SMF - Just Installed!
Попробуйте сгенерировать сертификат, согласно этой статьи:
tls_advertise_hosts = *
# Указываем где у нас находяться сертификат и ключ
tls_certificate = /etc/exim/ssl/exim.crt
tls_privatekey = /etc/exim/ssl/exim.pem
daemon_smtp_ports = 25 : 465
tls_on_connect_ports = 465
//> mkdir /etc/exim
//> mkdir /etc/exim/ssl
//> cd /etc/exim/ssl
/etc/exim/ssl/> openssl req -new -outform PEM -out exim.crt -newkey rsa:2048 \
-nodes -keyout exim.key -keyform PEM -days 9999 -x509
Generating a 2048 bit RSA private key
..........................................+++
........................................+++
writing new private key to 'exim.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:RU
State or Province Name (full name) [Some-State]:Rostov
Locality Name (eg, city) []:Zernograd
Organization Name (eg, company) [Internet Widgits Pty Ltd]:COMPANY
Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:smtp.zern.domain-ak.ru
Email Address []:postmaster@domain-ak.ru
TLS error on connection from (mail-yx0-f172.google.com) [209.85.213.172] I=[xx.xx.xx.101]:25 (SSL_CTX_use_PrivateKey_file file=/etc/exim/ssl/exim.pem): error:02001002:system library:fopen:No such file or directory
TLS error on connection from (mail-gy0-f172.google.com) [209.85.160.172] I=[xx.xx.xx.101]:25 (SSL_CTX_use_PrivateKey_file file=/etc/exim/ssl/exim.pem): error:0906D06C:PEM routines:PEM_read_bio:no start line
Dec 13 22:07:59 xxxxx exim[2573]: SMTP connection from (mail-gy0-f172.google.com) [209.85.160.172] I=[xx.xx.xx.101]:25 closed by QUIT
Dec 13 22:08:45 xxxxx exim[2564]: SMTP connection from [209.85.213.172] I=[xx.xx.xx.101]:25 (TCP/IP connection count = 1)
Dec 13 22:08:46 xxxxx exim[2575]: TLS error on connection from (mail-yx0-f172.google.com) [209.85.213.172] I=[xx.xx.xx.101]:25 (SSL_CTX_use_PrivateKey_file file=/etc/exim/ssl/exim.pem): error:0906D06C:PEM routines:PEM_read_bio:no start line
Dec 13 22:08:46 xxxxx exim[2575]: SMTP connection from (mail-yx0-f172.google.com) [209.85.213.172] I=[xx.xx.xx.101]:25 closed by QUIT
TLS error on connection from (mail-yx0-f172.google.com) [209.85.213.172] I=[xx.xx.xx.101]:25 (SSL_accept): error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
Dec 13 21:59:44 xxxxx exim[2502]: SMTP connection from (mail-yx0-f172.google.com) [209.85.213.172] I=[xx.xx.xx.101]:25 closed by EOF
?$rcmail_config['default_host'] = '%n'
Или необходимо, чтобы пользователи этого интерфейса подключались к другим серверам?
# ping xxxxxx.com
PING xxxxxx (192.168.1.4): 56 data bytes
ping: sendto: Permission denied
ping: sendto: Permission denied
ping: sendto: Permission denied
ping: sendto: Permission denied
::1 localhost localhost.my.domain
127.0.0.1 localhost localhost.my.domain
192.168.1.4 xxxxxxx xxxxxxx.com
# ping xxxxxxxx.com
PING xxxxxx (192.168.1.4): 56 data bytes
64 bytes from 192.168.1.4: icmp_seq=0 ttl=64 time=0.046 ms
64 bytes from 192.168.1.4: icmp_seq=1 ttl=64 time=0.037 ms
$rcmail_config['default_host'] = '%d';
// TCP port used for IMAP connections
$rcmail_config['default_port'] = 143;
[13-Dec-2011 00:01:39 +0200]: IMAP Error: Could not connect to com:143: php_network_getaddresses: getaddrinfo failed: hostname nor servname provided, or not known in /usr/local/www/roundcube/program/include/rcube_imap.php on line 143 (POST /wmail/?_task=&_action=login)
А если установить $rcmail_config['imap_auth_type'] = null; в файле main.inc.php? Будет ли работать в случае установленной опции disable_plaintext_auth: yes в конфигурации Dovecot-а?
