Bonjour,
Tout d'abord merci pour ce tuto qui est l'un des plus clair / complet / à jour que j'ai trouvé, félicitations à l'auteur
Quelques petites remarques :
- dans "6 - Configuration de dovecot", le gist de "dovecot.conf" contient le protocole "sieve" alors qu'il n'est pas encore installé à ce moment du tuto
- toujours dans "", le path dans le code de "10-mail.conf" ne me semble pas correct ("/mail en trop la fin ?")
Sinon j'ai voulu suivre le tuto mais je rencontre un problème avec le SMTP.
J'en suis à la partie 15 après l'installation de RainLoop, j'aimerais regler mon souci avant d'aller plus loin.
Le serveur mail serait "mail.domain.tld" , pour gérer le domaine "domain.tld"
L'IMAP semble fonctionner, mais impossible de faire fonctionner le SMTP sur 3 clients : K9Mail sous Android, ThunderBird sous Mint et Rainloop sur le serveur en question (Debian 7).
Par contre il semblerait que ça fonctionne en ligne de commande :
$ openssl s_client -starttls smtp -crlf -connect mail.domain.tld:587
CONNECTED(00000003)
...
Start Time: 1428768332
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---
250 DSN
ehlo test
250-mail.domain.tld
250-PIPELINING
250-SIZE 502400000
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
AUTH PLAIN <mon auth password>
235 2.7.0 Authentication successful
mail from: <arthur@domain.tld>
250 2.1.0 Ok
rcpt to: <arthur@domain2.tld>
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
test
.
250 2.0.0 Ok: queued as 1D1A4435FF
Bon le message se fait jeter par Google (les mails @domain2.tld sont chez Google) mais c'est un autre problème, au moins il a l'air de partir :
Apr 11 18:05:58 hostname postfix/qmgr[28302]: 1D1A4435FF: from=<arthur@domain.tld>, size=387, nrcpt=1 (queue active)
Apr 11 18:05:59 hostname postfix/smtp[3116]: 1D1A4435FF: host ASPMX.L.GOOGLE.com[173.194.67.26] said: 421-4.7.0 [62.210.66.225 15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. fb2si4864092wib.18 - gsmtp (in reply to end of DATA command)
Apr 11 18:06:00 hostname postfix/smtp[3116]: 1D1A4435FF: to=<arthur@domain2.tld>, relay=ALT1.ASPMX.L.GOOGLE.com[173.194.71.26]:25, delay=17, delays=15/0.01/1.3/0.96, dsn=4.7.0, status=deferred (host ALT1.ASPMX.L.GOOGLE.com[173.194.71.26] said: 421-4.7.0 [62.210.66.225 15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. yi7si3898050lbb.14 - gsmtp (in reply to end of DATA command))
Dans Rainloop, j'ai ce message d'erreur dans la partie SMTP de mon domaine (l'IMAP est ok et fonctionne)
stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
Voilà voilà, j'ai cherché un peu dans tous les sens sans trouver grand chose, si quelqu'un a une idée ça pourrait m'aider
Conf Postfix :
root@hostname:~# hostname
hostname
root@hostname:~# hostname -f
hostname.domain2.tld
root@hostname:~# cat /etc/postfix/main.cf
#######################
## GENERALS SETTINGS ##
#######################
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = no
delay_warning_time = 4h
mailbox_command = procmail -a "$EXTENSION"
recipient_delimiter = +
disable_vrfy_command = yes
message_size_limit = 502400000
mailbox_size_limit = 1024000000
inet_interfaces = all
inet_protocols = ipv4
myhostname = mail.domain.tld
myorigin = mail.domain.tld
mydestination = localhost localhost.$mydomain hostname.domain.tld
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 62.210.66.224/27
