歡迎您光臨本站 註冊首頁

Linux下mail伺服器應用之郵件系統的安全性

←手機掃碼閱讀     火星人 @ 2014-03-08 , reply:0

Linuxmail伺服器應用之郵件系統的安全性

郵件系統的安全性

目錄:

一:使sendmail與CA結合實現發送加密:

二:使dovecot與CA結合實現接收加密:

三:使sendmail啟用認證功能:

郵件安全簡介: smtp pop3 imap smtps

1.

465 (smtps)

2. Smtp ssl (starttls)

為郵件伺服器添加SMTPS 功能:

SMTPS:通過一個獨立的埠向用戶提供ssl/tls 加密的服務,監聽埠:465.

STARTTLS:通過25 號埠同時提供加密/不加密的功能.

s/mimp gpg pop3-àpop3s

認證:sasl

[[email protected] ~]# sendmail -d0.1 –bv #查看sendmail的詳細信息,查看sendmail 是否支持startls 功能(取決於二進位程序在編譯的時候是否將startls 功能添加進去),若存在STARTTLS,說明支持發送加密.

NETUNIX NEWDB NIS PIPELINING SASLv2 SCANF SOCKETMAP STARTTLS

[[email protected] ~]# telnet 127.0.0.1 25 Trying 127.0.0.1... Connected to mail.bj.com (127.0.0.1). Escape character is '^]'.

220 mail.bj.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Mar 2012 16:16:04 0800

EHLO 127.0.0.1 250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DSN 250-ETRN 250-DELIVERBY 250 HELP quit 221 2.0.0 mail.bj.com closing connection

Connection closed by foreign host.

可以看到:不存在STARTTLS選項!說明不支持加密!需要進行配置,具體參考下面的資料:

郵件系統的基本配置請參考博主文章:

Linuxmail伺服器應用之sendmail郵件系統的一個案例

http://xjzhujunjie.blog.51cto.com/3582724/815292

Linuxmail伺服器應用之郵件系統簡介

http://xjzhujunjie.blog.51cto.com/3582724/815261

一:使sendmail與CA結合實現發送加密:

,為CA創建證書: [[email protected] ~]# cd /etc/pki/ [[email protected] pki]# ll [[email protected] pki]# vim tls/openssl.cnf 45 dir = /etc/pki/CA

88 countryName = optional

89 stateOrProvinceName = optional

90 organizationName = optional

[[email protected] pki]# cd CA/ [[email protected] CA]# mkdir certs newcerts crl [[email protected] CA]# touch index.txt serial

[[email protected] CA]# echo "01" >serial

[[email protected] CA]# ll

[[email protected] CA]# openssl genrsa 1024 > private/cakey.pem

Generating RSA private key, 1024 bit long modulus

........... ....

e is 65537 (0x10001)

[[email protected] CA]# chmod 600 private/cakey.pem [[email protected] CA]# ll private/cakey.pem -rw------- 1 root root 887 Feb 10 23:22 private/cakey.pem

[[email protected] CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 888

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:cn

State or Province Name (full name) [Berkshire]:henan

Locality Name (eg, city) [Newbury]:zhengzhou

Organization Name (eg, company) [My Company Ltd]:junjie

Organizational Unit Name (eg, section) []:soft

Common Name (eg, your name or your server's hostname) []:

ca.junjie.com

Email Address []:[email protected] [[email protected] CA]#ll [[email protected] CA]#chmod 600 cacert.pem [[email protected] CA]#ll ,為sendmail伺服器,簽發證書: [[email protected] CA]# mkdir /etc/mail/certs [[email protected] CA]# cd /etc/mail/certs [[email protected] certs]# openssl genrsa 1024 >sendmail.key

Generating RSA private key, 1024 bit long modulus

................................. ...........

e is 65537 (0x10001)

[[email protected] certs]# openssl req -new -key sendmail.key -out sendmail.csr

Country Name (2 letter code) [GB]:cn

State or Province Name (full name) [Berkshire]:

henan

Locality Name (eg, city) [Newbury]:zhengzhou

Organization Name (eg, company) [My Company Ltd]:junjie

Organizational Unit Name (eg, section) []:tec

Common Name (eg, your name or your server's hostname) []:mail.bj.com

Email Address []:[email protected] [[email protected] certs]# openssl ca -in sendmail.csr -out sendmail.crt

