turboLinux_White Box Enterprise Linux_Fedora Core_Red Hat Memo/Miracle9_inst のバックアップ差分(No.6)

バックアップ一覧
現在との差分を表示
ソースを表示
バックアップを表示
turboLinux_White Box Enterprise Linux_Fedora Core_Red Hat Memo/Miracle9_inst へ行く。
- 1 (2024-02-26 (月) 07:54:07)
- 2 (2024-02-26 (月) 07:55:22)
- 3 (2024-02-27 (火) 07:11:33)
- 4 (2024-02-28 (水) 06:13:38)
- 5 (2024-02-29 (木) 02:07:20)
- 6 (2024-03-01 (金) 07:57:15)
- 7 (2024-03-04 (月) 06:42:07)
- 8 (2024-03-08 (金) 06:00:17)
追加された行はこの色です。
削除された行はこの色です。
#author("2024-02-29T11:07:20+09:00","default:okada","okada")
#author("2024-03-01T16:57:15+09:00","default:okada","okada")
*MIRACLE LINUX 9.2 [#p33307be]


RIGHT:更新日&lastmod();
RIGHT:作成日:2024年2月26日

**OS Install [#n27e09d1]

以下から、完全版インストールイメージ（MIRACLELINUX-9.2-rtm-x86_64.iso）をDL

Esxi8.0u2にインストール 

ゲストOSはMIRACLE LINUX 8 (64 ビット)を指定

https://www.miraclelinux.com/distribution/download


**Emacs install [#l3c34804]

 # yum install emacs

**Web server install [#h87a2521]

 # rpm -qa | grep httpd
 miraclelinux-logos-httpd-90.4-1.el9.ML.6.noarch
 httpd-filesystem-2.4.57-5.el9.noarch
 httpd-tools-2.4.57-5.el9.x86_64
 httpd-core-2.4.57-5.el9.x86_64
 httpd-2.4.57-5.el9.x86_64
 httpd-manual-2.4.57-5.el9.noarch

 # systemctl status httpd
 ○ httpd.service - The Apache HTTP Server
      Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: d>
      Active: inactive (dead)

 # systemctl start httpd
 # systemctl status httpd
 ● httpd.service - The Apache HTTP Server
      Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: d>
      Active: active (running) since Tue 2024-02-13 15:20:02 JST; 5s ago
        Docs: man:httpd.service(8)
    Main PID: 4650 (httpd)
      Status: "Started, listening on: port 443, port 80"

***htmlの場所 [#f606973f]

-/var/www/html

インストール時には空フォルダで、デフォルトのページが開くがindex.htmlを作成すると、index.htmlが開く

**Firewall [#y4892730]

***firewallの確認 [#f1e912a0]

 # firewall-cmd --state
 running
 # firewall-cmd --get-services | sed 's/ /\n/g' | grep http
 http
 http3
 https
 wbem-http
 wbem-https


***一時的にhttpのポートを開ける [#q1734195]

 # firewall-cmd --add-service=http
 success
 # firewall-cmd --add-service=https
 success

***恒久的にhttpのポートを開ける [#r2e7a840]

 # firewall-cmd --add-service=http --permanent
 success
 # firewall-cmd --add-service=https --permanent
 success

***恒久的にhttpのポートを閉じる [#xf7c7f08]

 # firewall-cmd --remove-service=http --permanent
 success
 # firewall-cmd --reload
 success


***firewallのサービス一覧表示 [#c372ef9c]

 # firewall-cmd --get-services | sed 's/ /\n/g'
 RH-Satellite-6
 RH-Satellite-6-capsule
 afp
 amanda-client
 amanda-k5-client
 amqp
 amqps
 （略）

**ネットワーク（ipv6停止) [#f04fdd2c]

***デバイスの確認 [#w35ad7ae]

 # nmcli dev s
 DEVICE  TYPE      STATE            CONNECTION
 ens192  ethernet  接続済み         ens192
 lo      loopback  接続済み (外部)  lo

***ipアドレスの確認 [#k957f2cf]

 # ip address show ens192
 2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
     link/ether 00:0c:29:6e:0f:f3 brd ff:ff:ff:ff:ff:ff
     altname enp11s0
     inet 192.168.10.142/24 brd 192.168.10.255 scope global noprefixroute ens192
        valid_lft forever preferred_lft forever
     inet6 fe80::20c:29ff:fe6e:ff3/64 scope link noprefixroute
        valid_lft forever preferred_lft forever

***ipv6をdisabled に設定してネットワーク再起動 [#l452dfca]

 # nmcli connection modify ens192 ipv6.method "disabled"

 # nmcli connection up ens192
 接続が正常にアクティベートされました (D-Bus アクティブパス: /org/freedesktop/NetworkManager/ActiveConnection/3)

***ipv6が消えていることの確認 [#r1781b8e]

 # ip address show ens192
 2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
     link/ether 00:0c:29:6e:0f:f3 brd ff:ff:ff:ff:ff:ff
     altname enp11s0
     inet 192.168.10.142/24 brd 192.168.10.255 scope global noprefixroute ens192
        valid_lft forever preferred_lft forever

