在RHEL 4 上配置全功能的Postfix 服务器

文档版本：0.2

文档日志：

2005-12-17 至 12-20 初稿完成，首次公开

作者：Tony Feng

邮件：tonyfeng@yahoo.com

简介

本文讲述在安装了Redhat Enterprice AS 4 U2的PC上，配置一台Postfix邮件服务器的过程。实现虚拟域、虚拟用户、POP3、POP3S、SMTP、SMTPS、IMAP、IMAPS、防毒、防SPAM、网页邮件功能。

涉及的软件

1. Redhat Enterprice AS 4 U2

2. Mysql系统自带用于存储虚拟域、虚拟用户等信息。

3. Apache系统自带运行网页邮件SquirrelMail和PostfixAdmin时使用。

4. PHP系统自带运行网页邮件SquirrelMail和PostfixAdmin时使用。

5. Cyrus-sasl系统自带实现带验证的SMTP时使用。

6. Courier authentication library从http://www.courier-mta.org/ 下载实现带验证的SMTP时使用。

7. Postfix从http://postfix.org 下载一个MTA，虽然RHEL 4 自带Postfix，但因为其不支持SSL及Mysql，所以我们需要自行编译。

8. PostfixAdmin从http://postfixadmin.com/ 下载虚拟域、虚拟用户等信息是放在Mysql内的，安装PostfixAdmin后，就可以用浏览器管理这些信息。

9. SquirrelMail系统自带一个基于IMAP的Webmail客户端。

10. Dovecot系统自带提供POP3，POP3S，IMAP，IMAPS功能。

11. F-prot从http://www.f-prot.com 下载，Linux workstation 版个人使用是免费的

提供杀毒功能，据闻速度和病毒库比开源的Clamav好。

12. SpamAssassin系统自带提供过滤垃圾邮件功能。

13. MailScanner

从http://www.sng.ecs.soton.ac.uk/mailscanner/ 下载

Postfix 是使用MailScanner 调用f-prot 与SpamAssassin，或者其它调用方法效率更好，但MailScanner配置比较直观，且最近拿了一个大奖 http://www.linuxawards.co.uk/content/view/26/42/ 。

配置过程

1．基本软件安装

安装RHEL 4 U2，使用默认安装，语系为简体中文。关闭SE Linux，配置网卡，使其能访问Internet。进入X window，开始-系统设置-添加/删除应用程序，安装上文中提及“系统自带”的软件，包括：

万维网服务器：mysql %26amp; php 相关的

邮件服务器：SquirrelMail perl-cyrus

SQL 数据库：全部。

下载其它需要的软件。

2．配置PostfixAdmin、Mysql、Apache

[root@localhost tmp]# tar xzf postfixadmin-2.1.0.tgz

[root@localhost tmp]# mv postfixadmin-2.1.0 /var/www/html/pa

[root@localhost tmp]# service mysqld start

[root@localhost tmp]# mysql -uroot

[root@localhost tmp]# cp /var/www/html/pa/config.inc.php.sample /var/www/html/pa/config.inc.php

[root@localhost tmp]# service httpd start

打开浏览器访问 http://localhost/pa，然后按提示增加两个虚拟域名d1.com 和 d2.com，增加两个虚拟用户a@d1.com，b@d2.com。

设置Mysql和Apache自动启动

[root@localhost tmp]# chkconfig --level 35 mysqld on

[root@localhost tmp]# chkconfig --level 35 httpd on

3．编译、配置Postfix

先删除sendmail

[root@localhost tmp]# rpm –e sendmail –nodeps

[root@localhost tmp]# groupadd postfix

[root@localhost tmp]# groupadd postdrop

[root@localhost tmp]#useradd postfix -g postfix -c "Postfix user" -d /dev/null -s /sbin/nologin

