☰

Dovecot 无法连接到 imaps 993

tag-icon • tag-icon email-server dovecot imap digital-ocean
Dovecot 无法连接到 imaps 993

我正在尝试在 digitalocean VPS 中设置邮件服务器。问题是我无法远程登录到 993，尽管防火墙处于非活动状态并且 dovecot 正在监听。请告诉我我哪里做错了。我跟着本 postfix、dovecot、mysql、spamassasin 教程。

我的服务器操作系统：

lsb_release -a

结果：

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.1 LTS
Release:        16.04
Codename:       xenial

我按照教程一直到这部分：telnet example.com 993结果是：

telnet mysite.com 993
Trying 127.0.1.1...
Connected to mysite.com.
Escape character is '^]'.
Connection closed by foreign host.

我检查了防火墙：sudo ufw status结果是：

Status: inactive

以及 dovecot 是否处于活动状态：sudo netstat -plutn | grep 993

tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      27460/dovecot
tcp6       0      0 :::993                  :::*                    LISTEN      27460/dovecot

Dovecot -F 没有显示错误，以下是 dovecot -n 的输出：

# 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.13 (7b14904)
# OS: Linux 4.4.0-34-generic x86_64 Ubuntu 16.04.1 LTS ext4
auth_mechanisms = plain login
mail_location = maildir:/var/mail/vhosts/%d/%n
mail_privileged_group = mail
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix =
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
protocols = imap lmtp pop3
service auth-worker {
  user = vmail
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
  }
  user = dovecot
}
service imap-login {
  inet_listener imap {
    port = 0
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
ssl = required
ssl_cert = /etc/letsencrypt/live/mysite.com/fullchain.pem
ssl_key = /etc/letsencrypt/live/mysite.com/privkey.pem
userdb {
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
  driver = static
}

但是 Telnet 到 postfix smtp 是可以的：telnet mysite.com smtp结果：

Trying 127.0.1.1...
Connected to mysite.com.
Escape character is '^]'.
220 mysite.com ESMTP Postfix (Ubuntu)
ehlo mysite.com
250-mysite.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye
Connection closed by foreign host.

请帮忙。

编辑1：

仍然没有运气openssl s_client -connect mysite.com:993 -crlf

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1515817904
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

雷鸟运气不佳： Thunderbird 失败

正在运行：telnet mysite.com 110有时立即关闭，有时延迟一分钟才关闭。

Trying 127.0.1.1...
Connected to mysite.com.
Escape character is '^]'.
Connection closed by foreign host.

从我在其他地方读到的内容来看，我想我应该期待这一行：+OK Dovecot (Ubuntu) ready.

更多信息：sudo netstat -pltn结果：

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:34600         0.0.0.0:*               LISTEN      27939/postgres
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      27886/mysqld
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      27434/master
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN      27460/dovecot
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2409/sshd
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      27434/master
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      27460/dovecot
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN      27460/dovecot
tcp6       0      0 :::587                  :::*                    LISTEN      27434/master
tcp6       0      0 :::110                  :::*                    LISTEN      27460/dovecot
tcp6       0      0 :::80                   :::*                    LISTEN      1519/apache2
tcp6       0      0 :::22                   :::*                    LISTEN      2409/sshd
tcp6       0      0 :::25                   :::*                    LISTEN      27434/master
tcp6       0      0 :::443                  :::*                    LISTEN      1519/apache2
tcp6       0      0 :::993                  :::*                    LISTEN      27460/dovecot
tcp6       0      0 :::995                  :::*                    LISTEN      27460/dovecot

sshd_config顺便问一下...这与>有什么关系吗PasswordAuthentication no

其他信息sudo iptables-save：：

# Generated by iptables-save v1.6.0 on Sat Jan 13 12:55:47 2018
*filter
:INPUT ACCEPT [53354:9755959]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [48733:30432882]
COMMIT
# Completed on Sat Jan 13 12:55:47 2018

答案1

解决方案

该问题实际上是一个配置问题，dovecot 本身对此进行了评论/var/log/syslog：

Jan 14 17:34:23 mysite dovecot: imap-login: Fatal: Can't load ssl_cert: There is no valid PEM certificate. (You probably forgot '<' from ssl_cert=</etc/letsencrypt/live/mysite.com/fullchain.pem)

旧尝试

来自 telnet 的输出：

telnet mysite.com 993
Trying 127.0.1.1...
Connected to mysite.com.
Escape character is '^]'.
Connection closed by foreign host.

正如您所期望的。端口 993 是 IMAP 的 SSL 加密端口，因此通过 telnet 与其通信相当困难 ;-)

检查 thunderbird 是否与您的设置兼容 - 否则在尝试失败后发布您的邮件客户端和/或 dovecot 的输出。

编辑： 您可以使用 openssl 连接到您的 IMAPS 端口。还有一个问题已经详细回答了这个问题： https://stackoverflow.com/q/14959461/6591024

openssl s_client -connect mysite.com:993

正如链接问题答案中所述，您可能需要在openssl s_client -connect mysite.com:993 -crlf使用 MacOS 或 Windows 时强制执行 CRLF（也许？）

答案2

我认为没有证书的 TLS 是行不通的：

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:

我会尝试生成一个自签名证书并安装它，看看是否有帮助。

答案3

确认一下，输出的是iptables-save空的吗？

禁用 ufw 后，iptables 应该没有输出（也没有规则）。

相关内容