☰

Centos8 上的 Postfix / OpenDKIM 配置

tag-icon • tag-icon centos postfix opendkim
Centos8 上的 Postfix / OpenDKIM 配置

我已经将 Postfix 与 Dovecot 设置为我的 SaaS 应用程序的集成邮件服务，它作为收件箱运行良好。问题始于我开始发送电子邮件时，它没有签名，所以我继续安装 opendkim 并使用 Postfix 配置它，电子邮件发出正常，签名没有问题，但没有

我打破了入站消息。我无论如何也想不通我到底错在哪里。

邮件日志：
May 30 22:12:30 dotcom postfix/smtpd[20436]: connect from mail-pj1-f43.google.com[209.85.216.43]
May 30 22:12:30 dotcom postfix/smtpd[20436]: discarding EHLO keywords: CHUNKING
May 30 22:12:31 dotcom postfix/smtpd[20436]: warning: SASL: Connect to smtpd failed: No such file or directory
May 30 22:12:31 dotcom postfix/smtpd[20436]: fatal: no SASL authentication mechanisms
May 30 22:12:32 dotcom postfix/master[19904]: warning: process /usr/libexec/postfix/smtpd pid 20436 exit status 1
后配置-n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
compatibility_level = 2
disable_vrfy_command = yes
inet_interfaces = all
inet_protocols = all
invalid_hostname_reject_code = 550
mailbox_size_limit = 0
maximal_backoff_time = 3h
milter_default_action = accept
minimal_backoff_time = 180s
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = dotsoft.co.za
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128, 129.232.230.173
myorigin = $mydomain
non_fqdn_reject_code = 550
non_smtpd_milters = $smtpd_milters
readme_directory = no
recipient_delimiter = +
smtp_always_send_ehlo = yes
smtp_rcpt_timeout = 15s
smtp_tls_security_level = may
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname
smtpd_milters = inet:127.0.0.1:8891
smtpd_recipient_limit = 40
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unlisted_recipient, reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain
smtpd_timeout = 30s
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/dotcom.dotsoft.co.za/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/dotcom.dotsoft.co.za/privkey.pem
smtpd_tls_security_level = may
smtpd_use_tls = yes
strict_rfc821_envelopes = yes
unknown_address_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
unverified_recipient_reject_code = 550
unverified_sender_reject_code = 550
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp

鸽舍日志中没有任何奇怪的东西，请参阅下面的摘录

鸽舍-n：

# 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf
# OS: Linux 4.18.0-383.el8.x86_64 x86_64 CentOS Stream release 8 xfs
# Hostname: dotcom.dotsoft.co.za
auth_mechanisms = plain login
first_valid_uid = 1000
log_path = /var/log/dovecot.log
mail_location = maildir:/var/mail/vhosts/%d/%n/
mail_privileged_group = mail
mbox_write_locks = fcntl
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  driver = pam
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
postmaster_address = postmaster at dotcom.dotsoft.co.za
service auth-worker {
  user = vmail
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
  }
  user = dovecot
}
service imap-login {
  inet_listener imap {
    port = 0
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 0
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}
ssl = required
ssl_cert = </etc/letsencrypt/live/dotcom.dotsoft.co.za/fullchain.pem
ssl_cipher_list = PROFILE=SYSTEM
ssl_key = # hidden, use -P to show it
userdb {
  driver = passwd
}
userdb {
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
  driver = static
}

答案1

您有 dovecot 的常见配置，将插座置于/var/spool/postfix/private/auth。

由于您的 SASL 提供商是 Dovecot ( smtpd_sasl_type = dovecot)，Postfix 正在其 chroot 目录中寻找套接字文件。您必须指定相对的路径。通常情况下，该路径为smtpd_sasl_path=private/auth。但您的配置显示该路径与默认路径 相同smtpd_sasl_path=smtpd，因此出现错误“连接到 smtpd 失败”。这不可能奏效。

如果之前有效，请与备份进行比较，或者检查main.cf文件是否有删除或损坏的行围绕smtpd_sasl_*设置。如果文件中存在明显的语法错误main.cf，Postfix 会在启动时打印警告，因此重新启动可能有助于查明原因。

身份验证相关问题会干扰（非身份验证）收到的邮件本来可以避免smtpd_sasl_auth_enable=yes，如果您只为需要它们的服务设置了，则在 中master.cf，而不是在 中全局main.cf设置。通常，它会位于端口smtps或的服务配置下方submission，正如您将在 中找到的常见配置建议。

改变unknown_hostname_reject_code和类似的设置是明确建议不要Postfix 文档中写道“除非您完全理解 RFC 5321”。即使您有理由针对特定邮件提交更改这些内容，但对于从一般互联网接收邮件来说，这不太可能是一个好主意。

相关内容