unbound和mail服务的部署和简单应用
2018-10-18 本文已影响60人
小短腿电工
1、服务的介绍
Unbound是一个缓存DNS解析器。unbound官网
它使用根区域的内置权威名称服务器列表
（。），所谓的根提示。在收到DNS查询时，它会询问
答案的根名称服务器，几乎在所有情况下都会收到
授权给顶级域名（TLD）权威名称服务器。它
然后会询问名称服务器的答案。它将以递归方式进行
直到找到答案或没有答案（NXDOMAIN）。
出于性能和效率的原因，答案被缓存为cer-
时间（答案的生存时间或TTL）。第二个查询
然后将从缓存中回答相同的名称。不受约束也可以
DNSSEC验证。
相传他的开发者是一位牙医，不知是否为真。
postfix这是Wietse Venema开发的邮件服务器
postfix是Wietse Venema想要为使用最广泛的提供替代品的一个尝试。在Internet世界中，大部分的电子邮件都是通过sendmail来投递的，大约有100万用户使用sendmail，每天投递上亿封邮件。这真是一个让人吃惊的数字。Postfix试图更快、更容易管理、更安全，同时还与sendmail保持足够的兼容性。
来自百度文献
2、环境介绍
server端：
[root@100 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.1 (Maipo)
[root@100 ~]# hostname
100.hzy.com
[root@100 ~]# ip a |grep inet
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
inet 192.168.137.100/24 brd 192.168.137.255 scope global eno16777736
inet6 fe80::20c:29ff:feac:5681/64 scope link
client端：
[root@200 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.1 (Maipo)
[root@200 ~]# hostname
200.hzy.com
[root@200 ~]# ip a |grep inet
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
inet 192.168.137.200/24 brd 192.168.137.255 scope global eno16777736
inet6 fe80::20c:29ff:febb:c0b0/64 scope link
3、安装和部署unbound服务
安装
yum install -y unbound
[root@100 ~]# rpm -ql unbound |grep etc
/etc/sysconfig/unbound
/etc/tmpfiles.d/unbound.conf
/etc/unbound/conf.d
/etc/unbound/conf.d/example.com.conf
/etc/unbound/keys.d
/etc/unbound/keys.d/example.com.key
/etc/unbound/local.d
/etc/unbound/local.d/block-example.com.conf
/etc/unbound/unbound.conf
找到unbound.conf修改其配置
server:
verbosity: 1
statistics-interval: 0
statistics-cumulative: no
extended-statistics: yes
num-threads: 2 #线程数
interface: 0.0.0.0 #可以是本地个任意端口ip
interface-automatic: no #自动选择端口
port: 53 #端口53相应数据包
access-control: 0.0.0.0/0 allow #相应来自所有网段的数据包
chroot: "" #虚拟目录
username: "unbound" #指定的系统用户安装默认创建
directory: "/etc/unbound" #配置文件所在的目录
log-time-ascii: yes #日志的同步时间戳
pidfile: "/var/run/unbound/unbound.pid" #这个服务的系统pid值
harden-glue: yes #
harden-dnssec-stripped: yes
harden-below-nxdomain: yes
harden-referral-path: yes
use-caps-for-id: no
unwanted-reply-threshold: 10000000
prefetch: yes
prefetch-key: yes
rrset-roundrobin: yes
minimal-responses: yes
dlv-anchor-file: "/etc/unbound/dlv.isc.org.key"
trusted-keys-file: /etc/unbound/keys.d/*.key
auto-trust-anchor-file: "/var/lib/unbound/root.key"
val-clean-additional: yes
val-permissive-mode: no
val-log-level: 1
include: /etc/unbound/local.d/*.conf #读取的解析文件路径
remote-control: #dns的控制设置
control-enable: yes
server-key-file: "/etc/unbound/unbound_server.key"
server-cert-file: "/etc/unbound/unbound_server.pem"
control-key-file: "/etc/unbound/unbound_control.key"
control-cert-file: "/etc/unbound/unbound_control.pem"
# Stub and Forward zones
include: /etc/unbound/conf.d/*.conf
他的解析文件在 include: /etc/unbound/local.d/*.conf
[root@100 ~]# cat /etc/unbound/local.d/aa.conf
local-zone: "hzy.com." static #设置静态的域
##这一行是dns的默认参数设置可以不写
local-data: "hzy.com. NS 100.hzy.com." #指定这个域里的dns服务器
