タグ: メールサーバ

05. メールサーバ構築(1) – dovecot [さくらのVPS/CentOS7]

・dovecot の用途

  1. LMTPサーバ (メール受信)
  2. Sieve(メールフィルタリング/メール転送)
  3. POP3/IMPA4サーバ (メール参照)
  4. ManageSieveサーバ

・dovecotをインストール

#-- 変数に必要な値を代入
DOMAIN=masdon.life
LDAP_SERVER=127.0.0.1 

#-- dovecot 2.3系の repository を登録
cat <<_EOL_> /etc/yum.repos.d/dovecot.repo
[dovecot-2.3-latest]
name=Dovecot 2.3 CentOS $releasever - \$basearch
baseurl=http://repo.dovecot.org/ce-2.3-latest/centos/\$releasever/RPMS/\$basearch
gpgkey=https://repo.dovecot.org/DOVECOT-REPO-GPG
gpgcheck=1
enabled=1
_EOL_

#-- dovecot のインストールと設定
yum install -y dovecot dovecot-pigeonhole
yum install -y openldap-devel expat-devel bzip2-devel zlib-devel

#- dovecot の設定
cat <<_EOL_> /etc/dovecot/local.conf
postmaster_address = postmater@${DOMAIN}
auth_mechanisms = plain login
deliver_log_format = from=%{from_envelope}, to=%{to_envelope}, size=%p, msgid=%m, delivery_time=%{delivery_time}, session_time=%{session_time}, %\$
disable_plaintext_auth = no
first_valid_uid = 97
mail_location = maildir:/var/dovecot/%Ld/%Ln
mail_plugins = \$mail_plugins zlib
plugin {
  sieve = /var/dovecot/%Ld/%Ln/dovecot.sieve
  sieve_extensions = +notify +imapflags +editheader +vacation-seconds
  sieve_max_actions = 32
  sieve_max_redirects = 10
  sieve_redirect_envelope_from = recipient
  sieve_vacation_min_period = 1h
  sieve_vacation_default_period = 7d
  sieve_vacation_max_period = 60d
  zlib_save = bz2
  zlib_save_level = 5
}
protocols = imap pop3 lmtp sieve
service imap-login {
  inet_listener imap {
    address = 127.0.0.1
  }
}
service lmtp {
  inet_listener lmtp {
    address = 127.0.0.1
    port = 24
  }
}
service pop3-login {
  inet_listener pop3 {
    address = 127.0.0.1
  }
}
service managesieve-login {
  inet_listener sieve {
    address = 127.0.0.1
  }
}
protocol lmtp {
  mail_plugins = \$mail_plugins sieve
}
protocol imap {
  mail_max_userip_connections = 20
}
ssl = no
ssl_cert =
ssl_key =
lda_mailbox_autocreate = yes
lmtp_save_to_detail_mailbox = yes
_EOL_

#- dovecot の認証設定
cp -p /etc/dovecot/conf.d/10-auth.conf{,.org}
cp -p /etc/dovecot/conf.d/auth-static.conf.ext{,.org}
sed -i 's/auth-system.conf.ext/auth-static.conf.ext/' /etc/dovecot/conf.d/10-auth.conf
cat <<_EOL_>/etc/dovecot/conf.d/auth-static.conf.ext
passdb {
  driver = static
  args = nopassword=y
}
# userdb {
#   driver = static
#   args = uid=dovecot gid=dovecot home=/var/dovecot/%Ld/%Ln allow_all_users=yes
# }
userdb {
  driver = ldap
  args = /etc/dovecot/dovecot-ldap.conf.ext
}
_EOL_

#- doveadm コマンドで ldap を参照する為の設定
cat <<_EOL_>/etc/dovecot/dovecot-ldap.conf.ext
hosts = ${LDAP_SERVER}
auth_bind = yes
base = ""
pass_attrs=mailRoutingAddress=User,userPassword=password
pass_filter = (&(objectClass=inetLocalMailRecipient)(mailRoutingAddress=%u))
iterate_attrs = mailRoutingAddress=user
iterate_filter = (&(objectClass=inetLocalMailRecipient)(mailRoutingAddress=*))
user_filter = (&(objectClass=inetLocalMailRecipient)(mailRoutingAddress=%u))
user_attrs = \
  =uid=dovecot, \
  =gid=dovecot, \
  =mail=maildir:/var/dovecot/%Ld/%Ln, \
  =home=/var/dovecot/%Ld/%Ln, \
  =acl_groups=%{ldap:publicMailboxGroup}, \
  =quota_rule=*:bytes=%{ldap:mailQuotaBytes}, \
  =quota_rule2=*:messages=%{ldap:mailQuotaMessages}
_EOL_
#-- acl_group, quota_rule, quota_rule2 については 別途必要な schema を定義する必要がある。acl_group は gr1,gr2 のようにカンマ区切りで値を設定する