[root@localhost tmp]# tar xzf postfix-2.2.7.tar.gz

[root@localhost tmp]# cd postfix-2.2.7

[root@localhost postfix-2.2.7]# make -f Makefile.init makefiles 'CCARGS=-DHAS_MYSQL -I/usr/include/mysql -DUSE_TLS -DUSE_SASL_AUTH -I/usr/include/sasl' 'AUXLIBS=-L/usr/lib/mysql -lmysqlclient -lz -lm -L/usr/lib -lssl -lcrypto -lsasl2'

[root@localhost postfix-2.2.7]# make

[root@localhost postfix-2.2.7]# make install

注：“make install”命令后的所有问题都直接敲回车键即可。

编辑/etc/postfix/main.cf 为以下内容

#=====================BASE=========================

myhostname = mail.d1.com

mydomain = d1.com

myorigin = $mydomain

mydestination = $myhostname localhost localhost.$mydomain

mynetworks = 192.168.1.0/24 127.0.0.0/8

inet_interfaces = all

#=====================Vritual Mailbox settings=========================

virtual_mailbox_base = /var/spool/mail

virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf

virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf

virtual_alias_domains =

virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf

virtual_uid_maps = static:501

virtual_gid_maps = static:502

virtual_transport = virtual

maildrop_destination_recipient_limit = 1

maildrop_destination_concurrency_limit = 1

#====================QUOTA========================

message_size_limit = 14336000

virtual_mailbox_limit = 20971520

virtual_create_maildirsize = yes

virtual_mailbox_extended = yes

virtual_mailbox_limit_maps = mysql:/etc/postfix/mysql_virtual_mailbox_limit_maps.cf

virtual_mailbox_limit_override = yes

virtual_maildir_limit_message = Sorry, the user's maildir has overdrawn his diskspace quota, please try again later.

virtual_overquota_bounce = yes

#====================SASL========================

broken_sasl_auth_clients = yes

smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_invalid_hostname,reject_non_fqdn_hostname,reject_unknown_sender_domain,reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unknown_recipient_domain,reject_unauth_pipelining,reject_unauth_destination,permit

smtpd_sasl_auth_enable = yes

smtpd_sasl_local_domain = $myhostname

smtpd_sasl_security_options = noanonymous

smtpd_sasl_application_name = smtpd

smtpd_banner=$myhostname ESMTP "Version not Available"