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

[[email protected] certs]# chmod 600 * [[email protected] certs]# ll total 12

-rw------- 1 root root 3214 Mar 23 16:35 sendmail.crt

-rw------- 1 root root 688 Mar 23 16:32 sendmail.csr

-rw------- 1 root root 887 Mar 23 16:30 sendmail.key

:使sendmail服務使用證書功能

三個所需文件已經準備完畢,到此,證書已經申請成功,下面開始修改配置文件/etc/mail/sendmail.mc:以使sendmail服務使用證書功能

[[email protected] certs]# cd /etc/mail/certs/

[[email protected] certs]# cp /etc/pki/CA/cacert.pem .

[[email protected] certs]# vim /etc/mail/sendmail.mc

21 define(`confLOG_LEVEL', `9')dnl 60 define(`confCACERT_PATH', `/etc/mail/certs')dnl 61 define(`confCACERT', `/etc/mail/certs/cacert.pem')dnl 62 define(`confSERVER_CERT', `/etc/mail/certs/sendmail.crt')dnl 63 define(`confSERVER_KEY', `/etc/mail/certs/sendmail.key')dnl

134 DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl

保存,重啟服務.line 134 監聽smtps(465)埠;打開日誌功能line21

[[email protected] certs]# service sendmail restart Shutting down sm-client: [ OK ]

Shutting down sendmail:

[ OK ]

Starting sendmail: [ OK ]

Starting sm-client: [ OK ]

:使用telnet測試一下

[[email protected] certs]# telnet mail.bj.com 25

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

220 mail.bj.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Mar 2012 16:54:22 0800

EHLO mail.bj.com

250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DSN 250-ETRN 250-STARTTLS 250-DELIVERBY 250 HELP quit

221 2.0.0 mail.bj.com closing connection

Connection closed by foreign host.

再次可以看到:存在有STARTTLS功能了!說明可以支持加密了!

:使用windows 上的outlook Express 進行發信測試: 日誌分析:

[[email protected] ~]# tail -f /var/log/maillog

Mar 23 17:50:17 mail sendmail[3129]: STARTTLS=server, relay=[10.106.6.200], version=TLSv1/SSLv3, verify=NO, cipher=RC4-MD5, bits=128/128

Mar 23 17:50:57 mail sendmail[3129]: q2N9oHfJ003129: from=<[email protected]>, size=1306, class=0, nrcpts=1, msgid=<[email protected]>, proto=SMTP, daemon=MTA, relay=[10.106.6.200]

Mar 23 17:50:57 mail sendmail[3132]: q2N9oHfJ003129: to=<[email protected]>, ctladdr=<[email protected]> (500/500), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31528, dsn=2.0.0, stat=Sent

Mar 23 17:51:07 mail dovecot: pop3-login: Login: user=<user1>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254

Mar 23 17:51:07 mail dovecot: POP3(user1): Disconnected: Logged out top=0/0, retr=1/1608, del=1/1, size=1591

二:使dovecot與CA結合實現接收加密:

#為dovecot 增加SSL 功能:pop3---->pop3s imap-----> imaps [[email protected] ~]# yum install -y wireshark

[[email protected] ~]# tshark -ni eth0 -R "tcp.dstport eq 110"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

183.544764 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [SYN] Seq=0 Win=64240 Len=0 MSS=1460

183.546267 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [ACK] Seq=1 Ack=1 Win=64240 Len=0

183.548706 10.106.6.200 -> 10.106.6.254 POP Request: USER user1 183.562924 10.106.6.200 -> 10.106.6.254 POP Request: PASS 123 183.578535 10.106.6.200 -> 10.106.6.254 POP Request: STAT 183.586984 10.106.6.200 -> 10.106.6.254 POP Request: LIST 183.593295 10.106.6.200 -> 10.106.6.254 POP Request: RETR 1

183.594018 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [ACK] Seq=43 Ack=1693 Win=64240 Len=0

