☰

为具有多个域和多个 IP 的 Postfix 添加 tls/ssl

tag-icon • tag-icon postfix
为具有多个域和多个 IP 的 Postfix 添加 tls/ssl

我正在开发一个 Postfix 服务器。该服务器通过多个 IP 为多个域发送邮件。一些域有专用 IP 地址。其他域使用同一个 IP。

一切正常。

现在，我想启用 SSL 和 TLS。我知道如何针对具有单个 IP 地址和单个域的 Postfix 服务器执行操作：

cd /etc/postfix
openssl req -nodes -new -x509 -keyout dsfc.key -out dsfc.crt

然后我必须在 /etc/postfix/main.cf 中添加以下代码：

smtpd_use_tls = yes
smtpd_tls_key_file = /etc/postfix/dsfc.key
smtpd_tls_cert_file = /etc/postfix/dsfc.crt
smtpd_tls_ask_ccert = yes
smtpd_tls_req_ccert = yes
smtpd_tls_security_level = encrypt
smtpd_tls_auth_only = yes
smtpd_tls_ccert_verifydepth = 1
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
smtpd_tls_session_cache_timeout = 86400

但我不确定它是否适用于我的情况。我应该为每个域名或每个 IP 都准备一个证书吗？或者一个证书可以适用于所有域名？

谢谢

答案1

SSL/TLS 证书和密钥用于邮件服务器域/IP，所有其他域都通过该域/IP，因此安全邮件服务器涵盖使用它的所有域，专用 IP 无关紧要。为获得最佳效果和最大安全性，请使用可用的配置选项。如果您计划使用 smtpd_tls_security_level=encrypt，请注意某些邮件服务器不会接受连接，因为它们不接受仅 TLS 连接。如果您坚持加密，请检查您的邮件日志，看看是否有任何主机因这个原因而拒绝。您可以创建 /etc/postfix/tls_policy 并在其中添加主机并指定可能，以便邮件被传递 IE：

smtp_tls_policy_maps = hash:/etc/postfix/tls_policy

在该文件中，您可以像下面这样添加主机

live.co.uk             may
live.com               may
charter.net            may
mx.west.cox.net        may
bigpond.com            may
cox.net                may

是的，如果强制使用 TLS，live.com 将拒绝。编辑文件后，请不要忘记运行 postmap

例子：

# TLS parameters
# ---------------------------------

# The default snakeoil certificate. Comment if using a purchased
# SSL certificate.
#smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem
#smtpd_tls_key_file = /etc/ssl/private/postfix.pem

# Uncomment if using a custom SSL certificate.
smtpd_tls_cert_file=/path/to/ssl/example.com/cert.pem
smtpd_tls_key_file=/path/to/ssl/example.com/key.pem

# The snakeoil self-signed certificate has no need for a CA file. But
# if you are using your own SSL certificate, then you probably have
# a CA certificate bundle from your provider. The path to that goes here.
smtp_tls_CAfile=/path/to/ssl/example.com/chain.pem
smtpd_tls_CAfile=/path/to/ssl/example.com/chain.pem

# trusted CA path, where your server has the trust store of commercial certs
smtp_tls_CApath = /etc/ssl/certs
smtpd_tls_CApath = /etc/ssl/certs

smtpd_use_tls = yes
smtp_use_tls = yes
#enable ECDH
smtpd_tls_eecdh_grade = strong
#enabled SSL protocols, don't allow SSLv2 and SSLv3
smtpd_tls_protocols= !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols= !SSLv2, !SSLv3
#allowed ciphers for smtpd_tls_security_level=encrypt
smtpd_tls_mandatory_ciphers = high
#allowed ciphers for smtpd_tls_security_level=may
smtpd_tls_ciphers = high
#enforce the server cipher preference
tls_preempt_cipherlist = yes
#disable following ciphers for smtpd_tls_security_level=encrypt
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
#disable following ciphers for smtpd_tls_security_level=may
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA
#enable TLS logging to see the ciphers for inbound connections
smtpd_tls_loglevel = 1
#enable TLS logging to see the ciphers for outbound connections
smtp_tls_loglevel = 1
smtp_tls_note_starttls_offer = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_tls_dh1024_param_file = /etc/ssl/certs/dhparam.pem

# Note that forcing use of TLS is going to cause breakage - most mail servers
# don't offer it and so delivery will fail, both incoming and outgoing. This is
# unfortunate given what various governmental agencies are up to these days.
#

# For MTAs that reject based on encrypt TLS setting, lets do 'may' to get the mail delivered
#smtp_tls_policy_maps = hash:/etc/postfix/tls_policy

# AUTH only must be enabled when using smtpd encrypt
smtpd_tls_auth_only = yes
# Enable and force all incoming smtpd connections to use TLS.
#smtpd_tls_security_level = encrypt
# Enable and force all outgoing smtp connections to use TLS.
#smtp_tls_security_level = encrypt
# Enable (but don't force all incoming smtpd connections to use TLS.
smtpd_tls_security_level = may
# Enable (but don't force) all outgoing smtp connections to use TLS.
smtp_tls_security_level = may

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

相关内容