disable_plaintext_auth: yes
disable_plaintext_auth: no
<?php
$rcmail_config = array();
$rcmail_config['debug_level'] = 1;
$rcmail_config['log_driver'] = 'file';
$rcmail_config['log_date_format'] = 'd-M-Y H:i:s O';
$rcmail_config['syslog_id'] = 'roundcube';
$rcmail_config['syslog_facility'] = LOG_USER;
$rcmail_config['smtp_log'] = true;
$rcmail_config['log_logins'] = true;
$rcmail_config['sql_debug'] = true;
$rcmail_config['imap_debug'] = true;
$rcmail_config['ldap_debug'] = false;
$rcmail_config['smtp_debug'] = false;
$rcmail_config['default_host'] = '%d';
$rcmail_config['default_port'] = 143;
$rcmail_config['imap_auth_type'] = PLAIN;
$rcmail_config['imap_root'] = null;
$rcmail_config['imap_delimiter'] = null;
$rcmail_config['imap_force_caps'] = false;
$rcmail_config['imap_timeout'] = 0;
$rcmail_config['smtp_server'] = 'localhost';
$rcmail_config['smtp_port'] = 25;
$rcmail_config['smtp_user'] = '%u';
$rcmail_config['smtp_pass'] = '%p';
$rcmail_config['smtp_auth_type'] = 'PLAIN';
$rcmail_config['smtp_helo_host'] = 'mail.gipernet.eu';
$rcmail_config['smtp_timeout'] = 0;
$rcmail_config['enable_installer'] = false;
$rcmail_config['log_dir'] = 'logs/';
$rcmail_config['temp_dir'] = 'temp/';
$rcmail_config['enable_caching'] = false;
$rcmail_config['message_cache_lifetime'] = '10d';
$rcmail_config['force_https'] = false;
$rcmail_config['auto_create_user'] = true;
$rcmail_config['skin_include_php'] = false;
$rcmail_config['session_lifetime'] = 10;
$rcmail_config['ip_check'] = false;
$rcmail_config['double_auth'] = false;
$rcmail_config['des_key'] = 'Moi kod';
$rcmail_config['username_domain'] = '%d';
$rcmail_config['mail_domain'] = '%d';
$rcmail_config['password_charset'] = 'ISO-8859-1';
$rcmail_config['sendmail_delay'] = 0;
$rcmail_config['max_recipients'] = 0;
$rcmail_config['max_group_members'] = 0;
$rcmail_config['useragent'] = 'Roundcube Webmail/'.RCMAIL_VERSION;
$rcmail_config['product_name'] = 'Roundcube Webmail';
$rcmail_config['include_host_config'] = false;
$rcmail_config['generic_message_footer'] = '';
$rcmail_config['generic_message_footer_html'] = '';
$rcmail_config['http_received_header'] = false;
$rcmail_config['http_received_header_encrypt'] = false;
$rcmail_config['mail_header_delimiter'] = NULL;
$rcmail_config['line_length'] = 72;
$rcmail_config['send_format_flowed'] = true;
$rcmail_config['session_domain'] = '';
$rcmail_config['dont_override'] = array();
$rcmail_config['identities_level'] = 0;
$rcmail_config['mime_magic'] = '/usr/share/misc/magic';
$rcmail_config['email_dns_check'] = false;
$rcmail_config['plugins'] = array();
$rcmail_config['message_sort_col'] = '';
$rcmail_config['message_sort_order'] = 'DESC';
$rcmail_config['list_cols'] = array('subject', 'from', 'date', 'size', 'flag', 'attachment');
$rcmail_config['language'] = null;
$rcmail_config['date_short'] = 'D H:i';
$rcmail_config['date_long'] = 'd.m.Y H:i';
$rcmail_config['date_today'] = 'H:i';
$rcmail_config['drafts_mbox'] = 'Drafts';
$rcmail_config['junk_mbox'] = 'Junk';
$rcmail_config['sent_mbox'] = 'Sent';
$rcmail_config['trash_mbox'] = 'Trash';
$rcmail_config['default_imap_folders'] = array('INBOX', 'Drafts', 'Sent', 'Junk', 'Trash');
