Это старая версия документа.


Postfix

Postfix является агентом передачи почты (MTA) в Ubuntu по умолчанию. Он разработан чтобы быть быстрым, простым в администрировании и безопасным. Он совместим с MTA sendmail. Этот раздел описывает как установить и настроить postfix. Здесь также разъясняется как сделать его SMTP сервером, использующим безопасные соединения (для безопасной передачи сообщений).

Это руководство не рассматривает настройку виртуальных доменов postfix. Для получения информации по виртуальным доменам и другим расширенным настройкам смотрите Ссылки.

Установка

Для установки postfix выполните следующую команду:

sudo apt-get install postfix

Просто нажимайте ввод когда процесс установки задает вопросы, очень детальная настройка будет выполнена на следующем этапе.

Базовая настройка

Для настройки postfix, выполните следующую команду:

sudo dpkg-reconfigure postfix

Будет запущен пользовательский интерфейс. На каждом экране выбирайте следующие значения:

  1. Internet Site

  2. mail.example.com

  3. steve

  4. mail.example.com, localhost.localdomain, localhost

  5. No

  6. 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24

  7. 0

  8. +

  9. all

Замените mail.example.com на домен, для которого вы настраиваете email, 192.168.0.0/24 на актуальную подсеть и маску вашего почтового сервера и steve на соответствующее имя пользователя.

Теперь самое время решить какой формат почтового ящика вы хотите использовать. По умолчанию postfix использует mbox в качестве формата. Вместо непосредственного редактирования файла конфигурации вы можете использовать команду postconf для настройки параметров postfix. Параметры будут сохранены в файле /etc/postfix/main.cf. В дальнейшем если вы решите переконфигурировать отдельные параметры вы можете как запустить команду, так и вручную поправить файл.

Для настройки формата почтового ящика для Maildir:

sudo postconf -e 'home_mailbox = Maildir/'

Это поместит новую почту в /home/username/Maildir, поэтому вам потребуется настроить вашего агента доставки почты (MDA) на использование этого же каталога.

Аутентификация SMTP

SMTP-AUTH allows a client to identify itself through an authentication mechanism (SASL). Transport Layer Security (TLS) should be used to encrypt the authentication process. Once authenticated the SMTP server will allow the client to relay mail.

  Configure Postfix for SMTP-AUTH using SASL (Dovecot SASL):
  sudo postconf -e 'smtpd_sasl_type = dovecot'
  sudo postconf -e 'smtpd_sasl_path = private/auth-client'
  sudo postconf -e 'smtpd_sasl_local_domain ='
  sudo postconf -e 'smtpd_sasl_security_options = noanonymous'
  sudo postconf -e 'broken_sasl_auth_clients = yes'
  sudo postconf -e 'smtpd_sasl_auth_enable = yes'
  sudo postconf -e 'smtpd_recipient_restrictions = \
  permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'
  The smtpd_sasl_path configuration is a path relative to the Postfix queue directory.
  Next, generate or obtain a digital certificate for TLS. See Certificates for details. This example also uses a Certificate Authority (CA). For information on generating a CA certificate see Certification Authority.
  MUAs connecting to your mail server via TLS will need to recognize the certificate used for TLS. This can either be done using a certificate from a commercial CA or with a self-signed certificate that users manually install/accept. For MTA to MTA TLS certficates are never validated without advance agreement from the affected organizations. For MTA to MTA TLS, unless local policy requires it, there is no reason not to use a self-signed certificate. Refer to Creating a Self-Signed Certificate for more details.
  Once you have a certificate, configure Postfix to provide TLS encryption for both incoming and outgoing mail:
  sudo postconf -e 'smtp_tls_security_level = may'
  sudo postconf -e 'smtpd_tls_security_level = may'
  sudo postconf -e 'smtp_tls_note_starttls_offer = yes'
  sudo postconf -e 'smtpd_tls_key_file = /etc/ssl/private/server.key'
  sudo postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/server.crt'
  sudo postconf -e 'smtpd_tls_loglevel = 1'
  sudo postconf -e 'smtpd_tls_received_header = yes'
  sudo postconf -e 'myhostname = mail.example.com'
  If you are using your own Certificate Authority to sign the certificate enter:
  sudo postconf -e 'smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem'
  Again, for more details about certificates see Certificates.

After running all the commands, Postfix is configured for SMTP-AUTH and a self-signed certificate has been created for TLS encryption.

Now, the file /etc/postfix/main.cf should look like this.

The postfix initial configuration is complete. Run the following command to restart the postfix daemon:

sudo /etc/init.d/postfix restart

Postfix supports SMTP-AUTH as defined in RFC2554. It is based on SASL. However it is still necessary to set up SASL authentication before you can use SMTP-AUTH.

