配置支持https
复制一份证书到apache的目录
mkdir /usr/local/etc/apache22/certs/
cp /usr/local/etc/postfix/certs/*.pem /usr/local/etc/apache22/certs/
编辑文件/usr/local/etc/apache22/Includes/extmail-ssl.conf，内容如下
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache shmcb:/var/run/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLMutex file:/var/run/ssl_mutex
<VirtualHost _default_:443>
DocumentRoot "/usr/local/www/extmail/html"
ServerName mail.xxxxx.cn:443
ScriptAlias /extmail/cgi /usr/local/www/extmail/cgi/
Alias /extmail /usr/local/www/extmail/html/
ScriptAlias /extman/cgi "/usr/local/www/extman/cgi/"
Alias /extman "/usr/local/www/extman/html/"
ServerAdmin
ppabc@qq.com
ErrorLog /var/log/httpd-error.log
TransferLog /var/log/httpd-access.log
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
#SSLCertificateFile /usr/local/etc/apache22/server.crt
#SSLCertificateKeyFile /usr/local/etc/apache22/server.key
SSLCertificateFile /usr/local/etc/apache22/certs/mycert.pem
SSLCertificateKeyFile /usr/local/etc/apache22/certs/mykey.pem
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/usr/local/www/apache22/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog /var/log/httpd-ssl_request.log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
#SuexecUserGroup vmail vmail
</VirtualHost>
重起一下apache
/usr/local/etc/rc.d/apache22.sh restart
安装配置Extmail
Extmail 是一个以perl语言编写，面向大容量/ISP级应用，免费的高性能Webmail软件。完整的支持Maildir++, 多字符、多语言支持，支持模版技术、方便的为自己定制界面等等。
安装extmail
安装不需要选择MySQL，mysql，因为在安装ExtMan的时候已经把这些包装上了。
cd /usr/ports/mail/extmail && make install clean
安装不需要选择MySQL
复制一份配置文件
cp /usr/local/www/extmail/webmail.cf.default /usr/local/www/extmail/webmail.cf
编辑/usr/local/www/extmail/webmail.cf，修改对应的参数如下
SYS_CONFIG = /usr/local/www/extmail/
SYS_LANGDIR = /usr/local/www/extmail/lang
SYS_TEMPLDIR = /usr/local/www/extmail/html
SYS_SESS_DIR = /var/tmp/extmail/
SYS_LOG_TYPE = file
SYS_USER_LANG = zh_CN
SYS_USER_CHARSET = utf-8
SYS_AUTH_TYPE = mysql
SYS_MAILDIR_BASE = /home/domains
SYS_mysql_BASE = dc=xxxxx.cn
SYS_mysql_RDN = cn=Manager,dc=xxxxx.cn
SYS_mysql_PASS = secret
SYS_mysql_HOST = mysql.xxxxx.cn
SYS_mysql_ATTR_USERNAME = mail
SYS_mysql_ATTR_DOMAIN = virtualDomain
SYS_mysql_ATTR_PASSWD = userPassword
SYS_mysql_ATTR_QUOTA = mailQuota
SYS_mysql_ATTR_NDQUOTA = netdiskQuota
SYS_mysql_ATTR_HOME = homeDirectory
SYS_mysql_ATTR_MAILDIR = mailMessageStore
执行如下命令
mkdir /var/tmp/extmail
chown vmail:vmail /var/tmp/extmail/
chmod 777 /var/tmp/extmail
touch /var/log/extmail.log
chown vmail:vmail /var/log/extmail.log
chown -R vmail:vmail /usr/local/www/extmail/
配置ExtMan
ExtMan是一个基于Web的邮件帐号管理系统。可以通过他来管理邮件帐号、管理员帐号和域名等，默认的超级用户是
root@xxxxx.cn，密码是extmail*123* ExtMan还集成了mailgraph，可以ExtMan内看到整个邮件系统的相关状态流量图。使用ExtMan来管理您的邮件系统将使工作变得更加轻松。之前我们已经安装了ExtMan，在此直接配置webman.cf即可。
配置extman
编辑/usr/local/www/extman/webman.cf，修改对应的参数如下
SYS_CONFIG = /usr/local/www/extman/
SYS_LANGDIR = /usr/local/www/extman/lang
SYS_TEMPLDIR = /usr/local/www/extman/html
SYS_MAILDIR_BASE = /home/domains
SYS_SESS_DIR = /var/tmp/extman/
SYS_PSIZE = 50
SYS_LANG = zh_CN
SYS_DEFAULT_MAXQUOTA = 10000
SYS_DEFAULT_MAXALIAS = 10000
SYS_DEFAULT_MAXUSERS = 1000
SYS_DEFAULT_MAXNDQUOTA = 100
SYS_BACKEND_TYPE = mysql
SYS_mysql_BASE = dc=xxxxx.cn
SYS_mysql_RDN = cn=Manager,dc=xxxxx.cn
SYS_mysql_PASS = secret
SYS_mysql_HOST = localhost
SYS_mysql_ATTR_USERNAME = mail
SYS_mysql_ATTR_PASSWD = userPassword
其他设置
执行如下命令
mkdir /var/lib
mkdir /var/tmp/extman/
chown –R vmail:vmail /var/tmp/extman/
chmod 777 /var/tmp/extman/
chmod 755 /usr/local/www/extman/webman.cf
unlink /usr/local/www/extman/libs/HTML/KTemplate.pm
cp /usr/local/www/extmail/libs/HTML/KTemplate.pm /usr/local/www/extman/libs/HTML/
配置图形日志
安装依赖软件
cd /usr/ports/databases/rrdtool && make install clean
cd /usr/ports/devel/p5-File-Tail && make install clean
cd /usr/ports/devel/p5-Time-HiRes && make install clean
安装mailgraph_ext
cp -Rfp /usr/local/www/extman/addon/mailgraph_ext/ /usr/local/mailgraph_ext
/usr/local/mailgraph_ext/mailgraph-init start
/usr/local/mailgraph_ext/qmonitor-init start
测试基本系统
到目前为止，一个基本的邮件系统已经安装完成，他支持了smtp，pop3，imap，webmail。并且支持对应的SSL加密smtps，pop3s，imaps，https。
测试pop3
telnet localhost 110
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
+OK Hello there.
