#author("2024-03-01T16:57:15+09:00","default:okada","okada") *MIRACLE LINUX 9.2 [#p33307be] RIGHT:更新日&lastmod(); RIGHT:作成日:2024年2月26日 **OS Install [#n27e09d1] 以下から、完全版インストールイメージ(MIRACLELINUX-9.2-rtm-x86_64.iso)をDL Esxi8.0u2にインストール ゲストOSはMIRACLE LINUX 8 (64 ビット)を指定 https://www.miraclelinux.com/distribution/download **Emacs install [#l3c34804] # yum install emacs **Web server install [#h87a2521] # rpm -qa | grep httpd miraclelinux-logos-httpd-90.4-1.el9.ML.6.noarch httpd-filesystem-2.4.57-5.el9.noarch httpd-tools-2.4.57-5.el9.x86_64 httpd-core-2.4.57-5.el9.x86_64 httpd-2.4.57-5.el9.x86_64 httpd-manual-2.4.57-5.el9.noarch # systemctl status httpd ○ httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: d> Active: inactive (dead) # systemctl start httpd # systemctl status httpd ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: d> Active: active (running) since Tue 2024-02-13 15:20:02 JST; 5s ago Docs: man:httpd.service(8) Main PID: 4650 (httpd) Status: "Started, listening on: port 443, port 80" ***htmlの場所 [#f606973f] -/var/www/html インストール時には空フォルダで、デフォルトのページが開くがindex.htmlを作成すると、index.htmlが開く **Firewall [#y4892730] ***firewallの確認 [#f1e912a0] # firewall-cmd --state running # firewall-cmd --get-services | sed 's/ /\n/g' | grep http http http3 https wbem-http wbem-https ***一時的にhttpのポートを開ける [#q1734195] # firewall-cmd --add-service=http success # firewall-cmd --add-service=https success ***恒久的にhttpのポートを開ける [#r2e7a840] # firewall-cmd --add-service=http --permanent success # firewall-cmd --add-service=https --permanent success ***恒久的にhttpのポートを閉じる [#xf7c7f08] # firewall-cmd --remove-service=http --permanent success # firewall-cmd --reload success ***firewallのサービス一覧表示 [#c372ef9c] # firewall-cmd --get-services | sed 's/ /\n/g' RH-Satellite-6 RH-Satellite-6-capsule afp amanda-client amanda-k5-client amqp amqps (略) **ネットワーク(ipv6停止) [#f04fdd2c] ***デバイスの確認 [#w35ad7ae] # nmcli dev s DEVICE TYPE STATE CONNECTION ens192 ethernet 接続済み ens192 lo loopback 接続済み (外部) lo ***ipアドレスの確認 [#k957f2cf] # ip address show ens192 2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:0c:29:6e:0f:f3 brd ff:ff:ff:ff:ff:ff altname enp11s0 inet 192.168.10.142/24 brd 192.168.10.255 scope global noprefixroute ens192 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe6e:ff3/64 scope link noprefixroute valid_lft forever preferred_lft forever ***ipv6をdisabled に設定してネットワーク再起動 [#l452dfca] # nmcli connection modify ens192 ipv6.method "disabled" # nmcli connection up ens192 接続が正常にアクティベートされました (D-Bus アクティブパス: /org/freedesktop/NetworkManager/ActiveConnection/3) ***ipv6が消えていることの確認 [#r1781b8e] # ip address show ens192 2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:0c:29:6e:0f:f3 brd ff:ff:ff:ff:ff:ff altname enp11s0 inet 192.168.10.142/24 brd 192.168.10.255 scope global noprefixroute ens192 valid_lft forever preferred_lft forever ** mail sever(postfix) install [#wae4b1dd] # rpm -qa | grep postfix postfix-3.5.9-24.el9.x86_64 # firewall-cmd --add-service=postfix Error: INVALID_SERVICE: postfix ***Postfixの基本設定 [#u11cf95f] -/etc/postfix/main.cf myhostname = miracle9.ism21.net mydomain = ism21.net myorigin = $myhostname ##inet_interfaces = localhost inet_interfaces = localhost, 192.168.10.142 ##mydestination = $myhostname, localhost.