183.642729 10.106.6.200 -> 10.106.6.254 POP Request: DELE 1 183.651676 10.106.6.200 -> 10.106.6.254 POP Request: QUIT

183.672294 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [ACK] Seq=57 Ack=1757 Win=64177 Len=0

183.674327 10.106.6.200 -> 10.106.6.254 TCP 1116 > 110 [FIN, ACK] Seq=57 Ack=1757 Win=64177 Len=0

12 packets captured ,為dovecot伺服器,簽發證書:

[[email protected] ~]# mkdir -pv /etc/dovecot/certs

mkdir: created directory `/etc/dovecot' mkdir: created directory `/etc/dovecot/certs' [[email protected] ~]# cd /etc/dovecot/certs

[[email protected] certs]#openssl genrsa 1024 >dovecot.key

Generating RSA private key, 1024 bit long modulus . ........................................ e is 65537 (0x10001)

[[email protected] certs]# openssl req -new -key dovecot.key -out dovecot.csr

Country Name (2 letter code) [GB]:cn State or Province Name (full name) [Berkshire]:henan Locality Name (eg, city) [Newbury]:zhengzhou Organization Name (eg, company) [My Company Ltd]:junjie Organizational Unit Name (eg, section) []:tec Common Name (eg, your name or your server's hostname) []:pop3.bj.com Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [[email protected] certs]# openssl ca -in dovecot.csr -out dovecot.crt Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y [[email protected] certs]# chmod 600 * [[email protected] certs]# ll total 12

-rw------- 1 root root 3214 Mar 23 18:02 dovecot.crt

-rw------- 1 root root 688 Mar 23 18:01 dovecot.csr

-rw------- 1 root root 887 Mar 23 17:59 dovecot.key

,使dovecot服務使用證書: #修改/etc/dovecot.conf : 使dovecot服務使用證書.

[[email protected] certs]# vim /etc/dovecot.conf

21 protocols = imap imaps pop3 pop3s

92 ssl_cert_file = /etc/dovecot/certs/dovecot.crt 93 ssl_key_file = /etc/dovecot/certs/dovecot.key

[[email protected] certs]# service dovecot restart

Stopping Dovecot Imap: [ OK ]

Starting Dovecot Imap: [ OK ]

[[email protected] certs]# netstat -tupln |grep dovecot

tcp 0 0 :::993 :::* LISTEN 3243/dovecot

tcp 0 0 :::995 :::* LISTEN 3243/dovecot

tcp 0 0 :::110 :::* LISTEN 3243/dovecot

tcp 0 0 :::143 :::* LISTEN 3243/dovecot

,windows客戶端使用telnet mail.bj.com 110 訪問

在linux下抓包分析:

[[email protected] ~]# tshark -ni eth0 -R "tcp.dstport eq 110"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

23.370858 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

23.371917 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=1 Ack=1 Win=65700 Len=0

23.580864 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=1 Ack=21 Win=65680 Len=0

36.262463 10.106.6.190 -> 10.106.6.254 POP Request: u

36.727270 10.106.6.190 -> 10.106.6.254 POP Request: s

37.462057 10.106.6.190 -> 10.106.6.254 POP Request: e

37.763750 10.106.6.190 -> 10.106.6.254 POP Request: r

39.832685 10.106.6.190 -> 10.106.6.254 POP Request:

40.969481 10.106.6.190 -> 10.106.6.254 POP Request: u

41.706240 10.106.6.190 -> 10.106.6.254 POP Request: s

41.979005 10.106.6.190 -> 10.106.6.254 POP Request: e

42.228525 10.106.6.190 -> 10.106.6.254 POP Request: r

44.641612 10.106.6.190 -> 10.106.6.254 POP Request: 1

45.863993 10.106.6.190 -> 10.106.6.254 POP Request:

46.063984 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=13 Ack=26 Win=65672 Len=0

47.656999 10.106.6.190 -> 10.106.6.254 POP Request: p

48.277840 10.106.6.190 -> 10.106.6.254 POP Request: a

48.687710 10.106.6.190 -> 10.106.6.254 POP Request: s

48.903481 10.106.6.190 -> 10.106.6.254 POP Request: s

52.138586 10.106.6.190 -> 10.106.6.254 POP Request:

52.642241 10.106.6.190 -> 10.106.6.254 POP Request: 1

52.945620 10.106.6.190 -> 10.106.6.254 POP Request: 2

53.309236 10.106.6.190 -> 10.106.6.254 POP Request: 3

54.483545 10.106.6.190 -> 10.106.6.254 POP Request:

54.743086 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=23 Ack=42 Win=65656 Len=0

61.181050 10.106.6.190 -> 10.106.6.254 POP Request: q

61.668851 10.106.6.190 -> 10.106.6.254 POP Request: u

61.743819 10.106.6.190 -> 10.106.6.254 POP Request: i

61.991869 10.106.6.190 -> 10.106.6.254 POP Request: t

62.323933 10.106.6.190 -> 10.106.6.254 POP Request:

62.326107 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [ACK] Seq=29 Ack=61 Win=65640 Len=0

62.336106 10.106.6.190 -> 10.106.6.254 TCP 49489 > 110 [FIN, ACK] Seq=29 Ack=61 Win=65640 Len=0

32 packets captured [[email protected] ~]# ,windows客戶端使用telnet mail.bj.com 993 訪問

在linux下抓包分析:

[[email protected] ~]# tail -f /var/log/maillog

Mar 24 16:34:47 mail dovecot: imap-login: Disconnected: rip=::ffff:10.106.6.190, lip=::ffff:10.106.6.254, TLS handshake

[[email protected] ~]# tshark -ni eth0 -R "tcp.dstport eq 993"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

7.758613 10.106.6.190 -> 10.106.6.254 TCP 49515 > 993 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

7.758832 10.106.6.190 -> 10.106.6.254 TCP 49515 > 993 [ACK] Seq=1 Ack=1 Win=65700 Len=0

78.938576 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

80.415623 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

81.063027 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

81.555095 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

82.209324 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

83.062545 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

83.561624 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

84.147630 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

84.538105 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

85.637208 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

86.519913 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

92.840161 10.106.6.200 -> 10.106.6.254 TCP 1121 > 993 [ACK] Seq=1 Ack=39 Win=63341 Len=0

,windows客戶端使用telnet mail.bj.com 995 訪問

在linux下抓包分析:

[[email protected] ~]# tail -f /var/log/maillog

Mar 24 16:39:36 mail dovecot: pop3-login: Disconnected: rip=::ffff:10.106.6.190, lip=::ffff:10.106.6.254, TLS handshake

[[email protected] ~]# tshark -ni eth0 -R "tcp.dstport eq 995"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

5.593159 10.106.6.190 -> 10.106.6.254 TCP 49523 > 995 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

5.593564 10.106.6.190 -> 10.106.6.254 TCP 49523 > 995 [ACK] Seq=1 Ack=1 Win=65700 Len=0

26.818995 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

27.142342 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

27.452354 10.106.6.190 -> 10.106.6.254

SSL Continuation Data

27.676539 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

30.876873 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

32.255238 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

32.484204 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

32.743865 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

32.943849 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

33.136547 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

34.540448 10.106.6.190 -> 10.106.6.254 SSL Continuation Data

,windows客戶端使用outlook express 訪問,使用995埠 [[email protected] ~]# tail -f /var/log/maillog

Mar 24 16:49:51 mail sendmail[3520]: STARTTLS=server, relay=[10.106.6.200], version=TLSv1/SSLv3, verify=NO, cipher=RC4-MD5, bits=128/128

Mar 24 16:49:51 mail sendmail[3520]: q2O8npGW003520: from=<[email protected]>, size=1317, class=0, nrcpts=1, msgid=<[email protected]>, proto=SMTP, daemon=MTA, relay=[10.106.6.200]

Mar 24 16:49:52 mail sendmail[3521]: q2O8npGW003520: to=<[email protected]>, ctladdr=<[email protected]> (500/500), delay=00:00:01, xdelay=00:00:00, mailer=local, pri=31539, dsn=2.0.0, stat=Sent

Mar 24 16:50:31 mail dovecot: pop3-login: Login: user=<user1>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254, TLS