** mail sever(postfix) install [#wae4b1dd]

 # rpm -qa | grep postfix
 postfix-3.5.9-24.el9.x86_64

 # firewall-cmd --add-service=postfix
 Error: INVALID_SERVICE: postfix


***Postfixの基本設定 [#u11cf95f]

-/etc/postfix/main.cf

 myhostname = miracle9.ism21.net

 mydomain = ism21.net

 myorigin = $myhostname

 ##inet_interfaces = localhost
 inet_interfaces = localhost, 192.168.10.142

 ##mydestination = $myhostname, localhost.$mydomain, localhost

 mydestination = $myhostname, localhost.$mydomain, localhost

 mynetworks = 192.168.10.0/24, 127.0.0.1/8
 mynetworks = 192.168.10.0/24, 127.0.0.0/8

***SMTPAUTHの設定 [#nb5fbe25]

認証が成功したユーザだけがメールをリレー送信することができる設定

/etc/postfix/main.cfの最後に以下を追加

 ## Edit by JE2ISM
 
 ###SMTPAUTH
 smtpd_sasl_auth_enable = yes
 smtpd_sasl_security_options = noanonymous
 smtpd_sasl_local_domain = $myhostname
 broken_sasl_auth_clients = yes
 smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated, check_relay_domains

またデフォルトで、以下の個所がsmtp_tlsの設定のようだ

-main.cf

 # TLS CONFIGURATION
 #
 # Basic Postfix TLS configuration by default with self-signed certificate
 # for inbound SMTP and also opportunistic TLS for outbound SMTP.
 
 # The full pathname of a file with the Postfix SMTP server RSA certificate
 # in PEM format. Intermediate certificates should be included in general,
 # the server certificate first, then the issuing CA(s) (bottom-up order).
 #
 smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem
 
 (略)

***ユーザーとパスワードを登録したデーターベースファイル/etc/sasldb2を作成 [#xea473c0]

 # /usr/sbin/saslpasswd2 -c -u `postconf -h myhostname` okada
 Password:
 Again (for verification):

 # chgrp postfix sasl2
 # ls -l sasl2
 合計 20
 -rw-------. 1 root root 16384  2月 14 15:30 sasldb2
 -rw-r--r--. 1 root root    49 12月  1 15:20 smtpd.conf

 # cd /etc/sasl2
 # chgrp  postfix sasl2/sasldb2
 # chmod g+r sasl2/sasldb2

 # ls -l sasl2
 合計 20
 -rw-r-----. 1 root postfix 16384  2月 14 15:30 sasldb2
 -rw-r--r--. 1 root root       49 12月  1 15:20 smtpd.conf

***saslのインストール及び確認 [#t48f65fa]

 # rpm -qa | grep sasl
 cyrus-sasl-lib-2.1.27-21.el9.x86_64
 cyrus-sasl-gssapi-2.1.27-21.el9.x86_64
 cyrus-sasl-2.1.27-21.el9.x86_64
 cyrus-sasl-plain-2.1.27-21.el9.x86_64

 # /usr/sbin/sasldblistusers2
 okada@miracle9.ism21.net: userPassword

 # less /etc/sasl2/smtpd.conf
 
 pwcheck_method: saslauthd
 mech_list: plain login

 # systemctl start saslauthd
 # systemctl status saslauthd
 ● saslauthd.service - SASL authentication daemon.
      Loaded: loaded (/usr/lib/systemd/system/saslauthd.service; disabled; prese>
      Active: active (running) since Wed 2024-02-21 14:21:36 JST; 2s ago
     Process: 2242 ExecStart=/usr/sbin/saslauthd -m $SOCKETDIR -a $MECH $FLAGS (>
    Main PID: 2243 (saslauthd)

 # systemctl enable saslauthd
 Created symlink /etc/systemd/system/multi-user.target.wants/saslauthd.service  → /usr/lib/systemd/system/saslauthd.service.

