service.support
UID 14
精華
0
積分 0
帖子 523
閱讀權限 200
註冊 2006-10-2
狀態 離線
|
Domainkeys 和DKIM 套件安裝設定說明
[ 安裝 DKIM ]
需要先安裝的套件如下:
1.sendmail-8.14.4-2H.i386.rpm
2.openssl098-0.9.8o-1H.i386.rpm
3.dkim-milter-2.8.3-3H.i386.rpm
1. http://www.socketlabs.com/services/dkwiz
請到上面網站, 產生 DomainKey 和 Private Key , 以下圖為例, 輸入網域名稱 , 至於 Selector 輸入Default 的 " mail " 就可以, 然後按下 "Generate" 後就會產生所需要的 Key !!
2. 將 DomainKeys 輸入到 DNS主機的網域紀錄中
vi /var/named/linustar.com.hosts
$TTL 38400
linustar.com. IN SOA ns1.linustar.com. mis.hgiga.com. (
1210574177
10800
3600
604800
300 )
linustar.com. IN NS ns1.linustar.com.
linustar.com. IN NS ns2.linustar.com.
ns2.linustar.com. IN A 61.57.243.169
ns1.linustar.com. IN A 210.243.241.197
linustar.com. IN MX 10 msl.linustar.com.
ccmail.linustar.com. IN A 61.222.81.195
spam.linustar.com. IN A 61.222.81.195
msl.linustar.com. IN A 61.222.81.215
ccmail.linustar.com. IN A 61.222.81.218
www.linustar.com. IN A 61.57.243.162
linustar.com. IN TXT "v=spf1 ip4:61.222.81.194 ip4:61.222.81.195 ip4:61.222.81.207 ip4:61.222.81.222 a:msl.linustar.com. mx ~all"
_domainkey.linustar.com. IN TXT "t=y;o=~;"
mail._domainkey.linustar.com. IN TXT "k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoPvpNip7EbjpBwF4nvDL8rEPhbuD++9YwRRl7WZ660d33ImyDvuY9NnWACnGOh+wCJZvs+FlqedRTkLtwPiHJhLAKC4liwiGZVqBuypn0B2jDWXuFdZHdk2XSQKf5h3T2gGhmZ1nOVEafdzgW9XuIdnFAdCMNLV5J8dOPl4WCFwIDAQAB"
_adsp._domainkey.linustar.com. IN TXT "dkim=all;"
3. 把產生結果的 Private Key 貼到 mail server 內的 /etc/mail/dkim/keys/linustar.com/key1並設定權限
mkdir -p /etc/mail/dkim/keys/linustar.com
vi /etc/mail/dkim/keys/linustar.com/key1
-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDoPvpNip7EbjpBwF4nvDL8rEPhbuD++9YwRRl7WZ660d33ImyD
vuY9NnWACnGOh+wCJZvs+FlqedRTkLtwPiHJhLAKC4liwiGZVqBuypn0B2jDWXuF
dZHdk2XSQKf5h3T2gGhmZ1nOVEafdzgW9XuIdnFAdCMNLV5J8dOPl4WCFwIDAQAB
AoGBAL3kKGJYUiJIAigasqGIlqPT8hiTwTGbFfEXvpMFnuwfhn53zgQWhUhNi9sq
LtkcN5M1zvz9vpZ5kGrXLvrCQnpkuE+oF2O0PjQGtKA+bAS7vZbUip1EOeOHIMZY
D/R+c17Wrh7Se/oDWW1w/60TWtTmDfwYINol6kQULM5cdvCpAkEA+q3AmIt/4EZy
u9FeFgz2oDjoDJzk/PGal5oONa9J4KVqYAB7DJu7Le26+uSwQyem5UAbWt4PAp5l
E5WOLtisxQJBAO0tDsQJSoCT83oQ2d/KTZCusMtsHe2O7OmwHcw2nRgSDse8jes6
YcBxJg8ZJjcR2caSME0iQmjHMankMkHQWSsCQQDK1+Rby63bJkZbEozmnPDIL6Qd
6Ksmvr4QZJmQ+Vl3jYKpUlo/lph9DrxZnsm+XYygPyKjgcJ1pQQ3N7KI183dAkEA
igYNsMHjbH4tVB0YXecCSq+OzWMm64egkcJfJOendkmT9mLhiEHafz6ZsnGlTqkB
vlB28Xx9fzJk0YSuRqS0LwJASgitBTLmVYiEowsiB10XHpnL4csZW4GcrTOtHVOC
5JNDuBQXJy5HqvwnDbekW4PgFtGVz6fffl1vvoG0NCk8Qg==
-----END RSA PRIVATE KEY-----
chmod 600 /etc/mail/dkim/keys/linustar.com/key1
chown -R dkim-milt:dkim-milt /etc/mail/dkim/keys
4. 編輯相關 mail domain name 清單
vi /etc/dkim-internal-hosts
192.168.7.133
192.168.7.134
msl.linustar.com
ccmail.linustar.com
localhost.localdomain
localhost
linustar.com
127.0.0.1
5.修改 /etc/dkim-filter.conf
vi /etc/dkim-filter.conf
ADSPDiscard no
:
ADSPNoSuchDomain no
:
Canonicalization simple/simple
:
Domain linustar.com
:
KeyFile /etc/mail/dkim/keys/linustar.com/key1
:
KeyList /etc/mail/dkim/keylist
:
Selector mail
:
Socket inet:8891@localhost
:
Mode sv
:
InternalHosts /etc/dkim-internal-hosts
:
MTA MSA
:
OmitHeaders to,mime-version,content-type
:
SignatureAlgorithm rsa-sha256
:
Syslog Yes
:
Userid dkim-milt
:
X-Header No
:
LogWhy no
