{"id":1437,"date":"2021-08-17T17:32:44","date_gmt":"2021-08-17T09:32:44","guid":{"rendered":"https:\/\/www.dxQerp.cn\/?p=1437"},"modified":"2021-09-06T06:54:26","modified_gmt":"2021-09-05T22:54:26","slug":"postfix-tls","status":"publish","type":"post","link":"http:\/\/www.dxQerp.cn\/?p=1437","title":{"rendered":"Postfix – TLS"},"content":{"rendered":"\n

\u70ba\u4e86\u4f7f\u7528 TLS\uff0cPostfix SMTP \u901a\u5e38\u9700\u8981’\u8b49\u66f8’<\/strong>\u548c’\u79c1\u9470’<\/strong>\u3002<\/h2>\n\n\n\n

\u5169\u8005\u90fd\u5fc5\u9808\u662f\u201cPEM<\/strong>\u201d\u683c\u5f0f, \u79c1\u9470<\/strong>\u4e0d\u5f97\u52a0\u5bc6.<\/p>\n\n\n\n

CA\u8b49\u66f8, \u9700\u8981\u767c\u884c\u6a5f\u69cb<\/strong> (\u4ed8\u8cbb \u6216\u662f \u81ea\u5df1\u5c31\u662f\u767c\u884c\u6a5f\u69cb)<\/p>\n\n\n\n

