Linux下mail服務器應用之郵件系統的安全性

 

 Linux下mail服務器應用之郵件系統的安全性

 

郵件系統的安全性

目錄：

一：使sendmail與CA結合實現發送加密：

二：使dovecot與CA結合實現接收加密：

三：使sendmail啓用認證功能：

郵件安全簡介：

smtp pop3 imap

smtps

1.    465 （smtps）

2.    Smtp+ssl （starttls）

爲郵件服務器添加SMTPS 功能：

SMTPS：通過一個獨立的端口向用戶提供ssl/tls 加密的服務，監聽端口：465。

STARTTLS：通過25 號端口同時提供加密/不加密的功能。

s/mimp gpg

pop3-àpop3s

認證：sasl

[root@mail ~]# sendmail -d0.1 –bv         #查看sendmail的詳細信息，查看sendmail 是否支持startls 功能（取決於二進制程序在編譯的時候是否將startls 功能添加進去），若存在STARTTLS，說明支持發送加密。

NETUNIX NEWDB NIS PIPELINING SASLv2 SCANF SOCKETMAP STARTTLS

[root@mail ~]# telnet 127.0.0.1 25

Trying 127.0.0.1...

Connected to mail.bj.com (127.0.0.1).

Escape character is '^]'.

220 mail.bj.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Mar 2012 16:16:04 +0800

EHLO 127.0.0.1

250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES

250-PIPELINING

250-8BITMIME

250-SIZE

250-DSN

250-ETRN

250-DELIVERBY

250 HELP

quit

221 2.0.0 mail.bj.com closing connection

Connection closed by foreign host.

可以看到：不存在STARTTLS選項！說明不支持加密！需要進行配置，具體參考下面的資料：

 

郵件系統的基本配置請參考博主文章：

Linux下mail服務器應用之sendmail郵件系統的一個案例

http://xjzhujunjie.blog.51cto.com/3582724/815292

Linux下mail服務器應用之郵件系統簡介

http://xjzhujunjie.blog.51cto.com/3582724/815261

 

一：使sendmail與CA結合實現發送加密：

① ，爲CA創建證書：

[root@ftp ~]# cd /etc/pki/

[root@ftp pki]# ll

[root@ftp pki]# vim tls/openssl.cnf

45 dir             = /etc/pki/CA

88 countryName             = optional

89 stateOrProvinceName     = optional

90 organizationName        = optional

[root@ftp pki]# cd CA/

[root@ftp CA]# mkdir certs newcerts crl

[root@ftp CA]# touch index.txt serial

[root@ftp CA]# echo "01" >serial

[root@ftp CA]# ll

[root@ftp CA]# openssl genrsa 1024 > private/cakey.pem

Generating RSA private key, 1024 bit long modulus

...........++++++

....++++++

e is 65537 (0x10001)

[root@ftp CA]# chmod 600 private/cakey.pem

[root@ftp CA]# ll private/cakey.pem

-rw------- 1 root root 887 Feb 10 23:22 private/cakey.pem

[root@ftp CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 888

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:cn

State or Province Name (full name) [Berkshire]:henan

Locality Name (eg, city) [Newbury]:zhengzhou

Organization Name (eg, company) [My Company Ltd]:junjie

Organizational Unit Name (eg, section) []:soft

Common Name (eg, your name or your server's hostname) []:ca.junjie.com

Email Address []:[email protected]

[root@ftp CA]#ll

[root@ftp CA]#chmod 600 cacert.pem

[root@ftp CA]#ll

② ，爲sendmail服務器，簽發證書：

[root@mail CA]# mkdir /etc/mail/certs

[root@mail CA]# cd /etc/mail/certs

[root@mail certs]# openssl genrsa 1024 >sendmail.key

Generating RSA private key, 1024 bit long modulus

.................................++++++

...........++++++

e is 65537 (0x10001)

[root@mail certs]# openssl req -new -key sendmail.key -out sendmail.csr

Country Name (2 letter code) [GB]:cn

State or Province Name (full name) [Berkshire]:henan

Locality Name (eg, city) [Newbury]:zhengzhou

Organization Name (eg, company) [My Company Ltd]:junjie

Organizational Unit Name (eg, section) []:tec

Common Name (eg, your name or your server's hostname) []:mail.bj.com

Email Address []:[email protected]