Mar 24 16:50:31 mail dovecot: POP3(user1): Disconnected: Logged out top=0/0, retr=1/1619, del=1/1, size=1602

[[email protected] ~]# tshark -ni eth0 -R "tcp.dstport eq 25"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

83.733934 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [SYN] Seq=0 Win=64240 Len=0 MSS=1460

83.734451 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [ACK] Seq=1 Ack=1 Win=64240 Len=0

83.863434 10.106.6.200 -> 10.106.6.254 SMTP Command: EHLO hp3aea877158e2

83.864925 10.106.6.200 -> 10.106.6.254 SMTP Command: STARTTLS

83.868606 10.106.6.200 -> 10.106.6.254 SMTP Command: \026\003\001\000a\001\000\000]\003\001Om\212\225\177\2448\033\244\377\245!\336\243\325\230\372\034\373\v\361\236\356\377\367*\376\255\342U\227\026 W\033\300\255\002\341j\002\333c\232$\356\331\376\373\214\217Y{\234\272\277"\277&f\275\240\t\3072\000\026\000\004\000\005\000

83.903397 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [ACK] Seq=134 Ack=2212 Win=64240 Len=0

83.915969 10.106.6.200 -> 10.106.6.254 SMTP Command: \026\003\001\000\215\v\000\000\003\000\000\000\020\000\000\202\000\200\276\224:\201\326n\tC\311\326\327\[email protected]\213\251\362\365\221Z J\241*\313\226\004\027\177\017R\t\0178\267{\217\314O\337Q2ckX\316E\017\177\216\364&u\324\215e\022n\227bH\022c#\213

83.948662 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

83.950965 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

84.027615 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

84.088790 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

84.090997 10.106.6.200 -> 10.106.6.254 SMTP Command: \027\003\001\000%\0000\353aZS\300\234\315w\216\366y\t \355\241\257\277\312\201\312\002cN/\303\313!-(Hg\265Z\251\364\027\003\001\000 \t\376X{\353!B\2475\200a\353\264N\344\341!\260\3061\375PS{\232\025\347\313\2601\245 \036\277\3376G\367}\232\222\370c\027\003\001\000)X(Jm\355\253\313\310\035\233\201|\347V\266\242\354^\adU\327\201\314\017\345\304.`\276\216\322\021\271Q\b\255\331<\377\025\027\003\001\000\026}\357\274\260\032\353\265%\235%\371:0_\256\222\016\352\203\036\346\\027\003\001\005Xa\201

84.133532 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

84.148026 10.106.6.200 -> 10.106.6.254 TCP [TCP segment of a reassembled PDU]

84.202514 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [FIN, ACK] Seq=1912 Ack=2669 Win=63783 Len=0

84.204916 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [RST] Seq=1913 Win=0 Len=0

84.204917 10.106.6.200 -> 10.106.6.254 TCP 1128 > 25 [RST, ACK] Seq=1913 Ack=2692 Win=0 Len=0

^C17 packets captured [[email protected] ~]#

[[email protected] ~]# tshark -ni eth0 -R "tcp.dstport eq 995"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

107.447859 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460

107.448440 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [ACK] Seq=1 Ack=1 Win=64240 Len=0

107.450502 10.106.6.200 -> 10.106.6.254 SSL Client Hello

107.505581 10.106.6.200 -> 10.106.6.254 TLSv1 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message

107.772579 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [ACK] Seq=285 Ack=898 Win=63343 Len=0

107.772581 10.106.6.200 -> 10.106.6.254 TCP [TCP Dup ACK 881#1] 1129 > 995 [ACK] Seq=285 Ack=898 Win=63343 Len=0

107.784547 10.106.6.200 -> 10.106.6.254

TLSv1 Application Data

107.801497 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

107.941173 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.048159 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.056046 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.057086 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [ACK] Seq=432 Ack=2748 Win=64240 Len=0

108.069078 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.077526 10.106.6.200 -> 10.106.6.254 TLSv1 Application Data

108.100136 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [ACK] Seq=488 Ack=2854 Win=64135 Len=0

108.100279 10.106.6.200 -> 10.106.6.254 TCP 1129 > 995 [FIN, ACK] Seq=488 Ack=2854 Win=64135 Len=0

,windows客戶端使用outlook express 訪問,使用993埠

三:使sendmail啟用認證功能:

為郵件伺服器提供SASL 功能:默認已經安裝.

