Sendmail学习笔记

安装所需软件

安装步骤

要sendmail正常运行，还需配置几个文件，其中最重要的就是sendmail.cf 文件了。它在源码目录树下的cf/cf目录下有很多例子可参考。你可以拷贝使用。由于sendmail.cf中的语法很复杂，所以不建议手工修改。我们可以以sendmail.mc文档配合sendmail-cf目录下的宏通过m4预处理器自动生成。m4预处理器用来从一组宏文件中创建sendmail配置文件。宏文件作为输入被读进来。宏被展开，然后写到一个输出文件。sendmail-cf目录一般放在/usr/share目录下。其实sendmail-cf目录的内容和源码目录树下的cf目录的内容是一样的，所以，为了保证sendmail-cf目录的内容与安装版本同步，要把源码目录树下的cf目录的内容拷贝到/usr/share/sendmail-cf目录。

sendmail.mc配置文档内容如下：

divert(-1)
include(`/usr/share/sendmail-cf/m4/cf.m4')
VERSIONID(`linux setup for Red Hat Linux')dnl
OSTYPE(`linux')
dnl Uncomment and edit the following line if your mail needs to be sent out
dnl through an external mail server:
dnl define(`SMART_HOST',`smtp.your.provider')
define(`confDEF_USER_ID',``8:12'')dnl
undefine(`UUCP_RELAY')dnl
undefine(`BITNET_RELAY')dnl
dnl define(`confAUTO_REBUILD')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST',true)dnl
define(`confDONT_PROBE_INTERFACES',true)dnl
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/mail/aliases')dnl
define(`STATUS_FILE', `/etc/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl               
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 
LOGIN PLAIN')dnl
dnl define(`confCACERT_PATH',`/usr/share/ssl/certs')
dnl define(`confCACERT',`/usr/share/ssl/certs/ca-bundle.crt')
dnl define(`confSERVER_CERT',`/usr/share/ssl/certs/sendmail.pem')
dnl define(`confSERVER_KEY',`/usr/share/ssl/certs/sendmail.pem')
dnl define(`confTO_QUEUEWARN', `4h')dnl
dnl define(`confTO_QUEUERETURN', `5d')dnl
dnl define(`confQUEUE_LA', `12')dnl
dnl define(`confREFUSE_LA', `18')dnl
define(`confTO_IDENT', `0')dnl
dnl FEATURE(delay_checks)dnl
FEATURE(`no_default_msa',`dnl')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
dnl The '-t' option will retry delivery if e.g. the user runs over his quota.
FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db',`hash -T<TMPF> -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
dnl This changes sendmail to only listen on the loopback device 127.0.0.1
dnl and not on any other network devices. Comment this out if you want
dnl to accept email over the network.
DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA')
dnl NOTE: binding both IPv4 and IPv6 daemon to the same port requires
dnl       a kernel patch
dnl DAEMON_OPTIONS(`port=smtp,Addr=::1, Name=MTA-v6, Family=inet6')
dnl We strongly recommend to comment this one out if you want to protect
dnl yourself from spam. However, the laptop and users on computers that do
dnl not have 24x7 DNS do need this.
FEATURE(`accept_unresolvable_domains')dnl
dnl FEATURE(`relay_based_on_MX')dnl
MAILER(smtp)dnl
MAILER(procmail)dnl

记得要使以下两个条语句有效，它的意思是如果access.db访问控制没有设置，则启用以下验证方式进行smtp验证。

TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl               
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 
LOGIN PLAIN')dnl

sendmail宏定义说明

完成sendmail.mc文档的编写后就可以用m4程序生成正式的sendmail.cf配置文档。语法如下：

# m4 sendmail.mc > sendmail.cf

也可以用源码目录树下的cf/cf/Build命令生成。前提是你要在该目录下有一个sendmail.mc文档。语法如下：

# ./Build sendmail.cf 

接着就可以把sendmail.cf and submit.cf文档安装到/etc/mail目录中的，语法如下：

# ./Build install-cf

其实也可以自已用cp命令拷贝的啦。记得把sendmail.mc文档也拷贝一份到/etc/mail目录，以便以后修改配置时可重新生成sendmail.cf文档。ok,接着到/etc/mail目录下配置一些文档。

debian:~# cd /etc/mail 
debian:/etc/mail# echo 'examply.com' >> local-host-names 接收邮件的主机名
debian:/etc/mail# echo 'localhost    RELAY'  >> access 用来拒绝或允许来自某个域的邮件，本例允许本地转发。
debian:/etc/mail# makemap hash access < access 生成access.db数据库
debian:/etc/mail# touch domaintable 用来把旧域名映射互新域名
debian:/etc/mail# makemap hash domaintable < domaintable 
debian:/etc/mail# touch mailertable 来覆盖向指定域的路由
debian:/etc/mail# makemap hash mailertable < mailertable 
debian:/etc/mail# touch trusted-users 
debian:/etc/mail# touch virtusertable 用来把用户和域名映射到其它地址
debian:/etc/mail# makemap hash virtusertable < virtusertable 
debian:/etc/mail# chown root:wheel /var/spool/mqueue/ 
debian:/etc/mail# chmod 700 /var/spool/mqueue 
debian:/etc/mail# touch aliases 别名数据库，文本形式。可参照源码目录树下sendmail/aliases文件。
debian:/etc/mail# newaliases                  从文本文件中创建一个新的别名数据库文件。
debian:/etc/mail# sendmail -v -bi调试启动。
/etc/mail/aliases: 42 aliases, longest 10 bytes, 432 bytes total
如果出现以上提示信息，则启动成功。可用以下命令正式启动:
debian:/etc/mail# sendmail -bd -q30m
该命令以后台进程方式（-bd）运行，并使其每隔30分钟（-q30m）轮询一次未发送邮件队列，检查是否有新邮件。

服务器启动后，可以用telnet连接服务器。

debian:~# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 test.tigerhead ESMTP Sendmail 8.12.10/8.12.10; Tue, 30 Mar 2004 14:50:14 +0800
ehlo test你输入的命令，按回车结束。
250-test.tigerhead Hello LOCALHOST.localdomain [127.0.0.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
250-DELIVERBY
250 HELP
以250-开头的为服务器的响应信息。注意倒数第三行，这就是成功配置smtp验证的显示。
输入quit离开。

安装完成后为确保系统安全,还需调整一些目录的权限。可参考sendmail源码目录下sendmail/SECURITY文档。

# chmod 0640 /etc/mail/aliases /etc/mail/aliases.{db,pag,dir}
# chmod 0640 /etc/mail/*.{db,pag,dir}
# chmod 0640 /etc/mail/statistics /var/log/sendmail.st
# chmod 0600 /var/run/sendmail.pid /etc/mail/sendmail.pid
-r-xr-sr-xroot   smmsp... /PATH/TO/sendmail
drwxrwx---smmsp  smmsp... /var/spool/clientmqueue
drwx------root   wheel... /var/spool/mqueue
-r--r--r--root   wheel... /etc/mail/sendmail.cf
-r--r--r--root   wheel... /etc/mail/submit.cf