メールサーバの構築

# ln -s postfixadmin-x.xx postfixadmin

<!--?php
/**
 * Contains configuration options that override the default config file
 */
/*****************************************************************
 *  !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 * You have to set $CONF['configured'] = true; before the
 * application will run!
 * Doing this implies you have changed this file as required.
 * i.e. configuring database etc; specifying setup.php password etc.
 */
$CONF['configured'] = true;
// In order to setup Postfixadmin, you MUST specify a hashed password here.
// To create the hash, visit setup.php in a browser and type a password into the field,
// on submission it will be echoed out to you as a hashed value.
$CONF['postfix_admin_url'] = '/postfixadmin';
$CONF['database_type'] = 'mysql';
$CONF['database_host'] = 'localhost';
$CONF['database_user'] = 'postfix';
$CONF['database_password'] = 'XXXXXXXXXX';
$CONF['database_name'] = 'postfix';
$CONF['admin_email'] = 'postmaster@wwwNNNNzz.sakura.ne.jp';
$CONF['encrypt'] = 'dovecot:CRAM-MD5';
$CONF['dovecotpw'] = '/usr/bin/doveadm pw';
$CONF['min_password_length'] = 6;
$CONF['page_size'] = '20';
$CONF['domain_path'] = 'YES';
$CONF['domain_in_mailbox'] = 'NO';
$CONF['aliases'] = '50';
$CONF['mailboxes'] = '50';
$CONF['maxquota'] = '100';
$CONF['quota'] = 'YES';
$CONF['quota_multiplier'] = '1024000';
$CONF['transport'] = 'NO';
$CONF['transport_options'] = array (
    'virtual',  // for virtual accounts
    'local',    // for system accounts
    'relay'     // for backup mx
);
$CONF['transport_default'] = 'virtual';
$CONF['vacation'] = 'NO';
$CONF['special_alias_control'] = 'YES';
$CONF['user_footer_link'] = 'http://wwwNNNNzz.sakura.ne.jp/postfixadmin/main';
$CONF['show_footer_text'] = 'YES';
$CONF['footer_text'] = 'Return to change-this-to-your.domain.tld';
$CONF['footer_link'] = 'http://wwwNNNNzz.sakura.ne.jp/postfixadmin';
$CONF['create_mailbox_subdirs']=array('Drafts','Spam','Sent','Trash');
$CONF['create_mailbox_subdirs_host']='localhost';
$CONF['create_mailbox_subdirs_prefix']='';
$CONF['used_quotas'] = 'YES';
$CONF['new_quota_table'] = 'YES';
// Alias Control
// Postfix Admin inserts an alias in the alias table for every mailbox it creates.
// The reason for this is that when you want catch-all and normal mailboxes
// to work you need to have the mailbox replicated in the alias table.
// If you want to take control of these aliases as well set this to 'YES'.
// Alias control for superadmins
$CONF['alias_control'] = 'YES';
// Alias Control for domain admins
$CONF['alias_control_admin'] = 'YES';
// Special Alias Control
// Set to 'NO' if your domain admins shouldn't be able to edit the default aliases
// as defined in $CONF['default_aliases']
$CONF['special_alias_control'] = 'NO';
// Alias Goto Field Limit
// Set the max number of entries that you would like to see
// in one 'goto' field in overview, the rest will be hidden and "[and X more...]" will be added.
// '0' means no limits.
$CONF['alias_goto_limit'] = '0';
// Alias Domains
// Alias domains allow to "mirror" aliases and mailboxes to another domain. This makes
// configuration easier if you need the same set of aliases on multiple domains, but
// also requires postfix to do more database queries.
// Note: If you update from 2.2.x or earlier, you will have to update your postfix configuration.
// Set to 'NO' to disable alias domains.
$CONF['alias_domain'] = 'YES';
//
// END OF CONFIG FILE
//

#  Web application to manage Postfix email server
#
<Directory "/usr/share/postfixadmin/">
 AllowOverride AuthConfig
 Order Deny,Allow
 Deny from All
 Allow from 127.0.0.1
 Allow from 自宅のルータに割り当てられたWAN側IPアドレス（グローバルIPアドレス）
</Directory>
Alias /postfixadmin /usr/share/postfixadmin
Alias /PostFixAdmin /usr/share/postfixadmin
Alias /PostfixAdmin /usr/share/postfixadmin

# yum install postfix

# service sendmail stop
# chkconfig sendmail off
# alternatives --config mta
sendmail.postfixを選択します。

# --------------- local settings ------------------
inet_interfaces                 = all
inet_protocols                  = ipv4
mynetworks_style                = host
alias_maps                      = hash:/etc/aliases
relay_domains                   =

