1
Konfiguracja / DKIM nie podpisuje maili (+postfix)
« Ostatnia wiadomość wysłana przez mariuszad dnia Wczoraj o 09:20:50 »Witam
Mam problem DKIM (Centos 7). W nagłówku maila nie pojawia się sygnatura DKIM. Przy testach :
Nagłówek wygląda tak:
Konfiguracja postfixa
Konfiguracja DKIM:
Test DKIM
DKIM dodany do pliku strefy:
Czy to może być spowodowane tym, że działam w domenie lokalnej, czy może to skopana konfiguracja? Mogę liczyć na pomoc?.
Pozdrawiam
Mam problem DKIM (Centos 7). W nagłówku maila nie pojawia się sygnatura DKIM. Przy testach :
Kod: [Zaznacz]
# openssl s_client -connect poczta.local.tld:587 -starttls smtp
# openssl s_client -connect poczta.local.tld:25 -starttls smtpNagłówek wygląda tak:
Kod: [Zaznacz]
Return-Path: <admin@local.tld>
Delivered-To: user2@local.tld
Received: from poczta.local.tld
by zeus with LMTP id AMe9FuE3aGXtBQAAZ8L/vg
for <user2@local.tld>; Thu, 30 Nov 2023 08:21:05 +0100
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.168.0.114; helo=poczta.local.tld; envelope-from=admin@local.tld; receiver=webmaster@local.tld
DKIM-Filter: OpenDKIM Filter v2.11.0 poczta.local.tld ADF5D60439A1
Received: from poczta.local.tld (unknown [192.168.0.114])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by poczta.local.tld (Postfix) with ESMTPS id ADF5D60439A1
for <webmaster@local.tld>; Thu, 30 Nov 2023 07:20:55 +0000 (UTC)
Message-Id: <20231130072058.ADF5D60439A1@poczta.local.tld>
Date: Thu, 30 Nov 2023 08:20:55 +0100 (CET)
From: admin@local.tldKonfiguracja postfixa
Kod: [Zaznacz]
# cat /etc/postfix/main.cf
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = localhost
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
unknown_local_recipient_reject_code = 550
# ============
#Ustawienia ogólne
myhostname = poczta.local.tld
mydomain = local.tld
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost
mynetworks = 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
home_mailbox = Maildir/
# Ustawienia poczty przychodzącej (SMTP)
smtpd_banner = $myhostname ESMTP
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
policyd-spf_time_limit = 3600
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_policy_service unix:private/policyd-spf
smtpd_helo_restrictions = permit_mynetworks permit_sasl_authenticated reject_invalid_hostname
# Ustawienia poczty wychodzącej (SMTP)
relayhost =
smtpd_client_restrictions = permit_sasl_authenticated
# TLS
smtpd_tls_cert_file=/etc/ssl/poczta/poczta.local.tld.crt
smtpd_tls_key_file=/etc/ssl/poczta/poczta.key
smtpd_tls_CAfile = /etc/ssl/poczta/ca.crt
smtpd_tls_security_level = may
smtp_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# Logowanie
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
broken_sasl_auth_clients = yes
virtual_transport = lmtp:unix:private/dovecot-lmtp
#Virtual
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf,
mysql:/etc/postfix/mysql-virtual-email2email.cf
# Milter configuration
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
Kod: [Zaznacz]
# cat /etc/postfix/master.cf
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - - smtpd
...
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_reject_unlisted_recipient=no
...
smtps inet n - n - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_reject_unlisted_recipient=no
...
pickup unix n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
...
policyd-spf unix - n n - 0 spawn
user=policyd-spf argv=/usr/libexec/postfix/policyd-spfKonfiguracja DKIM:
Kod: [Zaznacz]
# grep ^[^#] /etc/opendkim.conf
PidFile /var/run/opendkim/opendkim.pid
Mode sv
Syslog yes
SyslogSuccess yes
LogWhy yes
UserID opendkim:opendkim
Socket inet:8891@localhost
Umask 002
SendReports yes
SoftwareHeader yes
Canonicalization relaxed/relaxed
Domain local.tld
Selector default
MinimumKeyBits 1024
KeyTable /etc/opendkim/KeyTable
SigningTable refile:/etc/opendkim/SigningTable
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts
InternalHosts refile:/etc/opendkim/TrustedHosts
OversignHeaders FromTest DKIM
Kod: [Zaznacz]
# opendkim-testkey -d local.tld -s 20102023001 -vvv
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key '20102023001._domainkey.local.tld'
opendkim-testkey: key OK
DKIM dodany do pliku strefy:
Kod: [Zaznacz]
# dig 20102023001._domainkey.local.tld txt
<<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.15 <<>> 20102023001._domainkey.local.tld txt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18191
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;20102023001._domainkey.local.tld. IN TXT
;; ANSWER SECTION:
20102023001._domainkey.local.tld. 86400 IN TXT "v=DKIM1; k=rsa; " "p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg9AMIICCgKCAgEA8vEvrGiBiAwp7TJBc3frjRT6yulOGBp08oCA4C+AHyZEgLPhsypU8TNBedZuTS9DOlN3g4jTjU0xN8NmWb/n4tZ1/Pt4yymkZReeJOvmgZhvPTaq/jEh4lRWpHRisifJoPz83UitdTADltTSkFpYyggrYvuo5OYDUzVXIpKKk82Xefmeixk6H3v/ozj6qXzeoa3rRl/e54ZjJP" "yyOeGpAJcc9LsjoHlRadWQmWYfINCms3KYix07OK431WQfNYF/QG9nsqb5JdPnEOSSaOq7iQM/hTNNMsW33pmvB2cAi5gtxLQdHdwcb7bC4SHXbjB7EqIWNY651rX9BGo21ZnId3uMrTBb+aCrfssdIUxWwcjHLtTYvZWcluLRIyWdot0E8V8ULcXUHzIojLBnMU4O8qSEwKUGSouYLvfzGBcm3Q23xevHii8QnXCMEqYfcotD99UNYsxo" "yamObgaPl9gCRf1p6PihnMpHkb2A+GqhSO3JwQ+subdGwoIvklUK3TaFVMsOqdcqi03DH64wVoUIKIUBmGk3QDRS8lsv9d6xP2EczoIZp/HOT+IBE6n/GcQYj5wIa5DXFu9kfv8CwovBJdbuwhuVPqA7zDsxPUrNLhycpl5kt4tjamUgPkckhoj9DA/DB1W4IMvtNW4BlveVrtbF5SQOyj+ZWAz3QCkQFXUCAwEAAQ=="
;; AUTHORITY SECTION:
local.tld. 86400 IN NS local.tld.
;; ADDITIONAL SECTION:
local.tld. 86400 IN A 192.168.0.114
;; Query time: 0 msec
;; SERVER: 192.168.0.114#53(192.168.0.114)
;; WHEN: czw lis 30 08:46:30 CET 2023
;; MSG SIZE rcvd: 861Czy to może być spowodowane tym, że działam w domenie lokalnej, czy może to skopana konfiguracja? Mogę liczyć na pomoc?.
Pozdrawiam
Z filmikami na YT czy nawet przeglądanie Internetu już ciężko... to miałby być taki laptop na dobicie przez dziecko - pierwszy który "zajedzie" i do utylizacji. Druga opcja od razu do utylizacji i nie myśleć już nad uruchamianiem tak historycznego sprzętu...