groupadd -g 666 vmail
useradd -s /sbin/nologin -u 666 vmail -g 666
#############dovecot+mysql##################
1
yum install dovecot-mysql.x86_64 -y
#dovecot-mysql dovecot軟件的插件，讓此軟件可以識別mysql
2
vim /etc/dovecot/dovecot.conf
24 protocols = imap pop3 lmtp #支持收件協議
48 login_trusted_networks = 0.0.0.0/0 #信任網絡
49 disable_plaintext_auth = no #開啓明文認證
vim /etc/dovecot/conf.d/10-auth.conf
123 !include auth-sql.conf.ext #開啓mysql的認證方式
#生成dovecot讀取mysql的配置
cp /usr/share/doc/dovecot-2.2.10/example-config/dovecot-sql.conf.ext /etc/dovecot/dovecot-sql.conf.ext
vim /etc/dovecot/dovecot-sql.conf.ext
32 driver = mysql #數據庫類型
71 connect = host=localhost dbname=email user=postuser password=postuser #查詢時用到的信息
78 default_pass_scheme = PLAIN #默認認證方式爲明文
107 password_query = \ #查詢密碼匹配
108 SELECT username, domain, password \ ##查詢用戶，域名，密碼
109 FROM emailuser WHERE username = '%u' AND domain = '%d' ##從emailuser表中查詢
125 user_query = SELECT maildir, 666 AS uid, 666 AS gid FROM emailuser WHERE use rname = '%u'
##查詢郵件內部內容
vim /etc/dovecot/conf.d/10-mail.conf
30 mail_location = maildir:/home/vmail/%d/%n #指定郵件位置
168 first_valid_uid = 666 #郵件文件查詢用戶身份
175 first_valid_gid = 666
systemctl restart dovecot
systemctl status httpd.service
systemctl status mariadb.service
systemctl status firewalld
測試
yum install telnet -y
[root@westos-mail ~]# telnet 172.25.254.117 110
Trying 172.25.254.117...
Connected to 172.25.254.117.
Escape character is '^]'.
+OK [XCLIENT] Dovecot ready.
user [email protected] #建立表中的用戶名
+OK
pass jia #建立表中的密碼（可在網頁上查看）
+OK Logged in.
quit
+OK Logging out.
Connection closed by foreign host.
################空殼郵件##################
reset 217
配置eth0 yum
hostnamectl set-hostname nullmail.example.com
1
vim /etc/postfix/main.cf
75 myhostname = nullmail.example.com
83 mydomain = example.com
99 myorigin = westos.com # 設置爲真實的主機域名
113 inet_interfaces = all
164 mydestination = ##空殼郵件不接受郵件，所以不設置
316 relayhost = 172.25.254.117 ##接替的真實主機的IP
systemctl restart postfix.service
測試
217
[root@nullmail ~]# mail root
Subject: 345
2
.
EOT
[root@nullmail ~]# mailq
Mail queue is empty
117
[root@westos-mail ~]# mail
Heirloom Mail version 12.5 7/5/10. Type ? for help.
"/var/spool/mail/root": 3 messages 2 unread
>U 1 Mail Delivery System Wed May 31 04:15 73/2309 "Undelivered Mail Retu"
2 root Wed May 31 10:07 22/752 "fdsf"
U 3 root Wed May 31 10:09 22/750 "345"
& 3
Message 3:
From [email protected] Wed May 31 10:09:02 2017
Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Date: Wed, 31 May 2017 10:09:03 -0400
Subject: 345
User-Agent: Heirloom mailx 12.5 7/5/10
Content-Type: text/plain; charset=us-ascii
From: [email protected] (root)
Status: RO
##################iptables###################
iptables是一個工作於用戶空間的防火牆應用軟件
三表五鏈
filter表 mangle表 nat表
INPUT鏈 OUTPUT鏈 FORWARD鏈 PREROUTING鏈 POSTROUTING鏈
reset 117,217
systemctl stop firewalld
systemctl disable firewalld
117 雙網卡
217
IPADDR=172.25.0.217
PREFIX=24
GATEWAY=172.25.0.117
iptables
-t ##指定表名稱
-n ##不做解析
-L ##列出指定表中的策略
-A ##增加策略
-p ##網絡協議
--dport ##端口
-s ##數據來源
-j ##動作
ACCEPT ##允許
REJECT ##拒絕
DROP##丟棄
-N ##增加鏈
-E ##修改鏈名稱
-X ##刪除鏈
-D ##刪除指定策略
-I ##插入
-R ##修改策略
-P ##修改默認策略
iptables -t filter -nL #查看filter表中的策略
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
iptables -F #刷掉filter表中的所有策略，當沒有用-t指定表名稱時默認是filter
service iptables save #保存當前策略
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
iptables -A INPUT -i lo -j ACCEPT #允許lo
iptables -A INPUT -p tcp --dport 22 -j ACCEPT #允許訪問22 端口
iptables -A INPUT -s 172.25.254.250 -j ACCEPT #允許250主機訪問
iptables -A INPUT -j REJECT #拒絕所有主機的數據來源
iptables -N redhat #增加鏈redhat
iptables -E redhat westos #改變鏈名稱
iptables -X westos #刪除westos鏈
iptables -D INPUT 2 #刪除INPUT鏈中的第二條策略
iptables: Index of deletion too big.
iptables -I INPUT -p tcp --dport 80 -j REJECT #插入策略到INPUT中的第一條
iptables -R INPUT 1 -p tcp --dport 80 -j ACCEPT #修改第一條策略
iptables -P INPUT DROP #把INPUT表中的默認策略改爲drop
iptables -P INPUT ACCEPT #把INPUT表中的默認策略改爲accept
提高訪問速度，緩解訪問壓力方法
iptables -A INPUT -i lo -m state --state NEW -j ACCEPT ##允許迴環接口訪問
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT ##允許狀態是NEW訪問22端口
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT ##允許訪狀態是NEW問80端口
[iptables -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT ##允許訪狀態是NEW問443端口
iptables -A INPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT ##允許訪狀態是NEW問53端口
iptables -A INPUT -j REJECT ##拒絕所有主機數據來源
sysctl -a | grep forward ##查看forward狀態
net.ipv4.ip_forward = 0
vim /etc/sysctl.conf ##開啓內核路由
net.ipv4.ip_forward = 1
sysctl -p ##使生效
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-dest 172.25.0.117 ####進入路由設置
iptables -t nat -A PREROUTING -o eth0 -j SNAT --to-source 172.25.254.117 ####出路由設置
##eth0爲0網段的網卡