{"id":35,"date":"2011-11-17T22:44:17","date_gmt":"2011-11-17T18:44:17","guid":{"rendered":"http:\/\/blog.mgvmi-hipl.ru\/?p=35"},"modified":"2011-11-17T22:48:54","modified_gmt":"2011-11-17T18:48:54","slug":"sasl-%d0%b2-postfix","status":"publish","type":"post","link":"https:\/\/blog.5flor.ru\/?p=35","title":{"rendered":"sasl \u0432 Postfix"},"content":{"rendered":"

[~]
\n\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 SASL \u0432 Postfix<\/p>\n

SASL \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043d\u0435 \u0438\u0437 mynetworks. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0434\u043e\u043b\u0436\u0435\u043d \u0430\u0443\u0442\u0435\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c. \u0422.\u043a. \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\/\u043f\u0430\u0440\u043e\u043b\u044c \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0442\u0435\u043a\u0441\u0442\u043e\u043c \u043d\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442, \u0442\u043e \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 TLS.<\/p>\n

\u0422\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f postfix \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 SSL (\u0441 \u0440\u0435\u043b\u0438\u0437\u0430 2.2 \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0448\u0442\u0430\u0442\u043d\u043e \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u0432\u0438). \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f cyrus-sasl2.<\/p>\n

\u041f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0444\u0430\u0439\u043b\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a \u0434\u0435\u043c\u043e\u043d\u0430 saslauthd \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f.
\n\u0411\u0430\u0437\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0432 chroot-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438 Postfix (\/var\/spool\/postfix\/etc\/sasl2\/sasldb2).<\/p>\n

\u0421\u043e\u0437\u0434\u0430\u0451\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438 \u0444\u0430\u0439\u043b:<\/p>\n

# mkdir \/var\/spool\/postfix\/etc\/sasl2\/
\n# touch \/var\/spool\/postfix\/etc\/sasl2\/sasldb2
\n# chmod 640 \/var\/spool\/postfix\/etc\/sasl2\/sasldb2
\n# chown root:postfix \/var\/spool\/postfix\/etc\/sasl2\/sasldb2<\/p>\n

\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043d\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438:<\/p>\n

# saslpasswd2 -f \/var\/spool\/postfix\/etc\/sasl2\/sasldb2 -c user@domain<\/p>\n

\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f:<\/p>\n

# sasldblistusers2 \/var\/spool\/postfix\/etc\/sasl2\/sasldb2<\/p>\n

\u0423\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u043c\u0435\u0442\u043e\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0434\u043b\u044f Postfix:<\/p>\n

# echo «pwcheck_method: sasldb» > \/etc\/sasl2\/smtpd.conf<\/p>\n

\u0421\u043e\u0437\u0434\u0430\u0451\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b postfix.pem; postfix-dsa.pem; cacert.pem, \u0431\u0435\u0437 DH. \u0421\u043c. \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 OpenSSL.<\/p>\n

\u0421\u043e\u0437\u0434\u0430\u0451\u043c \u043a\u043b\u044e\u0447\u0438 DH:<\/p>\n

# openssl gendh -out \/etc\/postfix\/dh_1024.pem -2 -rand \/var\/run\/egd-pool 1024
\n# openssl gendh -out \/etc\/postfix\/dh_512.pem -2 -rand \/var\/run\/egd-pool 512
\n# chmod 400 \/etc\/postfix\/dh_1024.pem \/etc\/postfix\/dh_512.pem
\n# chown root:root \/etc\/postfix\/dh_1024.pem \/etc\/postfix\/dh_512.pem<\/p>\n

\u0421\u043e\u0437\u0434\u0430\u0451\u043c \u0444\u0430\u0439\u043b\u044b \u0434\u043b\u044f \u043a\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439:<\/p>\n

# touch \/etc\/postfix\/smtpd_scache.dir
\n# touch \/etc\/postfix\/smtpd_scache.pag
\n# chown root:postfix \/etc\/postfix\/smtpd_scache.*
\n# chmod 660 \/etc\/postfix\/smtpd_scache.*<\/p>\n

\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u0432 main.cf:<\/p>\n

# SASL support
\nsmtpd_sasl_auth_enable = yes
\nsmtpd_sasl_local_domain = domain.ru
\nsmtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
\nsmtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
\nsmtpd_sasl_security_options = noanonymous
\nsmtpd_sasl_tls_security_options = $smtpd_sasl_security_options
\nsmtpd_tls_auth_only=yes<\/p>\n

# TLS support
\nsmtp_use_tls = yes
\nsmtpd_use_tls = yes
\nsmtp_tls_note_starttls_offer = yes
\nsmtpd_tls_enforce_tls = yes
\nsmtpd_tls_session_cache_database = sdbm:\/etc\/postfix\/smtpd_scache
\nsmtpd_tls_session_cache_timeout = 360s
\n# tls_random_source = dev:\/dev\/urandom
\n# tls_daemon_random_source = dev:\/dev\/urandom<\/p>\n

# Sertificates
\nsmtpd_tls_cert_file = \/etc\/postfix\/postfix.pem
\nsmtpd_tls_key_file = $smtpd_tls_cert_file
\nsmtpd_tls_dcert_file = \/etc\/postfix\/postfix-dsa.pem
\nsmtpd_tls_dkey_file = $smtpd_tls_dcert_file
\nsmtpd_tls_CAfile = \/etc\/postfix\/cacert.pem<\/p>\n

smtpd_tls_dh1024_param_file = \/etc\/postfix\/dh_1024.pem
\nsmtpd_tls_dh512_param_file = \/etc\/postfix\/dh_512.pem<\/p>\n

\u0418 \u0432\u0441\u0451. \u0411\u0435\u0437 TLS \u043e\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 \u043e\u0431\u044b\u0447\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435, \u0431\u0435\u0437 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.
\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c TLS — \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e.<\/p>\n

\u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0430\u0431\u043e\u0442\u044b SSL \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0447\u0435\u0440\u0435\u0437<\/p>\n

openssl s_client -connect <server>:<port> -showcerts -starttls smtp<\/p>\n","protected":false},"excerpt":{"rendered":"

[~] \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 SASL \u0432 Postfix SASL \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043d\u0435 \u0438\u0437 mynetworks. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0434\u043e\u043b\u0436\u0435\u043d \u0430\u0443\u0442\u0435\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c. \u0422.\u043a. \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\/\u043f\u0430\u0440\u043e\u043b\u044c \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0442\u0435\u043a\u0441\u0442\u043e\u043c \u043d\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442, \u0442\u043e \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 … \u0427\u0438\u0442\u0430\u0442\u044c \u0434\u0430\u043b\u0435\u0435 →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,5],"tags":[],"class_list":["post-35","post","type-post","status-publish","format-standard","hentry","category-mail","category-postfix"],"_links":{"self":[{"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=\/wp\/v2\/posts\/35"}],"collection":[{"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=35"}],"version-history":[{"count":0,"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=\/wp\/v2\/posts\/35\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=35"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=35"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.5flor.ru\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=35"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}