#- mbox 用ディレクトリの作成
mkdir /var/dovecot
chown dovecot. /var/dovecot

#-- dovecot の起動
systemctl enable dovecot
systemctl start dovecot

04. LDAPサーバ構築 – openldap [さくらのVPS/CentOS7]

・LDAPサーバの用途

  1. メールアカウントの管理・認証
  2. Basic認証
  3. 各Webアプリケーションの認証

・LDAPサーバの構築

#-- 変数に必要な値を代入
ROOT_DN="cn=admin,dc=masdon,dc=life"
ROOT_PASSWORD="********"     #-- ROOT_DNのパスワードを入力
LDAP_MASTER=127.0.0.1
DOMAIN=masdon.life

#-- openldap と sendmail.schema をインストール
yum install -y openldap-servers openldap-clients sendmail-cf
ROOT_PW=$(slappasswd -s ${ROOT_PASSWORD})

#-- DB_CONFIG の作成
cat <<'_EOL_'> /var/lib/ldap/DB_CONFIG
set_cachesize 0 10485760 1
set_flags DB_LOG_AUTOREMOVE
set_lg_regionmax 262144
set_lg_bsize 2097152
_EOL_

#-- sendmail.schema を 指定のディレクトリへコピー
cp -p /usr/share/sendmail-cf/sendmail.schema /etc/openldap/schema/

#-- openldap の設定
cat <<_EOL_> /etc/openldap/slapd.conf
loglevel 0x4100
sizelimit -1
include  /etc/openldap/schema/corba.schema
include  /etc/openldap/schema/core.schema
include  /etc/openldap/schema/cosine.schema
include  /etc/openldap/schema/duaconf.schema
include  /etc/openldap/schema/dyngroup.schema
include  /etc/openldap/schema/inetorgperson.schema
include  /etc/openldap/schema/java.schema
include  /etc/openldap/schema/misc.schema
include  /etc/openldap/schema/nis.schema
include  /etc/openldap/schema/openldap.schema
include  /etc/openldap/schema/ppolicy.schema
include  /etc/openldap/schema/collective.schema
include  /etc/openldap/schema/sendmail.schema
allow bind_v2
pidfile  /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
moduleload syncprov.la
access to attrs=UserPassword
    by dn="${ROOT_DN}" write
    by self write
    by anonymous auth
    by * none
access to dn.regex="uid=.*,ou=Termed,dc=.*"
    by * none
access to *
    by * read
database config
access to *
    by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
    by * none
database monitor
access to *
    by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
    by dn.exact="${ROOT_DN}" read
    by * none
database bdb
suffix  ""
checkpoint 1024 15
rootdn  "${ROOT_DN}"
rootpw  "${ROOT_PW}"
directory /var/lib/ldap
index objectClass   eq,pres
index uid           eq,pres,sub
index mailHost,mailRoutingAddress,mailLocalAddress,userPassword,sendmailMTAHost eq,pres
_EOL_

#-- slapd の起動オプションを変更
sed -i "s#^SLAPD_URLS=.*#SLAPD_URLS=\"ldap://${LDAP_MASTER}/\"#" /etc/sysconfig/slapd

#-- yum update で /etc/openlda/slapd.d が再作成されると slapd の起動が失敗するので定期的に確認して削除、同じく slapd.conf も slapd.conf.bakにリネームされるので元に戻す
mv /etc/openldap/slapd.d /etc/openldap/slapd.d.org
echo '* * * * * root rm -rf /etc/openldap/slapd.d >/dev/null 2>&1' > /etc/cron.d/${DOMAIN}-cron
echo '* * * * * root /usr/bin/mv -f /etc/openldap/slapd.conf.bak /etc/openldap/slapd.conf >/dev/null 2>&1' >>/etc/cron.d/${DOMAIN}-cron