①:使用telnet 127.0.0.1 25進行簡單測試:

以下:沒有250認證功能

[[email protected] certs]# telnet 127.0.0.1 25 EHLO 127.0.0.1

250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DSN 250-ETRN 250-STARTTLS 250-DELIVERBY 250 HELP mail from:[email protected] 250 2.1.0 [email protected] Sender ok

rcpt to:[email protected] 250 2.1.5 [email protected] Recipient ok DATA

354 Enter mail, end with "." on a line by itself

123. .

250 2.0.0 q2O9MwGr003612 Message accepted for delivery

Quit

[[email protected] certs]# su - user1

[[email protected] ~]$ mail Mail version 8.1 6/6/93. Type ? for help.

"/var/spool/mail/user1": 2 messages 1 new

1 [email protected] Fri Mar 23 17:40 13/542 "DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA"

>N 2 [email protected] Sat Mar 24 17:24 11/344 & 2 Message 2: From [email protected] Sat Mar 24 17:24:15 2012 Date: Sat, 24 Mar 2012 17:22:58 0800 From: [email protected] 123. 日誌顯示發送成功:

Mar 24 17:24:15 mail sendmail[3612]: q2O9MwGr003612: [email protected], size=5, class=0, nrcpts=1, msgid=<[email protected]>, proto=ESMTP, daemon=MTA, relay=mail.bj.com [127.0.0.1]

Mar 24 17:24:15 mail sendmail[3615]: q2O9MwGr003612: [email protected], delay=00:00:29, xdelay=00:00:00, mailer=local, pri=30293, dsn=2.0.0, stat=Sent

②:安裝SASL 功能:默認已經安裝,並啟動saslauthd服務.

SASL (簡單認證安全層)服務為:saslauthd

需要安裝的軟體包為:

cyrus-sasl-2.1.22-4.i386.rpm [[email protected] certs]# rpm -qa |grep sasl cyrus-sasl-plain-2.1.22-4 cyrus-sasl-2.1.22-4 cyrus-sasl-lib-2.1.22-4 cyrus-sasl-devel-2.1.22-4

#查看已經安裝了相關軟體包.

[[email protected] certs]# chkconfig saslauthd on

[[email protected] certs]# chkconfig --list saslauthd

saslauthd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

[[email protected] certs]# service saslauthd start

Starting saslauthd: [ OK ]

③:配置sendmail的主配置文檔/etc/mail/sendmail.mc 啟用認證功能.

[[email protected] ~]# cd /etc/mail/ [[email protected] mail]# vim sendmail.mc

39 define(`confAUTH_OPTIONS', `A y')dnl

52 TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

53 define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

116DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, name=MTA,M=Ea')dnl

[[email protected] mail]# service sendmail restart

Shutting down sm-client: [ OK ]

Shutting down sendmail: [ OK ]

Starting sendmail: [ OK ]

Starting sm-client: [ OK ]

④:在linux上使用telnet mail.bj.com 25測試認證.

[[email protected] mail]# telnet mail.bj.com 25

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

220 mail.bj.com ESMTP Sendmail 8.13.8/8.13.8; Sat, 24 Mar 2012 17:50:50 0800

EHLO mail.bj.com

250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DSN 250-AUTH LOGIN PLAIN 250-STARTTLS 250-DELIVERBY 250 HELP mail from:[email protected] 530 5.7.0 Authentication required

在上面信息中出現250-AUTH LOGIN PLAIN表示此時以支持認證.

先對賬號和密碼做base64 位編碼

[[email protected] ~]# echo -n "[email protected]" |openssl base64

dXNlcjFAYmouY29t

[[email protected] ~]# echo -n "123" |openssl base64

MTIz 再次進行測試:

[[email protected] mail]# telnet mail.bj.com 25

Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'.