[root@mail certs]# openssl ca -in sendmail.csr -out sendmail.crt

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

[root@mail certs]# chmod 600 *

[root@mail certs]# ll

total 12

-rw------- 1 root root 3214 Mar 23 16:35 sendmail.crt

-rw------- 1 root root 688 Mar 23 16:32 sendmail.csr

-rw------- 1 root root 887 Mar 23 16:30 sendmail.key

③ ：使sendmail服務使用證書功能

三個所需文件已經準備完畢，到此，證書已經申請成功，下面開始修改配置文件/etc/mail/sendmail.mc：以使sendmail服務使用證書功能

[root@mail certs]# cd /etc/mail/certs/

[root@mail certs]# cp /etc/pki/CA/cacert.pem .

[root@mail certs]# vim /etc/mail/sendmail.mc

21 define(`confLOG_LEVEL', `9')dnl

60 define(`confCACERT_PATH', `/etc/mail/certs')dnl

 61 define(`confCACERT', `/etc/mail/certs/cacert.pem')dnl

 62 define(`confSERVER_CERT', `/etc/mail/certs/sendmail.crt')dnl

 63 define(`confSERVER_KEY', `/etc/mail/certs/sendmail.key')dnl

134 DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl

保存，重啓服務。line 134 監聽smtps（465）端口；打開日誌功能line21

[root@mail certs]# service sendmail restart

Shutting down sm-client:                                   [ OK ]

Shutting down sendmail:                                    [ OK ]

Starting sendmail:                                         [ OK ]

Starting sm-client:                                        [ OK ]

④ ：使用telnet測試一下

[root@mail certs]# telnet mail.bj.com 25

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

220 mail.bj.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Mar 2012 16:54:22 +0800

EHLO mail.bj.com

250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES

250-PIPELINING

250-8BITMIME

250-SIZE

250-DSN

250-ETRN

250-STARTTLS

250-DELIVERBY

250 HELP

quit

221 2.0.0 mail.bj.com closing connection

Connection closed by foreign host.

再次可以看到：存在有STARTTLS功能了！說明可以支持加密了！

⑤ ：使用windows 上的outlook Express 進行發信測試：

日誌分析：

[root@mail ~]# tail -f /var/log/maillog

Mar 23 17:50:17 mail sendmail[3129]: STARTTLS=server, relay=[10.106.6.200], version=TLSv1/SSLv3, verify=NO, cipher=RC4-MD5, bits=128/128

Mar 23 17:50:57 mail sendmail[3129]: q2N9oHfJ003129: from=<[email protected]>, size=1306, class=0, nrcpts=1, msgid=<006001cd0991$d178b870$c8066a0a@hp3aea877158e2>, proto=SMTP, daemon=MTA, relay=[10.106.6.200]

Mar 23 17:50:57 mail sendmail[3132]: q2N9oHfJ003129: to=<[email protected]>, ctladdr=<[email protected]> (500/500), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31528, dsn=2.0.0, stat=Sent

Mar 23 17:51:07 mail dovecot: pop3-login: Login: user=<user1>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254

Mar 23 17:51:07 mail dovecot: POP3(user1): Disconnected: Logged out top=0/0, retr=1/1608, del=1/1, size=1591

二：使dovecot與CA結合實現接收加密：

#爲dovecot 增加SSL 功能：pop3---->pop3s imap-----> imaps

[root@mail ~]# yum install -y wireshark

[root@mail ~]# tshark -ni eth0 -R "tcp.dstport eq 110"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

183.544764 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [SYN] Seq=0 Win=64240 Len=0 MSS=1460

183.546267 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [ACK] Seq=1 Ack=1 Win=64240 Len=0

183.548706 10.106.6.200 -> 10.106.6.254 POP Request: USER user1

183.562924 10.106.6.200 -> 10.106.6.254 POP Request: PASS 123

183.578535 10.106.6.200 -> 10.106.6.254 POP Request: STAT

183.586984 10.106.6.200 -> 10.106.6.254 POP Request: LIST

183.593295 10.106.6.200 -> 10.106.6.254 POP Request: RETR 1

183.594018 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [ACK] Seq=43 Ack=1693 Win=64240 Len=0

