dhcp sendmail tcpwrapper
yum install dhcp -y拷贝模板文件到/etc/下
cp /usr/share/doc/dhcp-3.0.5/dhcpd.conf.sample /etc/dhcpd.conf
ddns-update-style interim;
ignore client-updates;
subnet 10.1.1.0 netmask 255.255.255.0 {
option routers 10.1.1.1;
option subnet-mask 255.255.255.0;
option nis-domain "cluster.com";
option domain-name "upl.com";
option domain-name-servers 10.1.1.1;
option time-offset -18000; # Eastern Standard Time
range dynamic-bootp 10.1.1.88 10.1.1.88;
default-lease-time 21600;
max-lease-time 43200;
# we want the nameserver to appear at a fixed address
host boss {
hardware ethernet 00:27:19:96:19:B5;
fixed-address 10.1.1.88;
}
host sb {
hardware ethernet 00:27:19:96:19:B5;
fixed-address 10.1.1.244;
}
}
service dhcpd restart
客户端动态获取IP
dhclient eth0
===================================================
Sendmail
协议：tcp/smtp
端口：25
软件：
sendmail.i386
sendmail-cf.i386
sendmail-devel.i386
sendmail-doc.i386
m4.i386
dovecot<---MDA
promail<---负责把邮件分发到本地不同的帐号
# yum install sendmail* m4 procmail dovecot -y
配置目录 /etc/mail/
sendmail.cf
sendmail.mc
access
virtusertable
local-host-names
/etc/aliases
准备：
主机名FQDN
时间同步
关闭selinux，iptables
在DNS上设定正确的MX记录
@ IN NS squid.upl.com.
squid IN A 10.1.1.21
@ IN MX 0 mail.upl.com.
mail IN CNAME squid
验证MX记录的正确性
# nslookup
> set type=mx
> upl.com
Server: 10.1.1.21
Address: 10.1.1.21#53
upl.com mail exchanger = 0 mail.upl.com.
例子1：直接启动，验证服务器工作正常
# netstat -ntlp | grep :25
# telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 11:06:59 +0800
helo ddddd
250 squid.upl.com Hello localhost.localdomain , pleased to meet you
mail from:10000@qq.com
250 2.1.0 10000@qq.com... Sender ok
rcpt to:tom@squid.upl.com
250 2.1.5 tom@squid.upl.com... Recipient ok
data
354 Enter mail, end with "." on a line by itself
wel to upl
.
250 2.0.0 o6N36x3O004704 Message accepted for delivery
quit
221 2.0.0 squid.upl.com closing connection
Connection closed by foreign host.
查看邮件
cat /var/mail/tom
例子2：允许本地网络连接上来发送邮件
# vim sendmail.mc
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
修改为
DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA')dnl
# m4 sendmail.mc > sendmail.cf
# netstat -ntlp | grep :25
使用别的机器连接上来测试
# telnet 10.1.1.21 25
例子3：让邮件服务器支持短域名 ，支持 xxx@upl.com
# vim local-host-names
upl.com
squid.upl.com
测试
rcpt to:tom@upl.com
250 2.1.5 tom@upl.com... Recipient ok
例子4：邮件别名，群发等
# vim /etc/aliases
it: tom,bean群发
mary: tom 转发
# newaliases
测试
# cat /etc/fstab | mail -s "group mail" it@upl.com
# mail -s "group mail" it@upl.com < /etc/inittab
# cat /etc/hosts | sendmail -v mary@upl.com
例子5：支持发送外部邮件
必须打开中继功能： 把邮件发送到外部网络（MTA绑定的域名跟收件人的域名不一样）
# telnet 10.1.1.21 25
Trying 10.1.1.21...
Connected to squid.upl.com (10.1.1.21).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 13:49:12 +0800
mail from:10000@qq.com
250 2.1.0 10000@qq.com... Sender ok
rcpt to:l.t.b@126.com
550 5.7.1 l.t.b@126.com... Relaying denied
中继拒绝：默认是不允许其他IP登录邮件服务器发送外部邮件
实现允许内部某个网段发送外部邮件
# vim /etc/mail/access
Connect:10.1.1.19 REJCET
Connect:10.1.1 RELAY
TO:qq.com REJECT
FROM:gmail.com REJECT
# makemaphash /etc/mail/access.db < /etc/mail/access
# telnet 10.1.1.21 25
Trying 10.1.1.21...
Connected to squid.upl.com (10.1.1.21).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 13:56:51 +0800
mail from:10000@gmail.com
550 5.7.1 10000@gmail.com... Access denied
mail from:admin@qq.com
250 2.1.0 admin@qq.com... Sender ok
rcpt to:10000@qq.com
550 5.2.1 10000@qq.com... Mailbox disabled for this recipient
rcpt to:l.t.b@126.com
250 2.1.5 l.t.b@126.com... Recipient ok
data
354 Enter mail, end with "." on a line by itself
just for test
.
250 2.0.0 o6N5up32005376 Message accepted for delivery
quit
221 2.0.0 squid.upl.com closing connection
Connection closed by foreign host.
例子6：支持smtp验证
发送邮件必须验证帐号和密码
只要服务器打开了smtp验证之后，access就会被忽略
# vim sendmail.mc
搜索MD5
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
搜索submission
DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl
# m4 sendmail.mc > sendmail.cf
确定是否支持验证
# telnet 10.1.1.21 25
Trying 10.1.1.21...