$mydomain, localhost mydestination = $myhostname, localhost.$mydomain, localhost mynetworks = 192.168.10.0/24, 127.0.0.0/8 ***SMTPAUTHの設定 [#nb5fbe25] 認証が成功したユーザだけがメールをリレー送信することができる設定 /etc/postfix/main.cfの最後に以下を追加 ## Edit by JE2ISM ###SMTPAUTH smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated, check_relay_domains またデフォルトで、以下の個所がsmtp_tlsの設定のようだ -main.cf # TLS CONFIGURATION # # Basic Postfix TLS configuration by default with self-signed certificate # for inbound SMTP and also opportunistic TLS for outbound SMTP. # The full pathname of a file with the Postfix SMTP server RSA certificate # in PEM format. Intermediate certificates should be included in general, # the server certificate first, then the issuing CA(s) (bottom-up order). # smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem (略) ***ユーザーとパスワードを登録したデーターベースファイル/etc/sasldb2を作成 [#xea473c0] # /usr/sbin/saslpasswd2 -c -u `postconf -h myhostname` okada Password: Again (for verification): # chgrp postfix sasl2 # ls -l sasl2 合計 20 -rw-------. 1 root root 16384 2月 14 15:30 sasldb2 -rw-r--r--. 1 root root 49 12月 1 15:20 smtpd.conf # cd /etc/sasl2 # chgrp postfix sasl2/sasldb2 # chmod g+r sasl2/sasldb2 # ls -l sasl2 合計 20 -rw-r-----. 1 root postfix 16384 2月 14 15:30 sasldb2 -rw-r--r--. 1 root root 49 12月 1 15:20 smtpd.conf ***saslのインストール及び確認 [#t48f65fa] # rpm -qa | grep sasl cyrus-sasl-lib-2.1.27-21.el9.x86_64 cyrus-sasl-gssapi-2.1.27-21.el9.x86_64 cyrus-sasl-2.1.27-21.el9.x86_64 cyrus-sasl-plain-2.1.27-21.el9.x86_64 # /usr/sbin/sasldblistusers2 okada@miracle9.ism21.net: userPassword # less /etc/sasl2/smtpd.conf pwcheck_method: saslauthd mech_list: plain login # systemctl start saslauthd # systemctl status saslauthd ● saslauthd.service - SASL authentication daemon. Loaded: loaded (/usr/lib/systemd/system/saslauthd.service; disabled; prese> Active: active (running) since Wed 2024-02-21 14:21:36 JST; 2s ago Process: 2242 ExecStart=/usr/sbin/saslauthd -m $SOCKETDIR -a $MECH $FLAGS (> Main PID: 2243 (saslauthd) # systemctl enable saslauthd Created symlink /etc/systemd/system/multi-user.target.wants/saslauthd.service → /usr/lib/systemd/system/saslauthd.service. ***参考 [#h89644fd] -https://qiita.com/nkiw/items/cbddeaba18f8c010fb5e ***Postfix起動 [#aa98b019] # systemctl start postfix # systemctl status postfix ● postfix.service - Postfix Mail Transport Agent Loaded: loaded (/usr/lib/systemd/system/postfix.service; disabled; preset:> Active: active (running) since Wed 2024-02-14 15:42:15 JST; 6s ago Process: 2269 ExecStartPre=/usr/sbin/restorecon -R /var/spool/postfix/pid (> Process: 2270 ExecStartPre=/usr/libexec/postfix/aliasesdb (code=exited, sta> Process: 2274 ExecStartPre=/usr/libexec/postfix/chroot-update (code=exited,> Process: 2275 ExecStart=/usr/sbin/postfix start (code=exited, status=0/SUCC> Main PID: 2343 (master) (略) ***OS起動時に起動 [#c6672dfb] # systemctl enable postfix Created symlink /etc/systemd/system/multi-user.target.wants/postfix.service → /usr/lib/systemd/system/postfix.service. # systemctl status postfix ○ postfix.service - Postfix Mail Transport Agent Loaded: loaded (/usr/lib/systemd/system/postfix.service; enabled; preset: > Active: inactive (dead) # systemctl start postfix ***OS起動時のPostfixの以下のエラー対策 [#h07027c9] # systemctl status postfix (略) 2月 21 23:27:39 miracle9 systemd[1]: Starting Postfix Mail Transport Agent... 