Настройка SASL

Postfix supports two SASL implementations Cyrus SASL and Dovecot SASL. To enable Dovecot SASL the dovecot-common package will need to be installed. From a terminal prompt enter the following:

sudo apt-get install dovecot-common

Next you will need to edit /etc/dovecot/dovecot.conf. In the auth default section uncomment the socket listen option and change the following:

socket listen {
  #master {
    # Master socket provides access to userdb information. It's typically
    # used to give Dovecot's local delivery agent access to userdb so it
    # can find mailbox locations.
    #path = /var/run/dovecot/auth-master
    #mode = 0600
    # Default user/group is the one who started dovecot-auth (root)
    #user = 
    #group = 
  #}
  client {
    # The client socket is generally safe to export to everyone. Typical use
    # is to export it to your SMTP server so it can do SMTP AUTH lookups
    # using it.
    path = /var/spool/postfix/private/auth-client
    mode = 0660
    user = postfix
    group = postfix
  }
}

In order to let Outlook clients use SMTP-AUTH, in the auth default section of /etc/dovecot/dovecot.conf add «login»:

mechanisms = plain login

Once you have Dovecot configured restart it with:

sudo /etc/init.d/dovecot restart

Почтовый стек доставки

Another option for configuring Postfix for SMTP-AUTH is using the mail-stack-delivery package (previously packaged as dovecot-postfix). This package will install Dovecot and configure Postfix to use it for both SASL authentication and as a Mail Delivery Agent (MDA). The package also configures Dovecot for IMAP, IMAPS, POP3, and POP3S.

You may or may not want to run IMAP, IMAPS, POP3, or POP3S on your mail server. For example, if you are configuring your server to be a mail gateway, spam/virus filter, etc. If this is the case it may be easier to use the above commands to configure Postfix for SMTP-AUTH.

To install the package, from a terminal prompt enter:

sudo apt-get install mail-stack-delivery

You should now have a working mail server, but there are a few options that you may wish to further customize. For example, the package uses the certificate and key from the ssl-cert package, and in a production environment you should use a certificate and key generated for the host. See Certificates for more details.

Once you have a customized certificate and key for the host, change the following options in /etc/postfix/main.cf:

smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key

Then restart Postfix:

sudo /etc/init.d/postfix restart

Тестирование

SMTP-AUTH configuration is complete. Now it is time to test the setup.

To see if SMTP-AUTH and TLS work properly, run the following command:

telnet mail.example.com 25

After you have established the connection to the postfix mail server, type:

ehlo mail.example.com

If you see the following lines among others, then everything is working perfectly. Type quit to exit.

250-STARTTLS 250-AUTH LOGIN PLAIN 250-AUTH=LOGIN PLAIN 250 8BITMIME

Решение проблем

This section introduces some common ways to determine the cause if problems arise.

Отказ от режима chroot

The Ubuntu postfix package will by default install into a chroot environment for security reasons. This can add greater complexity when troubleshooting problems.

To turn off the chroot operation locate for the following line in the /etc/postfix/master.cf configuration file:

smtp inet n - - - - smtpd

and modify it as follows:

smtp inet n - n - - smtpd

You will then need to restart Postfix to use the new configuration. From a terminal prompt enter:

sudo /etc/init.d/postfix restart

Файлы журналов

Postfix sends all log messages to /var/log/mail.log. However error and warning messages can sometimes get lost in the normal log output so they are also logged to /var/log/mail.err and /var/log/mail.warn respectively.

To see messages entered into the logs in real time you can use the tail -f command:

tail -f /var/log/mail.err

The amount of detail that is recorded in the logs can be increased. Below are some configuration options for increasing the log level for some of the areas covered above.

  To increase TLS activity logging set the smtpd_tls_loglevel option to a value from 1 to 4.
  sudo postconf -e 'smtpd_tls_loglevel = 4'
  If you are having trouble sending or receiving mail from a specific domain you can add the domain to the debug_peer_list parameter.
  sudo postconf -e 'debug_peer_list = problem.domain'
  You can increase the verbosity of any Postfix daemon process by editing the /etc/postfix/master.cf and adding a -v after the entry. For example edit the smtp entry:
  smtp      unix  -       -       -       -       -       smtp -v

It is important to note that after making one of the logging changes above the Postfix process will need to be reloaded in order to recognize the new configuration: sudo /etc/init.d/postfix reload

  To increase the amount of information logged when troubleshooting SASL issues you can set the following options in /etc/dovecot/dovecot.conf
  auth_debug=yes
  auth_debug_passwords=yes

Just like Postfix if you change a Dovecot configuration the process will need to be reloaded: sudo /etc/init.d/dovecot reload.

Some of the options above can drastically increase the amount of information sent to the log files. Remember to return the log level back to normal after you have corrected the problem. Then reload the appropriate daemon for the new configuration to take affect.

Ссылки

Administering a Postfix server can be a very complicated task. At some point you may need to turn to the Ubuntu community for more experienced help.

A great place to ask for Postfix assistance, and get involved with the Ubuntu Server community, is the #ubuntu-server IRC channel on freenode. You can also post a message to one of the Web Forums.

For in depth Postfix information Ubuntu developers highly recommend: The Book of Postfix.

Finally, the Postfix website also has great documentation on all the different configuration options available.

Also, the Ubuntu Wiki Postifx page has more information.