Connected to squid.upl.com (10.1.1.21).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 14:05:30 +0800
ehlo squid.upl.com《－－－－
250-squid.upl.com Hello dns.upl.com , pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH LOGIN PLAIN《－－－－
250-DELIVERBY
250 HELP
2、把验证需要的软件包都安装
# yum install cyrus-* -y
3、重启所有相关的服务
service sendmail restart
service saslauthd restart
测试
# telnet 10.1.1.21 25
Trying 10.1.1.21...
Connected to squid.upl.com (10.1.1.21).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 14:12:30 +0800
auth login
334 VXNlcm5hbWU6
dG9t 《－－－编码之后的用户名
334 UGFzc3dvcmQ6
MTIz《－－－编码之后的密码
235 2.0.0 OK Authenticated
mail from:1000@qq.com
250 2.1.0 1000@qq.com... Sender ok
rcpt to:l.t.b@126.com
250 2.1.5 l.t.b@126.com... Recipient ok
data
354 Enter mail, end with "." on a line by itself
mail comes again
.
250 2.0.0 o6N6CUg9005754 Message accepted for delivery
quit
221 2.0.0 squid.upl.com closing connection
Connection closed by foreign host.
使用foxmail验证发送需要密码，验证接受邮件
接受邮件需要存在MDA
service dovecot restart<---打开他才允许MUA连接上来收取邮件
chkconfig dovecot on
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
Xinetd(扩展的网络服务守护进程)
1、提高系统性能，提高服务性能
2、增强访问控制
3、增加了额外的日志记录
配置目录
/etc/xinetd.d/
/etc/xinetd.conf
针对某个托管给xinetd的服务独立配置文件
# vim /etc/xinetd.d/tftp
service tftp
{
socket_type = dgram
protocol = udp
wait = yes
user = root
server = /usr/sbin/in.tftpd
server_args = -s /tftpboot
disable = yes
per_source = 11
cps = 100 2
flags = IPv4
}
例子1：把vsftp托管给xinetd
# vim /etc/xinetd.d/vsftp
service ftp
{
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/sbin/vsftpd
disable = no
}
修改vsftp的配置
# listen=YES<--注释掉
# service vsftpd stop
# service xinetd restart
验证:
# netstat -ntlp | grep :21
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 6264/xinetd
登录之前ps -ef | grep vsftpd
登录之后ps -ef | grep vsftpd
退出登录ps -ef | grep vsftpd
例子2：把sshd托管给xinetd
# vim sshd
service ssh
{
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/sbin/sshd
server_args = -i
disable = no
per_source = 2
cps = 100 2 <--媚笑最多处理100个请求，否则停止服务2秒
no_access = 10.1.1.251
only_from = 10.1.1.0/24
access_times = 16:00-23:00
instances = 3
flags = IPv4
}
# service sshd stop
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
tcpwrapper
client <----->tcpwrapper <----> xinetd <----> vsftpd
client <----->tcpwrapper <---->vsftpd
# ldd /usr/sbin/xinetd | grep wrap
libwrap.so.0 => /lib/libwrap.so.0 (0x00e95000)
# ldd /usr/sbin/vsftpd | grepwrap
libwrap.so.0 => /lib/libwrap.so.0 (0x00781000)
# ldd /usr/sbin/sshd | grepwrap
libwrap.so.0 => /lib/libwrap.so.0 (0x007c9000)
配置文件：
/etc/hosts.allow
/etc/hosts.deny
规则读取以及匹配算法：
首先读取allow文件，如果找到匹配的规则，就停止继续往下读取规则
如果allow找不到规则，就去找deny规则，如果找到就拒绝
如果找不到匹配规则，就默认允许
例子1：拒绝10.1.1.20访问vsftpd
# vim /etc/hosts.deny<--马上生效
vsftpd: 10.1.1.20
例子2：只是禁止10.1.1.0/24网段里的主机访问，但是10.1.1.20可以访问
方法1：
# vim /etc/hosts.allow
vsftpd: 10.1.1.20
# vim /etc/hosts.deny
vsftpd: 10.1.1.0/255.255.255.0
方法2：
# vim /etc/hosts.deny
vsftpd: 10.1.1.0/255.255.255.0 EXCEPT 10.1.1.20
方法3：
# vim /etc/hosts.allow
vsftpd: all EXCEPT 10.1.1.0/255.255.255.0 EXCEPT 10.1.1.20
允许所有IP，但除了10.1.1.1~10.1.1.19, 10.1.1.21~10.1.1.254
# vim /etc/hosts.deny<---拒绝所有人访问，别忘记了
vsftpd:all
例子3: 拒绝所有人访问，但是允许10.1.1.0/24访问，但不允许10.1.1.20
写两个文件：
# vim /etc/hosts.allow
vsftpd: 10.1.1.0/255.255.255.0 EXCEPT 10.1.1.20
# vim /etc/hosts.deny
vsftpd: all
方法2：
# vim /etc/hosts.deny
vsftpd: all EXCEPT 10.1.1.0/255.255.255.0 EXCEPT 10.1.1.20
拒绝所有IP，但除了10.1.1.1~10.1.1.19, 10.1.1.21~10.1.1.254
页:
[1]