我想使用 postfix 自动签名外发邮件。我找到了一个脚本并将其集成到 postfix 中。它的工作方式基本符合预期,但有两个错误,我希望你能帮助我修复它们。
/home/xxx/sign.sh
#!/bin/bash
WORKDIR="/tmp"
SENDMAIL="/usr/sbin/sendmail -G -i"
EX_UNAVAILABLE=69
SENDER="$2"; RECIPIENT="$4"
MESSAGEFILE="$WORKDIR/message.$$"
trap "rm -f $MESSAGEFILE; rm -f $MESSAGEFILE.signed" 0 1 2 3 15
umask 077
cat > $MESSAGEFILE || { echo Cannot save mail to file; exit $EX_UNAVAILABLE;}
SUBJECT=$(reformail -x "Subject:" < $MESSAGEFILE)
openssl smime -sign -in $MESSAGEFILE -out $MESSAGEFILE.signed -from $SENDER -to $RECIPIENT -subject "$SUBJECT" -signer /home/xxx/sign.crt -inkey /home/xxx/sign_key.crt -text || { echo Problem signing message; exit $EX_UNAVAILABLE; }
$SENDMAIL "$@" < $MESSAGEFILE.signed
exit $?
这是在 Postfix 中的实现:
smtp inet n - - - - smtpd
-o content_filter=spamassassin
-o content_filter=meinfilter:dummy
meinfilter unix - n n - 2 pipe
flags=Rq user=xxx null_sender=
argv=/home/xxx/sign.sh -f ${sender} -- ${recipient}
这些错误是
主题行始终为空,这是由于缺少软件依赖项造成的- 传递的消息的报头是双倍的(在正常报头和消息中)
这是原始电子邮件标题和正文。您可以注意到下面的双标题
To: xxx
From: xxx
Subject: Testsubject
MIME-Version: 1.0
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----2466B05A8CF1ACF5CD6D9B7B8AE72747"
This is an S/MIME signed message
------2466B05A8CF1ACF5CD6D9B7B8AE72747
Content-Type: text/plain
Return-Path: <xxx>
Received: from [127.0.0.1] (xxx [xxx])
by xxx (Postfix) with ESMTPSA id xxx
for <xxx>; Fri, 13 Sep 2013 02:49:22 +0000 (UTC)
Message-ID: <xxx>
Date: Fri, 13 Sep 2013 04:49:21 +0200
From: xxx
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8
MIME-Version: 1.0
To: xxx
Subject: Testsubject
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit
Testmessage
------2466B05A8CF1ACF5CD6D9B7B8AE72747
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
LONGTEXTLONGTEXTWITHPUBLICKEYLONGTEXTLONGTEXTWITHPUBLICKEY
LONGTEXTLONGTEXTWITHPUBLICKEYLONGTEXTLONGTEXTWITHPUBLICKEY
LONGTEXTLONGTEXTWITHPUBLICKEYLONGTEXTLONGTEXTWITHPUBLICKEY
...
LONGTEXTLONGTEXTWITHPUBLICKEYLONGTEXTLONGTEXTWITHPUBLICKEY
LONGTEXTLONGTEXTWITHPUBLICKEYLONGTEXTLONGTEXTWITHPUBLICKEY
LONGTEXTLONGTEXTWITHPUBLICKEYLONGTEXTLONGTEXTWITHPUBLICKEY
这两个问题该如何解决呢?
答案1
如果您不想将纯文本标头添加到签名的电子邮件中,请-text
从 sign.sh 脚本中的 openssl 命令中删除该选项。如上所述这里
-文本
this option adds plain text (text/plain) MIME headers to the supplied message if encrypting or signing. If decrypting or verifying it strips off text headers: if the decrypted or verified message is not of MIME type text/plain then an error occurs.
要仅签署外发电子邮件,我认为您需要做的是启用提交端口 (587) 或 smtps (465),master.cf
然后将其仅移动-o content_filter=meinfilter:dummy
到该端口
#submission
submission inet n - n - - smtpd
-o content_filter=meinfilter:dummy
这意味着只有在该端口上提交的邮件(通常与 TLS 和身份验证相关)才会由您的脚本签名。您可能还希望确保只有经过身份验证的 TLS 加密连接才允许通过您的服务器进行中继。