![[PukiWiki]](image/../localimages/Atom.gif "[PukiWiki]")
以下から、完全版インストールイメージ（MIRACLELINUX-9.2-rtm-x86_64.iso）をDL
Esxi8.0u2にインストール
ゲストOSはMIRACLE LINUX 8 (64 ビット)を指定
https://www.miraclelinux.com/distribution/download
# yum install emacs
# rpm -qa | grep httpd miraclelinux-logos-httpd-90.4-1.el9.ML.6.noarch httpd-filesystem-2.4.57-5.el9.noarch httpd-tools-2.4.57-5.el9.x86_64 httpd-core-2.4.57-5.el9.x86_64 httpd-2.4.57-5.el9.x86_64 httpd-manual-2.4.57-5.el9.noarch
# systemctl status httpd
○ httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: d>
Active: inactive (dead)
# systemctl start httpd
# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: d>
Active: active (running) since Tue 2024-02-13 15:20:02 JST; 5s ago
Docs: man:httpd.service(8)
Main PID: 4650 (httpd)
Status: "Started, listening on: port 443, port 80"
インストール時には空フォルダで、デフォルトのページが開くがindex.htmlを作成すると、index.htmlが開く
# firewall-cmd --state running # firewall-cmd --get-services | sed 's/ /\n/g' | grep http http http3 https wbem-http wbem-https
# firewall-cmd --add-service=http success # firewall-cmd --add-service=https success
# firewall-cmd --add-service=http --permanent success # firewall-cmd --add-service=https --permanent success
# firewall-cmd --remove-service=http --permanent success # firewall-cmd --reload success
# firewall-cmd --get-services | sed 's/ /\n/g' RH-Satellite-6 RH-Satellite-6-capsule afp amanda-client amanda-k5-client amqp amqps （略）
# nmcli dev s DEVICE TYPE STATE CONNECTION ens192 ethernet 接続済み ens192 lo loopback 接続済み (外部) lo
# ip address show ens192
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:6e:0f:f3 brd ff:ff:ff:ff:ff:ff
altname enp11s0
inet 192.168.10.142/24 brd 192.168.10.255 scope global noprefixroute ens192
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe6e:ff3/64 scope link noprefixroute
valid_lft forever preferred_lft forever
# nmcli connection modify ens192 ipv6.method "disabled"
# nmcli connection up ens192 接続が正常にアクティベートされました (D-Bus アクティブパス: /org/freedesktop/NetworkManager/ActiveConnection/3)
# ip address show ens192
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:6e:0f:f3 brd ff:ff:ff:ff:ff:ff
altname enp11s0
inet 192.168.10.142/24 brd 192.168.10.255 scope global noprefixroute ens192
valid_lft forever preferred_lft forever
# rpm -qa | grep postfix postfix-3.5.9-24.el9.x86_64
# firewall-cmd --add-service=postfix Error: INVALID_SERVICE: postfix
myhostname = miracle9.ism21.net
mydomain = ism21.net
myorigin = $myhostname
##inet_interfaces = localhost inet_interfaces = localhost, 192.168.10.142
##mydestination = $myhostname, localhost.$mydomain, localhost
mydestination = $myhostname, localhost.$mydomain, localhost
mynetworks = 192.168.10.0/24, 127.0.0.0/8
認証が成功したユーザだけがメールをリレー送信することができる設定
SASLによる認証方法を利用。
SASLによる認証方法には、主にUNIXユーザー認証（PAM認証）とSASL側のデータベース(sasldb)による認証がある。
/etc/postfix/main.cfの最後に以下を追加
## Edit by JE2ISM ###SMTPAUTH smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous ## PAM認証の場合 smtpd_sasl_local_domain = ## sasldbによる認証の場合 ##smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated permit_inet_interfaces reject_unauth_destination ## smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated, check_relay_domains
「ここ」の個所がSTARTTLS通信で送られてきたメールも、平文通信で送られてきたメールも、両方とも受信することができる
