postfix+mariadb 空壳邮件 iptables / 憋错料

####################postfix+mariadb###################
1.准备工作
[[email protected] ~]# yum install mariadb php php-mysql httpd dovecot dovecot-mysql -y
安装有关软件
2.配置文件
[[email protected] ~]# vim /etc/dovecot/dovecot.conf
       24 protocols = imap pop3 lmtp
       48 login_trusted_networks = 0.0.0.0/0
       49 disable_plaintext_auth = no
[[email protected] ~]# vim /etc/dovecot/conf.d/10-auth.conf
       123 !include auth-sql.conf.ext
[[email protected] ~]# cd /etc/dovecot/conf.d
[[email protected] conf.d]# ls
10-auth.conf       20-imap.conf                 auth-dict.conf.ext
10-director.conf   20-lmtp.conf                 auth-ldap.conf.ext
10-logging.conf    20-pop3.conf                 auth-master.conf.ext
10-mail.conf       90-acl.conf                  auth-passwdfile.conf.ext
10-master.conf     90-plugin.conf               auth-sql.conf.ext
10-ssl.conf        90-quota.conf                auth-static.conf.ext
15-lda.conf        auth-checkpassword.conf.ext auth-system.conf.ext
15-mailboxes.conf auth-deny.conf.ext           auth-vpopmail.conf.ext
[[email protected] conf.d]# cp /usr/share/doc/dovecot-2.2.10/example-config/dovecot-sql.conf.ext /etc/dovecot/dovecot-sql.conf.ext
[[email protected] conf.d]# vim /etc/dovecot/dovecot-sql.conf.ext
32 driver = mysql
71 connect = host=localhost dbname=email user=postuser password=postuser
78 default_pass_scheme = PLAIN
107 password_query = \
108   SELECT username, domain, password \
109   FROM emailuser WHERE username = ‘%u‘ AND domain = ‘%d‘
125    user_query = SELECT maildir, 666 AS uid, 666 AS gid FROM emailuser WHER    E username = ‘%u‘
[[email protected] conf.d]# vim 10-mail.conf
30 mail_location = maildir:/home/vmail/%d/%n
168 first_valid_uid = 666
175 first_valid_gid = 666
[[email protected] conf.d]# yum install -y telnet
[[email protected] conf.d]# systemctl restart dovecot

测试
[[email protected] conf.d]# telnet 172.25.254.101 110
Trying 172.25.254.101...
Connected to 172.25.254.101.
Escape character is ‘^]‘.
+OK [XCLIENT] Dovecot ready.
user [email protected]
+OK
pass lee
+OK Logged in.
quit
+OK Logging out.
Connection closed by foreign host.

#################空壳邮件####################
1.先重置空壳端
2.配置
[[email protected] ~]# vim /etc/postfix/main.cf
75 myhostname = nullmail.example.com     ##主机名
83 mydomain = example.com                ##域名
99 myorigin = westos.com                 ##要与真实主机的域名相同
113 inet_interfaces = all
164 mydestination =                      ##空壳实际不接收邮件，所以不写
316 relayhost = 172.25.254.101           ##真实主机ip
[[[email protected] ~]# systemctl restart postfix.service
测试
#空壳端
[[email protected] ~]# mail root
Subject: qe
qe
qe
.
EOT
[[email protected] ~]# mailq
Mail queue is empty

#真接收端
[[email protected] named]# mail
Heirloom Mail version 12.5 7/5/10. Type ? for help.
"/var/spool/mail/root": 1 message 1 new
>N 1 root Thu Jun 1 08:01 22/742 "qe"
& q

######################################
#############iptables#################
######################################
1.准备工作
查看火墙状态，如果是running，将其关闭
打开iptables

2.iptables
iptables是一个工作与用户之间的防火墙应用软件
三表：filter    ##不经过内核
      mangel
      nat       ##经过内核
五链：INPUT OUTPUT FORWARD PREROUTING POSTROUTING
           -t      ##指出表的名称
           -n      ##不作解析
           -L      ##列出指定表的策略
           -F      ##刷掉filter表中的所有策略
           -A      ##增加策略
           -s      ##数据来源
           -j      ##动作
           ACCEPT ##允许
           REJECT ##拒绝
           --dport ##端口
           -D      ##删除指定策略
           -I      ##插入策略
           -R      ##修改策略
           -P      ##修改默认策略
service iptables save     ##保存当前策略
[[email protected] ~]# iptables -A INPUT -i lo -j ACCEPT   ##允许lo
[[email protected] ~]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT ##允许访问22 端口
[[email protected] ~]# iptables -A INPUT -s 172.25.254.75 -j ACCEPT ##只允许75主机访问
[[email protected] ~]# iptables -A INPUT -j REJECT     ##其它全部拒绝
[[email protected] ~]# iptables -nL       ##查看filter表当前策略
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all -- 0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp -- 0.0.0.0/0            0.0.0.0/0            tcp dpt:22
ACCEPT     all -- 172.25.254.95        0.0.0.0/0
REJECT     all -- 0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable