1
Linux 討論版 / Re: dns備援伺服器的設定
« 於: 2019-07-08 15:55 »
你去slave端，檢查/var/named/slaves/底下有沒有跟master一樣的zone_file，有的話就是同步成功了。
顯示文章
這裡允許您檢視這個會員的所有文章。請注意, 您只能看見您有權限閱讀的文章。
頁: [1]
2
Linux 討論版 / Re: 關於dns反解問題
« 於: 2019-06-27 10:36 »
Dear twu2,
誠如大大說的，我剛試了真是如此，如果zone是設成"192.in-addr.arpa"，zone_file的record只要是x.x.非168，就都可以解析，
但如果zone設成我需要的"172.in-addr.arpa"，zone_file的record不管改成怎樣的數字，都無法解析，
所以，綜合兩位大大的說法，"似乎是bind的限制，不允許超過一個小數點的PTR_record，所有private_ip的網段在bind裡面都有特別處理"，
感謝兩位大大們的協助測試。
誠如大大說的，我剛試了真是如此，如果zone是設成"192.in-addr.arpa"，zone_file的record只要是x.x.非168，就都可以解析，
但如果zone設成我需要的"172.in-addr.arpa"，zone_file的record不管改成怎樣的數字，都無法解析，
所以，綜合兩位大大的說法，"似乎是bind的限制，不允許超過一個小數點的PTR_record，所有private_ip的網段在bind裡面都有特別處理"，
感謝兩位大大們的協助測試。
4
Linux 討論版 / Re: 關於dns反解問題
« 於: 2019-06-26 10:09 »
Dear Netman,
將zone_file移位置後，就query不到ns以及soa的東西了，log如下：
=======================================================
[root@test-dns01 named]# vim /etc/named.conf
view "wan" {
match-clients {
localhost;
192.168.10.0/24;
};
zone "." IN {
type hint;
file "named.ca";
};
zone "mytwcc.ai" IN {
type master;
file "twcc.wan";
allow-transfer { 192.168.10.238; };
};
zone "192.in-addr.arpa" IN {
type master;
file "twcc.wan.192";
allow-transfer { 192.168.10.238; };
};
};
=======================================================
[root@test-dns01 named]# tail /var/log/messages
Jun 26 08:53:45 test-dns01 named[15228]: command channel listening on 127.0.0.1#953
Jun 26 08:53:45 test-dns01 named[15228]: command channel listening on ::1#953
Jun 26 08:53:45 test-dns01 named[15228]: managed-keys-zone/wan: loaded serial 0
Jun 26 08:53:45 test-dns01 named[15228]: zone mytwcc.ai/IN/wan: loaded serial 2019062501
Jun 26 08:53:45 test-dns01 named[15228]: zone 192.in-addr.arpa/IN/wan: loaded serial 20190624
Jun 26 08:53:45 test-dns01 named[15228]: all zones loaded
Jun 26 08:53:45 test-dns01 named[15228]: running
Jun 26 08:53:45 test-dns01 named[15228]: zone mytwcc.ai/IN/wan: sending notifies (serial 2019062501)
Jun 26 08:53:45 test-dns01 named[15228]: zone 192.in-addr.arpa/IN/wan: sending notifies (serial 20190624)
Jun 26 08:53:45 test-dns01 systemd: Started Berkeley Internet Name Domain (DNS).
=======================================================
[root@test-dns01 named]# mkdir tmp; mv twcc.wan.192 tmp/
=======================================================
[root@test-dns01 named]# systemctl restart named
Job for named.service failed because the control process exited with error code. See "systemctl status named.service" and "journalctl -xe" for details.
=======================================================
[root@test-dns01 named]# journalctl -xe
Jun 26 08:58:13 test-dns01 bash[15267]: zone mytwcc.ai/IN: loaded serial 2019062501
Jun 26 08:58:13 test-dns01 bash[15267]: zone 192.in-addr.arpa/IN: loading from master file twcc.wan.192 failed: file not found
Jun 26 08:58:13 test-dns01 bash[15267]: zone 192.in-addr.arpa/IN: not loaded due to errors.
