里自动地接收邮件？

当然你可以让你的用户自己解决这个问题，不过这种僵硬的方法不见得合适。一般我们采用另外的办法，就是fetchmail，它是一个自动的邮件接力程序，可以让它从远程的 pop3账号处取得邮件，然后扔进用户的本地邮箱。(关于pop3的情况参考下一节)

可以直接用命令行调用fetchmail:

$ fetchmail -p [协议] -u [用户名] [服务器]

fetchmail得到的信息将直接投入localhost机器，账号是你启动fetchmail时使用的账号。

$ fetchmail -p POP3 -u yuanban mail.asnc.edu.cn

Enter password for yuanban@mail.asnc.edu.cn:

使用pop3协议从mail.asnc.edu.cn取得yuanban的信件。fetchmail要求你输入yuanba n的密码，然后进行验证，成功的话会出现下面的信息:

1 message for yuanban at mail.asnc.edu.cn (551840 octets).

reading message 1 of 1 (551840 octets) ................................... .....d

表示已经完成了一封信件的转交。

对于更复杂的情况，建议你使用fetchmail的配置文件，即用户宿主目录下面的.fetc hmailrc。这个文件的详细资料可以参考fetchmail的文档，这里只用一个简单地例子来介绍它。我们看一个简单的.fetchmailrc范例:

set syslog

set postmaster "isee"

poll 202.96.44.11 with proto POP3 and options

envelope Delivered-To:

user "mere" there with password "xxxxxxx" is isee@snail.home here

no keep

user "isee" there with password "yyyyyyy" is isee@snail.home here

no keep

这个范例相当简单。fetchmail在读取配置文件的时候会忽略所有的"there","here", "and","with","has","wants","options"之类的单词。

第一行set syslog程序定义fetchmail的记录文件使用系统记录功能。set postmaste r设置的是出错时的管理员账号，接下来的poll行定义了fetchmail使用的协议为POP3，连接的服务器是202.96.44.11。

envelope Delivered-To:这个选项比较有趣，它在信封上加上一个Delivered-To说明，这主要是为了让fetchmail可以把信件投递到一些使用qmail(见下面)的系统中。

接下来是fetchmail的主体部分，一个user的行定义了一个接力方法，现在的定义是取得202.96.44.11服务器上mere账号的信件，取信的口令是xxxxxxx，然后投递到isee@sn ail.home，同样，isee的信件也被自动投递到isee@snail.home。no-keep选项表示不在原始服务器上保留邮件。

下面是配置fetchmail的一些常用选项:

set logfile 制定log文件

set syslog 使用系统log文件

via 指定DNS机器名来取代poll中的机器明

proto 指定协议

port 指定端口

timeout 指定超时时间

interface 指定网络界面

user 指定远程用户

is 将本地用户和远程用户联系起来

to 同is

pass 口令