Почтовый сервер на базе OpenBSD 6.0 - История изменений

Ssh: /* Вступление */

2017-04-18T07:43:24Z

Вступление

Admwiki в 01:44, 27 октября 2016

2016-10-27T01:44:51Z

Внесённые изменения

Ssh: /* DKIMproxy */

2016-09-15T04:04:50Z

DKIMproxy

Ssh в 03:56, 15 сентября 2016

2016-09-15T03:56:40Z

Ssh: /* SpamAssassin and SpamPD */

2016-09-15T02:46:53Z

SpamAssassin and SpamPD

Ssh: /* ClamAV and ClamSMTP */

2016-09-15T02:32:20Z

ClamAV and ClamSMTP

Ssh в 02:31, 15 сентября 2016

2016-09-15T02:31:48Z

Ssh: /* ClamAV and ClamSMTP */

2016-09-15T02:28:53Z

ClamAV and ClamSMTP

Ssh в 02:17, 15 сентября 2016

2016-09-15T02:17:05Z

Ssh: /* OpenSMTPD и spamd */

2016-09-15T02:01:38Z

OpenSMTPD и spamd

@@ Строка 1: / Строка 1: @@
 = Вступление =
-Перевод [http://technoquarter.blogspot.ru/2015/02/openbsd-mail-server.html статьи] Chess Griffin с небольшим количеством комментариев от переводчика, в основном связанных с тем, что с момента релиза [http://www.openbsd.org/56.html OpenBSD 5.6], система стала еще [http://www.openbsd.org/60.html лучше!]
+Перевод [http://technoquarter.blogspot.ru статьи] Chess Griffin с небольшим количеством комментариев от переводчика, в основном связанных с тем, что с момента релиза [http://www.openbsd.org/56.html OpenBSD 5.6], система стала еще [http://www.openbsd.org/60.html лучше!]
 == Цель ==

← Предыдущая		Версия 04:04, 15 сентября 2016
Строка 349:		Строка 349:

	= DKIMproxy =		= DKIMproxy =
		+	# Follow the steps here to create public and private keys that will be used by DKIMproxy.
		+	# Create a TXT record for each domain the server will be hosting that looks something like this:
		+	#:<code>selector1._domainkey v=DKIM1; k=rsa; p=KEY_GOES_HERE TXT 1800 TTL</code>
		+	#:<br />
		+	# Install dkimproxy from ports (no packages available for OpenBSD 5.6). It has no dependencies that aren't already pulled in from prior packages so it's an easy and quick build.
		+	# Edit /etc/dkimproxy_out.conf so it looks something like this (note that the default ports are different so they don't conflict with the earlier clamsmtpd setup):
		+	#:<code># cat /etc/dkimproxy_out.conf</code>
		+	#:<code># specify what address/port DKIMproxy should listen on</code>
		+	#:<code>#listen 127.0.0.1:10027</code>
		+	#:<code>listen 127.0.0.1:10030</code>
		+	#:<br />
		+	#:<code># specify what address/port DKIMproxy forwards mail to</code>
		+	#:<code>#relay 127.0.0.1:10028</code>
		+	#:<code>relay 127.0.0.1:10029</code>
		+	#:<br />
		+	#:<code># specify what domains DKIMproxy can sign for (comma-separated, no spaces)</code>
		+	#:<code>#domain example.org</code>
		+	#:<code>domain example.com,example.net</code>
		+	#:<br />
		+	#:<code># specify what signatures to add</code>
		+	#:<code>signature dkim(c=relaxed)</code>
		+	#:<code>signature domainkeys(c=nofws)</code>
		+	#:<br />
		+	#:<code># specify location of the private key</code>
		+	#:<code>#keyfile /full/path/to/private.key</code>
		+	#:<code>keyfile /etc/mail/dkim/private.key</code>
		+	#:<br />
		+	#:<code># specify the selector (i.e. the name of the key record put in DNS)</code>
		+	#:<code>selector selector1</code>
		+	#:<code>...</code>
		+	#:<br />
		+	#: Since SpamAssassin already does DKIM checking for incoming mail, dkimproxy is only used for outgoing mail to add the DKIM keys etc. to outgoing headers.
		+	# Add "dkimproxy_out" to pkg_scripts in /etc/rc.conf.local and start it up. Again, check netstat -na -f inet to see if it's listening on port 10030.
		+	# Same drill as before. Edit /etc/mail/smtpd.conf so it looks something like this:
		+	#:<code># cat /etc/mail/smtpd.conf</code>
		+	#:<code>pki mail.example.com certificate "/etc/ssl/mail.example.com.crt"</code>
		+	#:<code>pki mail.example.com key "/etc/ssl/private/mail.example.com.key"</code>
		+	#:<br />
		+	#:<code>listen on lo0</code>
		+	#:<code>listen on lo0 port 10026 tag CLAM_IN # incoming mail</code>
		+	#:<code>listen on lo0 port 10028 tag CLAM_OUT # outgoing mail</code>
		+	#:<code>listen on lo0 port 10036 tag SPAM_IN # incoming mail</code>
		+	#:<code>listen on lo0 port 10029 tag DKIM_OUT # outgoing mail</code>
		+	#:<code>listen on egress tls pki mail.example.com auth-optional</code>
		+	#:<code>listen on egress port submission tls-require pki mail.example.com auth</code>
		+	#:<br />
		+	#:<code>table aliases db:/etc/mail/aliases.db</code>
		+	#:<code>table vusers file:/etc/mail/vusers</code>
		+	#:<code>table vdomains file:/etc/mail/vdomains</code>
		+	#:<br />
		+	#:<code>accept for local alias <aliases> deliver to maildir</code>
		+	#:<br />
		+	#:<code># tagged mail returned from dkimproxy_out relay out</code>
		+	#:<code>accept tagged DKIM_OUT for any relay</code>
		+	#:<br />
		+	#:<code># tagged mail returned from spampd deliver to maildir</code>
		+	#:<code>accept tagged SPAM_IN for domain <vdomains> virtual <vusers> deliver to maildir</code>
		+	#:<br />
		+	#:<code># tagged mail returned from clamsmtpd either send to spampd or dkimproxy_out</code>
		+	#:<code>accept tagged CLAM_IN for any relay via smtp://127.0.0.1:10035 # send to spampd</code>
		+	#:<code>accept tagged CLAM_OUT for any relay via smtp://127.0.0.1:10030 # send to dkimproxy_out</code>
		+	#:<br />
		+	#:<code># start here - untagged mail is sent to clamsmtpd</code>
		+	#:<code>accept from any for domain <vdomains> relay via smtp://127.0.0.1:10025 # incoming mail</code>
		+	#:<code>accept from local for any relay via smtp://127.0.0.1:10027 # outgoing mail</code>
		+	#:<br />
		+	# So now here is what’s happening:
		+	#: '''Incoming mail''' (unchanged from before since incoming mail is not using dkimproxy):
		+	#: pf -> relay to spamd -> send to opensmtpd on lo0 -> relay untagged mail to clamsmtpd on port 10025 -> relay to clamd on port 3310 -> return to clamsmtpd -> return to opensmtpd on lo0 port 10026 and tag it CLAM_IN -> -relay tagged CLAM_IN mail to spampd on port 10035 -> run it through SpamAssassin -> return to opensmtpd on lo0 port 10036 and tag it SPAM_IN -> deliver to maildir
		+	#: '''Outoing mail''':
		+	#: opensmtpd on lo0 -> relay untagged mail to clamsmtpd on port 10027 -> relay to clamd on port 3310 -> return to clamsmtpd -> return to opensmtpd on lo0 port 10028 and tag it CLAM_OUT -> relay to dkimproxy on port 10030 -> add DKIM headers -> return to opensmtpd on lo0 port 10029 and tag it DKIM_OUT -> relay out
		+	# Send an email and look at the headers. There should be some DKIM headers for the domain like these:
		+	#:<code>DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=example.com; h=from:date</code>
		+	#:<code> :message-id:to:subject; s=selector1; bh=[KEY HASH]</code>
		+	#:<code>DomainKey-Signature: a=rsa-sha1; c=nofws; d=example.com; h=from:date</code>
		+	#:<code> :message-id:to:subject; q=dns; s=selector1; b=[KEY HASH]</code>

	= Примечания =		= Примечания =

@@ Строка 347: / Строка 347: @@
 #: opensmtpd on lo0 -> relay untagged mail to clamsmtpd on port 10027 -> relay to clamd on port 3310 -> return to clamsmtpd -> return to opensmtpd on lo0 port 10028 and tag it CLAM_OUT -> relay out
 # Test again, both ways.  Use the GTUBE test to see if it’s flagged as spam.  There should be SpamAssassin headers in the incoming email.  SpamAssassin can be further set up for Bayesian training and cron entries for running sa-learn on designated directories.
 = Примечания =