Jun 26 08:58:13 test-dns01 bash[15267]: wan/192.in-addr.arpa/IN: file not found
Jun 26 08:58:13 test-dns01 systemd[1]: named.service: control process exited, code=exited status=1
Jun 26 08:58:13 test-dns01 systemd[1]: Failed to start Berkeley Internet Name Domain (DNS).
=======================================================
[root@test-dns01 named]# dig -t soa test-dns01.mytwcc.ai
; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> -t soa test-dns01.mytwcc.ai
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2229
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;test-dns01.mytwcc.ai. IN SOA
;; AUTHORITY SECTION:
ai. 8101 IN SOA pch.whois.ai. vince.offshore.ai. 2019062517 21600 3600 86400 86400
;; Query time: 3 msec
;; SERVER: 140.110.16.1#53(140.110.16.1)
;; WHEN: Wed Jun 26 09:52:50 CST 2019
;; MSG SIZE rcvd: 110
=======================================================
[root@test-dns01 named]# dig mytwcc.ai ns
; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> mytwcc.ai ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 47907
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mytwcc.ai. IN NS
;; AUTHORITY SECTION:
ai. 7205 IN SOA pch.whois.ai. vince.offshore.ai. 2019062517 21600 3600 86400 86400
;; Query time: 1 msec
;; SERVER: 140.110.16.1#53(140.110.16.1)
;; WHEN: Wed Jun 26 09:58:52 CST 2019
;; MSG SIZE rcvd: 99
=======================================================
將zone_file移位置後，就query不到ns以及soa的東西了，log如下：
=======================================================
[root@test-dns01 named]# vim /etc/named.conf
view "wan" {
match-clients {
localhost;
192.168.10.0/24;
};
zone "." IN {
type hint;
file "named.ca";
};
zone "mytwcc.ai" IN {
type master;
file "twcc.wan";
allow-transfer { 192.168.10.238; };
};
zone "192.in-addr.arpa" IN {
type master;
file "twcc.wan.192";
allow-transfer { 192.168.10.238; };
};
};
=======================================================
[root@test-dns01 named]# tail /var/log/messages
Jun 26 08:53:45 test-dns01 named[15228]: command channel listening on 127.0.0.1#953
Jun 26 08:53:45 test-dns01 named[15228]: command channel listening on ::1#953
Jun 26 08:53:45 test-dns01 named[15228]: managed-keys-zone/wan: loaded serial 0
Jun 26 08:53:45 test-dns01 named[15228]: zone mytwcc.ai/IN/wan: loaded serial 2019062501
Jun 26 08:53:45 test-dns01 named[15228]: zone 192.in-addr.arpa/IN/wan: loaded serial 20190624
Jun 26 08:53:45 test-dns01 named[15228]: all zones loaded
Jun 26 08:53:45 test-dns01 named[15228]: running
Jun 26 08:53:45 test-dns01 named[15228]: zone mytwcc.ai/IN/wan: sending notifies (serial 2019062501)
Jun 26 08:53:45 test-dns01 named[15228]: zone 192.in-addr.arpa/IN/wan: sending notifies (serial 20190624)
Jun 26 08:53:45 test-dns01 systemd: Started Berkeley Internet Name Domain (DNS).
=======================================================
[root@test-dns01 named]# mkdir tmp; mv twcc.wan.192 tmp/
=======================================================
[root@test-dns01 named]# systemctl restart named
Job for named.service failed because the control process exited with error code. See "systemctl status named.service" and "journalctl -xe" for details.
=======================================================
[root@test-dns01 named]# journalctl -xe
Jun 26 08:58:13 test-dns01 bash[15267]: zone mytwcc.ai/IN: loaded serial 2019062501
Jun 26 08:58:13 test-dns01 bash[15267]: zone 192.in-addr.arpa/IN: loading from master file twcc.wan.192 failed: file not found
Jun 26 08:58:13 test-dns01 bash[15267]: zone 192.in-addr.arpa/IN: not loaded due to errors.
Jun 26 08:58:13 test-dns01 bash[15267]: wan/192.in-addr.arpa/IN: file not found
Jun 26 08:58:13 test-dns01 systemd[1]: named.service: control process exited, code=exited status=1
Jun 26 08:58:13 test-dns01 systemd[1]: Failed to start Berkeley Internet Name Domain (DNS).
