unbound和mail服务的部署和简单应用

1、服务的介绍

Unbound是一个缓存DNS解析器。unbound官网

       它使用根区域的内置权威名称服务器列表
       （。），所谓的根提示。在收到DNS查询时，它会询问
       答案的根名称服务器，几乎在所有情况下都会收到
       授权给顶级域名（TLD）权威名称服务器。它
       然后会询问名称服务器的答案。它将以递归方式进行
       直到找到答案或没有答案（NXDOMAIN）。
       出于性能和效率的原因，答案被缓存为cer-
       时间（答案的生存时间或TTL）。第二个查询
       然后将从缓存中回答相同的名称。不受约束也可以
       DNSSEC验证。
        相传他的开发者是一位牙医，不知是否为真。

postfix这是Wietse Venema开发的邮件服务器

postfix是Wietse Venema想要为使用最广泛的提供替代品的一个尝试。在Internet世界中，大部分的电子邮件都是通过sendmail来投递的，大约有100万用户使用sendmail，每天投递上亿封邮件。这真是一个让人吃惊的数字。Postfix试图更快、更容易管理、更安全，同时还与sendmail保持足够的兼容性。
来自百度文献

2、环境介绍

server端：
[root@100 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.1 (Maipo)
[root@100 ~]# hostname
100.hzy.com
[root@100 ~]# ip a |grep inet
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
    inet 192.168.137.100/24 brd 192.168.137.255 scope global eno16777736
    inet6 fe80::20c:29ff:feac:5681/64 scope link
client端：
[root@200 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.1 (Maipo)
[root@200 ~]# hostname
200.hzy.com
[root@200 ~]# ip a |grep inet
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
    inet 192.168.137.200/24 brd 192.168.137.255 scope global eno16777736
    inet6 fe80::20c:29ff:febb:c0b0/64 scope link

3、安装和部署unbound服务

安装
yum install -y unbound
[root@100 ~]# rpm -ql unbound |grep etc
/etc/sysconfig/unbound
/etc/tmpfiles.d/unbound.conf
/etc/unbound/conf.d
/etc/unbound/conf.d/example.com.conf
/etc/unbound/keys.d
/etc/unbound/keys.d/example.com.key
/etc/unbound/local.d
/etc/unbound/local.d/block-example.com.conf
/etc/unbound/unbound.conf 

找到unbound.conf修改其配置
server:
	verbosity: 1
	statistics-interval: 0
	statistics-cumulative: no
	extended-statistics: yes

	num-threads: 2 #线程数
	interface: 0.0.0.0 #可以是本地个任意端口ip
	interface-automatic: no #自动选择端口
	port: 53 #端口53相应数据包

	access-control: 0.0.0.0/0 allow #相应来自所有网段的数据包
	chroot: "" #虚拟目录

	username: "unbound" #指定的系统用户安装默认创建

	directory: "/etc/unbound" #配置文件所在的目录

	log-time-ascii: yes #日志的同步时间戳

	pidfile: "/var/run/unbound/unbound.pid" #这个服务的系统pid值

	harden-glue: yes   #

	harden-dnssec-stripped: yes

	harden-below-nxdomain: yes

	harden-referral-path: yes

	use-caps-for-id: no

	unwanted-reply-threshold: 10000000

	prefetch: yes

	prefetch-key: yes

	rrset-roundrobin: yes
	minimal-responses: yes

	dlv-anchor-file: "/etc/unbound/dlv.isc.org.key"

	trusted-keys-file: /etc/unbound/keys.d/*.key
	auto-trust-anchor-file: "/var/lib/unbound/root.key"

	val-clean-additional: yes

	val-permissive-mode: no

	val-log-level: 1

	include: /etc/unbound/local.d/*.conf #读取的解析文件路径

remote-control: #dns的控制设置
	control-enable: yes

	server-key-file: "/etc/unbound/unbound_server.key"

	server-cert-file: "/etc/unbound/unbound_server.pem"

	control-key-file: "/etc/unbound/unbound_control.key"

	control-cert-file: "/etc/unbound/unbound_control.pem"