# TLS CONFIGURATION # # Basic Postfix TLS configuration by default with self-signed certificate # for inbound SMTP and also opportunistic TLS for outbound SMTP. # The full pathname of a file with the Postfix SMTP server RSA certificate # in PEM format. Intermediate certificates should be included in general, # the server certificate first, then the issuing CA(s) (bottom-up order). # smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem (略) # Announce STARTTLS support to remote SMTP clients, but do not require that # clients use TLS encryption (opportunistic TLS inbound). # smtpd_tls_security_level = may ←ここ
saslデータベース使用時には以下のようにユーザ、パスワードを作成する。
上記の場合はPAMを利用するので不要。
# /usr/sbin/saslpasswd2 -c -u `postconf -h myhostname` okada Password: Again (for verification):
# chgrp postfix sasl2 # ls -l sasl2 合計 20 -rw-------. 1 root root 16384 2月 14 15:30 sasldb2 -rw-r--r--. 1 root root 49 12月 1 15:20 smtpd.conf
# cd /etc/sasl2 # chgrp postfix sasl2/sasldb2 # chmod g+r sasl2/sasldb2
# ls -l sasl2 合計 20 -rw-r-----. 1 root postfix 16384 2月 14 15:30 sasldb2 -rw-r--r--. 1 root root 49 12月 1 15:20 smtpd.conf
# rpm -qa | grep sasl cyrus-sasl-lib-2.1.27-21.el9.x86_64 cyrus-sasl-gssapi-2.1.27-21.el9.x86_64 cyrus-sasl-2.1.27-21.el9.x86_64 cyrus-sasl-plain-2.1.27-21.el9.x86_64
# /usr/sbin/sasldblistusers2 okada@miracle9.ism21.net: userPassword
# less /etc/sasl2/smtpd.conf pwcheck_method: saslauthd mech_list: plain login
# systemctl start saslauthd
# systemctl status saslauthd
● saslauthd.service - SASL authentication daemon.
Loaded: loaded (/usr/lib/systemd/system/saslauthd.service; disabled; prese>
Active: active (running) since Wed 2024-02-21 14:21:36 JST; 2s ago
Process: 2242 ExecStart=/usr/sbin/saslauthd -m $SOCKETDIR -a $MECH $FLAGS (>
Main PID: 2243 (saslauthd)
# systemctl enable saslauthd Created symlink /etc/systemd/system/multi-user.target.wants/saslauthd.service → /usr/lib/systemd/system/saslauthd.service.
# systemctl start postfix
# systemctl status postfix
● postfix.service - Postfix Mail Transport Agent
Loaded: loaded (/usr/lib/systemd/system/postfix.service; disabled; preset:>
Active: active (running) since Wed 2024-02-14 15:42:15 JST; 6s ago
Process: 2269 ExecStartPre=/usr/sbin/restorecon -R /var/spool/postfix/pid (>
Process: 2270 ExecStartPre=/usr/libexec/postfix/aliasesdb (code=exited, sta>
Process: 2274 ExecStartPre=/usr/libexec/postfix/chroot-update (code=exited,>
Process: 2275 ExecStart=/usr/sbin/postfix start (code=exited, status=0/SUCC>
Main PID: 2343 (master)
(略)
# systemctl enable postfix
Created symlink /etc/systemd/system/multi-user.target.wants/postfix.service → /usr/lib/systemd/system/postfix.service.
# systemctl status postfix
○ postfix.service - Postfix Mail Transport Agent
Loaded: loaded (/usr/lib/systemd/system/postfix.service; enabled; preset: >
Active: inactive (dead)
# systemctl start postfix
# systemctl status postfix (略) 2月 21 23:27:39 miracle9 systemd[1]: Starting Postfix Mail Transport Agent... 2月 21 23:27:40 miracle9 postfix[1052]: fatal: parameter inet_interfaces: no local interface found for 192.168.10.142
inet_interfaces = all
にする
dnfはyumの後継となるコマンド
# dnf install telnet
$ telnet 127.0.0.1 25 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 miracle9.ism21.net ESMTP Postfix ehlo 127.0.0.1 250-miracle9.ism21.net 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS ←暗号化も許可 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
quit
暗号化したパスワード認証でも、通常のパスワード認証でもOKみたい
# firewall-cmd --add-service=smtp --zone=public --permanent success # firewall-cmd --reload success # firewall-cmd --list-services --zone=public ....... smtp ....