@@ Строка 253: / Строка 253: @@
 = SpamAssassin and SpamPD =
+# Install p5-Mail-SpamAssassin and spampd from packages.
 = Примечания =

@@ Строка 251: / Строка 251: @@
 # Send some emails both ways.  This should be in the header:
 #:<code>X-Virus-Scanned: ClamAV using ClamSMTP</code>
 = SpamAssassin and SpamPD =

@@ Строка 175: / Строка 175: @@
 # Install clamav and clamsmtp from packages.
 # Edit /etc/freshclam.conf -- comment out the “Example” line and uncomment the "DatabaseMirror" line and add the relevant country code in place of the "XY."
 #:<br />
-# cat /etc/freshclam.conf
+#:Run ‘freshclam’ to update the database. Add a freshclam command to root’s crontab to have periodic updates:
-#Example
+#:<code>20 * * * * /usr/local/bin/freshclam >/dev/null 2>&1</code>
 #:<br />
 # Once freshclam has updated the database, edit /etc/clamd.conf.  Comment out the “Example” line, uncomment “TCPSocket” and “TCPAddr” lines and change them so clamd listens on port 3310 at 127.0.0.1.
 #:<br />
-# cat /etc/clamd.conf
+#: Add “clamd” to pkg_scripts in /etc/rc.conf.local and then start clamd. Check netstat -na -f inet to see if clamd is running on 127.0.0.1:3310. Check out both /etc/freshclam.conf and /etc/clamd.conf to look at logging options or actions (in VirusEvent) to take when a virus is found.  Can set it up so it drops an email into root's mailbox when a virus is found.
 # Now, set up clamsmtp, which is a proxy for clamd.  Two config files will be used, one for incoming mail and one for outgoing mail.  OpenSMTPD will accept mail, send it to clamsmtp on one port for incoming mail (10025) and a different port (10027) for outgoing mail.  Clamsmtp will run the mail through clamd, and then return it to OpenSMTPD for incoming mail (10026) or outgoing mail (10028).  Depending on which port the mail is returned to, OpenSMTPD will tag it CLAM_IN or CLAM_OUT.
 #:<br />
-#: So copy /etc/clamsmtpd.conf and create /etc/clamsmtpd-in.conf and /etc/clamsmtpd-out.conf.  Modify the files like so:
+#:<code># cat /etc/clamsmtpd-out.conf</code>
-#:<br />
+#:<code>OutAddress: 10028</code>
-# cat /etc/clamsmtpd-in.conf
+#:<code>...</code>
-OutAddress: 10026
+#:<code>Listen: 0.0.0.0:10027</code>
-...
+#:<code>...</code>
-Listen: 0.0.0.0:10025
+#:<code>ClamAddress: 127.0.0.1:3310</code>
-...
+#:<code>...</code>
 #:<br />
 # Start them both:
-# /usr/local/sbin/clamsmtpd -f /etc/clamsmtpd-in.conf
+#:<code># /usr/local/sbin/clamsmtpd -f /etc/clamsmtpd-in.conf</code>
-# /usr/local/sbin/clamsmtpd -f /etc/clamsmtpd-out.conf
+#:<code># /usr/local/sbin/clamsmtpd -f /etc/clamsmtpd-out.conf</code>
 #:<br />
 #:(add something similar to /etc/rc.local so they start at boot)
 # Edit /etc/mail/smtpd.conf so it looks like this:
-# cat /etc/mail/smtpd.conf
+#:<code># cat /etc/mail/smtpd.conf</code>
 #:<br />
-pki mail.example.com certificate "/etc/ssl/mail.example.com.crt"
+#:<code>pki mail.example.com certificate "/etc/ssl/mail.example.com.crt"</code>
-pki mail.example.com key "/etc/ssl/private/mail.example.com.key"
+#:<code>pki mail.example.com key "/etc/ssl/private/mail.example.com.key"</code>
 #:<br />
-listen on lo0
+#:<code>listen on lo0</code>
-listen on lo0 port 10026 tag CLAM_IN # incoming mail
+#:<code>listen on lo0 port 10026 tag CLAM_IN # incoming mail</code>
-listen on lo0 port 10028 tag CLAM_OUT # outgoing mail
+#:<code>listen on lo0 port 10028 tag CLAM_OUT # outgoing mail</code>
-listen on egress tls pki mail.example.com auth-optional
+#:<code>listen on egress tls pki mail.example.com auth-optional</code>
-listen on egress port submission tls-require pki mail.example.com auth
+#:<code>listen on egress port submission tls-require pki mail.example.com auth</code>
 #:<br />
-table aliases db:/etc/mail/aliases.db
+#:<code>table aliases db:/etc/mail/aliases.db</code>
-table vusers file:/etc/mail/vusers
+#:<code>table vusers file:/etc/mail/vusers</code>
-table vdomains file:/etc/mail/vdomains
+#:<code>table vdomains file:/etc/mail/vdomains</code>
 #:<br />
-accept for local alias <aliases> deliver to maildir
+#:<code>accept for local alias <aliases> deliver to maildir</code>
 #:<br />
-# tagged mail returned from clamsmtpd either deliver or relay
+#:<code># tagged mail returned from clamsmtpd either deliver or relay</code>
-accept tagged CLAM_IN for domain <vdomains> virtual <vusers> deliver to maildir
+#:<code>accept tagged CLAM_IN for domain <vdomains> virtual <vusers> deliver to maildir</code>
-accept tagged CLAM_OUT for any relay
+#:<code>accept tagged CLAM_OUT for any relay</code>
 #:<br />
-# start here - untagged mail is sent to clamsmtpd
+#:<code># start here - untagged mail is sent to clamsmtpd</code>
-accept from any for domain <vdomains> relay via smtp://127.0.0.1:10025 # incoming mail
+#:<code>accept from any for domain <vdomains> relay via smtp://127.0.0.1:10025 # incoming mail</code>
-accept from local for any relay via smtp://127.0.0.1:10027 # outgoing mail
+#:<code>accept from local for any relay via smtp://127.0.0.1:10027 # outgoing mail</code>
 #:<br />
 #: So here is what's happening:
 #: '''Incoming mail''':
 #: pf -> relay to spamd -> send to opensmtpd on lo0 -> relay untagged mail to clamsmtpd on port 10025 -> relay to clamd on port 3310 -> return to clamsmtpd -> return to opensmtpd on lo0 port 10026 and tag it CLAM_IN -> deliver to maildir
 #:<br />
-#: Outoing mail:
+#: '''Outoing mail''':
 #: opensmtpd on lo0 -> relay untagged mail to clamsmtpd on port 10027 -> relay to clamd on port 3310 -> return to clamsmtpd -> return to opensmtpd on lo0 port 10028 and tag it CLAM_OUT -> relay out
 # Send some emails both ways.  This should be in the header:
-#:<code>X-Virus-Scanned: ClamAV using ClamSMTP
+#:<code>X-Virus-Scanned: ClamAV using ClamSMTP</code>
 = Примечания =