# Stub and Forward zones

include: /etc/unbound/conf.d/*.conf

他的解析文件在 include: /etc/unbound/local.d/*.conf
[root@100 ~]# cat /etc/unbound/local.d/aa.conf
local-zone: "hzy.com." static  #设置静态的域
##这一行是dns的默认参数设置可以不写
local-data: "hzy.com. NS 100.hzy.com." #指定这个域里的dns服务器
local-data: "hzy.com. MX 5 100.hzy.com." #指定这个域里的mail服务器
local-data: "mail.hzy.com. IN A 192.168.137.100"
local-data: "200.hzy.com. IN A 192.168.137.200"
local-data: "www.hzy.com. IN A 192.168.137.200"
local-data: "ftp.hzy.com. IN A 192.168.137.200"
local-data-ptr: "192.168.137.200 200.hzy.com"
local-data-ptr: "192.168.137.200 www.hzy.com"

[root@100 ~]# firewall-cmd --add-port=53/tcp --permanent
[root@100 ~]# firewall-cmd --reload 

测试
[root@200 ~]# nslookup mail.hzy.com
Server:		192.168.137.100
Address:	192.168.137.100#53

Name:	mail.hzy.com
Address: 192.168.137.100

[root@200 ~]# nslookup www.hzy.com
Server:		192.168.137.100
Address:	192.168.137.100#53

Name:	www.hzy.com
Address: 192.168.137.200

4、配置postfix服务并使用dovecot收件服务测试

安装
[root@100 ~]# yum install -y dovecot postfix
##在redhat系统中默认postfix是安装的
编辑/etc/postfix/main.cf
[root@100 ~]# grep -v "#" /etc/postfix/main.cf |grep -v "^$"
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = 100.hzy.com
mydomain = hzy.com
myorigin = hzy.com
inet_interfaces = all
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 550
mynetworks = 0.0.0.0/0
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
home_mailbox = Maildir/
smtpd_banner = $myhostname ESMTP $mail_name
debug_peer_level = 2
debugger_command =
	 PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
	 ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.10.1/samples
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
message_size_limit = 10485760
mailbox_size_limit = 1073741824
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination,permit_sasl_authenticated,reject
参数

作用

myhostname

邮局系统的主机名

mydomain

邮局系统的域名

myorigin

从本机发出邮件的域名名称

inet_interfaces

监听的网卡接口

mydestination

可接收邮件的主机名或域名

mynetworks

设置可转发哪些主机的邮件

relay_domains

设置可转发哪些网域的邮件
具体参数设置参考的是# [centos7搭建postfix邮件服务器](https://www.cnblogs.com/operationhome/p/9056870.html)

编辑/etc/dovecot/dovecot.conf
将监听的类型改成*
[root@100 ~]# grep -v '#' /etc/dovecot/dovecot.conf |grep -v "^$"
listen = *
dict {
}
!include conf.d/*.conf
!include_try local.conf

编辑/etc/dovecot/conf.d/10-auth.conf
[root@100 ~]# grep -v '#' /etc/dovecot/conf.d/10-auth.conf |grep -v "^$"
disable_plaintext_auth = no ##开启明码文本认证
auth_mechanisms = plain login
!include auth-system.conf.ext

编辑/etc/dovecot/conf.d/10-mail.conf
找到并修改mail_location = maildir:~/Maildir

编辑/etc/dovecot/conf.d/10-master.conf
89  # unix_listener auth-userdb {
 90     #mode = 0666
 91     #user =
 92     #group =
 93 #  }
 94 unix_listener /var/spool/postfix/private/auth {
 95 mode = 0666
 96 user = postfix
 97 group = postfix
 98 }

编辑/etc/dovecot/conf.d/10-ssl.conf
因为没有设置ssl加密，所以ssl的值修改为 ssl = no
[root@100 ~]# systemctl enable dovecot
ln -s '/usr/lib/systemd/system/dovecot.service' '/etc/systemd/system/multi-user.target.wants/dovecot.service'
[root@100 ~]# systemctl start dovecot.service

5、使用Foxmail测试

使用系统用户：建议使用非登录系统用户
[root@100 ~]# id bob
uid=1001(bob) gid=1001(bob) 组=1001(bob)
[root@100 ~]# id goudan
uid=1002(goudan) gid=1002(goudan) 组=1002(goudan)

简书链接

---END---