$rcmail_config['create_default_folders'] = false;
$rcmail_config['protect_default_folders'] = true;
$rcmail_config['quota_zero_as_unlimited'] = false;
$rcmail_config['mdn_requests'] = 0;
$rcmail_config['enable_spellcheck'] = true;
$rcmail_config['spellcheck_engine'] = 'googie';
$rcmail_config['spellcheck_uri'] = '';
$rcmail_config['spellcheck_languages'] = NULL;
$rcmail_config['max_pagesize'] = 200;
$rcmail_config['min_keep_alive'] = 60;
// ADDRESSBOOK SETTINGS
$rcmail_config['address_book_type'] = 'sql';
$rcmail_config['ldap_public'] = array();
$rcmail_config['ldap_public']['Verisign'] = array(
'name' => 'Verisign.com',
'hosts' => array('directory.verisign.com'),
'port' => 389,
'use_tls' => false,
'user_specific' => false,
'base_dn' => '',
'bind_dn' => '',
'bind_pass' => '',
'writable' => false, // Indicates if we can write to the LDAP directory or not.
'required_fields' => array("cn", "sn", "mail"), // The required fields needed to build a new contact as required by the object classes (can include additional fields not required by the object classes).
'LDAP_rdn' => 'mail', // The RDN field that is used for new entries, this field needs to be one of the search_fields, the base of base_dn is appended to the RDN to insert into the LDAP directory.
'ldap_version' => 3, // using LDAPv3
'search_fields' => array('mail', 'cn'), // fields to search in
'name_field' => 'cn', // this field represents the contact's name
'email_field' => 'mail', // this field represents the contact's e-mail
'surname_field' => 'sn', // this field represents the contact's last name
'firstname_field' => 'gn', // this field represents the contact's first name
'sort' => 'cn', // The field to sort the listing by.
'scope' => 'sub', // search mode: sub|base|list
'filter' => '', // used for basic listing (if not empty) and will be &'d with search queries. example: status=act
'fuzzy_search' => true, // server allows wildcard search
'sizelimit' => '0', // Enables you to limit the count of entries fetched. Setting this to 0 means no limit.
'timelimit' => '0', // Sets the number of seconds how long is spend on the search. Setting this to 0 means no limit.
);
*/
// An ordered array of the ids of the addressbooks that should be searched
// when populating address autocomplete fields server-side. ex: array('sql','Verisign');
// пВШСЧМЕООЩК НБУУЙЧ ЙДЕОФЙЖЙЛБФПТПЧ БДТЕУОПК ЛОЙЗЙ, ЛПФПТЩЕ ОХЦОП ОБКФЙ
$rcmail_config['autocomplete_addressbooks'] = array('sql');
// ----------------------------------
// USER PREFERENCES
// ----------------------------------
// Use this charset as fallback for message decoding
// йУРПМШЪПЧБФШ ЬФХ ЛПДЙТПЧЛХ ДМС РТЕПВТБЪПЧБОЙС УППВЭЕОЙС
$rcmail_config['default_charset'] = 'ISO-8859-1';
// skin name: folder from skins/
// оБЪЧБОЙЕ ФЕНЩ: ЛБФБМПЗ ЙЪ skins/
$rcmail_config['skin'] = 'default';
// show up to X items in list view
// пФПВТБЪЙФШ ДП ЪОБЮЕОЙС X Ч ЧЙДЕ УРЙУЛБ
$rcmail_config['pagesize'] = 40;
// use this timezone to display date/time
// йУРПМШЪПЧБФШ ЬФПФ ЮБУПЧПК РПСУ ДМС ПФПВТБЦЕОЙС ДБФЩ/ЧТЕНЕОЙ
$rcmail_config['timezone'] = 'auto';
// is daylight saving On?
// еЦЕДОЕЧОПЕ УПИТБОЕОЙС ЧЛМАЮЕОП?