2月 21 23:27:40 miracle9 postfix[1052]: fatal: parameter inet_interfaces: no local interface found for 192.168.10.142 -/etc/postfix/main.cf inet_interfaces = all にする ***Telnet のInsatll(dnf) [#z737bc9a] ''dnfはyumの後継となるコマンド'' # dnf install telnet ***Postfix接続テスト [#fac87dcf] $ telnet 127.0.0.1 25 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 miracle9.ism21.net ESMTP Postfix ehlo 127.0.0.1 250-miracle9.ism21.net 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS ←暗号化している 250-AUTH PLAIN LOGIN ←パスワードはShellパスワード 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING quit &ref("./smtp認証.png"); ***firewallの許可 [#ga4c1d9e] # firewall-cmd --add-service=smtp --zone=public --permanent success # firewall-cmd --reload success # firewall-cmd --list-services --zone=public ....... smtp .... **mailコマンド(クライアント)のInstall [#i4541ced] # dnf install s-nail $ mail s-nail: No mail for okada at /var/spool/mail/okada ***mail送信 [#rcbd9f55] $ mail okada Subject: TEST To: okada TEST ^D ← ctrl+d ------- (Preliminary) Envelope contains: To: okada Subject: TES Send this message [yes/no, empty: recompose]? yes https://users.miraclelinux.com/technet/document/linux/training/2_7_5.html#training2_7_5 **dovecot(IMAP)インストールと設定 [#o3dd97ac] imap(Port 143)+STARTTLSでの設定 STARTTLS:暗号化されていない状態で通信を開始し、途中でSTARTTLSコマンドを実行することで通信経路を暗号化をする # rpm -qa | grep dovecot dovecot-2.3.16-10.el9.x86_64 Postfix に SASL 機能が提供できるよう Dovecot を設定 # cd /etc/dovecot/ -dovecot.conf # Protocols we want to be serving. #protocols = imap pop3 lmtp submission protocols = imap pop3 lmtp submission #listen = *, :: listen = * # cd conf.d -10-auth.conf #disable_plaintext_auth = yes disable_plaintext_auth = no # NOTE: See also disable_plaintext_auth setting. ##auth_mechanisms = plain auth_mechanisms = plain login ← loginパスワードとして設定 -10-mail.conf #mail_location = mail_location = maildir:~/Maildir -10-master.conf # Postfix smtp-auth #unix_listener /var/spool/postfix/private/auth { # mode = 0666 #} unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix group = postfix } -10-ssl.conf # plain imap and pop3 are still allowed for local connections ## ssl = required ssl = no ***起動 [#q8e185d8] # systemctl start dovecot # systemctl status dovecot ● dovecot.service - Dovecot IMAP/POP3 email server Loaded: loaded (/usr/lib/systemd/system/dovecot.service; disabled; preset:> Active: active (running) since Wed 2024-02-21 16:44:22 JST; 6s ago Docs: man:dovecot(1) https://doc.dovecot.org/ Process: 2512 ExecStartPre=/usr/libexec/dovecot/prestartscript (code=exited> Main PID: 2519 (dovecot) # systemctl enable dovecot Created symlink /etc/systemd/system/multi-user.target.wants/dovecot.service → /usr/lib/systemd/system/dovecot.service. ***Firewallのポートを許可 [#e92c4ae3] # firewall-cmd --add-service={pop3,imap} --permanent success # firewall-cmd --reload success ***postfixのmailboxを変更 [#od55c225] -/etc/postfix/main.cf home_mailbox = Maildir/ **Firewall 許可の表示(port / service) [#y2397cb0] # firewall-cmd --list-ports --zone=public --permanent # firewall-cmd --list-ports --zone=public # firewall-cmd --list-services --zone=public cockpit dhcpv6-client imap pop3 ssh ***Thunderbirdの設定 [#v90e9098] &ref("./imap暗号化.png"); &ref("./受信サーバの設定.png"); ***参考 [#s42f6252] -https://www.server-world.info/query?os=CentOS_7&p=mail&f=2 -https://mebee.info/2020/05/26/post-11804/#outline__4 **dovecot(imap)パスワードの暗号化 [#p44475f2] imapのパスワードの暗号化。通信はSTARTTLS。 ***dovecotの設定 [#k169eba9] # cd /etc/dovecot/conf.d -10-auth.conf # NOTE: See also disable_plaintext_auth setting. ##auth_mechanisms = plain ###auth_mechanisms = plain login auth_mechanisms = cram-md5 (略) #!include auth-passwdfile.conf.ext !include auth-passwdfile.conf.ext -auth-passwdfile.conf.ext passdb { driver = passwd-file ## args = scheme=CRYPT username_format=%u /etc/dovecot/users args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users } userdb { driver = passwd-file args = username_format=%u /etc/dovecot/users ***パスワード作成時エラー [#d5a7cc76] &color(red){パスワード作成時以下のエラーが発生}; # doveadm pw -s CRAM-MD5 Error: conn unix:/run/dovecot/stats-writer (pid=1418,uid=0): Timeout waiting for handshake response Enter new password: Retype new password: ***対策 [#f34d6e0b] /etc/dovecot/dovecot.confの行末に以下を追加 ## Edit by JE2ISM service stats { unix_listener stats-reader { group = dovecot mode = 0660 } unix_listener stats-writer { group = dovecot mode = 0660 } } service anvil { unix_listener anvil { group = dovecot mode = 0660 } } -再起動 # systemctl restart dovecot ***パスワード作成 [#x416cde5] # doveadm pw -s CRAM-MD5 Enter new password: Retype new password: {CRAM-MD5}848d037dda(略)053ecba9e ***ユーザ・パスワードファイル作成 [#f5e28f5a] -/etc/dovecot/ # 新規登録 # [ユーザー名]: [パスワード] okada:{CRAM-MD5}848d037dda(略)053ecba9e ***Thunderbirdの設定 [#jbfb7ded] &ref("./imapパスワード暗号化.png"); ***参考 [#v6f196f6] -https://www.kd2.jp/memo/ubuntu/postfix/02_install_dovecot.php -https://www.server-world.info/query?os=Ubuntu_20.04&p=mail&f=9 **dovecotでSSLを使用する [#tdfe063d] &color(red){以下のようにすることでimps(Port993) SSL/TLS通信が出来るようだが、Thunderbirdが自己認証をサポートしないようなので、上記のSTARTTLSを検討する。}; -conf.d/10-ssl.conf ssl = yes ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem -conf.d/10-master.conf service imap-login { inet_listener imap { #port = 143 } inet_listener imaps { #port = 993 #ssl = yes port = 993 ssl = yes } # systemctl restart dovecot # firewall-cmd --add-service=imaps --zone=public --permanent success # firewall-cmd --reload %%imapを停止してimapsだけサービスを動作させることが出来ないのでfirewallでimapを切る%% # firewall-cmd --remove-service=imap --zone=public --permanent success # firewall-cmd --reload success # firewall-cmd --list-services --zone=public cockpit dhcpv6-client imaps pop3 smtp ssh ***参考 [#s4f08749] -https://rms.ne.jp/sslserver/install/install_dovecot-html/ -https://www.bigbang.mydns.jp/dovecot20-x.htm