***参考 [#h89644fd]

-https://qiita.com/nkiw/items/cbddeaba18f8c010fb5e


***Postfix起動 [#aa98b019]

 # systemctl start postfix
 # systemctl status postfix
 ● postfix.service - Postfix Mail Transport Agent
      Loaded: loaded (/usr/lib/systemd/system/postfix.service; disabled; preset:>
      Active: active (running) since Wed 2024-02-14 15:42:15 JST; 6s ago
     Process: 2269 ExecStartPre=/usr/sbin/restorecon -R /var/spool/postfix/pid (>
     Process: 2270 ExecStartPre=/usr/libexec/postfix/aliasesdb (code=exited, sta> 
     Process: 2274 ExecStartPre=/usr/libexec/postfix/chroot-update (code=exited,> 
     Process: 2275 ExecStart=/usr/sbin/postfix start (code=exited, status=0/SUCC>
    Main PID: 2343 (master)
 (略)

***OS起動時に起動 [#c6672dfb]

 # systemctl enable postfix
 Created symlink /etc/systemd/system/multi-user.target.wants/postfix.service → /usr/lib/systemd/system/postfix.service.
 # systemctl status postfix
 ○ postfix.service - Postfix Mail Transport Agent
      Loaded: loaded (/usr/lib/systemd/system/postfix.service; enabled; preset: >
      Active: inactive (dead)

 # systemctl start postfix

***OS起動時のPostfixの以下のエラー対策 [#h07027c9]

 # systemctl status postfix
 (略)
 2月 21 23:27:39 miracle9 systemd[1]: Starting Postfix Mail Transport Agent...
 2月 21 23:27:40 miracle9 postfix[1052]: fatal: parameter inet_interfaces: no local interface found for 192.168.10.142

-/etc/postfix/main.cf

 inet_interfaces = all

にする


***Telnet のInsatll(dnf) [#z737bc9a]

''dnfはyumの後継となるコマンド''

 # dnf install telnet

***Postfix接続テスト [#fac87dcf]

 $ telnet 127.0.0.1 25
 Trying 127.0.0.1...
 Connected to 127.0.0.1.
 Escape character is '^]'.
 220 miracle9.ism21.net ESMTP Postfix
 ehlo 127.0.0.1
 250-miracle9.ism21.net
 250-PIPELINING
 250-SIZE 10240000
 250-VRFY
 250-ETRN
 250-STARTTLS  ←暗号化している
 250-AUTH PLAIN LOGIN　	←パスワードはShellパスワード
 250-AUTH=PLAIN LOGIN
 250-ENHANCEDSTATUSCODES
 250-8BITMIME
 250-DSN
 250-SMTPUTF8
 250 CHUNKING

 quit

&ref("./smtp認証.png");

***firewallの許可 [#ga4c1d9e]

 # firewall-cmd --add-service=smtp --zone=public --permanent
 success
 # firewall-cmd --reload
 success
 # firewall-cmd --list-services --zone=public
 ....... smtp ....

**mailコマンド(クライアント)のInstall [#i4541ced]

 # dnf install s-nail

 $ mail
 s-nail: No mail for okada at /var/spool/mail/okada

***mail送信 [#rcbd9f55]

 $ mail okada
 Subject: TEST
 To: okada
 TEST
 ^D ← ctrl+d
 -------
 (Preliminary) Envelope contains:
 To: okada
 Subject: TES
 Send this message [yes/no, empty: recompose]? yes


https://users.miraclelinux.com/technet/document/linux/training/2_7_5.html#training2_7_5


**dovecot(IMAP)インストールと設定 [#o3dd97ac]

imap(Port 143)＋STARTTLSでの設定

STARTTLS:暗号化されていない状態で通信を開始し、途中でSTARTTLSコマンドを実行することで通信経路を暗号化をする

 # rpm -qa | grep dovecot
 dovecot-2.3.16-10.el9.x86_64

Postfix に SASL 機能が提供できるよう Dovecot を設定

 # cd /etc/dovecot/

-dovecot.conf

 # Protocols we want to be serving.
 #protocols = imap pop3 lmtp submission
 protocols = imap pop3 lmtp submission
 
 
 #listen = *, ::
 listen = *

 # cd conf.d

-10-auth.conf

 #disable_plaintext_auth = yes
 disable_plaintext_auth = no
 
 # NOTE: See also disable_plaintext_auth setting.
 ##auth_mechanisms = plain
 auth_mechanisms = plain login ← loginパスワードとして設定

-10-mail.conf

 #mail_location =
 mail_location = maildir:~/Maildir

-10-master.conf

   # Postfix smtp-auth
   #unix_listener /var/spool/postfix/private/auth {
   #  mode = 0666
   #}
 
   unix_listener /var/spool/postfix/private/auth {
     mode = 0666
     user = postfix
     group = postfix
   }


-10-ssl.conf

 # plain imap and pop3 are still allowed for local connections
 ## ssl = required
 ssl = no

***起動 [#q8e185d8]

 # systemctl start dovecot
 # systemctl status dovecot
 ● dovecot.service - Dovecot IMAP/POP3 email server
      Loaded: loaded (/usr/lib/systemd/system/dovecot.service; disabled; preset:> 
      Active: active (running) since Wed 2024-02-21 16:44:22 JST; 6s ago
        Docs: man:dovecot(1)
              https://doc.dovecot.org/
     Process: 2512 ExecStartPre=/usr/libexec/dovecot/prestartscript (code=exited>
    Main PID: 2519 (dovecot)

 # systemctl enable dovecot
 Created symlink /etc/systemd/system/multi-user.target.wants/dovecot.service → /usr/lib/systemd/system/dovecot.service.

