☰

Postfix — 强制 TLS 加密不适用于端口 25“中继发送”

tag-icon • tag-icon postfix
Postfix — 强制 TLS 加密不适用于端口 25“中继发送”

在我的 Postfix 服务器上，我使用端口465进行提交，使用端口25进行中继（“中继接收”和“中继发送”）。我使用993在Dovecot中配置的端口来“检索”邮件。

当我设置 Postfix 时，我避免配置端口25&465内部配置/etc/postfix/main.cf，这仍然很简单：

smtpd_banner = $myhostname -------> "HELLO!"
biff = no
append_dot_mydomain = no
readme_directory = no
compatibility_level = 2
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.domain.eu
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases
myorigin = /etc/mailname
mydestination = $myhostname, tekpi-eu, localhost.localdomain, localhost
relayhost = 
mynetworks = 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
mydomain = domain.eu
mynetworks_style = host
virtual_mailbox_base = /var/mail/
virtual_mailbox_domains = domain.eu
virtual_mailbox_maps = hash:/etc/postfix/virtual_mailboxes
virtual_gid_maps = static:997
virtual_uid_maps = static:997
virtual_alias_maps = hash:/etc/postfix/virtual_aliases

25单独配置端口&似乎更合乎465逻辑/etc/postfix/master.cf。

smtp      inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtp
  -o smtp_use_tls=yes
  -o smtp_tls_loglevel=1
  -o smtp_tls_security_level=encrypt
  -o smtp_tls_wrappermode=yes
# -o smtp_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
  -o smtp_tls_mandatory_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
  -o smtp_tls_cert_file=/etc/ssl/certs/server-rsa.cert
  -o smtp_tls_key_file=/etc/ssl/private/server-rsa.key
  -o smtp_tls_eccert_file=/etc/ssl/certs/server-ecdsa.cert
  -o smtp_tls_eckey_file=/etc/ssl/private/server-ecdsa.key
#
  -o smtpd_use_tls=yes
  -o smtpd_tls_security_level=may
  -o smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
  -o smtpd_tls_cert_file=/etc/ssl/certs/server-rsa.cert
  -o smtpd_tls_key_file=/etc/ssl/private/server-rsa.key
  -o smtpd_tls_eccert_file=/etc/ssl/certs/server-ecdsa.cert
  -o smtpd_tls_eckey_file=/etc/ssl/private/server-ecdsa.key
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=smtpd
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_use_tls=yes
  -o smtpd_tls_wrappermode=yes
  -o smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
  -o smtpd_tls_cert_file=/etc/ssl/certs/server-rsa.cert
  -o smtpd_tls_key_file=/etc/ssl/private/server-rsa.key
  -o smtpd_tls_eccert_file=/etc/ssl/certs/server-ecdsa.cert
  -o smtpd_tls_eckey_file=/etc/ssl/private/server-ecdsa.key
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=smtpd
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
...
...
...