readme_directory = no

sample_directory = /etc/postfix

sendmail_path = /usr/sbin/sendmail

html_directory = no

setgid_group = postdrop

command_directory = /usr/sbin

manpage_directory = /usr/local/man

daemon_directory = /usr/libexec/postfix

newaliases_path = /usr/bin/newaliases

mailq_path = /usr/bin/mailq

queue_directory = /var/spool/postfix

mail_owner = postfix

编辑/etc/postfix/ mysql_virtual_alias_maps.cf 为以下内容

user = postfix

password = postfix

hosts = localhost

dbname = postfix

table = alias

select_field = goto

where_field = address

编辑/etc/postfix/ mysql_virtual_domains_maps.cf 为以下内容

user = postfix

password = postfix

hosts = localhost

dbname = postfix

table = domain

select_field = description

where_field = domain

编辑/etc/postfix/ mysql_virtual_mailbox_limit_maps.cf 为以下内容

user = postfix

password = postfix

hosts = localhost

dbname = postfix

table = mailbox

select_field = quota

where_field = username

编辑/etc/postfix/ mysql_virtual_mailbox_maps.cf 为以下内容

user = postfix

password = postfix

hosts = localhost

dbname = postfix

table = mailbox

select_field = maildir

where_field = username

4．配置SMTP 认证

编辑 /usr/lib/sasl2/smtpd.conf 为以下内容

pwcheck_method: authdaemond

log_level: 3

mech_list: plain login

authdaemond_path:/usr/local/courier-authlib/var/spool/authdaemon/socket

安装Courier authentication library

[root@localhost tmp]# tar jxf courier-authlib-0.58.tar.bz2

[root@localhost tmp]# cd courier-authlib-0.58

[root@localhost courier-authlib-0.58]# ./configure --prefix=/usr/local/courier-authlib --without-authpam --without-authldap --without-authpwd --without-authshadow --without-authvchkpw --without-authpgsql --with-authmysql --with-mysql-libs=/usr/lib/mysql --with-mysql-includes=/usr/include/mysql --with-redhat --with-authmysqlrc=/usr/local/courier-authlib/etc/authmysqlrc --with-authdaemonrc=/usr/local/courier-authlib/etc/authdaemonrc CFLAGS="-march=i686 -O2 -fexpensive-optimizations" CXXFLAGS="-march=i686 -O2 -fexpensive-optimizations"

[root@localhost courier-authlib-0.58]# make

[root@localhost courier-authlib-0.58]# make install

[root@localhost courier-authlib-0.58]# chmod 755 /usr/local/courier-authlib/var/spool/authdaemon

[root@localhost courier-authlib-0.58]# cp /usr/local/courier-authlib/etc/authdaemonrc.dist /usr/local/courier-authlib/etc/authdaemonrc

修改/usr/local/courier-authlib/etc/authdaemonrc 文件

authmodulelist="authmysql"

authmodulelistorig="authmysql"

daemons=10

编辑/usr/local/courier-authlib/etc/authmysqlrc 为以下内容，其中501，502 为postfix 用户的UID和GID。

MYSQL_SERVER localhost

MYSQL_USERNAME postfix

MYSQL_PASSWORD postfix

MYSQL_SOCKET /var/lib/mysql/mysql.sock

MYSQL_DATABASE postfix

MYSQL_USER_TABLE mailbox

MYSQL_CRYPT_PWFIELD password

MYSQL_UID_FIELD '501'

MYSQL_GID_FIELD '502'

MYSQL_LOGIN_FIELD username

MYSQL_HOME_FIELD concat('/var/spool/mail/',maildir)

MYSQL_MAILDIR_FIELD concat('/var/spool/mail/',maildir)

MYSQL_NAME_FIELD name

# cp courier-authlib.sysvinit /etc/init.d/courier-authlib

# chmod 755 /etc/init.d/courier-authlib

# chkconfig --add courier-authlib

# chkconfig --level 35 courier-authlib on

手动启动服务：

# service courier-authlib start

此时你已经拥有一台带验证的SMTP 服务器，用Outlook 、Foxmail测试一下吧，用户名采用usename@domainName.com 形式。

5．增加SSL功能，配置SMTPS服务

在/etc/postfix/main.cf 增加以下内容

smtp_use_tls = yes

smtpd_use_tls = yes

smtp_tls_note_starttls_offer = yes

smtpd_tls_key_file = /etc/ssl/smtpd.pem

smtpd_tls_cert_file = /etc/ssl/smtpd.pem

smtpd_tls_CAfile = /etc/ssl/smtpd.pem

smtpd_tls_loglevel = 1

smtpd_tls_received_header = yes

smtpd_tls_session_cache_timeout = 3600s

tls_random_source = dev:/dev/urandom

生成证书

# mkdir /etc/ssl

# cd /etc/ssl

# openssl req -new -x509 -nodes -out smtpd.pem -keyout smtpd.pem -days 3650

重新启动postfix

# postfix reload

这时SMTPS功能应该能正常工作了。有能力测试的网友们请验证一下这功能，因为使用SMTPS + Outlook 时有一错误提示。

6．配置Dovecot，增加IMAP，IMAPS，POP3，POP3S功能由于Dovecot 是系统自带的，配置两个文件，再生成证书就可以了。

编辑 /etc/dovecot.conf 为以下内容

base_dir = /var/run/dovecot/

protocols = imap imaps pop3 pop3s

imap_listen = [::]

pop3_listen = [::]