# postconf -d
または
# postconf -d inet_interfaces

# postconf -a

# postconf -A

# ---------------------- SASL PART (Server) -----------------
smtpd_sasl_auth_enable         = yes
smtpd_sasl_local_domain        = $myhostname
smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_security_options    = noplaintext,noanonymous
broken_sasl_auth_clients       = yes
smtpd_sasl_type                = dovecot
# Can be an absolute path, or relative to $queue_directory
smtpd_sasl_path                = private/auth

# chkconfig saslauthd off
# service saslauthd stop

# --------------- VIRTUAL DOMAINS ----------------------
virtual_mailbox_domains             = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_base                = /home/mailuser
virtual_mailbox_maps                = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_mailbox_limit_maps          = mysql:/etc/postfix/mysql_virtual_mailbox_limit_maps.cf
virtual_alias_maps                  = mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_minimum_uid                 = 10000
virtual_uid_maps                    = static:10000
virtual_gid_maps                    = static:10000
virtual_transport                   = lmtp:unix:private/dovecot-lmtp
dovecot_destination_recipient_limit = 1

# postconf -m

# postmap -q vdomain1.jp mysql:/etc/postfix/mysql_virtual_domains_maps.cf
vdomain1.jp

# ---------------------- TLS PART --------------------------------
smtpd_tls_auth_only                 = yes
smtpd_tls_CAfile                    = /etc/pki/server1/cacert.crt
smtpd_tls_cert_file                 = /etc/pki/server1/mail-server.crt
smtpd_tls_key_file                  = /etc/pki/server1/mail-server.key
smtpd_tls_session_cache_database    = btree:/var/lib/postfix/smtpd_scache
smtpd_tls_security_level            = may
smtpd_tls_received_header           = yes
smtpd_tls_loglevel                  = 1
tls_random_source                   = dev:/dev/urandom

# ---------------------- Security PART ----------------------
smtp_tls_protocols                  = !SSLv2, !SSLv3
smtp_tls_mandatory_protocols        = !SSLv2, !SSLv3
smtpd_tls_protocols                 = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols       = !SSLv2, !SSLv3
smtpd_banner                        = $myhostname ESMTP Unknown
smtpd_helo_required                 = yes
disable_vrfy_command                = yes
unknown_local_recipient_reject_code = 550
maps_rbl_reject_code                = 550
default_rbl_reply                   = $rbl_code <$recipient>: Recipient address rejected: User unknown in local recipient table
header_checks                       = pcre:/etc/postfix/header_checks
#warning: the restrictions reject_unknown_(sender|recipient)_domain
#will trigger if your DNS becomes unavailable
smtpd_client_restrictions           = permit_mynetworks,
                                      check_client_access hash:/etc/postfix/access,
                                      check_client_access cidr:/etc/postfix/client.cidr,
                                      reject_rbl_client all.rbl.jp,
                                      reject_rbl_client bl.spamcop.net,
                                      reject_rbl_client multi.surbl.org,
                                      reject_rbl_client sbl-xbl.spamhaus.org,
                                      permit
smtpd_helo_restrictions             = permit_mynetworks,
                                      check_helo_access hash:/etc/postfix/access,
                                      check_client_access cidr:/etc/postfix/client.cidr,
                                      reject_invalid_hostname,
                                      permit
smtpd_sender_restrictions           = permit_mynetworks,
                                      hash:/etc/postfix/reject_sender,
                                      reject_unknown_sender_domain,
                                      reject_non_fqdn_sender
smtpd_recipient_restrictions        = permit_mynetworks,
                                      permit_sasl_authenticated,
                                      reject_unauth_destination
smtpd_data_restrictions             = reject_unauth_pipelining,
                                      reject_multi_recipient_bounce,
                                      permit

smtp      inet  n       -       n       -       -       smtpd
  -o receive_override_options=no_address_mappings
submission inet n       -       n       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o milter_macro_daemon_name=ORIGINATING
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous,noplaintext
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination
smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,permit_mynetworks,reject

# rpm --inport http://packages.atrpms.net/RPM-GPG-KEY.atrpms

# cd /usr/local/src/rpm
# wget http://packages.atrpms.net/dist/el6/atrpms-repo/atrpms-repo-6-7.el6.i686.rpm
# rpm -ivH atrpms-repo-6-7.el6.i686.rpm