\u53d7\u4fe1\u4efb\u7684 CA<\/strong><\/p>\n\n\n\n

dnf info ca-certificates<\/code><\/pre>\n\n\n\n
\u7522\u751f SSL \u6191\u8b49<\/strong><\/p>\n\n\n\n
\u5229\u7528 dovecot \u7684 \u8173\u672c mkcert.sh \u751f\u6210<\/p>\n\n\n\n
vi \/etc\/pki\/dovecot\/dovecot-openssl.cnf  (dovecot-openssl.cnf \u6a23\u677f)<\/code><\/pre>\n\n\n\n
\/usr\/libexec\/dovecot\/mkcert.sh   (\u9ed8\u8a8d\u60c5\u6cc1\u4e0b)<\/code><\/pre>\n\n\n\n
\u8b49\u66f8 \u5275\u5efa\u70ba \/etc\/pki\/tls\/certs\/mail.dxqerp.com.pem
\u79c1\u9470 \u5275\u5efa\u70ba \/etc\/pki\/tls\/private\/mail.dxqerp.com.pem<\/p>\n\n\n\n
\u6b64\u5916\uff0c\u9ed8\u8a8d\u60c5\u6cc1\u4e0b\uff0c\u8b49\u66f8\u5c07\u5728 365 \u5929\u540e\u904e\u671f\u3002
\u5982\u679c\u60a8\u60f3\u66f4\u6539\u5176\u4e2d\u4efb\u4f55\u4e00\u9805\uff0c\u8acb\u4fee\u6539 mkcert.sh \u8173\u672c<\/p>\n\n\n\n
smtpd_tls_cert_file =\/etc\/pki\/tls\/certs\/mail.dxqerp.com.pem
smtpd_tls_key_file =\/etc\/pki\/tls\/private\/mail.dxqerp.com.pem<\/code><\/pre>\n\n\n\n
\u8b49\u66f8 \u548c \u79c1\u9470<\/strong><\/p>\n\n\n\n
PEM \u683c\u5f0f\u662f \u8b49\u66f8\u9812\u767c\u6a5f\u69cb <\/strong>\u9812\u767c\u8b49\u66f8\u7684\u6700\u5e38\u898b\u683c\u5f0f\u3002
PEM \u8b49\u66f8\u901a\u5e38\u5177\u6709\u64f4\u5c55\u540d\uff0c\u4f8b\u5982 .pem\u3001.crt\u3001.cer \u548c .key\u3002
\u5b83\u5011\u662f Base64 \u7de8\u78bc\u7684 ASCII \u6587\u4ef6\uff0c<\/p>\n\n\n\n
\u5305\u542b\u201c—–BEGIN CERTIFICATE—–\u201d\u548c\u201c—–END CERTIFICATE—–\u201d\u8a9e\u53e5\u3002
\u670d\u52d9\u5668\u8b49\u66f8\u3001\u4e2d\u9593\u8b49\u66f8\u548c\u79c1\u9470\u90fd\u53ef\u4ee5\u653e\u5165 PEM \u683c\u5f0f\u3002<\/p>\n\n\n\n
\u78ba\u8a8d<\/strong><\/p>\n\n\n\n
openssl x509 -in mail.dxqerp.com.pem -noout -subject<\/code><\/pre>\n\n\n\n
openssl x509 -in<\/span> mail.dxqerp.com.pem -noout -text<\/code><\/pre>\n\n\n\n
\u914d\u7f6e <\/strong>
Smtp Server<\/strong><\/p>\n\n\n\n
smtpd_tls_security_level = may<\/span>  # \u9810\u8a2d \u7a7a\u5b57\u4e32
# \u8f6c\u53d1\u90ae\u4ef6\u914d\u7f6e\u542f\u7528SSL\/TLS,\u82e5remote SMTP server\u652f\u6301 TLS\/SSL\uff0c\u5219\u4f7f\u7528TLS\/SSL\u4f20\u8f93\uff0c\u5426\u5219\u4f7f\u7528\u4f20\u7edf\u7684SMTP+TCP\u3002<\/code><\/pre>\n\n\n\n
smtpd_tls_loglevel = 1<\/span>   # \u9810\u8a2d 0
# \u50c5\u8a18\u9304 TLS \u63e1\u624b\u5b8c\u6210\u6642\u7684\u6458\u8981\u6d88\u606f<\/code><\/pre>\n\n\n\n
smtpd_tls_received_header = yes<\/span>  # \u9810\u8a2d \u7a7a\u5b57\u4e32
# \u8acb\u6c42 Postfix SMTP \u670d\u52d9\u5668\u751f\u6210 Received: \u6d88\u606f\u6a19\u982d\uff0c\u5176\u4e2d\u5305\u542b\u6709\u95dc\u4f7f\u7528\u7684\u5354\u8b70\u548c\u5bc6\u78bc\u7684\u4fe1\u606f<\/code><\/pre>\n\n\n\n
smtpd_tls_auth_only = yes<\/span>
#\u5f37\u8feb SASL \u9a57\u8b49\u63a1\u7528 TLS \u4e26\u7981\u6b62\u7d14\u6587\u5b57\u9a57\u8b49\u767c\u751f\uff0c\u9664\u975e\u5df2\u7d93\u5efa\u7acb\u4e86\u4e00\u500b TLS \u5de5\u4f5c\u968e\u6bb5\u3002
\uff08\u5728\u6e2c\u8a66\u6642\u8a3b\u91cb\u6389 smtpd_tls_auth_only = yes \u4e5f\u8a31\u6703\u6709\u7528\uff0c\u597d\u8b93\u6211\u5011\u80fd\u6e2c\u8a66 SSL\uff0fTLS \u80fd\u5426\u904b\u4f5c\uff0c\u4f46\u7576 SSL\uff0fTLS \u5931\u6548\u6642\u4ecd\u6709\u7d14\u6587\u5b57 SASL \u9a57\u8b49\u4f5c\u70ba\u5f8c\u5099\uff09\u3002
\u5982\u679c\u4e00\u5207\u5982\u671f\u904b\u4f5c\uff0c\u6211\u5011\u61c9\u8a72\u6703\u770b\u898b\u4f3a\u670d\u5668\u63d0\u4f9b STARTTLS\uff0c\u800c\u4e14\u56e0\u70ba\u6211\u5011\u6307\u5b9a 'smtpd_tls_auth_only = yes'\uff0c\u7d14\u6587\u5b57 SASL \u9a57\u8b49\uff08AUTH PLAIN LOGIN \u53ca AUTH=PLAIN LOGIN\uff09\u5df2\u4e0d\u518d\u88ab\u652f\u63f4\u3002<\/code><\/pre>\n\n\n\n
Smtp Client<\/strong><\/p>\n\n\n\n
smtp_tls_security_level = encrypt<\/span>  # \u9810\u8a2d may
# Postfix SMTP \u5ba2\u6236\u7aef\u7684\u5b89\u5168\u7d1a\u5225 ( encrypt \u52a0\u5bc6)<\/code><\/pre>\n\n\n\n
smtp_tls_note_starttls_offer = yes<\/span>
# \u7576\u5c1a\u672a\u70ba\u8a72\u670d\u52d9\u5668\u555f\u7528 TLS \u6642\uff0c\u8a18\u9304\u63d0\u4f9b STARTTLS \u7684\u9060\u7a0b SMTP \u670d\u52d9\u5668\u7684\u4e3b\u6a5f\u540d\u3002<\/code><\/pre>\n\n\n\n
systemctl restart postfix<\/code><\/pre>\n\n\n\n
\u6e2c\u8a66<\/strong><\/p>\n\n\n\n
echo \"Body: This is a test mail. Hallo Charlie\" | mail -s \"Subject: A big test\" qq@mail.dxqerp.com<\/code><\/pre>\n\n\n\n
Connection to the SMTP server<\/strong><\/p>\n\n\n\n
openssl s_client -connect localhost:25 -starttls smtp<\/code><\/pre>\n\n\n\n
STARTTLS Command<\/h4>\n\n\n\n
nc localhost 25<\/code><\/pre>\n\n\n\n
THE END<\/strong><\/h2>\n\n\n\n
\u53c3\u8003<\/h3>\n\n\n\n
https:\/\/datacadamia.com\/marketing\/email\/postfix\/tls#starttls_command<\/a><\/p>\n\n\n\n
https:\/\/wiki.centos.org\/zh-tw\/HowTos\/postfix_sasl<\/a><\/p>\n\n\n\n
https:\/\/doc.dovecot.org\/configuration_manual\/howto\/postfix_and_dovecot_sasl\/#howto-postfix-and-dovecot-sasl<\/a><\/p>\n\n\n\n
https:\/\/www.linuxtechi.com\/install-configure-postfix-mailserver-centos-8\/<\/a><\/p>\n\n\n\n
https:\/\/www.cnblogs.com\/shenlinken\/p\/9968274.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
\u70ba\u4e86\u4f7f\u7528 TLS\uff0cPostfix SMTP \u901a\u5e38\u9700\u8981’\u8b49\u66f8’\u548c’\u79c1\u9470&#8 […]<\/p>\n","protected":false},"author":1,"featured_media":1490,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[36],"tags":[],"jetpack_featured_media_url":"http:\/\/www.dxQerp.cn\/wp-content\/uploads\/2021\/09\/postfix-TLS-How-to.png","_links":{"self":[{"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=\/wp\/v2\/posts\/1437"}],"collection":[{"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1437"}],"version-history":[{"count":23,"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=\/wp\/v2\/posts\/1437\/revisions"}],"predecessor-version":[{"id":1498,"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=\/wp\/v2\/posts\/1437\/revisions\/1498"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=\/wp\/v2\/media\/1490"}],"wp:attachment":[{"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1437"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.dxQerp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}