183.642729 10.106.6.200 -> 10.106.6.254 POP Request: DELE 1

183.651676 10.106.6.200 -> 10.106.6.254 POP Request: QUIT

183.672294 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [ACK] Seq=57 Ack=1757 Win=64177 Len=0

183.674327 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [FIN, ACK] Seq=57 Ack=1757 Win=64177 Len=0

12 packets captured

① ，爲dovecot服務器，簽發證書：

[root@mail ~]# mkdir -pv /etc/dovecot/certs

mkdir: created directory `/etc/dovecot'

mkdir: created directory `/etc/dovecot/certs'

[root@mail ~]# cd /etc/dovecot/certs

[root@mail certs]#openssl genrsa 1024 >dovecot.key

Generating RSA private key, 1024 bit long modulus

.++++++

........................................++++++

e is 65537 (0x10001)

[root@mail certs]# openssl req -new -key dovecot.key -out dovecot.csr

Country Name (2 letter code) [GB]:cn

State or Province Name (full name) [Berkshire]:henan

Locality Name (eg, city) [Newbury]:zhengzhou

Organization Name (eg, company) [My Company Ltd]:junjie

Organizational Unit Name (eg, section) []:tec

Common Name (eg, your name or your server's hostname) []:pop3.bj.com

Email Address []:[email protected]

 

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@mail certs]# openssl ca -in dovecot.csr -out dovecot.crt

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

[root@mail certs]# chmod 600 *

[root@mail certs]# ll

total 12

-rw------- 1 root root 3214 Mar 23 18:02 dovecot.crt

-rw------- 1 root root 688 Mar 23 18:01 dovecot.csr

-rw------- 1 root root 887 Mar 23 17:59 dovecot.key

② ，使dovecot服務使用證書：

#修改/etc/dovecot.conf : 使dovecot服務使用證書。

[root@mail certs]# vim /etc/dovecot.conf

 21 protocols = imap imaps pop3 pop3s

 92 ssl_cert_file = /etc/dovecot/certs/dovecot.crt

 93 ssl_key_file = /etc/dovecot/certs/dovecot.key

[root@mail certs]# service dovecot restart

Stopping Dovecot Imap:                                     [ OK ]

Starting Dovecot Imap:                                     [ OK ]

[root@mail certs]# netstat -tupln |grep dovecot

tcp        0      0 :::993                      :::*                        LISTEN      3243/dovecot       

tcp        0      0 :::995                      :::*                        LISTEN      3243/dovecot       

tcp        0      0 :::110                      :::*                        LISTEN      3243/dovecot       

tcp        0      0 :::143                      :::*                        LISTEN      3243/dovecot

③ ，windows客戶端使用telnet mail.bj.com 110 訪問

在linux下抓包分析：

[root@mail ~]# tshark -ni eth0 -R "tcp.dstport eq 110"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

 23.370858 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

 23.371917 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=1 Ack=1 Win=65700 Len=0

 23.580864 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=1 Ack=21 Win=65680 Len=0

 36.262463 10.106.6.190 -> 10.106.6.254 POP Request: u

 36.727270 10.106.6.190 -> 10.106.6.254 POP Request: s

 37.462057 10.106.6.190 -> 10.106.6.254 POP Request: e

 37.763750 10.106.6.190 -> 10.106.6.254 POP Request: r

 39.832685 10.106.6.190 -> 10.106.6.254 POP Request: 

 40.969481 10.106.6.190 -> 10.106.6.254 POP Request: u

 41.706240 10.106.6.190 -> 10.106.6.254 POP Request: s

 41.979005 10.106.6.190 -> 10.106.6.254 POP Request: e

 42.228525 10.106.6.190 -> 10.106.6.254 POP Request: r

 44.641612 10.106.6.190 -> 10.106.6.254 POP Request: 1

 45.863993 10.106.6.190 -> 10.106.6.254 POP Request:

 46.063984 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=13 Ack=26 Win=65672 Len=0

 47.656999 10.106.6.190 -> 10.106.6.254 POP Request: p

 48.277840 10.106.6.190 -> 10.106.6.254 POP Request: a

 48.687710 10.106.6.190 -> 10.106.6.254 POP Request: s

 48.903481 10.106.6.190 -> 10.106.6.254 POP Request: s

 52.138586 10.106.6.190 -> 10.106.6.254 POP Request: 

 52.642241 10.106.6.190 -> 10.106.6.254 POP Request: 1

 52.945620 10.106.6.190 -> 10.106.6.254 POP Request: 2

 53.309236 10.106.6.190 -> 10.106.6.254 POP Request: 3

 54.483545 10.106.6.190 -> 10.106.6.254 POP Request:

 54.743086 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=23 Ack=42 Win=65656 Len=0

 61.181050 10.106.6.190 -> 10.106.6.254 POP Request: q

 61.668851 10.106.6.190 -> 10.106.6.254 POP Request: u

 61.743819 10.106.6.190 -> 10.106.6.254 POP Request: i

 61.991869 10.106.6.190 -> 10.106.6.254 POP Request: t

 62.323933 10.106.6.190 -> 10.106.6.254 POP Request:

 62.326107 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=29 Ack=61 Win=65640 Len=0

 62.336106 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [FIN, ACK] Seq=29 Ack=61 Win=65640 Len=0

32 packets captured

[root@mail ~]#

④ ，windows客戶端使用telnet mail.bj.com 993 訪問

在linux下抓包分析：

[root@mail ~]# tail -f /var/log/maillog

Mar 24 16:34:47 mail dovecot: imap-login: Disconnected: rip=::ffff:10.106.6.190, lip=::ffff:10.106.6.254, TLS handshake

[root@mail ~]# tshark -ni eth0 -R "tcp.dstport eq 993"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

 7.758613 10.106.6.190 -> 10.106.6.254 TCP 49515 > 993 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

 7.758832 10.106.6.190 -> 10.106.6.254 TCP 49515 > 993 [ACK] Seq=1 Ack=1 Win=65700 Len=0

 78.938576 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 80.415623 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 81.063027 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 81.555095 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 82.209324 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 83.062545 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 83.561624 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 84.147630 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 84.538105 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 85.637208 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 86.519913 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 92.840161 10.106.6.200 -> 10.106.6.254 TCP 1121 > 993 [ACK] Seq=1 Ack=39 Win=63341 Len=0

⑤ ，windows客戶端使用telnet mail.bj.com 995 訪問

在linux下抓包分析：

[root@mail ~]# tail -f /var/log/maillog

Mar 24 16:39:36 mail dovecot: pop3-login: Disconnected: rip=::ffff:10.106.6.190, lip=::ffff:10.106.6.254, TLS handshake

[root@mail ~]# tshark -ni eth0 -R "tcp.dstport eq 995"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

 5.593159 10.106.6.190 -> 10.106.6.254 TCP 49523 > 995 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

 5.593564 10.106.6.190 -> 10.106.6.254 TCP 49523 > 995 [ACK] Seq=1 Ack=1 Win=65700 Len=0

 26.818995 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 27.142342 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 27.452354 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 27.676539 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 30.876873 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 32.255238 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 32.484204 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 32.743865 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 32.943849 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 33.136547 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

 34.540448 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

⑥ ，windows客戶端使用outlook express 訪問，使用995端口

[root@mail ~]# tail -f /var/log/maillog

Mar 24 16:49:51 mail sendmail[3520]: STARTTLS=server, relay=[10.106.6.200], version=TLSv1/SSLv3, verify=NO, cipher=RC4-MD5, bits=128/128

Mar 24 16:49:51 mail sendmail[3520]: q2O8npGW003520: from=<[email protected]>, size=1317, class=0, nrcpts=1, msgid=<00b001cd099b$0411aae0$c8066a0a@hp3aea877158e2>, proto=SMTP, daemon=MTA, relay=[10.106.6.200]