user
test@xxxxx.cn
+OK Password required.
pass test
+OK logged in.
list
+OK POP3 clients that break here, they violate STD53.
.
quit
+OK Bye-bye.
Connection closed by foreign host.
测试smtp认证
通过以下命令获得
test@xxxxx.cn的用户名及密码的BASE64编码：
perl -e 'use MIME::Base64; print encode_base64("test\@xxxxx.cn")'
dGVzdEBleHRtYWlsLm9yZw==
perl -e 'use MIME::Base64; print encode_base64("test")'
dGVzdA==
然后本机测试，其过程如下
telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
220 mail.xxxxx.cn ESMTP Postfix - by xxxxx.cn
ehlo demo.domain.tld
250-mail.xxxxx.cn
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
auth login
334 VXNlcm5hbWU6
dGVzdEBleHRtYWlsLm9yZw==
334 UGFzc3dvcmQ6
dGVzdA==
235 2.0.0 Authentication successful
quit
221 2.0.0 Bye
最后出现235 Authentication Successful 表明认证成功了。
测试smtps
mail# telnet localhost 25
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.localhostadmin.
Escape character is '^]'.
220 mail.xxxxx.cn ESMTP Postfix
ehlo localhost
250-mail.xxxxx.cn
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-STARTTLS
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
STARTTLS
220 2.0.0 Ready to start TLS
^]
telnet> q
Connection closed.
测试pop3s/imaps
telnet连接本机的993，995端口出现如下提示：
telnet localhost 993
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.localhostadmin.
Escape character is '^]'.
^]
telnet> q
Connection closed.
telnet localhost 995
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.localhostadmin.
Escape character is '^]'.
^]
telnet> q
Connection closed.
也可以在OutLook中如下设置进行测试
测试webmail/extman
你能通过如下链接登陆webmail
http://mail.xxxxx.cn
https://mail.xxxxx.cn
http://mail.xxxxx.cn/extman
https://mail.xxxxx.cn/extman
内容/病毒过虑
安装amavisd-new
amavisd-new是一个类似Mailscanner的解信的程序，他可以调用外部的杀毒/反垃圾来对邮件进行过滤，很方便的实现病毒过滤，内容过滤。amavisd和mailscanner的不同在于，他使用SMTP协议通信，处理完后再回传给Postfix，整个过程不会对Postfix造成任何结构上的影响。Mailscanner必须监视Postfix的Hold队列，采用比较暴力的做法。
cd /usr/ports/security/amavisd-new && make install clean
安装时选择 BDB MILTER SPAMASSASSIN FILE RAR UNRAR ARJ LHA ARC CAB RPM ZOO UNZOO LZOP FREEZE P7ZIP
修改/etc/rc.conf增加如下一行，系统启动时自动运行amavisd
amavisd_enable="YES"
配置amavisd.conf
修改/usr/local/etc/amavisd.conf文件中对应的选项，如下
$max_servers = 10;
$sa_spam_subject_tag = '[SPAM] ';
$mydomain = 'mail.xxxxx.cn';
$myhostname = 'mail.xxxxx.cn';
@local_domains_maps = qw(.);
$sa_tag_level_deflt = undef;
$sa_tag2_level_deflt = 5.0;
$sa_kill_level_deflt = 5.0;
$final_virus_destiny = D_DISCARD;
$final_banned_destiny = D_DISCARD;
$final_spam_destiny = D_DISCARD;
$virus_admin = "postmaster\@$mydomain";
$mailfrom_notify_admin = "postmaster\@$mydomain";
$mailfrom_notify_recip = "postmaster\@$mydomain";
$mailfrom_notify_spamadmin = "postmaster\@$mydomain";
@whitelist_sender_maps = read_hash("$MYHOME/white.lst");
@blacklist_sender_maps = read_hash("$MYHOME/black.lst");
$spam_quarantine_to = "spam\@$mydomain";
$virus_quarantine_to = "virus\@$mydomain";
$banned_quarantine_to = "spam\@$mydomain";
$hdrfrom_notify_admin = "Content Filter ";
执行如下操作
touch /var/amavis/white.txt
touch /var/amavis/black.txt
chown –R vscan:vscan /var/amavis/
配置postfix对amavisd-new的支持
修改/usr/local/etc/postfix/master.cf，增加如下内容
smtp-amavis unix - - n - 4 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o receive_override_options=
修改content_filter ,receive_override_options这两项，禁止地址展开/影射，否则遇到别名时会产生冗余邮件。但是打开这一项receive_override_options后会和邮件列表程序相冲突，导致邮件列表的aliases不能打开。
所以如果使用了邮件列表，则不要设置receive_override_options这一项。
/usr/local/sbin/postconf -e 'content_filter = smtp-amavis:[localhost]:10024'
/usr/local/sbin/postconf -e 'receive_override_options = no_address_mappings'