發現時常因為驗簽章失敗退別人的信, 想關閉驗簽失敗退信的功能可修改一下參數:
:
On-Default accept
On-BadSignature accept
On-DNSError accept
:
6. 修改 /etc/mail/dkim/keylist
vi /etc/mail/dkim/keylist
*@linustar.com:linustar.com:/etc/mail/dkim/keys/linustar.com/key1
7.啟動 dkim-milter 服務
service dkim-milter start
chkconfig --level 123456 dkim-milter on
8. 修改 sendmail.cf 設定, 將下面幾行輸入到設定檔的最後面:
# Input mail filters
O InputMailFilters=dkim-filter
# MAIL FILTER DEFINE
Xdkim-filter, S=inet:8891@localhost
重新啟動 Sendmail 服務
service sendmail reload
[ 安裝 Domainkeys ]
需要先安裝的套件如下:
sendmail-8.14.4-2H.i386.rpm
openssl098-0.9.8o-1H.i386.rpm
主套件:
dk-milter-1.0.2-2H.i386.rpm
使用套件安裝後的設定時的注意事項:
1. 更新 DNS (DomainKey 和 DKIM 可以共用同一個 openssl 產生的 key file)
建立一筆DNS的TXT紀錄 default._domainkey.hgiga.com. , 設定跟 DKIM 一樣的即可！！
default._domainkey.hgiga.com. IN TXT "k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7LmZZHb8wVi+WNEr0Ip/jt5vS2p0pw0MG7mHsZgvbBjXw2+PTEy0vfhh9UtdxIcjYDXBwnL+6TLwhikICWOLwZd5Pzg66/5N0x9lN82Rnp3TsiDPZElUapVMmU3uBw+gGOibSc1fOr8OtqiKJvszKGBAh1NSdxG0DMG0WoRUCcQIDAQAB"
2. 套件設定檔預設的 Key file 需放置於/etc/mail/domainkeys/dk_DomainName.pem , 可與 DKIM共用同一個 Key File
cp -af /etc/mail/dkim/keys/hgiga.com/key1 ./dk_hgiga.com.pem
chmod 600 /etc/mail/domainkeys/dk_hgiga.com.pem
chown -R dk-milt:dk-milt /etc/mail/domainkeys/
3. 套件的 dk-milter 的設定檔路徑為 /etc/sysconfig/dk-milter
vi /etc/sysconfig/dk-milter
加入下面三行!!
PORT="inet:8892@localhost"
SIGNING_DOMAIN="realinux.com"
KEYFILE="/etc/mail/domainkeys/dk_realinux.com.pem"
CANON=nofws
EXTRA_ARGS="-h -l -D -H -o received,dkim-signature,errors-to,received,x-originating-ip,x-mailer,return-path,senderaccount,hmid,hhid,huid,message-id,x-received-ip,x-envelope-from,x-sherlock-send,x-smtp-auth,x-license,x-ms-tnef-correlator,disposition-notification-to,thread-index,content-language,x-mimeole,x-esetscannerbuild,x-priority,x-msmail-priority,importance,x-cr-hashedpuzzle,x-cr-puzzleid,user-agent,x-signed-by"
REJECTION="bad=a,dns=a,int=a,no=a,miss=a"
4. 套件的內部發送主機設定檔路徑為 /etc/dk-internal-hosts (本機發送時不需建立和設定內部主機設定檔案), 如無建立 /etc/dk-internal-hosts 時也可使用 dkim 的內部主機設定檔 /etc/dkim-internal-hosts
cp -af /etc/dkim-internal-hosts /etc/dk-internal-hosts
/etc/dk-internal-hosts 設定範例如下:
192.168.16.230
localhost.localdomain
192.168.16.1
ccmail82.realinux.com
localhost
hgiga.com
realinux.com
5. 修改 sendmail.cf 加入下面兩行
O InputMailFilters=dkim-filter,dk-filter
Xdk-filter, S=inet:8892@localhost
6. 設定 dk-milter 預設開機啟動, 和 Reload Sendmail 和 Start dk-milter
chkconfig --level 123456 dk-milter on
service dk-milter restart
service sendmail reload
7. 更新Sendmail啟動檔案
ncftpget -t 10 -r 3 ftp://dluser:dluser@www.hgiga.com/sendmail.dkim.script
chmod 777 sendmail.dkim.script
mv -f sendmail.dkim.script /etc/rc.d/init.d/sendmail
檔案位置: /etc/rc.d/init.d/dk-milter
#以下請自行調整,主要為對應啟動時的參數
SOCKET="inet:8892@localhost"
CANON="simple"
DOMAIN=$(hostname)
PRIVATE_KEY="/etc/mail/abelyang.private"
USER=smmsp
HEADER_IGNORE="subject,date,message-id,to"
SELECTOR=$(date +%Y)
FILTER_RULE="bad=r,dns=r,int=r,no=a,miss=r"
上述參數 -C config 檔中的設定方法,
代碼:
#result=action,result=action,...,括號內為簡寫
#Results:
# 依序為認證失敗,DNS 錯誤,Milter 內部錯誤,沒有 DKIM 欄位,沒有簽章欄位(b=)
badsignature(bad)
dnserror(dns)
internal(int)
nosignature(no)
signature-missing(miss)
#action:
# 依序為 同意,丟棄,臨時失敗,拒絕
accept(a)
discard(d)
tempfail(t)
reject(r)
|
|