local-data: "hzy.com. MX 5 100.hzy.com." #指定这个域里的mail服务器
local-data: "mail.hzy.com. IN A 192.168.137.100"
local-data: "200.hzy.com. IN A 192.168.137.200"
local-data: "www.hzy.com. IN A 192.168.137.200"
local-data: "ftp.hzy.com. IN A 192.168.137.200"
local-data-ptr: "192.168.137.200 200.hzy.com"
local-data-ptr: "192.168.137.200 www.hzy.com"
[root@100 ~]# firewall-cmd --add-port=53/tcp --permanent
[root@100 ~]# firewall-cmd --reload
测试
[root@200 ~]# nslookup mail.hzy.com
Server: 192.168.137.100
Address: 192.168.137.100#53
Name: mail.hzy.com
Address: 192.168.137.100
[root@200 ~]# nslookup www.hzy.com
Server: 192.168.137.100
Address: 192.168.137.100#53
Name: www.hzy.com
Address: 192.168.137.200
4、配置postfix服务并使用dovecot收件服务测试
安装
[root@100 ~]# yum install -y dovecot postfix
##在redhat系统中默认postfix是安装的
编辑/etc/postfix/main.cf
[root@100 ~]# grep -v "#" /etc/postfix/main.cf |grep -v "^$"
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = 100.hzy.com
mydomain = hzy.com
myorigin = hzy.com
inet_interfaces = all
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 550
mynetworks = 0.0.0.0/0
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
home_mailbox = Maildir/
smtpd_banner = $myhostname ESMTP $mail_name
debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.10.1/samples
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
message_size_limit = 10485760
mailbox_size_limit = 1073741824
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination,permit_sasl_authenticated,reject
参数
作用
myhostname
邮局系统的主机名
mydomain
邮局系统的域名
myorigin
从本机发出邮件的域名名称
inet_interfaces
监听的网卡接口
mydestination
可接收邮件的主机名或域名
mynetworks
设置可转发哪些主机的邮件
relay_domains
设置可转发哪些网域的邮件
具体参数设置参考的是# [centos7搭建postfix邮件服务器](https://www.cnblogs.com/operationhome/p/9056870.html)
编辑/etc/dovecot/dovecot.conf
将监听的类型改成*
[root@100 ~]# grep -v '#' /etc/dovecot/dovecot.conf |grep -v "^$"
listen = *
dict {
}
!include conf.d/*.conf
!include_try local.conf
编辑/etc/dovecot/conf.d/10-auth.conf
[root@100 ~]# grep -v '#' /etc/dovecot/conf.d/10-auth.conf |grep -v "^$"
disable_plaintext_auth = no ##开启明码文本认证
auth_mechanisms = plain login
!include auth-system.conf.ext
编辑/etc/dovecot/conf.d/10-mail.conf
找到并修改mail_location = maildir:~/Maildir
编辑/etc/dovecot/conf.d/10-master.conf
89 # unix_listener auth-userdb {
90 #mode = 0666
91 #user =
92 #group =
93 # }
94 unix_listener /var/spool/postfix/private/auth {
95 mode = 0666
96 user = postfix
97 group = postfix
98 }
编辑/etc/dovecot/conf.d/10-ssl.conf
因为没有设置ssl加密，所以ssl的值修改为 ssl = no
[root@100 ~]# systemctl enable dovecot
ln -s '/usr/lib/systemd/system/dovecot.service' '/etc/systemd/system/multi-user.target.wants/dovecot.service'
[root@100 ~]# systemctl start dovecot.service
5、使用Foxmail测试
使用系统用户：建议使用非登录系统用户
[root@100 ~]# id bob
uid=1001(bob) gid=1001(bob) 组=1001(bob)
[root@100 ~]# id goudan
uid=1002(goudan) gid=1002(goudan) 组=1002(goudan)
image.png
image.png
image.png
image.png
---END---
