我正在 postfix 伺服器上工作。該伺服器正在透過多個網域的多個 IP 發送郵件。有些網域有專用的 IP 位址。其他的都在同一個IP上。
一切正常。
現在，我想啟用 SSL 和 TLS。我知道如何處理具有單一 IP 位址和單一網域的 postfix 伺服器：
cd /etc/postfix
openssl req -nodes -new -x509 -keyout dsfc.key -out dsfc.crt
然後我必須將其添加到 /etc/postfix/main.cf 中：
smtpd_use_tls = yes
smtpd_tls_key_file = /etc/postfix/dsfc.key
smtpd_tls_cert_file = /etc/postfix/dsfc.crt
smtpd_tls_ask_ccert = yes
smtpd_tls_req_ccert = yes
smtpd_tls_security_level = encrypt
smtpd_tls_auth_only = yes
smtpd_tls_ccert_verifydepth = 1
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
smtpd_tls_session_cache_timeout = 86400
但我不確定它是否適用於我的情況。我應該為每個網域或每個 IP 擁有一個憑證嗎？或是一張憑證就可以完成所有網域的工作？
謝謝
答案1
SSL/TLS 憑證和金鑰適用於所有其他網域都經過的郵件伺服器網域/IP，因此安全郵件伺服器涵蓋使用它的所有網域，專用 IP 無關緊要。為了獲得最佳結果和最大安全性，請使用可用的設定選項。如果您打算使用 smtpd_tls_security_level=encrypt ，請意識到某些郵件伺服器將不接受連接，因為它們不接受僅 TLS 連接。如果您堅持加密，請檢查您的郵件日誌並查看是否有任何主機因此而拒絕。您可以建立 /etc/postfix/tls_policy 並在其中新增主機並指定可能，以便郵件將透過 IE 傳遞：
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
在該文件中，您可以新增如下所示的主機
live.co.uk may
live.com may
charter.net may
mx.west.cox.net may
bigpond.com may
cox.net may
是的，如果強制使用 TLS，live.com 將拒絕 編輯檔案後不要忘記執行 postmap
例子：
# TLS parameters
# ---------------------------------
# The default snakeoil certificate. Comment if using a purchased
# SSL certificate.
#smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem
#smtpd_tls_key_file = /etc/ssl/private/postfix.pem
# Uncomment if using a custom SSL certificate.
smtpd_tls_cert_file=/path/to/ssl/example.com/cert.pem
smtpd_tls_key_file=/path/to/ssl/example.com/key.pem
# The snakeoil self-signed certificate has no need for a CA file. But
# if you are using your own SSL certificate, then you probably have
# a CA certificate bundle from your provider. The path to that goes here.
smtp_tls_CAfile=/path/to/ssl/example.com/chain.pem
smtpd_tls_CAfile=/path/to/ssl/example.com/chain.pem
# trusted CA path, where your server has the trust store of commercial certs
smtp_tls_CApath = /etc/ssl/certs
smtpd_tls_CApath = /etc/ssl/certs
smtpd_use_tls = yes
smtp_use_tls = yes
#enable ECDH
smtpd_tls_eecdh_grade = strong
#enabled SSL protocols, don't allow SSLv2 and SSLv3
smtpd_tls_protocols= !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols= !SSLv2, !SSLv3
#allowed ciphers for smtpd_tls_security_level=encrypt
smtpd_tls_mandatory_ciphers = high
#allowed ciphers for smtpd_tls_security_level=may
smtpd_tls_ciphers = high
#enforce the server cipher preference
tls_preempt_cipherlist = yes
#disable following ciphers for smtpd_tls_security_level=encrypt
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
#disable following ciphers for smtpd_tls_security_level=may
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA
#enable TLS logging to see the ciphers for inbound connections
smtpd_tls_loglevel = 1
#enable TLS logging to see the ciphers for outbound connections
smtp_tls_loglevel = 1
smtp_tls_note_starttls_offer = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_tls_dh1024_param_file = /etc/ssl/certs/dhparam.pem
# Note that forcing use of TLS is going to cause breakage - most mail servers
# don't offer it and so delivery will fail, both incoming and outgoing. This is
# unfortunate given what various governmental agencies are up to these days.
#
# For MTAs that reject based on encrypt TLS setting, lets do 'may' to get the mail delivered
#smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
# AUTH only must be enabled when using smtpd encrypt
smtpd_tls_auth_only = yes
# Enable and force all incoming smtpd connections to use TLS.
#smtpd_tls_security_level = encrypt
# Enable and force all outgoing smtp connections to use TLS.
#smtp_tls_security_level = encrypt
# Enable (but don't force all incoming smtpd connections to use TLS.
smtpd_tls_security_level = may
# Enable (but don't force) all outgoing smtp connections to use TLS.
smtp_tls_security_level = may
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.