http://www.howtoforge.com/virtual_users_and_domains_with_postfix_debian_etch
http://www.howtoforge.com/etch_postfix_dspam_clamav
Почему вольная? Потому что многие вещи в тех хау-ту избыточны, а некоторые вредны :)
Итак, начнем:
- Ставим софт:
apt-get install postfix postfix-mysql mysql-client mysql-server courier-authdaemon courier-authlib-mysql courier-pop courier-pop-ssl courier-imap courier-imap-ssl postfix-tls libsasl2 libsasl2-modules libsasl2-modules-sql sasl2-bin libpam-mysql openssl
На вопросы отвечаем:Create directories for web-based administration ? <-- No General type of configuration? <-- Internet Site Mail name? <-- server1.example.com SSL certificate required <-- Ok
- Патч с квотами опускаем - посколько в нашем случае в нем нет необходимости.
Создаем базу в мускуле:mysqladmin -u root password yourrootsqlpassword mysqladmin -u root -p create mail mysql -u root -p GRANT SELECT, INSERT, UPDATE, DELETE ON mail.* TO 'mail_admin'@'localhost' IDENTIFIED BY 'mail_admin_password'; GRANT SELECT, INSERT, UPDATE, DELETE ON mail.* TO 'mail_admin'@'localhost.localdomain' IDENTIFIED BY 'mail_admin_password'; FLUSH PRIVILEGES; USE mail; CREATE TABLE domains ( domain varchar(50) NOT NULL, PRIMARY KEY (domain) ) TYPE=MyISAM; CREATE TABLE forwardings ( source varchar(80) NOT NULL, destination TEXT NOT NULL, PRIMARY KEY (source) ) TYPE=MyISAM; CREATE TABLE users ( email varchar(80) NOT NULL, password varchar(35) NOT NULL, PRIMARY KEY (email) ) TYPE=MyISAM; CREATE TABLE transport ( domain varchar(128) NOT NULL default '', transport varchar(128) NOT NULL default '', UNIQUE KEY domain (domain) ) TYPE=MyISAM; quit;
В таблице domains будут хранится виртуальные домены для которых принимает почту postfixdomain example.com source destination info@example.com sales@example.com email password sales@example.com $1$wksxtIk0$yePWdBTzNlaC9kKoGVynY0 ("secret" in encrypted form) domain transport example.com smtp:[1.2.3.4] - Теперь настроим Postfix для работы с базой данных. Для избежания проблем с доступом Postfix к MySQL (из-за запуска Postfix в chroot) будем использовать для доступа к базе адрес 127.0.0.1.
nano /etc/postfix/mysql-virtual_domains.cfuser = mail_admin password = mail_admin_password dbname = mail query = SELECT domain AS virtual FROM domains WHERE domain='%s' hosts = 127.0.0.1
nano /etc/postfix/mysql-virtual_forwardings.cfuser = mail_admin password = mail_admin_password dbname = mail query = SELECT destination FROM forwardings WHERE source='%s' hosts = 127.0.0.1
nano /etc/postfix/mysql-virtual_mailboxes.cfuser = mail_admin password = mail_admin_password dbname = mail query = SELECT CONCAT(SUBSTRING_INDEX(email,'@',-1),'/', SUBSTRING_INDEX(email,'@',1),'/') FROM users WHERE email='%s' hosts = 127.0.0.1
nano /etc/postfix/mysql-virtual_email2email.cfuser = mail_admin password = mail_admin_password dbname = mail query = SELECT email FROM users WHERE email='%s' hosts = 127.0.0.1
nano /etc/postfix/mysql-virtual_transports.cfuser = mail_admin password = mail_admin_password dbname = mail query = SELECT transport FROM transport WHERE domain='%s' hosts = 127.0.0.1
Выставим права:chmod o= /etc/postfix/mysql-virtual_*.cf chgrp postfix /etc/postfix/mysql-virtual_*.cf
Создадим пользователя vmail и папку /home/vmail - там будет вся почта:groupadd -g 5000 vmail useradd -g vmail -u 5000 vmail -d /home/vmail -m
зададим конфигурацию Postfix:postconf -e 'myhostname = server1.example.com' postconf -e 'mydestination = server1.example.com, localhost, localhost.localdomain' postconf -e 'mynetworks = 127.0.0.0/8' postconf -e 'virtual_alias_domains =' postconf -e 'virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf' postconf -e 'virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf' postconf -e 'virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf' postconf -e 'virtual_mailbox_base = /home/vmail' postconf -e 'virtual_uid_maps = static:5000' postconf -e 'virtual_gid_maps = static:5000' postconf -e 'smtpd_sasl_auth_enable = yes' postconf -e 'broken_sasl_auth_clients = yes' postconf -e 'smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination' postconf -e 'smtpd_use_tls = yes' postconf -e 'smtpd_tls_cert_file = /etc/postfix/smtpd.cert' postconf -e 'smtpd_tls_key_file = /etc/postfix/smtpd.key' postconf -e 'transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf' postconf -e 'virtual_create_maildirsize = yes' postconf -e 'virtual_mailbox_extended = yes' postconf -e 'proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks'
Создадим SSL сертификаты нужные для TLS:cd /etc/postfix openssl req -new -outform PEM -out smtpd.cert -newkey rsa:2048 -nodes -keyout smtpd.key -keyform PEM -days 365 -x509 chmod o= /etc/postfix/smtpd.key
- Настроим Saslauthd:
mkdir -p /var/spool/postfix/var/run/saslauthd nano /etc/default/saslauthd