=======================================================
[root@test-dns01 named]# dig -t soa test-dns01.mytwcc.ai
; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> -t soa test-dns01.mytwcc.ai
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2229
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;test-dns01.mytwcc.ai. IN SOA
;; AUTHORITY SECTION:
ai. 8101 IN SOA pch.whois.ai. vince.offshore.ai. 2019062517 21600 3600 86400 86400
;; Query time: 3 msec
;; SERVER: 140.110.16.1#53(140.110.16.1)
;; WHEN: Wed Jun 26 09:52:50 CST 2019
;; MSG SIZE rcvd: 110
=======================================================
[root@test-dns01 named]# dig mytwcc.ai ns
; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> mytwcc.ai ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 47907
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mytwcc.ai. IN NS
;; AUTHORITY SECTION:
ai. 7205 IN SOA pch.whois.ai. vince.offshore.ai. 2019062517 21600 3600 86400 86400
;; Query time: 1 msec
;; SERVER: 140.110.16.1#53(140.110.16.1)
;; WHEN: Wed Jun 26 09:58:52 CST 2019
;; MSG SIZE rcvd: 99
=======================================================
5
Linux 討論版 / Re: 關於dns反解問題
« 於: 2019-06-24 21:06 »
Dear Netman,
您說對點了，這就是我不解的地方，log顯示載入的zone是正確的，但SOA就是錯的，而且不是我設定的SOA，好怪。
我今天實驗把zone改成"168.192.in-addr.arpa"，zone file的record改成"234.10 IN PTR test-ldap.mytwcc.ai."，這樣就可以正常反解，我就更加不懂了，難道是bind的天生限制嗎?
您說對點了，這就是我不解的地方，log顯示載入的zone是正確的，但SOA就是錯的，而且不是我設定的SOA，好怪。
我今天實驗把zone改成"168.192.in-addr.arpa"，zone file的record改成"234.10 IN PTR test-ldap.mytwcc.ai."，這樣就可以正常反解，我就更加不懂了，難道是bind的天生限制嗎?
6
Linux 討論版 / Re: 關於dns反解問題
« 於: 2019-06-23 22:16 »
Dear Netman,
我照您的教法去vm開了虛擬機測試，但還是解析不到，請問我是有哪邊設錯嗎？
以下是我的設定檔以及測試結果：
=================================================================
[root@test-dns01 named]# vim /etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.10.0/24; };
forwarders {
8.8.8.8;
140.110.16.1;
};
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
view "wan" {
match-clients {
localhost;
192.168.10.0/24;
};
zone "." IN {
type hint;
file "named.ca";
};
zone "mytwcc.ai" IN {
type master;
file "twcc.wan";
allow-transfer { 192.168.10.238; };
};
zone "192.in-addr.arpa" IN {
type master;
file "twcc.wan.192";
allow-transfer { 192.168.10.238; };
};
};
=================================================================
[root@test-dns01 named]# vim twcc.wan.192
$TTL 86400
@ IN SOA test-dns01.mytwcc.ai. root.mytwcc.ai. (
2019050109 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
@ IN NS test-dns01.mytwcc.ai.
@ IN NS slave.mytwcc.ai.
235.10.168 IN PTR test-dns01.mytwcc.ai.
238.10.168 IN PTR slave.mytwcc.ai.
@ IN MX 10 testsmtp.mytwcc.ai.
