yum install dhcp -y
拷貝模板檔案到/etc/下
cp /usr/share/doc/dhcp-3.0.5/dhcpd.conf.sample /etc/dhcpd.conf
ddns-update-style interim;
ignore client-updates;
subnet 10.1.1.0 netmask 255.255.255.0 {
option routers 10.1.1.1;
option subnet-mask 255.255.255.0;
option nis-domain "cluster.com";
option domain-name "upl.com";
option domain-name-servers 10.1.1.1;
option time-offset -18000; # Eastern Standard Time
range dynamic-bootp 10.1.1.88 10.1.1.88;
default-lease-time 21600;
max-lease-time 43200;
# we want the nameserver to appear at a fixed address
host boss {
hardware ethernet 00:27:19:96:19:B5;
fixed-address 10.1.1.88;
}
host sb {
hardware ethernet 00:27:19:96:19:B5;
fixed-address 10.1.1.244;
}
}
service dhcpd restart
用戶端動態擷取IP
dhclient eth0
===================================================
Sendmail
協議：tcp/smtp
連接埠：25
軟體：
sendmail.i386
sendmail-cf.i386
sendmail-devel.i386
sendmail-doc.i386
m4.i386
dovecot <---MDA
promail <---負責把郵件分發到本地不同的帳號
# yum install sendmail* m4 procmail dovecot -y
配置目錄 /etc/mail/
sendmail.cf
sendmail.mc
access
virtusertable
local-host-names
/etc/aliases
準備：
主機名稱FQDN
時間同步
關閉selinux，iptables
在DNS上設定正確的MX記錄
@ IN NS squid.upl.com.
squid IN A 10.1.1.21
@ IN MX 0 mail.upl.com.
mail IN CNAME squid
驗證MX記錄的正確性
[root@dns 06]# nslookup
> set type=mx
> upl.com
Server: 10.1.1.21
Address: 10.1.1.21#53
upl.com mail exchanger = 0 mail.upl.com.
例子1：直接啟動，驗證伺服器工作正常
# netstat -ntlp | grep :25
[root@squid mail]# telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 11:06:59 +0800
helo ddddd
250 squid.upl.com Hello localhost.localdomain [127.0.0.1], pleased to meet you
mail from:10000@qq.com
250 2.1.0 10000@qq.com... Sender ok
rcpt to:tom@squid.upl.com
250 2.1.5 tom@squid.upl.com... Recipient ok
data
354 Enter mail, end with "." on a line by itself
wel to upl
.
250 2.0.0 o6N36x3O004704 Message accepted for delivery
quit
221 2.0.0 squid.upl.com closing connection
Connection closed by foreign host.
查看郵件
cat /var/mail/tom
例子2：允許本網串連上來發送郵件
# vim sendmail.mc
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
修改為
DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA')dnl
# m4 sendmail.mc > sendmail.cf
# netstat -ntlp | grep :25
使用別的機器串連上來測試
# telnet 10.1.1.21 25
例子3：讓郵件伺服器支援短網域名稱 ，支援 xxx@upl.com
# vim local-host-names
upl.com
squid.upl.com
測試
rcpt to:tom@upl.com
250 2.1.5 tom@upl.com... Recipient ok
例子4：郵件暱稱，群發等
# vim /etc/aliases
it: tom,bean 群發
mary: tom 轉寄
# newaliases
測試
# cat /etc/fstab | mail -s "group mail" it@upl.com
# mail -s "group mail" it@upl.com < /etc/inittab
# cat /etc/hosts | sendmail -v mary@upl.com
例子5：支援發送外部郵件
必須開啟中繼功能： 把郵件發送到外部網路（MTA綁定的網域名稱跟收件者的網域名稱不一樣）
[root@dns 06]# telnet 10.1.1.21 25
Trying 10.1.1.21...
Connected to squid.upl.com (10.1.1.21).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 13:49:12 +0800
mail from:10000@qq.com
250 2.1.0 10000@qq.com... Sender ok
rcpt to:l.t.b@126.com
550 5.7.1 l.t.b@126.com... Relaying denied
中繼拒絕：預設是不允許其他IP登入郵件伺服器發送外部郵件
實現允許內部某個網段發送外部郵件
# vim /etc/mail/access
Connect:10.1.1.19 REJCET
Connect:10.1.1 RELAY
TO:qq.com REJECT
FROM:gmail.com REJECT
# makemap hash /etc/mail/access.db < /etc/mail/access
[root@dns 06]# telnet 10.1.1.21 25
Trying 10.1.1.21...
Connected to squid.upl.com (10.1.1.21).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 13:56:51 +0800
mail from:10000@gmail.com
550 5.7.1 10000@gmail.com... Access denied
mail from:admin@qq.com
250 2.1.0 admin@qq.com... Sender ok
rcpt to:10000@qq.com
550 5.2.1 10000@qq.com... Mailbox disabled for this recipient
rcpt to:l.t.b@126.com
250 2.1.5 l.t.b@126.com... Recipient ok
data
354 Enter mail, end with "." on a line by itself
just for test
.
250 2.0.0 o6N5up32005376 Message accepted for delivery
quit
221 2.0.0 squid.upl.com closing connection
Connection closed by foreign host.
例子6：支援smtp驗證
發送郵件必須驗證帳號和密碼
只要伺服器開啟了smtp驗證之後，access就會被忽略
# vim sendmail.mc
搜尋MD5
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
搜尋submission
DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl
# m4 sendmail.mc > sendmail.cf
確定是否支援驗證
[root@dns 06]# telnet 10.1.1.21 25
Trying 10.1.1.21...