# # Settings for saslauthd daemon # # Should saslauthd run automatically on startup? (default: no) START=yes # Which authentication mechanisms should saslauthd use? (default: pam) # # Available options in this Debian package: # getpwent -- use the getpwent() library function # kerberos5 -- use Kerberos 5 # pam -- use PAM # rimap -- use a remote IMAP server # shadow -- use the local shadow password file # sasldb -- use the local sasldb database file # ldap -- use LDAP (configuration is in /etc/saslauthd.conf) # # Only one option may be used at a time. See the saslauthd man page # for more information. # # Example: MECHANISMS="pam" MECHANISMS="pam" # Additional options for this mechanism. (default: none) # See the saslauthd man page for information about mech-specific options. MECH_OPTIONS="" # How many saslauthd processes should we run? (default: 5) # A value of 0 will fork a new process for each connection. THREADS=5 # Other options (default: -c) # See the saslauthd man page for information about these options. # # Example for postfix users: "-c -m /var/spool/postfix/var/run/saslauthd" # Note: See /usr/share/doc/sasl2-bin/README.Debian OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"
nano /etc/pam.d/smtpauth required pam_mysql.so user=mail_admin passwd=mail_admin_password host=127.0.0.1 db=mail table=users usercolumn=email passwdcolumn=password crypt=1 account sufficient pam_mysql.so user=mail_admin passwd=mail_admin_password host=127.0.0.1 db=mail table=users usercolumn=email passwdcolumn=password crypt=1
nano /etc/postfix/sasl/smtpd.confpwcheck_method: saslauthd mech_list: plain login allow_plaintext: true auxprop_plugin: mysql sql_hostnames: 127.0.0.1 sql_user: mail_admin sql_passwd: mail_admin_password sql_database: mail sql_select: select password from users where email = '%u'
/etc/init.d/postfix restart
/etc/init.d/saslauthd restart - Настроим Courier
nano /etc/courier/authdaemonrc[...] authmodulelist="authmysql" [...]
cp /etc/courier/authmysqlrc /etc/courier/authmysqlrc_orig
cat /dev/null > /etc/courier/authmysqlrc
nano /etc/courier/authmysqlrcMYSQL_SERVER localhost MYSQL_USERNAME mail_admin MYSQL_PASSWORD mail_admin_password MYSQL_PORT 0 MYSQL_DATABASE mail MYSQL_USER_TABLE users MYSQL_CRYPT_PWFIELD password #MYSQL_CLEAR_PWFIELD password MYSQL_UID_FIELD 5000 MYSQL_GID_FIELD 5000 MYSQL_LOGIN_FIELD email MYSQL_HOME_FIELD "/home/vmail" MYSQL_MAILDIR_FIELD CONCAT(SUBSTRING_INDEX(email,'@',-1),'/',SUBSTRING_INDEX(email,'@',1),'/') #MYSQL_NAME_FIELD MYSQL_QUOTA_FIELD quota
/etc/init.d/courier-authdaemon restart /etc/init.d/courier-imap restart /etc/init.d/courier-imap-ssl restart /etc/init.d/courier-pop restart /etc/init.d/courier-pop-ssl restart telnet localhost pop3
server1:/etc/postfix# telnet localhost pop3 Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. +OK Hello there. quit +OK Better luck next time. Connection closed by foreign host.
- Исправим алиасы и проверим Postfix:
nano /etc/aliases[...] postmaster: root root: postmaster@yourdomain.tld [...]
newaliases
telnet localhost 25
ehlo localhostTrying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. 220 server1.example.com ESMTP Postfix (Debian/GNU) ehlo localhost 250-server1.example.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH LOGIN PLAIN 250-AUTH=LOGIN PLAIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN quit 221 2.0.0 Bye Connection closed by foreign host.
- Заводим пользователей:
mysql -u root -p USE mail; INSERT INTO `domains` (`domain`) VALUES ('example.com'); INSERT INTO `users` (`email`, `password`) VALUES ('sales@example.com', VALUES('MD5')); INSERT INTO `forwardings` (`source`, `destination`) VALUES ('info@example.com','sales@example.com'); INSERT INTO `transport` (`domain`, `transport`) VALUES ('example.com','smtp:mail.example.com'); quit;
Пример того, как могут выглядеть таблицы forwardings и transport:source destination info@example.com sales@example.com Перенаправление почты для info@example.com на sales@example.com @example.com thomas@example.com Создание Catch-All аккаунта для thomas@example.com. Все письма на example.com будут падать на thomas@example.com, кроме тех что присутствуют в таблице users. @example.com @anotherdomain.tld Редирект всех писем на example.com к тем же пользователям на anotherdomain.tld. Т.е. письмо к thomas@example.com упадет на thomas@anotherdomain.tld. info@example.com sales@example.com, billing@anotherdomain.tld Пересылка письма на info@example.com на 2 или более адреса. Все перечисленые в приемнике адреса получат копию письма.
domain transport example.com : Обрабатывать почту для example.com локально. Этой записи может и не быть. example.com smtp:mail.anotherdomain.tld Передавать все письма для example.com через smtp на сервер mail.anotherdomain.com. example.com smtp:mail.anotherdomain.tld:2025 то же самое только используя порт 2025. example.com smtp:[1.2.3.4]
smtp:[1.2.3.4]:2025
smtp:[mail.anotherdomain.tld]не делать поиск в DNS MX записи. .example.com smtp:mail.anotherdomain.tld Письма для любого субдомена example.com направлять на mail.anotherdomain.tld. * smtp:mail.anotherdomain.tld Все письма направлять на mail.anotherdomain.tld. joe@example.com smtp:mail.anotherdomain.tld Письма для joe@example.com направлять на mail.anotherdomain.tld.
man transport
После правки таблицы transport надо перегружать постфикс:
postfix reload