@@ Строка 171: / Строка 171: @@
 #:'''Outoing mail''':
 #:opensmtpd on lo0 -> relay out
 = Примечания =

@@ Строка 104: / Строка 104: @@
 #:<code>accept from any for domain <vdomains> virtual <vusers> deliver to maildir</code>
 #:<code>accept from local for any relay</code>
 # Edit pf.conf to allow connections on smtp port 25 and port 587, such as:
 #:<code># cat /etc/pf.conf</code>
@@ Строка 110: / Строка 111: @@
 #:<code>pass in on egress proto tcp to any port submission</code>
 #:<code>...</code>
 # Reload pf and start /etc/rc.d/smtpd.
 # Test sending mail to/from the user's account.  Since there is no imap client yet, might want to install mutt or something similar and point to the user's ~/Maildir to check incoming mail.  The user should be able to connect to OpenSMTPD on port 587 from an outside client to send mail through OpenSMTPD to another party.  Sending outbound mail from the command line should also work.  Perhaps telnet into the server or run a couple of SMTP checks against the server like this one to verify things are working correctly.  The session transcript should look something like this:
@@ Строка 129: / Строка 131: @@
 #:<br />
 #:<code>MXTB-PWS3v2 3260ms</code>
 # If that works, set up spamd.  This is a very simple and standard setup and there are lots of resources out there on how to do this, but here is the shorthand:  Add spamd_flags=”-v” to /etc/rc.conf.local. Edit /etc/mail/spamd.conf to add override/whitelist if desired (file /etc/mail/nospamd in sample pf rules). Add spamd pf rules from example /etc/pf.conf and comment out prior rule that passed smtp on egress (because now we want incoming mail to be redirected to spamd running on localhost port 8025):
 #:<code># cat /etc/pf.conf</code>