#-- rsyslog の設定と logrotate の設定
echo "local4.*  /var/log/openldap" > /etc/rsyslog.d/openldap.conf
sed -i '1s#^#/var/log/openldap\n#' /etc/logrotate.d/syslog
systemctl restart rsyslog

#-- openldap を起動
systemctl enable slapd
systemctl start slapd

・ドメインと管理ユーザを登録

WORKDIR=~/work
mkdir -p ${WORKDIR}/ldap

#-- メールドメイン用の ldifファイルを作成
TMPDN=""
for x in $(for y in $(echo "${DOMAIN}" | sed 's/\./ /g')
do
    echo ${y}
done | tac)
do
    TMPDN="dc=${x}${TMPDN}"
cat <<_EOL_>>${WORKDIR}/ldap/init.ldif
dn: ${TMPDN}
objectClass: dcObject
objectClass: organization
dc: ${x}
o: ${DOMAIN}

_EOL_
    TMPDN=",${TMPDN}"
done

#-- 作成した ldif を LDAPサーバに登録
ldapadd -x -h ${LDAP_MASTER} -D "${ROOT_DN}" -w ${ROOT_PASSWORD} -f ${WORKDIR}/ldap/init.ldif

・管理者用メールアドレスの作成

#-- 管理者用メールアドレスを作成するスクリプトを作成
cat <<'_EOL_'> /usr/local/bin/create_admin_address.sh
#!/bin/bash
#
# usage)
# ./create_admin_address.sh domain

DOMAIN=$1
LDAP_MASTER=127.0.0.1
OUTBOUND_MTA_SERVER=127.0.0.1
STORE_SERVER=127.0.0.1
ROOT_DN="cn=admin,dc=masdon,dc=life"
ROOT_PASSWORD="********"  #-- ROOT_DNのパスワードを入力
WORKDIR=/root/work/ldap
ADMINS=" admin root postmaster abuse virus-report nobody "

ldapsearch -x -h ${LDAP_MASTER} -D "${ROOT_DN}" -w "${ROOT_PASSWORD}" > /dev/null 2>&1

if [ $? -ne 0 ]
then
  echo "invalid rootdn or rootpassword!!"
  exit 1
fi

mkdir -p ${WORKDIR}

ACCOUNT=$(echo ${ADMINS} | awk '{print $1}')
SSHAPW=$(slappasswd -s "${ROOT_PASSWORD}")
TMPDN=""
for x in $(for y in $(echo "${DOMAIN}" | sed 's/\./ /g')
do
  echo ${y}
done | tac)
do
  TMPDN="dc=${x}${TMPDN}"
  if [ $(ldapsearch -h ${LDAP_MASTER} -x -D "${ROOT_DN}" -w "${ROOT_PASSWORD}" -b "${TMPDN}" | grep -c ^dn:) -eq 0 ]
  then
    cat <<_EOF_>>${WORKDIR}/${DOMAIN}.ldif
dn: ${TMPDN}
objectClass: dcObject
objectClass: organization
dc: ${x}
o: ${DOMAIN}

_EOF_
  fi
  TMPDN=",${TMPDN}"
done

BASEDN=$(echo ${TMPDN} | sed 's/^,//')
BASEDN="ou=People,${BASEDN}"
TERMED=$(echo ${BASEDN} | sed 's/ou=People/ou=Termed/')

cat <<_EOF_>>${WORKDIR}/${DOMAIN}.ldif
dn: ${BASEDN}
ou: People
objectclass: organizationalUnit

dn: ${TERMED}
ou: Termed
objectclass: organizationalUnit

dn: uid=${ACCOUNT},${BASEDN}
objectclass: uidObject
objectClass: simpleSecurityObject
objectClass: inetLocalMailRecipient
objectClass: sendmailMTA
uid: ${ACCOUNT}
userPassword: ${SSHAPW}
mailHost: ${STORE_SERVER}
sendmailMTAHost: ${OUTBOUND_MTA_SERVER}
description: ${DOMAIN}
mailRoutingAddress: ${ACCOUNT}@${DOMAIN}
mailLocalAddress: ${ACCOUNT}@${DOMAIN}
_EOF_

for z in ${ADMINS}
do
  if [ "${z}" = "${ACCOUNT}" ]
  then
    continue
  fi
  echo "mailLocalAddress: ${z}@${DOMAIN}" >> ${WORKDIR}/${DOMAIN}.ldif
done
echo >> ${WORKDIR}/${DOMAIN}.ldif
ldapadd -x -h ${LDAP_MASTER} -D "${ROOT_DN}" -w "${ROOT_PASSWORD}" -f ${WORKDIR}/${DOMAIN}.ldif

