Postfix, VPN kanye ne-smarthost: umugqa awuyona firewall

Ukugcina i-imeyili emugqeni kuze kukhuphuke i-VPN kuyinkinga yokuhlela, futhi isisombululo esivamile ukumisa i-Postfix, ukushintsha i-main.cf bese uyivula kabusha. Lokho kuyasebenza, futhi iyisimo esingalungile, ngoba kuhlanganisa izimfuno ezimbili: ukuthi ukulethwa kufanele kuzanywe nini, futhi iyingxenye iphi yendlela yenethiwekhi engayithwala. Eyesibili isinqumo se-firewall, futhi awekho umyalo we-Postfix ongayenza. Uma lezi ezimbili zihlukanisiwe, ngayinye inempendulo encane futhi engahlolwa.

Gcina indawo okufika kuyo i-relay izinzile, vimba ukulethwa okuqondile emngceleni wenethiwekhi, futhi vumela umugqa ukuthi ulinde.

Izimfuno ezimbili abantu abazihlanganisa zibe yinye

I-relay itshela i-Postfix ukuthi i-imeyili iyiswe kuphi; i-relayhost = [smtp.corp.example]:587 isho i-host ne-port, futhi ama-bracket acindezela ukukhethwa okusekelwe ku-MX kwalolo gxuma olulandelayo. Indlela itshela i-kernel ukuthi amaphakethe angaya kuphi. I-relayhost elungile ngaphandle komkhawulo wendlela isavumela i-Postfix ukuthi ifinyelele i-inthanethi ngokuqondile uma ithebula lomzila likuvuma, futhi i-firewall elungile ene-relayhost engalungile ithumela i-imeyili endaweni engalungile. Akukho okuphoqelela okunye.

Amamephu okuthutha, ukushintshwa ngomthumeli ngamunye kanye nama-relay ayisipele ngakunye kufanele ukufundwa okufanayo. I-relayhost ezinzile akusona ubufakazi bokuthi yonke indlela yokulethwa elungisiwe iyayisebenzisa, futhi indlela eyisipele edlula i-relay iwukwehluleka okufanayo ekufihlweni okungcono.

I-defer_transports yenzani ngempela

I-defer_transports ibamba imilayezo yezokuthutha ezishiwo, ngakho akukho mzamo wokulethwa owenziwayo kuze kube umjikelezo womugqa uyazithinta. Lokhu kuwukulawula kokuhlela, futhi ukukhipha umugqa kuyakweqa; lokho kuwukwakhiwa hhayi iphutha. Sebenzisa amagama okuthutha angempela avela ku-master.cf, ngoba ukuthutha okwenziwe ngokwezifiso noma ukuthutha kwe-relay okuqanjwe ngokwahlukile akukho ngaphansi ngenxa nje yokuthi uhlelo lwakho lukhuluma ne-SMTP futhi. Umzamo ojwayelekile wokuphinda uwumshini ohlukile: ngendlela ye-fail-closed, imizamo yokulethwa ihluleka nje futhi ihlale emugqeni, ngaphandle kwesiyalo sokubambezeleka.

Ukwehluleka okuphakade akulindi ngesizotha. Umamukeli omubi noma ubufakazi obunqatshiwe buyabuyela noma bunamathela njengephutha eliqinile esikhundleni bokuhlala kuze kuvele umhubhe, ngakho umugqa ogcwele i-imeyili ebambezelisiwe awuwona ngokuzenzakalela umugqa ophephile.

Phoqelela indlela esigabeni senethiwekhi

Umkhawulo ungowomngcele wokuphuma wasendaweni noma ngaphakathi kwendawo yamagama yenethiwekhi ehlukanisiwe. Kufanele ihlanganise amakheli angempela e-relay, ukuthutha ne-port, kuhlanganise ne-IPv6 uma kunikwe amandla, ngoba umthetho ovimbayo i-TCP 25 awenzanga lutho ku-relay ekwi-587 noma i-465. Gcina i-loopback nezindlela zokuthumela zasendaweni zihlukene ukuze umugqa ngokwawo uqhubeke usebenza. Inqubomgomo kufanele ihlale ivaliwe uma indlela yomhubhe inyamalala noma iphinde ivele ngaphansi kwelinye igama lesixhumi.

Umcimbi wokukhuphuka kwesixhumi awufakazi ukuthi i-relay ifinyeleleka ngawo. Yingakho i-hook ehlola isixhumanisi bese ikhipha umugqa iwukusiza hhayi isiqiniseko: isixhumanisi singashintsha phakathi kokuhlola nomzamo wokulethwa.

Fakaza ngomlayezo owodwa ongenabungozi

Thumela umlayezo owodwa ongenabungozi ngenkathi i-VPN iphansi, bese uhlola i-postqueue -p ngesizathu sokubambezeleka ne-ID yomugqa. Buyisela indlela ebihlosiwe futhi ucele umjikelezo womugqa olawulwayo, ubuka ukuthi umlayezo uphuma nge-relay hhayi kwenye indawo. Bese uphinda uqamule indlela phakathi nendiza futhi uqinisekise ukuthi umlayezo ubuyela emugqeni. Buyekeza i-maximal_queue_lifetime ngaphambi kokunquma ukuthi ukuphazamiseka kungathatha isikhathi esingakanani, ngoba inani elinguziro lisho umzamo owodwa hhayi ukugcinwa okungenamkhawulo.

Qapha ubudala bomugqa nokusetshenziswa kwediski. Inqubomgomo elinda i-VPN iba ukuphazamiseka kwe-imeyili uma kungekho oqaphelayo ukuthi umugqa uyakhula kusukela ngoLwesihlanu.

Rekhoda i-relay, ukuthutha, umthetho we-firewall kanye nempilo kanye. Lezo zine zichaza ukuhlelwa; noma yikuphi kuzo sodwa kuchaza ukuqagela.