据我所知/etc/postfix/master.cf：

  • -o smtpd_以configure开头的命令入站連接
  • -o smtp_以configure开头的命令出站連接

-o此外，在以下行之后应用的以 开头的参数仅修改端口25：

smtp      inet  n       -       y       -       -       smtpd

-o类似地，在以下行之后应用以 开头的参数仅修改端口465：

smtps     inet  n       -       y       -       -       smtpd

如你所见，我在端口上配置了强制 TLS25 出站连接，但是当我向 Gmail 发送电子邮件时，邮件上标有一条警告：“此邮件未加密”：

在此处输入图片描述

如果我检查电子邮件标题，第一个字段中没有加密的迹象Received：

Delivered-To: [email protected]
Received: by 2002:a50:a414:0:0:0:0:0 with SMTP id u20csp5876423edb;
        Wed, 23 Dec 2020 10:04:30 -0800 (PST)
X-Google-Smtp-Source: ABdhPJz/H6LVTTELjEg4kyxfY5WvBpShW3zeBpEASR/dmz8FHcT8QBpRbaNbCdGaTON4PTFMXVds
X-Received: by 2002:a05:6402:366:: with SMTP id s6mr25548681edw.44.1608746670340;
        Wed, 23 Dec 2020 10:04:30 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1608746670; cv=none;
        d=google.com; s=arc-20160816;
        b=0GELxkiim2MQGGCIrMsuVfXIiuzCbPnx6q6q7Sxuhssnb6XxCc1dtmsdUCVaGorqL/
         NWMA9sBfBZkz2ZCb90AoAk4Tyi1YzYw3WVLblw2+xQkbq+JwuYwdAjEQj2i2EJlBI3Zk
         KyYC2zfZqMkWMNRL27bI6pYwNtRYM7FifUeKmxaGuGuXv+7KY9wkrv9LTGI3a/UN634r
         Mqhog1Em8L8uLys0tDlj9GB08ZO52pPw01vJNU1AXqwOeRVznF9FPwfzP6Pn1drc4cOM
         x2vA5NJ+TgguOhqhgTSMW1hQrhNpyku3bYRW9PKQChZdHMowtSotpldYy1sJCf/VYeuA
         6fGg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=content-language:content-transfer-encoding:mime-version:user-agent
         :date:message-id:subject:from:to;
        bh=ZnLGQleFTlvpbWbWBAKrwartxhkzwpbLw0l/ILVPQLo=;
        b=Lt/88Ansftfa790xIUJbRfnuHWadZtBq5QHPDlDjJeGLBlmrLiyfIlzG5xwZTkqZmY
         XPImCgNHC+JfBDOhTFbiyahI7OMMAJGJAZDrr8K60TCztYqKE4Gkr6SZ7h3nAZVjLE8Y
         QBr0NOHZSQkMac/3WKOU86NtPEJwIu53Is71ucdpvNvwj8U5XHDDK9zUw8rcO9XF9JL+
         VUXTOhHmpEqhFgZDq+ldLANLkML+Ix/qvAnyb6JSss+rfsJO0h3Q2nh/LSQzbTFeWBbq
         oGksWfsCX7L0cfSij1GLWwYJ+1RrT/UBdb9p6OIK7sV2IpzAFmLgdRHoV2XHuB3XYSDy
         8gyw==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 2a01:4f8:211:2a4::2 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=domain.eu
Return-Path: <[email protected]>
Received: from mail.domain.eu ([2a01:4f8:211:2a4::2])
        by mx.google.com with ESMTP id j10si12321635ejf.404.2020.12.23.10.04.30
        for <[email protected]>;
        Wed, 23 Dec 2020 10:04:30 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 2a01:4f8:211:2a4::2 as permitted sender) client-ip=2a01:4f8:211:2a4::2;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 2a01:4f8:211:2a4::2 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=domain.eu
Received: from [192.168.64.100] (188-230-147-194.dynamic.t-2.net [188.230.147.194])
    by mail.domain.eu (Postfix) with ESMTPSA id B486F15A1315
    for <[email protected]>; Wed, 23 Dec 2020 19:04:29 +0100 (CET)
To: [email protected]
From: Z L <[email protected]>
Subject: TEST (mandatory TLS): domain --> gmail
Message-ID: <[email protected]>
Date: Wed, 23 Dec 2020 19:04:29 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.6.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US

CONTENT TEXT

当我给自己发送电子邮件时，也没有任何加密迹象。以下是示例电子邮件来源：

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from [192.168.64.100] (unknown [188.230.147.194])
    by mail.domain.eu (Postfix) with ESMTPSA id 3BE6015A132B
    for <[email protected]>; Wed, 23 Dec 2020 23:03:15 +0100 (CET)
To: [email protected]
From: Z L <[email protected]>
Subject: TEST (mandatory TLS): domain --> domain
Message-ID: <[email protected]>
Date: Wed, 23 Dec 2020 23:03:14 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.6.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US

CONTENT TEXT

强制 TLS 在端口 上有效465。我配置错了什么导致它在端口 上无效25？我该如何解决这个问题，才能在端口 上使用强制 TLS 或机会性 TLS25 出站连接？

答案1

配置出站连接的指令smtp_需要放在 中main.cf，而不是 中master.cf。后者专门处理入站连接。

相关内容