_EOL_

#-- 管理者用メールアドレス作成
chmod 755 /usr/local/bin/create_admin_address.sh
/usr/local/bin/create_admin_address.sh ${DOMAIN}

・メールアドレスの作成

#-- メールアドレスを作成するスクリプトを作成
cat <<'_EOL_'> /usr/local/bin/create_mailaddress.sh
#!/bin/bash
# usage) ./create_mailaddress.sh <mailaddress>
ADDRESS=$1
LDAP_MASTER=127.0.0.1
STORE_SERVER=127.0.0.1
OUTBOUND_MTA_SERVER=127.0.0.1
ROOT_DN="cn=admin,dc=masdon,dc=life"
ROOT_PASSWORD="********"  #-- ROOT_DNのパスワードを入力
WORKDIR=/root/work/ldap

ldapsearch -x -h ${LDAP_MASTER} -D "${ROOT_DN}" -w ${ROOT_PASSWORD} > /dev/null 2>&1

if [ $? -ne 0 ]
then
	echo "invalid rootdn or rootpassword!!"
	exit 1
fi

if [ $(ldapsearch -x mailRoutingAddress=${ADDRESS} | grep -c "^mailRoutingAddress") -ne 0 ]
then
	echo "${ADDRESS} is already exist!!"
	exit 1
fi

mkdir -p ${WORKDIR}/ldap

ACCOUNT=$(echo ${ADDRESS} | awk -F@ '{print $1}')
if [ $(echo "${ADMINS}" | grep -c " ${ACCOUNT} ") -eq 1 ]
then
	echo "skip ${ADDRESS}"
	continue
fi
DOMAIN=$(echo ${ADDRESS} | awk -F@ '{print $2}')
mkdir -p ${WORKDIR}/${DOMAIN}
LDIFDIR=${WORKDIR}/${DOMAIN}
PASSWORD=$(mkpasswd -l 12 -d 3 -c 3 -C 3 -s 0)
SSHAPW=$(slappasswd -s ${PASSWORD})
BASEDN=""
for x in $(echo "${DOMAIN}" | sed 's/\./ /g')
do
	BASEDN="${BASEDN},dc=${x}"
done
BASEDN="ou=People${BASEDN}"

cat <<_EOF_>>${LDIFDIR}/${ACCOUNT}.ldif
dn: uid=${ACCOUNT},${BASEDN}
objectclass: uidObject
objectClass: simpleSecurityObject
objectclass: inetLocalMailRecipient
objectClass: sendmailMTA
uid: ${ACCOUNT}
userPassword: ${SSHAPW}
mailHost: ${STORE_SERVER}
sendmailMTAHost: ${OUTBOUND_MTA_SERVER}
mailRoutingAddress: ${ACCOUNT}@${DOMAIN}
mailLocalAddress: ${ACCOUNT}@${DOMAIN}

_EOF_

ldapadd -x -h ${LDAP_MASTER} -D "${ROOT_DN}" -w ${ROOT_PASSWORD} -f ${LDIFDIR}/${ACCOUNT}.ldif >/dev/null && echo ${PASSWORD}
_EOL_

chmod 755 /usr/local/bin/create_mailaddress.sh

・使用するアトリビュートの説明

アトリビュート説明例
uidユーザ名admin
mailRoutingAddress配送先メールアドレス
認証に使用		admin@masdon.life
mailLocalAddressエイリアスメールアドレス
このアドレスに届いたメールは、
mailRoutingAddress の MBOX に配送される		admin@masdon.life
abuse@masdon.life
root@masdon.life
userPasswordパスワード{SSHA}ZiGSOKPJHbr9Jy2r2Q9hhJpdDv……
mailHostメール保存サーバ127.0.0.1
sendmailMTAHostメール送信サーバ127.0.0.1
description特にシステムで使用はしていない
ouPeople の場合は有効アカウント
Termed の場合は無効アカウント

これから構築するメールサーバはメールアドレスを LDAP に登録するだけですぐに使用できるようになる