安裝

dovecot

1. cd /usr/ports/mail/dovecot
2. make config

   [X] KQUEUE    kqueue(2) support
   [X] SSL       SSL support
   [X] IPV6      IPv6 support
   [X] POP3      POP3 support
   [X] LDA       LDA support
   [ ] GSSAPI    GSSAPI support
   [ ] VPOPMAIL  VPopMail support
   [ ] LDAP      OpenLDAP support
   [X] PGSQL     PostgreSQL support
   [ ] MYSQL     MySQL support
   [ ] SQLITE    SQLite support
   

3. make install clean

安裝 Postfix

1. /usr/ports/mail/postfix
2. make config

   [X] PCRE      Perl Compatible Regular Expressions
   [ ] SASL2     Cyrus SASLv2 (Simple Auth. and Sec. Layer)
   [X] DOVECOT   Dovecot SASL authentication method
   [ ] SASLKRB   If your SASL req. Kerberos select this option
   [ ] SASLKRB5  If your SASL req. Kerberos5 select this option
   [ ] SASLKMIT  If your SASL req. MIT Kerberos5 select this option
   [X] TLS       Enable SSL and TLS support
   [X] BDB       Berkeley DB (choose version with WITH_BDB_VER)
   [ ] MYSQL     MySQL maps (choose version with WITH_MYSQL_VER)
   [X] PGSQL     PostgreSQL maps (choose with DEFAULT_PGSQL_VER)
   [ ] OPENLDAP  OpenLDAP maps (choose ver. with WITH_OPENLDAP_VER)
   [X] CDB       CDB maps lookups
   [ ] NIS       NIS maps lookups
   [X] VDA       VDA (Virtual Delivery Agent)
   [ ] TEST      SMTP/LMTP test server and generator
   

3. make install clean

設定

Dovecot

1. 建立 Cert/Key File
   1. 編輯 /usr/local/share/dovecot/dovecot-openssl.cnf

      [ req ]
      default_bits = 1024
      encrypt_key = yes
      distinguished_name = req_dn
      x509_extensions = cert_type
      prompt = no
      
      [ req_dn ]
      # country (2 letter code)
      C=TW
      
      # State or Province Name (full name)
      ST=Taiwan
      
      # Locality Name (eg. city)
      L=Taipei
      
      # Organization (eg. company)
      O=D-Life
      
      # Organizational Unit Name (eg. section)
      OU=IMAP server
      
      # Common Name (*.example.com is also possible)
      CN=[hostname]
      
      # E-mail contact
      emailAddress=postmaster@[hostname]
      
      [ cert_type ]
      nsCertType = server
      

   2. 修改 keygen script

      SSLDIR=/usr/local/etc/dovecot/
      OPENSSLCONFIG=/usr/local/share/dovecot/dovecot-openssl.cnf
      OPENSSL=/usr/local/bin/openssl
      

   3. 產生 Keys

      /usr/local/share/dovecot/mkcert.sh
      

   4. 更改檔案目錄讀取權限

      chmod og-rwx /usr/local/etc/dovecot/* /usr/local/etc/dovecot
      

2. 設定檔：/usr/local/etc/dovecot.conf

   ## Dovecot configuration file
   
   base_dir=/var/run/dovecot
   listen=127.0.0.1
   disable_plaintext_auth = no
   mail_location = maildir:~/Maildir
   pop3_uidl_format=%08Xu%08Xv
   
   log_path = /var/log/dovecot/error.log
   info_log_path = /var/log/dovecot/info.log
   log_timestamp = "%b %d %H:%M:%S "
   #syslog_facility = mail
   
   auth default {
     mechanisms = PLAIN LOGIN
   
     auth_cache_size = 1024
     passdb pam {
       args = cache_key=%u%r%l session=yes dovecot
     }
     socket listen {
       client {
         path = /var/spool/postfix/private/auth
         mode = 0660
         user = postfix
         group = postfix
       }
     }
   }
   
   # 與 IMAP/POP3 相關設定
   ssl_disable = no
   protocols = imap imaps pop3 pop3s
   
   ssl_cert_file = /usr/local/etc/dovecot/certs/dovecot.pem
   ssl_key_file = /usr/local/etc/dovecot/private/dovecot.pem
   

Postfix

1. 檔案: /usr/local/etc/postfix/main.cf
2. 設定支援的 SASL 套件，採用 dovecot

   smtpd_sasl_type = dovecot
   

3. 設定與 dovecot 認證通連的 unix socket

   # Can be an absolute path, or relative to $queue_directory
   smtpd_sasl_path = private/auth
   

4. 設定啟用 SASL

   # and the common settings to enable SASL:
   smtpd_sasl_auth_enable = yes
   

5. 在收信確認的時候，加上通過 SASL 驗證的可以收信，並禁止未通過認證的人發信

   smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
   

啟動設定

Dovecot

1. 設定檔為： /etc/rc.conf

   # Dovecot
   dovecot_enable="YES"
   

2. 啟動程序

   /usr/local/etc/rc.d/dovecot start
   

Postfix

1. 設定檔為： /etc/rc.conf

   sendmail_enable="NO"
   sendmail_submit_enable="NO"
   sendmail_outbound_enable="NO"
   sendmail_msp_queue_enable="NO"
   
   postfix_enable="YES"
   

2. 啟動程序

   /usr/local/etc/rc.d/postfix start
   

驗證測試

1. 產生 PLAIN 認證要用到的驗證字串

   perl -MMIME::Base64 -e 'print encode_base64("\0使用者帳號\0密碼");'
   

2. 驗證程序
   1. 連線到 SMTP port 25

      telnet localhost 25
      Trying ::1...
      Trying 127.0.0.1...
      Connected to localhost.
      Escape character is '^]'.
      220 cbs.ntu.edu.tw ESMTP Postfix
      

   2. 檢視是否有支援 PLAIN 的 AUTH 認證機制，有出現 250-AUTH PLAIN 即表示有支援

      ehlo localhost
      250-localhost
      250-PIPELINING
      250-SIZE 10240000
      250-ETRN
      250-AUTH PLAIN LOGIN
      250-ENHANCEDSTATUSCODES
      250-8BITMIME
      250 DSN
      

   3. 輸入驗證字串，如果出現 235 2.7.0 即表示成功，若出現 535 5.7.8 表示驗證失敗。最好是成功和失敗的狀況都要確認一下。

      AUTH PLAIN [剛才利用 perl 指令所產生的字串]
      

      1. 驗證成功結果

         235 2.7.0 Authentication successful 
         

      2. 驗證失敗結果

         535 5.7.8 Error: authentication failed:
         

   4. 結束程序

      quit
      221 2.0.0 Bye