HGIGA Service Docs - Powered by Discuz! Board

標題: Domainkeys 和DKIM 套件安裝設定說明 [打印本頁]

作者: service.support 時間: 2010-12-2 10:50 標題: Domainkeys 和DKIM 套件安裝設定說明

[ 安裝 DKIM ]

需要先安裝的套件如下:
1.sendmail-8.14.4-2H.i386.rpm
2.openssl098-0.9.8o-1H.i386.rpm
3.dkim-milter-2.8.3-3H.i386.rpm

1. http://www.socketlabs.com/services/dkwiz

請到上面網站, 產生 DomainKey 和 Private Key , 以下圖為例, 輸入網域名稱 , 至於 Selector 輸入Default 的 " mail " 就可以, 然後按下 "Generate" 後就會產生所需要的 Key !!

2. 將 DomainKeys 輸入到 DNS主機的網域紀錄中

vi /var/named/linustar.com.hosts
$TTL 38400
linustar.com. IN    SOA    ns1.linustar.com. mis.hgiga.com. (
                     1210574177
                     10800
                     3600
                     604800
                     300 )
linustar.com. IN    NS    ns1.linustar.com.
linustar.com. IN    NS    ns2.linustar.com.
ns2.linustar.com.    IN    A    61.57.243.169
ns1.linustar.com.    IN    A    210.243.241.197
linustar.com. IN    MX    10 msl.linustar.com.
ccmail.linustar.com. IN    A    61.222.81.195
spam.linustar.com.    IN    A    61.222.81.195
msl.linustar.com.    IN    A    61.222.81.215
ccmail.linustar.com. IN    A    61.222.81.218
www.linustar.com.    IN    A    61.57.243.162
linustar.com. IN    TXT    "v=spf1 ip4:61.222.81.194 ip4:61.222.81.195 ip4:61.222.81.207 ip4:61.222.81.222 a:msl.linustar.com. mx ~all"
_domainkey.linustar.com.       IN    TXT    "t=y;o=~;"
mail._domainkey.linustar.com.  IN TXT "k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoPvpNip7EbjpBwF4nvDL8rEPhbuD++9YwRRl7WZ660d33ImyDvuY9NnWACnGOh+wCJZvs+FlqedRTkLtwPiHJhLAKC4liwiGZVqBuypn0B2jDWXuFdZHdk2XSQKf5h3T2gGhmZ1nOVEafdzgW9XuIdnFAdCMNLV5J8dOPl4WCFwIDAQAB"
_adsp._domainkey.linustar.com.  IN    TXT    "dkim=all;"

3. 把產生結果的 Private Key 貼到 mail server 內的 /etc/mail/dkim/keys/linustar.com/key1並設定權限

mkdir -p /etc/mail/dkim/keys/linustar.com
vi  /etc/mail/dkim/keys/linustar.com/key1

-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDoPvpNip7EbjpBwF4nvDL8rEPhbuD++9YwRRl7WZ660d33ImyD
vuY9NnWACnGOh+wCJZvs+FlqedRTkLtwPiHJhLAKC4liwiGZVqBuypn0B2jDWXuF
dZHdk2XSQKf5h3T2gGhmZ1nOVEafdzgW9XuIdnFAdCMNLV5J8dOPl4WCFwIDAQAB
AoGBAL3kKGJYUiJIAigasqGIlqPT8hiTwTGbFfEXvpMFnuwfhn53zgQWhUhNi9sq
LtkcN5M1zvz9vpZ5kGrXLvrCQnpkuE+oF2O0PjQGtKA+bAS7vZbUip1EOeOHIMZY
D/R+c17Wrh7Se/oDWW1w/60TWtTmDfwYINol6kQULM5cdvCpAkEA+q3AmIt/4EZy
u9FeFgz2oDjoDJzk/PGal5oONa9J4KVqYAB7DJu7Le26+uSwQyem5UAbWt4PAp5l
E5WOLtisxQJBAO0tDsQJSoCT83oQ2d/KTZCusMtsHe2O7OmwHcw2nRgSDse8jes6
YcBxJg8ZJjcR2caSME0iQmjHMankMkHQWSsCQQDK1+Rby63bJkZbEozmnPDIL6Qd
6Ksmvr4QZJmQ+Vl3jYKpUlo/lph9DrxZnsm+XYygPyKjgcJ1pQQ3N7KI183dAkEA
igYNsMHjbH4tVB0YXecCSq+OzWMm64egkcJfJOendkmT9mLhiEHafz6ZsnGlTqkB
vlB28Xx9fzJk0YSuRqS0LwJASgitBTLmVYiEowsiB10XHpnL4csZW4GcrTOtHVOC
5JNDuBQXJy5HqvwnDbekW4PgFtGVz6fffl1vvoG0NCk8Qg==
-----END RSA PRIVATE KEY-----

chmod 600 /etc/mail/dkim/keys/linustar.com/key1
chown -R dkim-milt:dkim-milt /etc/mail/dkim/keys

4. 編輯相關 mail domain name 清單

vi /etc/dkim-internal-hosts

192.168.7.133
192.168.7.134
msl.linustar.com
ccmail.linustar.com
localhost.localdomain
localhost
linustar.com
127.0.0.1

5.修改 /etc/dkim-filter.conf

vi /etc/dkim-filter.conf

ADSPDiscard          no
:
ADSPNoSuchDomain       no
:
Canonicalization       simple/simple
:
Domain                linustar.com
:
KeyFile                /etc/mail/dkim/keys/linustar.com/key1
:
KeyList                /etc/mail/dkim/keylist
:
Selector             mail
:
Socket                inet:8891@localhost
:
Mode                   sv
:
InternalHosts          /etc/dkim-internal-hosts
:
MTA MSA
:
OmitHeaders          to,mime-version,content-type
:
SignatureAlgorithm rsa-sha256
:
Syslog Yes
:
Userid dkim-milt
:
X-Header No
:
LogWhy  no