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
####################
## TLS PARAMETERS ##
####################
# SMTP ( OUTGOING )
# ----------------------------------------------------------------------
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_CAfile = /etc/ssl/certs/CAroot.crt
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# SMTPD ( INCOMING )
# ----------------------------------------------------------------------
smtpd_tls_loglevel = 1
smtpd_tls_auth_only = yes
smtpd_tls_security_level = may
smtpd_tls_received_header = yes
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 TLSv1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, MD5, DES, RC4, PSK
tls_random_source = dev:/dev/urandom
# TLS PUBLIC CERTIFICATES AND PRIVATE KEY
smtpd_tls_CAfile = /etc/ssl/certs/CAroot.crt
smtpd_tls_cert_file = /etc/ssl/certs/mailserver.crt
smtpd_tls_key_file = /etc/ssl/private/mailserver.key
# TLS/LMTP SESSION CACHE DATABASES
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
lmtp_tls_session_cache_database = btree:${data_directory}/lmtp_scache
# CYPHERS AND CURVE PARAMETERS
smtpd_tls_eecdh_grade = ultra
tls_eecdh_strong_curve = prime256v1
tls_eecdh_ultra_curve = secp384r1
# DIFFIE-HELLMAN PARAMETERS
smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem
smtpd_tls_dh512_param_file = /etc/postfix/dh512.pem
# ----------------------------------------------------------------------
#####################
## SASL PARAMETERS ##
#####################
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes
##############################
## VIRTUALS MAPS PARAMETERS ##
##############################
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_minimum_uid = 5000
virtual_mailbox_base = /var/mail
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
######################
## ERRORS REPORTING ##
######################
# notify_classes = bounce, delay, resource, software
notify_classes = resource, software
error_notice_recipient = admin@domain.tld
# delay_notice_recipient = admin@domain.tld
# bounce_notice_recipient = admin@domain.tld
# 2bounce_notice_recipient = admin@domain.tld
##################
## RESTRICTIONS ##
##################
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_non_fqdn_recipient,
reject_unauth_destination,
reject_unknown_recipient_domain,
reject_rbl_client zen.spamhaus.org
smtpd_helo_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_invalid_helo_hostname,
reject_non_fqdn_helo_hostname
# reject_unknown_helo_hostname
smtpd_client_restrictions =
permit_mynetworks,
permit_inet_interfaces,
permit_sasl_authenticated
# reject_plaintext_session,
# reject_unauth_pipelining
smtpd_sender_restrictions =
reject_non_fqdn_sender,
reject_unknown_sender_domain
#########################
## MILTERS DKIM/CLAMAV ##
#########################
milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:localhost:12301
non_smtpd_milters = inet:localhost:12301
root@hostname:~# cat /etc/postfix/master.cf
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - - - - smtpd
-o content_filter=spamassassin
#smtp inet n - - - 1 postscreen
#smtpd pass - - - - - smtpd
#dnsblog unix - - - - 0 dnsblog
#tlsproxy unix - - - - 0 tlsproxy
submission inet n - - - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_dh1024_param_file=${config_directory}/dh2048.pem
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#smtps inet n - - - - smtpd
# -o syslog_name=postfix/smtps
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - - - - qmqpd
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp
relay unix - - - - - smtp
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - - - - showq
error unix - - - - - error
retry unix - - - - - error
discard unix - - - - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
root@hostname:~#
Conf Dovecot
root@hostname:~# cat /etc/dovecot/dovecot.conf
## Dovecot configuration file
# Enable installed protocols
!include_try /usr/share/dovecot/protocols.d/*.protocol
protocols = imap lmtp
# A space separated list of IP or host addresses where to listen in for
# connections. "*" listens in all IPv4 interfaces. "[::]" listens in all IPv6
# interfaces. Use "*, [::]" for listening both IPv4 and IPv6.
listen = *
# Most of the actual configuration gets included below. The filenames are
# first sorted by their ASCII value and parsed in that order. The 00-prefixes
# in filenames are intended to make it easier to understand the ordering.
!include conf.d/*.conf
# A config file can also tried to be included without giving an error if
# it's not found:
!include_try local.conf
root@hostname:~# cat /etc/dovecot/conf.d/10-auth.conf
## Authentication processes
# Disable LOGIN command and all other plaintext authentications unless
# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
# matches the local IP (ie. you're connecting from the same computer), the
# connection is considered secure and plaintext authentication is allowed.
disable_plaintext_auth = yes
# Space separated list of wanted authentication mechanisms:
# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey
# gss-spnego
# NOTE: See also disable_plaintext_auth setting.
auth_mechanisms = plain login
#
# Password database is used to verify user's password (and nothing more).
# You can have multiple passdbs and userdbs. This is useful if you want to
# allow both system users (/etc/passwd) and virtual users to login without
# duplicating the system users into virtual database.
#
# <doc/wiki/PasswordDatabase.txt>
#
# User database specifies where mails are located and what user/group IDs
# own them. For single-UID configuration use "static" userdb.
#
# <doc/wiki/UserDatabase.txt>
!include auth-sql.conf.ext
root@hostname:~# cat /etc/dovecot/dovecot-sql.conf.ext
# Paramètres de connexion
driver = mysql
connect = host=127.0.0.1 dbname=postfix user=postfix password=<mon password>
# Permet de définir l'algorithme de hachage.
# Pour plus d'information: http://wiki2.dovecot.org/Authentication/PasswordSchemes
# /!\ ATTENTION : ne pas oublier de modifier le paramètre $CONF['encrypt'] de PostfixAdmin
default_pass_scheme = MD5-CRYPT
# Requête de récupération du mot de passe du compte utilisateur
password_query = SELECT password FROM mailbox WHERE username = '%u'
root@hostname:~# cat /etc/dovecot/conf.d/10-mail.conf
mail_location = maildir:/var/mail/vhosts/%d/%n
namespace inbox {
inbox = yes
}
mail_uid = 5000
mail_gid = 5000
first_valid_uid = 5000
last_valid_uid = 5000
mail_privileged_group = vmail
root@hostname:~# cat /etc/dovecot/conf.d/10-master.conf
service imap-login {
inet_listener imap {
port = 143
}
inet_listener imaps {
port = 993
ssl = yes
}
service_count = 0
}
service imap {
}
service lmtp {
# On autorise Postfix à transférer les emails dans le spooler de Dovecot via LMTP
unix_listener /var/spool/postfix/private/dovecot-lmtp {
mode = 0600
user = postfix
group = postfix
}
}
service auth {
# On autorise Postfix à se connecter à Dovecot via LMTP
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user = postfix
group = postfix
}
# On indique à Dovecot les permissions du conteneur local
unix_listener auth-userdb {
mode = 0600
user = vmail
group = vmail
}
user = dovecot
}
service auth-worker {
user = vmail
}
root@hostname:~# cat /etc/dovecot/conf.d/10-ssl.conf
## SSL settings
# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
ssl = required
# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
# ssl_cert = </etc/ssl/certs/dovecot.pem
# ssl_key = </etc/ssl/private/dovecot.pem
ssl_cert = </etc/ssl/certs/mailserver.crt
ssl_key = </etc/ssl/private/mailserver.key
ssl_protocols = !SSLv2 !SSLv3
root@hostname:~# cat /etc/dovecot/conf.d/auth-sql.conf.ext
# Le mot de passe est obtenu à partir de la base de donnée
passdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf.ext
}
# Par contre le nom d'utilisateur est obtenu de manière statique à partir du conteneur local
# %d = domaine.tld
# %n = utilisateur
userdb {
driver = static
args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
}
Certifs / clés / perms / version
root@hostname:~# ls -l /etc/ssl/certs/CAroot.crt
-r--r--r-- 1 root root 2106 Apr 11 08:17 /etc/ssl/certs/CAroot.crt
root@hostname:~# ls -l /etc/ssl/certs/mailserver.crt
-r--r--r-- 1 root root 1988 Apr 11 08:18 /etc/ssl/certs/mailserver.crt
root@hostname:~# ls -l /etc/ssl/private/mailserver.key
-r-------- 1 root root 3243 Apr 11 08:18 /etc/ssl/private/mailserver.key
root@hostname:~# ls -l /etc/postfix/dh*
-rw-r--r-- 1 root root 424 Apr 11 08:19 /etc/postfix/dh2048.pem
-rw-r--r-- 1 root root 156 Apr 11 08:20 /etc/postfix/dh512.pem
root@hostname:~# uname -a
Linux hostname 3.2.0-4-amd64 #1 SMP Debian 3.2.65-1+deb7u2 x86_64 GNU/Linux
root@hostname:~# dpkg -l | grep postfix
ii postfix 2.9.6-2 amd64 High-performance mail transport agent
ii postfix-mysql 2.9.6-2 amd64 MySQL map support for Postfix
root@hostname:~# dpkg -l | grep dovecot
ii dovecot-core 1:2.1.7-7+deb7u1 amd64 secure mail server that supports mbox, maildir, dbox and mdbox mailboxes
ii dovecot-imapd 1:2.1.7-7+deb7u1 amd64 secure IMAP server that supports mbox, maildir, dbox and mdbox mailboxes
ii dovecot-lmtpd 1:2.1.7-7+deb7u1 amd64 secure LMTP server for Dovecot
ii dovecot-mysql 1:2.1.7-7+deb7u1 amd64 MySQL support for Dovecot
Merci d'avance !
@Hardware : tu as toujous l'adresse 1PJyPjCd2wJPptu33BKtaFcMmewHiPaF7c sous la main ?
