Debian邮件服务器虚拟用户

Debian 邮件服务器虚拟用户部署指南

一架构与组件

采用 Postfix 作为 MTA（负责接收与投递）、Dovecot 作为 IMAP/POP3/LMTP（负责收件箱访问与 SASL 认证），账户与域信息集中到 MySQL 管理，便于多域名与大规模用户扩展。
认证链路：客户端提交到 Postfix 的 Submission（端口 587） 或 SMTPS（端口 465） 时，由 Postfix 通过 SASL 委托 Dovecot 完成账号密码校验；Dovecot 从 MySQL 读取用户与域数据。
邮件投递：Postfix 将入站邮件投递到 Dovecot 管理的 Maildir 或 mbox 邮箱存储，用户通过 IMAP/POP3 访问。

二安装与基础配置

安装软件包
- 执行：sudo apt update && sudo apt install postfix dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd mariadb-server libpam-mysql
- Postfix 安装时选择 Internet Site，并设置 System mail name 为主域名（如：mail.example.com）。
基础网络与主机名
- 建议设置：
  - myhostname = mail.example.com
  - mydomain = example.com
  - myorigin = $mydomain
  - inet_interfaces = all
  - inet_protocols = ipv4（或 all）
防火墙放行
- 放行端口：sudo ufw allow 25/tcp, 587/tcp, 465/tcp, 143/tcp, 993/tcp, 110/tcp, 995/tcp
日志与维护
- 主要日志：/var/log/mail.log（Postfix）、/var/log/dovecot.log（Dovecot）；建议配置 logrotate 与监控告警。

三数据库设计与初始化

创建数据库与账号

执行：

CREATE DATABASE maildb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'mailuser'@'localhost' IDENTIFIED BY 'StrongPass!';
GRANT SELECT, INSERT, UPDATE, DELETE ON maildb.* TO 'mailuser'@'localhost';
FLUSH PRIVILEGES;

建议表结构（示例）

域表（virtual_domains）

CREATE TABLE virtual_domains (
  id INT AUTO_INCREMENT PRIMARY KEY,
  name VARCHAR(255) NOT NULL UNIQUE
);

用户表（virtual_users）

CREATE TABLE virtual_users (
  id INT AUTO_INCREMENT PRIMARY KEY,
  domain_id INT NOT NULL,
  email VARCHAR(255) NOT NULL UNIQUE,
  password VARCHAR(255) NOT NULL,
  active TINYINT(1) DEFAULT 1,
  FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
);

别名表（virtual_aliases）

CREATE TABLE virtual_aliases (
  id INT AUTO_INCREMENT PRIMARY KEY,
  domain_id INT NOT NULL,
  source VARCHAR(255) NOT NULL,
  destination VARCHAR(255) NOT NULL,
  FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
);

初始化示例数据

INSERT INTO virtual_domains (name) VALUES ('example.com');
INSERT INTO virtual_users (domain_id, email, password) VALUES
  ((SELECT id FROM virtual_domains WHERE name='example.com'), 'alice@example.com', ENCRYPT('Secret123', CONCAT('$6$', SUBSTRING(SHA(RAND()),1,16))));
INSERT INTO virtual_aliases (domain_id, source, destination) VALUES
  ((SELECT id FROM virtual_domains WHERE name='example.com'), 'sales@example.com', 'alice@example.com');

说明：示例密码使用 SHA-512 加密（示例仅演示，生产环境请使用更安全的口令存储与轮换策略）。

四 Postfix 与 Dovecot 核心配置

Postfix 主配置（/etc/postfix/main.cf，关键片段）

# 基本
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4

# 虚拟域与映射
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps      = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps       = mysql:/etc/postfix/mysql-virtual-alias-maps.cf

# 投递与 LMTP
virtual_transport = lmtp:unix:private/dovecot-lmtp
mailbox_size_limit = 0
message_size_limit = 102400000

# SASL 与策略
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination

Postfix MySQL 映射示例（/etc/postfix/mysql-virtual-mailbox-domains.cf）

host = 127.0.0.1
user = mailuser
password = StrongPass!
dbname = maildb
query = SELECT 1 FROM virtual_domains WHERE name='%s'

Postfix MySQL 映射示例（/etc/postfix/mysql-virtual-mailbox-maps.cf）

host = 127.0.0.1
user = mailuser
password = StrongPass!
dbname = maildb
query = SELECT 1 FROM virtual_users WHERE email='%s' AND active=1

Postfix MySQL 映射示例（/etc/postfix/mysql-virtual-alias-maps.cf）

host = 127.0.0.1
user = mailuser
password = StrongPass!
dbname = maildb
query = SELECT destination FROM virtual_aliases WHERE domain_id=(SELECT id FROM virtual_domains WHERE name='%d') AND source='%u'

Dovecot 认证与用户查询（/etc/dovecot/conf.d/10-auth.conf）

disable_plaintext_auth = yes
auth_mechanisms = plain login
passdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}
userdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}

Dovecot SQL 配置（/etc/dovecot/dovecot-sql.conf.ext）

driver = mysql
connect = host=127.0.0.1 dbname=maildb user=mailuser password=StrongPass!
default_pass_scheme = SHA512-CRYPT
password_query = SELECT email AS user, password FROM virtual_users WHERE email='%u' AND active=1
user_query = SELECT email AS user, '/var/mail/vhosts/%d/%n' AS home, 'maildir:/var/mail/vhosts/%d/%n' AS mail, 5000 AS uid, 5000 AS gid, 'maildir:/var/mail/vhosts/%d/%n' AS quota_rule

Dovecot 邮件存储与协议（/etc/dovecot/conf.d/10-mail.conf）

mail_location = maildir:/var/mail/vhosts/%d/%n
namespace inbox {
  inbox = yes
}

Dovecot LMTP（/etc/dovecot/conf.d/10-master.conf，服务段）

service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = postfix
    group = postfix
  }
}

Dovecot SASL（/etc/dovecot/conf.d/10-master.conf，服务段）

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
    group = postfix
  }
}

目录与权限

sudo mkdir -p /var/mail/vhosts/example.com/alice
sudo chown -R 5000:5000 /var/mail/vhosts
sudo chmod -R 0700 /var/mail/vhosts

应用与验证
```
sudo systemctl restart postfix dovecot
sudo postfix check
sudo doveconf -n
```
- 提示：若使用自签名证书，首次客户端连接需确认指纹或导入 CA。

五安全与测试

TLS 加密

Postfix（/etc/postfix/main.cf）

smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file  = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtp_tls_security_level = may

Dovecot（/etc/dovecot/conf.d/10-ssl.conf）

ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key  = </etc/letsencrypt/live/mail.example.com/privkey.pem

证书建议通过 Let’s Encrypt 获取并自动续期（如 certbot）。

基础连通性测试
```
openssl s_client -connect mail.example.com:993 -quiet
nc -vz mail.example.com 25
```
- 发送测试邮件（示例）：swaks --to alice@example.com --from test@example.org --server mail.example.com:587 --auth LOGIN --auth-user alice@example.com --auth-password Secret123
日志与排错
- 查看日志：sudo tail -f /var/log/mail.log /var/log/dovecot.log
- 常见问题：SASL 认证失败（检查 Dovecot SQL 查询与权限）、LMTP 投递失败（检查目录权限与属主）、证书不匹配（检查证书路径与域名）。

最新问答

相关标签