發現時常因為驗簽章失敗退別人的信, 想關閉驗簽失敗退信的功能可修改一下參數:

:
On-Default             accept
On-BadSignature       accept
On-DNSError          accept
:

6. 修改 /etc/mail/dkim/keylist

vi /etc/mail/dkim/keylist

*@linustar.com:linustar.com:/etc/mail/dkim/keys/linustar.com/key1

7.啟動 dkim-milter 服務

service dkim-milter start
chkconfig --level 123456 dkim-milter on

8. 修改 sendmail.cf 設定, 將下面幾行輸入到設定檔的最後面:

# Input mail filters
O InputMailFilters=dkim-filter
# MAIL FILTER　DEFINE
Xdkim-filter, S=inet:8891@localhost

重新啟動 Sendmail 服務

service sendmail reload

[ 安裝 Domainkeys ]

需要先安裝的套件如下:
sendmail-8.14.4-2H.i386.rpm
openssl098-0.9.8o-1H.i386.rpm
主套件:
dk-milter-1.0.2-2H.i386.rpm

使用套件安裝後的設定時的注意事項:

1. 更新 DNS (DomainKey 和 DKIM 可以共用同一個 openssl 產生的 key file)

建立一筆DNS的TXT紀錄 default._domainkey.hgiga.com. , 設定跟 DKIM 一樣的即可！！
default._domainkey.hgiga.com.    IN    TXT    "k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7LmZZHb8wVi+WNEr0Ip/jt5vS2p0pw0MG7mHsZgvbBjXw2+PTEy0vfhh9UtdxIcjYDXBwnL+6TLwhikICWOLwZd5Pzg66/5N0x9lN82Rnp3TsiDPZElUapVMmU3uBw+gGOibSc1fOr8OtqiKJvszKGBAh1NSdxG0DMG0WoRUCcQIDAQAB"

2. 套件設定檔預設的 Key file 需放置於/etc/mail/domainkeys/dk_DomainName.pem , 可與 DKIM共用同一個 Key File

cp -af /etc/mail/dkim/keys/hgiga.com/key1 ./dk_hgiga.com.pem
chmod 600 /etc/mail/domainkeys/dk_hgiga.com.pem
chown -R dk-milt:dk-milt /etc/mail/domainkeys/

3. 套件的 dk-milter 的設定檔路徑為 /etc/sysconfig/dk-milter

vi /etc/sysconfig/dk-milter

加入下面三行!!

PORT="inet:8892@localhost"
SIGNING_DOMAIN="realinux.com"
KEYFILE="/etc/mail/domainkeys/dk_realinux.com.pem"
CANON=nofws
EXTRA_ARGS="-h -l -D -H -o received,dkim-signature,errors-to,received,x-originating-ip,x-mailer,return-path,senderaccount,hmid,hhid,huid,message-id,x-received-ip,x-envelope-from,x-sherlock-send,x-smtp-auth,x-license,x-ms-tnef-correlator,disposition-notification-to,thread-index,content-language,x-mimeole,x-esetscannerbuild,x-priority,x-msmail-priority,importance,x-cr-hashedpuzzle,x-cr-puzzleid,user-agent,x-signed-by"
REJECTION="bad=a,dns=a,int=a,no=a,miss=a"

4. 套件的內部發送主機設定檔路徑為 /etc/dk-internal-hosts (本機發送時不需建立和設定內部主機設定檔案), 如無建立 /etc/dk-internal-hosts 時也可使用 dkim 的內部主機設定檔 /etc/dkim-internal-hosts

cp -af /etc/dkim-internal-hosts /etc/dk-internal-hosts

/etc/dk-internal-hosts 設定範例如下:
192.168.16.230
localhost.localdomain
192.168.16.1
ccmail82.realinux.com
localhost
hgiga.com
realinux.com

5. 修改 sendmail.cf 加入下面兩行

O InputMailFilters=dkim-filter,dk-filter
Xdk-filter, S=inet:8892@localhost

6. 設定 dk-milter 預設開機啟動, 和 Reload Sendmail 和 Start dk-milter

chkconfig --level 123456 dk-milter on
service dk-milter restart
service sendmail reload

7. 更新Sendmail啟動檔案
ncftpget -t 10 -r 3 ftp://dluser:dluser@www.hgiga.com/sendmail.dkim.script
chmod 777 sendmail.dkim.script
mv -f sendmail.dkim.script /etc/rc.d/init.d/sendmail

檔案位置: /etc/rc.d/init.d/dk-milter
#以下請自行調整,主要為對應啟動時的參數
SOCKET="inet:8892@localhost"
CANON="simple"
DOMAIN=$(hostname)
PRIVATE_KEY="/etc/mail/abelyang.private"
USER=smmsp
HEADER_IGNORE="subject,date,message-id,to"
SELECTOR=$(date +%Y)
FILTER_RULE="bad=r,dns=r,int=r,no=a,miss=r"

上述參數 -C config 檔中的設定方法,
代碼:
#result=action,result=action,...,括號內為簡寫
#Results:
# 依序為認證失敗,DNS 錯誤,Milter 內部錯誤,沒有 DKIM 欄位,沒有簽章欄位(b=)
badsignature(bad)
dnserror(dns)
internal(int)
nosignature(no)
signature-missing(miss)

#action:
# 依序為同意,丟棄,臨時失敗,拒絕
accept(a)
discard(d)
tempfail(t)
reject(r)

歡迎光臨 HGIGA Service Docs (http://docs.hgiga.com/Discuz4/)