234.10.168 IN PTR test-ldap.mytwcc.ai.
235.10.168 IN PTR test-dns01.mytwcc.ai.
236.10.168 IN PTR test-smtp.mytwcc.ai.
236.10.168 IN PTR testsmtp.mytwcc.ai.
237.10.168 IN PTR test-prometheus.mytwcc.ai.
238.10.168 IN PTR test-dns02.mytwcc.ai.
=================================================================
[root@test-dns01 named]# dig -x 192.168.10.236
; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> -x 192.168.10.236
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 30046
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;236.10.168.192.in-addr.arpa. IN PTR
;; AUTHORITY SECTION:
168.192.in-addr.arpa. 86400 IN SOA 168.192.in-addr.arpa. . 0 28800 7200 604800 86400
;; Query time: 1 msec
;; SERVER: 192.168.10.235#53(192.168.10.235)
;; WHEN: Sun Jun 23 22:14:28 CST 2019
;; MSG SIZE rcvd: 91
我照您的教法去vm開了虛擬機測試，但還是解析不到，請問我是有哪邊設錯嗎？
以下是我的設定檔以及測試結果：
=================================================================
[root@test-dns01 named]# vim /etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.10.0/24; };
forwarders {
8.8.8.8;
140.110.16.1;
};
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
view "wan" {
match-clients {
localhost;
192.168.10.0/24;
};
zone "." IN {
type hint;
file "named.ca";
};
zone "mytwcc.ai" IN {
type master;
file "twcc.wan";
allow-transfer { 192.168.10.238; };
};
zone "192.in-addr.arpa" IN {
type master;
file "twcc.wan.192";
allow-transfer { 192.168.10.238; };
};
};
=================================================================
[root@test-dns01 named]# vim twcc.wan.192
$TTL 86400
@ IN SOA test-dns01.mytwcc.ai. root.mytwcc.ai. (
2019050109 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
@ IN NS test-dns01.mytwcc.ai.
@ IN NS slave.mytwcc.ai.
235.10.168 IN PTR test-dns01.mytwcc.ai.
238.10.168 IN PTR slave.mytwcc.ai.
@ IN MX 10 testsmtp.mytwcc.ai.
234.10.168 IN PTR test-ldap.mytwcc.ai.
235.10.168 IN PTR test-dns01.mytwcc.ai.
236.10.168 IN PTR test-smtp.mytwcc.ai.
236.10.168 IN PTR testsmtp.mytwcc.ai.
237.10.168 IN PTR test-prometheus.mytwcc.ai.
238.10.168 IN PTR test-dns02.mytwcc.ai.
=================================================================
[root@test-dns01 named]# dig -x 192.168.10.236
; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> -x 192.168.10.236
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 30046
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;236.10.168.192.in-addr.arpa. IN PTR
;; AUTHORITY SECTION:
168.192.in-addr.arpa. 86400 IN SOA 168.192.in-addr.arpa. . 0 28800 7200 604800 86400
;; Query time: 1 msec
;; SERVER: 192.168.10.235#53(192.168.10.235)
;; WHEN: Sun Jun 23 22:14:28 CST 2019
;; MSG SIZE rcvd: 91
7
請教各位大大們,
日前在設定dns反解時發現一個疑問，
我的dns正解裡有多筆record，例如：172.17.79.161、172.19.49.1、172.16.48.1、172.18.64.8、172.18.196.10等不同submask的IP，數量超過300筆，
在設定反解zone名稱時，我設為"172.in-addr.arpa"，可是用dig指令去隨便反解一筆record，發現無"ANSWER SECTION"，且"AUTHORITY SECTION"指向的zone名稱並非我設定的"172.in-addr.arpa"，
請問反解的zone不能指定一個大class嗎？
日前在設定dns反解時發現一個疑問，
我的dns正解裡有多筆record，例如：172.17.79.161、172.19.49.1、172.16.48.1、172.18.64.8、172.18.196.10等不同submask的IP，數量超過300筆，
在設定反解zone名稱時，我設為"172.in-addr.arpa"，可是用dig指令去隨便反解一筆record，發現無"ANSWER SECTION"，且"AUTHORITY SECTION"指向的zone名稱並非我設定的"172.in-addr.arpa"，
請問反解的zone不能指定一個大class嗎？
9
Linux 討論版 / smtp with sasl & ssl/tls
« 於: 2019-05-12 10:53 »
請教各位大大，因工作需求，smtp需有SASL驗證以及ss/tls加密，於VM環境將一切設定搞妥之後，先用telnet試試有無問題：
--------------------------------------------------
[root@test-smtp postfix]# telnet localhost 25
Trying ::1...
Connected to localhost.
Escape character is '^]'.