***Firewallのポートを許可 [#e92c4ae3]

 # firewall-cmd --add-service={pop3,imap} --permanent
 success

 # firewall-cmd --reload
 success

***postfixのmailboxを変更 [#od55c225]


-/etc/postfix/main.cf

 home_mailbox = Maildir/


**Firewall 許可の表示(port / service) [#y2397cb0]


 # firewall-cmd --list-ports --zone=public --permanent

 # firewall-cmd --list-ports --zone=public

 # firewall-cmd --list-services --zone=public
 cockpit dhcpv6-client imap pop3 ssh

***Thunderbirdの設定 [#v90e9098]

&ref("./imap暗号化.png");

&ref("./受信サーバの設定.png");

***参考 [#s42f6252]

-https://www.server-world.info/query?os=CentOS_7&p=mail&f=2

-https://mebee.info/2020/05/26/post-11804/#outline__4

**dovecot(imap)パスワードの暗号化 [#p44475f2]

imapのパスワードの暗号化。通信はSTARTTLS。

***dovecotの設定 [#k169eba9]

 # cd /etc/dovecot/conf.d

-10-auth.conf

 # NOTE: See also disable_plaintext_auth setting.
 ##auth_mechanisms = plain
 ###auth_mechanisms = plain login
 auth_mechanisms = cram-md5
 
 (略)
 
 #!include auth-passwdfile.conf.ext
 !include auth-passwdfile.conf.ext
 

-auth-passwdfile.conf.ext

 passdb {
   driver = passwd-file
 ##  args = scheme=CRYPT username_format=%u /etc/dovecot/users
   args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users
 }
 
 userdb {
   driver = passwd-file
   args = username_format=%u /etc/dovecot/users

***パスワード作成時エラー [#d5a7cc76]

&color(red){パスワード作成時以下のエラーが発生};

 # doveadm pw -s CRAM-MD5
 Error: conn unix:/run/dovecot/stats-writer (pid=1418,uid=0): Timeout waiting for handshake response
 Enter new password:
 Retype new password:

***対策 [#f34d6e0b]

/etc/dovecot/dovecot.confの行末に以下を追加

 ## Edit by JE2ISM
 
 service stats {
   unix_listener stats-reader {
     group = dovecot
     mode = 0660
   }
   unix_listener stats-writer {
     group = dovecot
     mode = 0660
   }
 }
 service anvil {
   unix_listener anvil {
     group = dovecot
     mode = 0660
   }
 }

-再起動

 # systemctl restart dovecot

***パスワード作成 [#x416cde5]

 # doveadm pw -s CRAM-MD5
 Enter new password:
 Retype new password:
 {CRAM-MD5}848d037dda（略）053ecba9e


***ユーザ・パスワードファイル作成 [#f5e28f5a]

-/etc/dovecot/

 # 新規登録
 # [ユーザー名]: [パスワード]
 
 okada:{CRAM-MD5}848d037dda（略）053ecba9e

***Thunderbirdの設定 [#jbfb7ded]

&ref("./imapパスワード暗号化.png");

***参考 [#v6f196f6]

-https://www.kd2.jp/memo/ubuntu/postfix/02_install_dovecot.php
-https://www.server-world.info/query?os=Ubuntu_20.04&p=mail&f=9



**dovecotでSSLを使用する [#tdfe063d]

&color(red){以下のようにすることでimps(Port993) SSL/TLS通信が出来るようだが、Thunderbirdが自己認証をサポートしないようなので、上記のSTARTTLSを検討する。};

-conf.d/10-ssl.conf 

 ssl = yes
 ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
 ssl_key = </etc/pki/dovecot/private/dovecot.pem

-conf.d/10-master.conf 

service imap-login {
  inet_listener imap {
    #port = 143
  }
  inet_listener imaps {
    #port = 993
    #ssl = yes
    port = 993
    ssl = yes
  }

 # systemctl restart dovecot

 # firewall-cmd --add-service=imaps --zone=public --permanent
 success
 # firewall-cmd --reload


%%imapを停止してimapsだけサービスを動作させることが出来ないのでfirewallでimapを切る%%

 # firewall-cmd --remove-service=imap --zone=public --permanent
 success
 # firewall-cmd --reload
 success
 # firewall-cmd --list-services --zone=public
 cockpit dhcpv6-client imaps pop3 smtp ssh

***参考 [#s4f08749]

-https://rms.ne.jp/sslserver/install/install_dovecot-html/

-https://www.bigbang.mydns.jp/dovecot20-x.htm