220 mail.bj.com ESMTP Sendmail 8.13.8/8.13.8; Sat, 24 Mar 2012 17:50:50 0800

EHLO mail.bj.com 250-mail.bj.com Hello mail.bj.com [127.0.0.1], pleased to meet you 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DSN 250-AUTH LOGIN PLAIN

250-STARTTLS 250-DELIVERBY 250 HELP AUTH LOGIN dXNlcjFAYmouY29t 334 UGFzc3dvcmQ6 MTIz 235 2.0.0 OK Authenticated mail from:[email protected] 250 2.1.0 [email protected] Sender ok rcpt to:[email protected] 250 2.1.5 [email protected] Recipient ok DATA 354 Enter mail, end with "." on a line by itself user1-to-user1--2012/03/24. . 250 2.0.0 q2OA2AdE003852 Message accepted for delivery quit 221 2.0.0 mail.bj.com closing connection Connection closed by foreign host. [[email protected] ~]# su - user1 [[email protected] ~]$ mail Mail version 8.1 6/6/93. Type ? for help. "/var/spool/mail/user1": 2 messages 1 new

1 [email protected] Fri Mar 23 17:40 13/542 "DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA"

>N 2 [email protected] Sat Mar 24 18:05 12/402 & 2 Message 2:

From [email protected] Sat Mar 24 18:05:28 2012

Date: Sat, 24 Mar 2012 18:02:10 0800 From: [email protected] user1-to-user1--2012/03/24. & quit Saved 1 message in mbox Held 1 message in /var/spool/mail/user1 [[email protected] ~]$ 日誌分析:

Mar 24 18:05:28 mail sendmail[3852]: q2OA2AdE003852: [email protected], size=28, class=0, nrcpts=1, msgid=<[email protected]>, proto=ESMTP, daemon=MTA, relay=mail.bj.com [127.0.0.1]

Mar 24 18:05:28 mail sendmail[3857]: q2OA2AdE003852: [email protected], [email protected] (500/500), delay=00:00:27, xdelay=00:00:00, mailer=local, pri=30345, dsn=2.0.0, stat=Sent

:使用outlook express測試認證.

此時已經可以用OE 通過驗證身份的方式發送郵件了.

在啟用sasl 功能之後,access 的設置就不起效,因為所有的認證都是通過sasl 來實現了.此時,smtp 就不再基於IP 地址來認證,只需提供賬戶密碼即可.

日誌文件如下所示:

[[email protected] ~]# tail -f /var/log/maillog

Mar 24 18:22:58 mail sendmail[3927]: STARTTLS=server, relay=[10.106.6.200], version=TLSv1/SSLv3, verify=NO, cipher=RC4-MD5, bits=128/128

Mar 24 18:22:58 mail sendmail[3927]: AUTH=server, relay=[10.106.6.200], authid=user1, mech=LOGIN, bits=0

Mar 24 18:22:58 mail sendmail[3927]: q2OAMwNU003927: from=<[email protected]>, size=1244, class=0, nrcpts=1, msgid=<[email protected]>, proto=ESMTP, daemon=MTA, relay=[10.106.6.200]

Mar 24 18:22:58 mail sendmail[3928]: q2OAMwNU003927: to=<[email protected]>, ctladdr=<[email protected]> (500/500), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31491, dsn=2.0.0, stat=Sent

Mar 24 18:23:26 mail dovecot: imap-login: Login: user=<user2>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254, TLS

Mar 24 18:23:26 mail dovecot: IMAP(user2)

: Disconnected in IDLE

Mar 24 18:23:29 mail dovecot: pop3-login: Login: user=<user1>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254, TLS

Mar 24 18:23:29 mail dovecot: POP3(user1): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0

Mar 24 18:23:29 mail dovecot: imap-login: Login: user=<user2>, method=PLAIN, rip=::ffff:10.106.6.200, lip=::ffff:10.106.6.254, TLS

Mar 24 18:23:29 mail dovecot: IMAP(user2): Connection closed

本文出自 「xjzhujunjie」 博客,請務必保留此出處http://xjzhujunjie.blog.51cto.com/3582724/816099


[火星人 ] Linux下mail伺服器應用之郵件系統的安全性已經有759次圍觀

http://coctec.com/docs/linux/show-post-46300.html