220 smtp1.twcc.ai ESMTP
ehlo localhost
250-smtp1.twcc.ai
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
starttls
220 2.0.0 Ready to start TLS
quit
quit
Connection closed by foreign host.
--------------------------------------------------
結果顯示都是OK的，但如果此時看maillog，會出現error訊息，此訊息會導致465 port無作用：
--------------------------------------------------
May 12 10:44:10 test-smtp postfix/smtpd[17030]: connect from localhost[::1]
May 12 10:44:21 test-smtp postfix/smtpd[17030]: SSL_accept error from localhost[::1]: -1
May 12 10:44:21 test-smtp postfix/smtpd[17030]: warning: TLS library problem: 17030:error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:640:
May 12 10:44:21 test-smtp postfix/smtpd[17030]: lost connection after STARTTLS from localhost[::1]
May 12 10:44:21 test-smtp postfix/smtpd[17030]: disconnect from localhost[::1]
--------------------------------------------------
請問有人遇過這種問題嗎，能否給小弟建議呢，感謝。
我的main.cf：
--------------------------------------------------
[root@test-smtp ~]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mydomain = twcc.ai
myhostname = smtp1.twcc.ai
mynetworks = 192.168.10.0/24, 127.0.0.0/8
mynetworks_style = subnet
myorigin = $myhostname
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
relay_domains = $mydestination
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
smtp_tls_note_starttls_offer = yes
smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, reject_rbl_client cblless.anti-spam.org.cn, reject_rbl_client sbl-xbl.spamhaus.org, check_policy_service unix:/var/spool/postfix/postgrey/socket
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_CAfile = /etc/postfix/rootca.crt
smtpd_tls_cert_file = /etc/postfix/smtp1.twcc.ai.crt
smtpd_tls_key_file = /etc/postfix/smtp1.twcc.ai.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
--------------------------------------------------
我的master.cf僅修改一小部分：
--------------------------------------------------
smtps inet n - n - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
--------------------------------------------------
firewall及selinux已關閉。
--------------------------------------------------
[root@test-smtp postfix]# telnet localhost 25
Trying ::1...
Connected to localhost.
Escape character is '^]'.
220 smtp1.twcc.ai ESMTP
ehlo localhost
250-smtp1.twcc.ai
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
starttls
220 2.0.0 Ready to start TLS
quit
quit
Connection closed by foreign host.
--------------------------------------------------
結果顯示都是OK的，但如果此時看maillog，會出現error訊息，此訊息會導致465 port無作用：
--------------------------------------------------
May 12 10:44:10 test-smtp postfix/smtpd[17030]: connect from localhost[::1]
May 12 10:44:21 test-smtp postfix/smtpd[17030]: SSL_accept error from localhost[::1]: -1
May 12 10:44:21 test-smtp postfix/smtpd[17030]: warning: TLS library problem: 17030:error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:640:
May 12 10:44:21 test-smtp postfix/smtpd[17030]: lost connection after STARTTLS from localhost[::1]
May 12 10:44:21 test-smtp postfix/smtpd[17030]: disconnect from localhost[::1]
--------------------------------------------------
請問有人遇過這種問題嗎，能否給小弟建議呢，感謝。
我的main.cf：
--------------------------------------------------
[root@test-smtp ~]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mydomain = twcc.ai
myhostname = smtp1.twcc.ai
mynetworks = 192.168.10.0/24, 127.0.0.0/8
mynetworks_style = subnet
myorigin = $myhostname
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
relay_domains = $mydestination
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
smtp_tls_note_starttls_offer = yes
smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, reject_rbl_client cblless.anti-spam.org.cn, reject_rbl_client sbl-xbl.spamhaus.org, check_policy_service unix:/var/spool/postfix/postgrey/socket
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_CAfile = /etc/postfix/rootca.crt
smtpd_tls_cert_file = /etc/postfix/smtp1.twcc.ai.crt
smtpd_tls_key_file = /etc/postfix/smtp1.twcc.ai.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
--------------------------------------------------
我的master.cf僅修改一小部分：
--------------------------------------------------
smtps inet n - n - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
--------------------------------------------------
firewall及selinux已關閉。
頁: [1]