Mar 24 16:49:52 mail sendmail[3521]: q2O8npGW003520: to=<[email protected]>, ctladdr=<[email protected]> (500/500), delay=00:00:01, xdelay=00:00:00, mailer=local, pri=31539, dsn=2.0.0, stat=Sent

Mar 24 16:50:31 mail dovecot: pop3-login: Login: user=<user1>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254, TLS

Mar 24 16:50:31 mail dovecot: POP3(user1): Disconnected: Logged out top=0/0, retr=1/1619, del=1/1, size=1602

[root@mail ~]# tshark -ni eth0 -R "tcp.dstport eq 25"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

 83.733934 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [SYN] Seq=0 Win=64240 Len=0 MSS=1460

 83.734451 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [ACK] Seq=1 Ack=1 Win=64240 Len=0

 83.863434 10.106.6.200 -> 10.106.6.254 SMTP Command: EHLO hp3aea877158e2

 83.864925 10.106.6.200 -> 10.106.6.254 SMTP Command: STARTTLS

 83.868606 10.106.6.200 -> 10.106.6.254 SMTP Command: \026\003\001\000a\001\000\000]\003\001Om\212\225\177\2448\033\244\377\245!\336\243\325\230\372\034\373\v\361\236\356\377\367*\376\255\342U\227\026 W\033\300\255\002\341j\002\333c\232$\356\331\376\373\214\217Y{\234\272\277"\277&f\275\240\t\3072\000\026\000\004\000\005\000

 83.903397 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [ACK] Seq=134 Ack=2212 Win=64240 Len=0

 83.915969 10.106.6.200 -> 10.106.6.254 SMTP Command: \026\003\001\000\215\v\000\000\003\000\000\000\020\000\000\202\000\200\276\224:\201\326n\tC\311\326\327\354@B\213\251\362\365\221Z+J\241*\313\226\004\027\177\017R\t\0178\267{\217\314O\337Q2ckX\316E\017\177\216\364&u\324\215e\022n\227bH\022c#\213

 83.948662 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

 83.950965 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

 84.027615 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

 84.088790 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

 84.090997 10.106.6.200 -> 10.106.6.254 SMTP Command: \027\003\001\000%\0000\353aZS\300\234\315w\216\366y\t+\355\241\257\277\312\201\312\002cN/\303\313!-(Hg\265Z\251\364\027\003\001\000+\t\376X{\353!B\2475\200a\353\264N\344\341!\260\3061\375PS{\232\025\347\313\2601\245+\036\277\3376G\367}\232\222\370c\027\003\001\000)X(Jm\355\253\313\310\035\233\201|\347V\266\242\354^\adU\327\201\314\017\345\304.`\276\216\322\021\271Q\b\255\331<\377\025\027\003\001\000\026}\357\274\260\032\353\265%\235%\371:0_\256\222\016\352\203\036\346\\027\003\001\005Xa\201

 84.133532 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

 84.148026 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

 84.202514 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [FIN, ACK] Seq=1912 Ack=2669 Win=63783 Len=0

 84.204916 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [RST] Seq=1913 Win=0 Len=0

 84.204917 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [RST, ACK] Seq=1913 Ack=2692 Win=0 Len=0

^C17 packets captured

[root@mail ~]#

[root@mail ~]# tshark -ni eth0 -R "tcp.dstport eq 995"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

107.447859 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460

107.448440 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [ACK] Seq=1 Ack=1 Win=64240 Len=0

107.450502 10.106.6.200 -> 10.106.6.254 SSL Client Hello

107.505581 10.106.6.200 -> 10.106.6.254 TLSv1 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message

107.772579 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [ACK] Seq=285 Ack=898 Win=63343 Len=0

107.772581 10.106.6.200 -> 10.106.6.254 TCP [TCP Dup ACK 881#1] 1129 > 995 [ACK] Seq=285 Ack=898 Win=63343 Len=0

107.784547 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

107.801497 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

107.941173 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.048159 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.056046 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.057086 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [ACK] Seq=432 Ack=2748 Win=64240 Len=0

108.069078 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.077526 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.100136 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [ACK] Seq=488 Ack=2854 Win=64135 Len=0

108.100279 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [FIN, ACK] Seq=488 Ack=2854 Win=64135 Len=0