Connected to squid.upl.com (10.1.1.21).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 14:05:30 +0800
ehlo squid.upl.com 《－－－－
250-squid.upl.com Hello dns.upl.com [10.1.1.20], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH LOGIN PLAIN 《－－－－
250-DELIVERBY
250 HELP
2、把驗證需要的軟體包都安裝
# yum install cyrus-* -y
3、重啟所有相關的服務
service sendmail restart
service saslauthd restart
測試
[root@dns 06]# telnet 10.1.1.21 25
Trying 10.1.1.21...
Connected to squid.upl.com (10.1.1.21).
Escape character is '^]'.
220 squid.upl.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 23 Jul 2010 14:12:30 +0800
auth login
334 VXNlcm5hbWU6
dG9t 《－－－編碼之後的使用者名稱
334 UGFzc3dvcmQ6
MTIz 《－－－編碼之後的密碼
235 2.0.0 OK Authenticated
mail from:1000@qq.com
250 2.1.0 1000@qq.com... Sender ok
rcpt to:l.t.b@126.com
250 2.1.5 l.t.b@126.com... Recipient ok
data
354 Enter mail, end with "." on a line by itself
mail comes again
.
250 2.0.0 o6N6CUg9005754 Message accepted for delivery
quit
221 2.0.0 squid.upl.com closing connection
Connection closed by foreign host.
使用foxmail驗證發送要求輸入密碼，驗證接受郵件
接受郵件需要存在MDA
service dovecot restart <---開啟他才允許MUA串連上來收取郵件
chkconfig dovecot on
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
Xinetd (擴充的網路服務守護進程)
1、提高系統效能，提高服務效能
2、增強存取控制
3、增加了額外的日誌記錄
配置目錄
/etc/xinetd.d/
/etc/xinetd.conf
針對某個託管給xinetd的服務獨立設定檔
# vim /etc/xinetd.d/tftp
service tftp
{
socket_type = dgram
protocol = udp
wait = yes
user = root
server = /usr/sbin/in.tftpd
server_args = -s /tftpboot
disable = yes
per_source = 11
cps = 100 2
flags = IPv4
}
例子1：把vsftp託管給xinetd
# vim /etc/xinetd.d/vsftp
service ftp
{
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/sbin/vsftpd
disable = no
}
修改vsftp的配置
# listen=YES <--注釋掉
# service vsftpd stop
# service xinetd restart
驗證:
# netstat -ntlp | grep :21
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 6264/xinetd
登入之前ps -ef | grep vsftpd
登入之後ps -ef | grep vsftpd
退出登入ps -ef | grep vsftpd
例子2：把sshd託管給xinetd
# vim sshd
service ssh
{
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/sbin/sshd
server_args = -i
disable = no
per_source = 2
cps = 100 2 <--媚笑最多處理100個請求，否則停止服務2秒
no_access = 10.1.1.251
only_from = 10.1.1.0/24
access_times = 16:00-23:00
instances = 3
flags = IPv4
}
# service sshd stop
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
tcpwrapper
client <-----> tcpwrapper <----> xinetd <----> vsftpd
client <-----> tcpwrapper <----> vsftpd
[root@squid ~]# ldd /usr/sbin/xinetd | grep wrap
libwrap.so.0 => /lib/libwrap.so.0 (0x00e95000)
[root@squid ~]# ldd /usr/sbin/vsftpd | grep wrap
libwrap.so.0 => /lib/libwrap.so.0 (0x00781000)
[root@squid ~]# ldd /usr/sbin/sshd | grep wrap
libwrap.so.0 => /lib/libwrap.so.0 (0x007c9000)
設定檔：
/etc/hosts.allow
/etc/hosts.deny
規則讀取以及匹配演算法：
首先讀取allow檔案，如果找到匹配的規則，就停止繼續往下讀取規則
如果allow找不到規則，就去找deny規則，如果找到就拒絕
如果找不到匹配規則，就預設允許
例子1：拒絕10.1.1.20訪問vsftpd
# vim /etc/hosts.deny <--馬上生效
vsftpd: 10.1.1.20
例子2：只是禁止10.1.1.0/24網段裡的主機訪問，但是10.1.1.20可以訪問
方法1：
# vim /etc/hosts.allow
vsftpd: 10.1.1.20
# vim /etc/hosts.deny
vsftpd: 10.1.1.0/255.255.255.0
方法2：
# vim /etc/hosts.deny
vsftpd: 10.1.1.0/255.255.255.0 EXCEPT 10.1.1.20
方法3：
# vim /etc/hosts.allow
vsftpd: all EXCEPT 10.1.1.0/255.255.255.0 EXCEPT 10.1.1.20
允許所有IP，但除了10.1.1.1~10.1.1.19, 10.1.1.21~10.1.1.254
# vim /etc/hosts.deny <---拒絕所有人訪問，別忘記了
vsftpd:all
例子3: 拒絕所有人訪問，但是允許10.1.1.0/24訪問，但不允許10.1.1.20
寫兩個檔案：
# vim /etc/hosts.allow
vsftpd: 10.1.1.0/255.255.255.0 EXCEPT 10.1.1.20
# vim /etc/hosts.deny
vsftpd: all
方法2：
# vim /etc/hosts.deny
vsftpd: all EXCEPT 10.1.1.0/255.255.255.0 EXCEPT 10.1.1.20
拒絕所有IP，但除了10.1.1.1~10.1.1.19, 10.1.1.21~10.1.1.254
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