# dnf install s-nail
$ mail s-nail: No mail for okada at /var/spool/mail/okada
$ mail okada Subject: TEST To: okada TEST ^D ← ctrl+d ------- (Preliminary) Envelope contains: To: okada Subject: TES Send this message [yes/no, empty: recompose]? yes
https://users.miraclelinux.com/technet/document/linux/training/2_7_5.html#training2_7_5
imap(Port 143)＋STARTTLSでの設定
STARTTLS:暗号化されていない状態で通信を開始し、途中でSTARTTLSコマンドを実行することで通信経路を暗号化をする
# rpm -qa | grep dovecot dovecot-2.3.16-10.el9.x86_64
Postfix に SASL 機能が提供できるよう Dovecot を設定
# cd /etc/dovecot/
# Protocols we want to be serving. #protocols = imap pop3 lmtp submission protocols = imap pop3 lmtp submission #listen = *, :: listen = *
# cd conf.d
#disable_plaintext_auth = yes disable_plaintext_auth = no # NOTE: See also disable_plaintext_auth setting. ##auth_mechanisms = plain auth_mechanisms = plain login ← loginパスワードとして設定
#mail_location = mail_location = maildir:~/Maildir
# Postfix smtp-auth
#unix_listener /var/spool/postfix/private/auth {
# mode = 0666
#}
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user = postfix
group = postfix
}
# plain imap and pop3 are still allowed for local connections ## ssl = required ssl = no
# systemctl start dovecot
# systemctl status dovecot
● dovecot.service - Dovecot IMAP/POP3 email server
Loaded: loaded (/usr/lib/systemd/system/dovecot.service; disabled; preset:>
Active: active (running) since Wed 2024-02-21 16:44:22 JST; 6s ago
Docs: man:dovecot(1)
https://doc.dovecot.org/
Process: 2512 ExecStartPre=/usr/libexec/dovecot/prestartscript (code=exited>
Main PID: 2519 (dovecot)
# systemctl enable dovecot Created symlink /etc/systemd/system/multi-user.target.wants/dovecot.service → /usr/lib/systemd/system/dovecot.service.
# firewall-cmd --add-service={pop3,imap} --permanent
success
# firewall-cmd --reload success
home_mailbox = Maildir/
# firewall-cmd --list-ports --zone=public --permanent
# firewall-cmd --list-ports --zone=public
# firewall-cmd --list-services --zone=public cockpit dhcpv6-client imap pop3 ssh
imapのパスワードの暗号化。通信はSTARTTLS。
# cd /etc/dovecot/conf.d
# NOTE: See also disable_plaintext_auth setting. ##auth_mechanisms = plain ###auth_mechanisms = plain login auth_mechanisms = cram-md5 (略) #!include auth-passwdfile.conf.ext !include auth-passwdfile.conf.ext
passdb {
driver = passwd-file
## args = scheme=CRYPT username_format=%u /etc/dovecot/users
args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users
}
userdb {
driver = passwd-file
args = username_format=%u /etc/dovecot/users
パスワード作成時以下のエラーが発生
# doveadm pw -s CRAM-MD5 Error: conn unix:/run/dovecot/stats-writer (pid=1418,uid=0): Timeout waiting for handshake response Enter new password: Retype new password:
/etc/dovecot/dovecot.confの行末に以下を追加
## Edit by JE2ISM
service stats {
unix_listener stats-reader {
group = dovecot
mode = 0660
}
unix_listener stats-writer {
group = dovecot
mode = 0660
}
}
service anvil {
unix_listener anvil {
group = dovecot
mode = 0660
}
}
# systemctl restart dovecot
# doveadm pw -s CRAM-MD5
Enter new password:
Retype new password:
{CRAM-MD5}848d037dda（略）053ecba9e
# 新規登録
# [ユーザー名]: [パスワード]
okada:{CRAM-MD5}848d037dda（略）053ecba9e
以下のようにすることでimps(Port993) SSL/TLS通信が出来るようだが、Thunderbirdが自己認証をサポートしないようなので、上記のSTARTTLSを検討する。
ssl = yes ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem
service imap-login {
inet_listener imap {
#port = 143
}
inet_listener imaps {
#port = 993
#ssl = yes
port = 993
ssl = yes
}
# systemctl restart dovecot
# firewall-cmd --add-service=imaps --zone=public --permanent success # firewall-cmd --reload
imapを停止してimapsだけサービスを動作させることが出来ないのでfirewallでimapを切る
# firewall-cmd --remove-service=imap --zone=public --permanent success # firewall-cmd --reload success # firewall-cmd --list-services --zone=public cockpit dhcpv6-client imaps pop3 smtp ssh