# yum --disablerepo=* --enablerepo=atrpms-testing install dovecot

protocols = imap pop3 lmtp
disable_plaintext_auth = yes
ssl=yes
ssl_ca = </etc/pki/server1/cacert.crt
ssl_cert = </etc/pki/server1/mail-server.crt
ssl_key = </etc/pki/server1/mail-server.key
mail_location = maildir:/home/maiuser/%d/%n
first_valid_uid = 10000
last_valid_uid = 10000
maildir_copy_with_hardlinks = yes
mail_plugins = quota
# Should saving a mail to a nonexistent mailbox automatically create it?
lda_mailbox_autocreate = yes
# Should automatically created mailboxes be also automatically subscribed?
lda_mailbox_autosubscribe = yes
# Having "login" also as a mechanism make sure outlook can use the auth smtpd as well
# http://wiki.dovecot.org/Authentication/Mechanisms
auth_mechanisms = cram-md5 plain login
passdb {
  driver = sql
  args = /etc/dovecot/sql.conf
}
userdb {
  driver = sql
  args = /etc/dovecot/sql.conf
}
# ++++++++++++++++++++++++ conf.d/10-master.conf ++++++++++++++++++
service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 110
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
   group = postfix
   mode = 0600
   user = postfix
  }
  # Create inet listener only if you can't use the above UNIX socket
  #inet_listener lmtp {
    # Avoid making LMTP visible for the entire internet
    #address =
    #port =
  #}
  process_min_avail = 5
  executable = lmtp -L
}
service imap {
  # Most of the memory goes to mmap()ing files. You may need to increase this
  # limit if you have huge mailboxes.
  vsz_limit = 256M
  # Max. number of IMAP processes (connections)
  process_limit = 1024
}
service pop3 {
  # Max. number of POP3 processes (connections)
  process_limit = 1024
}
#auth_verbose = yes
#auth_debug = yes
#auth_debug_passwords = yes
service auth {
  unix_listener auth-userdb {
    group = vmail
    mode = 0600
    user = vmail
  }
  # Postfix smtp-auth
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    # Assuming the default Postfix user and group
    user = postfix
    group = postfix
  }
}
service dict {
  # If dict proxy is used, mail processes should have access to its socket.
  # For example: mode=0660, group=vmail and global mail_access_groups=vmail
  unix_listener dict {
    mode = 0600
    user = vmail
    group = vmail
  }
}
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
protocol imap {
  mail_plugins = $mail_plugins imap_quota
  imap_client_workarounds = delay-newmail
}
protocol pop3 {
  mail_plugins = $mail_plugins quota
  pop3_uidl_format = %08Xu%08Xv
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}
protocol lmtp {
  postmaster_address = postmaster@wwwNNNNzz.sakura.ne.jp
  mail_plugins = quota sieve
  info_log_path = /var/log/dovecot-lmtp.log
}
dict {
  quotadict = mysql:/etc/dovecot/dict-quota.conf
}
plugin {
  quota2 = dict:User quota::proxy::quotadict
  quota = dict:Domain quota:%d:proxy::quotadict
  acl = vfile:/etc/dovecot/acls
  trash = /etc/dovecot/trash.conf
  sieve_global_path = /home/sieve/globalfilter.sieve
  sieve = ~/dovecot.sieve
  sieve_dir = ~/sieve
  sieve_global_dir = /home/sieve/
  #sieve_extensions = +notify +imapflags
  sieve_max_script_size = 1M
  #sieve_max_actions = 32
  #sieve_max_redirects = 4
}
namespace {
# Namespace type: private, shared or public
type = private
# Hierarchy separator to use. You should use the same separator for all
# namespaces or some clients get confused. '/' is usually a good one.
# The default however depends on the underlying mail storage format.
separator = .
# Prefix required to access this namespace. This needs to be different for
# all namespaces. For example "Public/".
prefix = INBOX.
# Physical location of the mailbox. This is in same format as
# mail_location, which is also the default for it.
#location =
# There can be only one INBOX, and this setting defines which namespace
# has it.
inbox = yes
# If namespace is hidden, it's not advertised to clients via NAMESPACE
# extension or shown in LIST replies. This is mostly useful when converting
# from another server with different namespaces which you want to depricate
# but still keep working. For example you can create hidden namespaces with
# prefixes "~/mail/", "~%u/mail/" and "mail/".
hidden = no
}
ssl_protocols = !SSLv2 !SSLv3

service imap-login {
  inet_listener imap {
    port = 0
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 0
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}

#auth_verbose = yes
#auth_debug = yes
#auth_debug_passwords = yes

# service postfix start

# service dovecot start

-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 25 --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 465 --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 587 --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 995 --state NEW -j ACCEPT