⑦ ，windows客戶端使用outlook express 訪問，使用993端口

 

三：使sendmail啓用認證功能：

爲郵件服務器提供SASL 功能：默認已經安裝。

①：使用telnet 127.0.0.1 25進行簡單測試：

以下：沒有250認證功能

[root@mail certs]# telnet 127.0.0.1 25

EHLO 127.0.0.1

250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES

250-PIPELINING

250-8BITMIME

250-SIZE

250-DSN

250-ETRN

250-STARTTLS

250-DELIVERBY

250 HELP

mail from:[email protected]

250 2.1.0 [email protected]... Sender ok

rcpt to:[email protected]

250 2.1.5 [email protected]... Recipient ok

DATA

354 Enter mail, end with "." on a line by itself

123.

.

250 2.0.0 q2O9MwGr003612 Message accepted for delivery

Quit

[root@mail certs]# su - user1

[user1@mail ~]$ mail

Mail version 8.1 6/6/93. Type ? for help.

"/var/spool/mail/user1": 2 messages 1 new

    1 [email protected] Fri Mar 23 17:40 13/542   "DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA"

>N 2 [email protected]             Sat Mar 24 17:24 11/344 

& 2

Message 2:

From [email protected] Sat Mar 24 17:24:15 2012

Date: Sat, 24 Mar 2012 17:22:58 +0800

From: [email protected]

123.

日誌顯示發送成功：

Mar 24 17:24:15 mail sendmail[3612]: q2O9MwGr003612: [email protected], size=5, class=0, nrcpts=1, msgid=<[email protected]>, proto=ESMTP, daemon=MTA, relay=mail.bj.com [127.0.0.1]

Mar 24 17:24:15 mail sendmail[3615]: q2O9MwGr003612: [email protected], delay=00:00:29, xdelay=00:00:00, mailer=local, pri=30293, dsn=2.0.0, stat=Sent

②：安裝SASL 功能：默認已經安裝，並啓動saslauthd服務。

SASL （簡單認證安全層）服務爲：saslauthd

需要安裝的軟件包爲：

cyrus-sasl-2.1.22-4.i386.rpm

[root@mail certs]# rpm -qa |grep sasl

cyrus-sasl-plain-2.1.22-4

cyrus-sasl-2.1.22-4

cyrus-sasl-lib-2.1.22-4

cyrus-sasl-devel-2.1.22-4

#查看已經安裝了相關軟件包。

[root@mail certs]# chkconfig saslauthd on    

[root@mail certs]# chkconfig --list saslauthd  

saslauthd             0:off      1:off      2:on       3:on       4:on       5:on       6:off

[root@mail certs]# service saslauthd start

Starting saslauthd:                                        [ OK ]

③：配置sendmail的主配置文檔/etc/mail/sendmail.mc 啓用認證功能。

[root@mail ~]# cd /etc/mail/

[root@mail mail]# vim sendmail.mc

39 define(`confAUTH_OPTIONS', `A y')dnl

52 TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

53 define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

116DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, name=MTA,M=Ea')dnl

[root@mail mail]# service sendmail restart

Shutting down sm-client:                                   [ OK ]

Shutting down sendmail:                                    [ OK ]

Starting sendmail:                                         [ OK ]

Starting sm-client:                                        [ OK ]

④：在linux上使用telnet mail.bj.com 25測試認證。

[root@mail mail]# telnet mail.bj.com 25

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

220 mail.bj.com ESMTP Sendmail 8.13.8/8.13.8; Sat, 24 Mar 2012 17:50:50 +0800

EHLO mail.bj.com

250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES

250-PIPELINING

250-8BITMIME

250-SIZE

250-DSN

250-AUTH LOGIN PLAIN

250-STARTTLS

250-DELIVERBY

250 HELP

mail from:[email protected]