ssl_disable = no

ssl_cert_file = /etc/ssl/certs/imapd.pem

ssl_key_file = /etc/ssl/private/imapd.pem

ssl_parameters_file = /var/run/dovecot/ssl-parameters.dat

login_dir = /var/run/dovecot-login

mbox_locks = fcntl

auth = default

auth_mechanisms = plain

auth_userdb = passwd

auth_user = root

default_mail_env = maildir:/var/spool/mail/%u/

auth_userdb = mysql /etc/dovecot-mysql.conf

auth_passdb = mysql /etc/dovecot-mysql.conf

first_valid_uid = 501

编辑 /etc/dovecot-mysql.conf 为以下内容

db_host = localhost

db_port = 3306

db_unix_socket = /var/lib/mysql/mysql.sock

db = postfix

db_user = postfix

db_passwd = postfix

db_client_flags = 0

default_pass_scheme = PLAIN-MD5

password_query = SELECT password FROM mailbox WHERE username = '%u'

user_query = SELECT maildir, 501 AS uid, 502 AS gid FROM mailbox WHERE username = '%u'

生成证书

# mkdir /etc/ssl/certs

# mkdir /etc/ssl private

# cd /usr/share/doc/dovecot-0.99.11/

# sh mkcert.sh

启动Dovecot 服务

# service dovecot start

# chkconfig --level 35 dovecot on

顺利的话，此时SMTP、SMTPS、POP3、POP3S已经配置完成。

7．配置SquirrelMail网页邮件很简单，用浏览器访问 http://localhost/webmail

8．配置杀毒、过滤SPAM功能如果你打算将杀毒、过滤SPAM功能安排在各个客户端，以下是不必要操作的。

安装f-prot

从http://files.f-prot.com/files/linux-x86/fp-linux-ws.rpm 下载

# rpm -ivh fp-linux-ws.rpm

启动SpamAssassin

# service spamassassin start

# chkconfig --level 35 spamassassin on

安装、配置MailScanner

# tar xzf MailScanner-4.48.4-2.rpm.tar.gz

# cd MailScanner-4.48.4-2

# ./install.sh

修改 /etc/MailScanner/MailScanner.conf

Run As User = postfix

Run As Group = postfix

Incoming Queue Dir = /var/spool/postfix/hold

Outgoing Queue Dir = /var/spool/postfix/incoming

MTA = postfix

Virus Scanners = f-prot

Always Include SpamAssassin Report = yes

Use SpamAssassin = yes

Required SpamAssassin Score = 4

SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin

SpamAssassin Install Prefix = /usr/bin

SpamAssassin Local Rules Dir = /etc/MailScanner

让Postfix 调用MailScanner，在/etc/postfix/main.cf 加入以下一行

header_checks = regexp:/etc/postfix/header_checks

编辑/etc/postfix/header_checks 为以下内容

/^Received:/ HOLD

修正权限

# chown postfix.postfix /var/spool/MailScanner/incoming

# chown postfix.postfix /var/spool/MailScanner/quarantine

启用

# postfix stop

# service MailScanner start

# chkconfig --level 35 MailScanner on

注：MailScanner 会自动启动Postfix。

测试SpamAssassin

发一封邮件带如下内容，接收后，标题应该带有标记：

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

测试f-prot

升级病毒库：

# /usr/local/f-prot/tools/check-updates.pl

访问http://www.webmail.us/testvirus，申请寄一封带virus 的邮件寄到自己的邮箱

9．如果上面的操作顺利，整个配置完成

其它补充

在应用在生产环境前，请重新检查各个软件的配置文件，进行完整的测试，有发现请联系笔者，谢谢！

主要参考文档

http://bbs.chinaunix.net/viewthread.php?tid=640481

http://anti-spam.org.cn/forums/index.php?s=7949d9143931cc4859230eaf3174e456%26amp;showtopic=3357%26amp;st=0