530 5.7.0 Authentication required

在上面信息中出現250-AUTH LOGIN PLAIN表示此時以支持認證。

先對賬號和密碼做base64 位編碼

[root@mail ~]# echo -n "[email protected]" |openssl base64

dXNlcjFAYmouY29t

[root@mail ~]# echo -n "123" |openssl base64

MTIz

再次進行測試：

[root@mail mail]# telnet mail.bj.com 25

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

220 mail.bj.com ESMTP Sendmail 8.13.8/8.13.8; Sat, 24 Mar 2012 17:50:50 +0800

EHLO mail.bj.com

250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES

250-PIPELINING

250-8BITMIME

250-SIZE

250-DSN

250-AUTH LOGIN PLAIN

250-STARTTLS

250-DELIVERBY

250 HELP

AUTH LOGIN dXNlcjFAYmouY29t

334 UGFzc3dvcmQ6

MTIz

235 2.0.0 OK Authenticated

mail from:[email protected]

250 2.1.0 [email protected]... Sender ok

rcpt to:[email protected]

250 2.1.5 [email protected]... Recipient ok

DATA

354 Enter mail, end with "." on a line by itself

user1-to-user1--2012/03/24.

.

250 2.0.0 q2OA2AdE003852 Message accepted for delivery

quit

221 2.0.0 mail.bj.com closing connection

Connection closed by foreign host.

[root@mail ~]# su - user1

[user1@mail ~]$ mail

Mail version 8.1 6/6/93. Type ? for help.

"/var/spool/mail/user1": 2 messages 1 new

    1 [email protected] Fri Mar 23 17:40 13/542   "DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA"

>N 2 [email protected]          Sat Mar 24 18:05 12/402 

& 2

Message 2:

From [email protected] Sat Mar 24 18:05:28 2012

Date: Sat, 24 Mar 2012 18:02:10 +0800

From: [email protected]

 

user1-to-user1--2012/03/24.

 

& quit

Saved 1 message in mbox

Held 1 message in /var/spool/mail/user1

[user1@mail ~]$

日誌分析：

Mar 24 18:05:28 mail sendmail[3852]: q2OA2AdE003852: [email protected], size=28, class=0, nrcpts=1, msgid=<[email protected]>, proto=ESMTP, daemon=MTA, relay=mail.bj.com [127.0.0.1]

Mar 24 18:05:28 mail sendmail[3857]: q2OA2AdE003852: [email protected], [email protected] (500/500), delay=00:00:27, xdelay=00:00:00, mailer=local, pri=30345, dsn=2.0.0, stat=Sent

⑥ ：使用outlook express測試認證。

此時已經可以用OE 通過驗證身份的方式發送郵件了。

在啓用sasl 功能之後，access 的設置就不起效，因爲所有的認證都是通過sasl 來實現了。此時，smtp 就不再基於IP 地址來認證，只需提供賬戶密碼即可。

日誌文件如下所示：

[root@mail ~]# tail -f /var/log/maillog

Mar 24 18:22:58 mail sendmail[3927]: STARTTLS=server, relay=[10.106.6.200], version=TLSv1/SSLv3, verify=NO, cipher=RC4-MD5, bits=128/128

Mar 24 18:22:58 mail sendmail[3927]: AUTH=server, relay=[10.106.6.200], authid=user1, mech=LOGIN, bits=0

Mar 24 18:22:58 mail sendmail[3927]: q2OAMwNU003927: from=<[email protected]>, size=1244, class=0, nrcpts=1, msgid=<00e901cd09a7$f3aa8700$c8066a0a@hp3aea877158e2>, proto=ESMTP, daemon=MTA, relay=[10.106.6.200]

Mar 24 18:22:58 mail sendmail[3928]: q2OAMwNU003927: to=<[email protected]>, ctladdr=<[email protected]> (500/500), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31491, dsn=2.0.0, stat=Sent

Mar 24 18:23:26 mail dovecot: imap-login: Login: user=<user2>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254, TLS

Mar 24 18:23:26 mail dovecot: IMAP(user2): Disconnected in IDLE

Mar 24 18:23:29 mail dovecot: pop3-login: Login: user=<user1>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254, TLS

Mar 24 18:23:29 mail dovecot: POP3(user1): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0

Mar 24 18:23:29 mail dovecot: imap-login: Login: user=<user2>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254, TLS

Mar 24 18:23:29 mail dovecot: IMAP(user2): Connection closed