$rcmail_config['dst_active'] = (bool)date('I');
// prefer displaying HTML messages
// уОБЮБМБ ПФПВТБЦБФШ HTML УППВЭЕОЙС
$rcmail_config['prefer_html'] = true;
// display remote inline images
// 0 - Never, always ask
// 1 - Ask if sender is not in address book
// 2 - Always show inline images
// пФПВТБЦБФШ ХДБМЕООЩЕ ЧУФТПЕООЩЕ ЙЪПВТБЦЕОЙС
$rcmail_config['show_images'] = 0;
// compose html formatted messages by default
// уПЪДБЧБФШ html-УППВЭЕОЙС РП ХНПМЮБОЙА
$rcmail_config['htmleditor'] = false;
// show pretty dates as standard
// пФПВТБЦБФШ ХДПВОЩЕ ДБФЩ РП ХНПМЮБОЙА
$rcmail_config['prettydate'] = true;
// save compose message every 300 seconds (5min)
// уПИТБОСФШ УПЪДБЧБЕНПЕ УППВЭЕОЙЕ ЛБЦДЩЕ 300 УЕЛХОД
$rcmail_config['draft_autosave'] = 300;
// default setting if preview pane is enabled
// ъОБЮЕОЙЕ РП ХНПМЮБОЙА, ЕУМЙ РТЕДЧБТЙФЕМШОЩК РТПУНПФТ ТБЪТЕЫЕО
$rcmail_config['preview_pane'] = false;
// Mark as read when viewed in preview pane (delay in seconds)
// Set to -1 if messages in preview pane should not be marked as read
// рПНЕЮБФШ ЛБЛ РТПЮЙФБООПЕ Ч РТЕДЧБТЙФЕМШОПН РТПУНПФТЕ
$rcmail_config['preview_pane_mark_read'] = 0;
// focus new window if new message arrives
// рЕТЕЛМАЮБФШУС ОБ ОПЧПЕ ПЛОП, РП РТЙИПДХ ОПЧПЗП УППВЭЕОЙС
$rcmail_config['focus_on_new_message'] = true;
// Clear Trash on logout
// пЮЙЭБФШ ЛПТЪЙОХ РТЙ ЧЩИПДЕ
$rcmail_config['logout_purge'] = false;
// Compact INBOX on logout
// уЦЙНБФШ чИПДСЭЙЕ РТЙ ЧЩИПДЕ
$rcmail_config['logout_expunge'] = false;
// Display attached images below the message body
// пФПВТБЦБФШ РТЙЛТЕРМЕООЩЕ ЙЪПВТБЦЕОЙС ОЙЦЕ ФЕМБ УППВЭЕОЙС
$rcmail_config['inline_images'] = true;
// Encoding of long/non-ascii attachment names:
// 0 - Full RFC 2231 compatible
// 1 - RFC 2047 for 'name' and RFC 2231 for 'filename' parameter (Thunderbird's default)
// 2 - Full 2047 compatible
// рЕТЕЛПДЙТПЧБФШ ДМЙООЩЕ/non-ascii ЙНЕОБ ЧМПЦЕОЙК
$rcmail_config['mime_param_folding'] = 1;
// Set true if deleted messages should not be displayed
// This will make the application run slower
// ъБДБФШ "true" ЕУМЙ ХДБМЕООЩЕ УППВЭЕОЙС ОЕ ДПМЦОЩ ПФПВТБЦБФШУС
$rcmail_config['skip_deleted'] = false;
$rcmail_config['read_when_deleted'] = true;
$rcmail_config['flag_for_deletion'] = false;
$rcmail_config['keep_alive'] = 60;
$rcmail_config['check_all_folders'] = false;
$rcmail_config['display_next'] = false;
$rcmail_config['autoexpand_threads'] = 0;
$rcmail_config['top_posting'] = false;
$rcmail_config['strip_existing_sig'] = true;
$rcmail_config['show_sig'] = 1;
$rcmail_config['sig_above'] = false;
$rcmail_config['force_7bit'] = false;
$rcmail_config['default_imap_folders']
$rcmail_config['search_mods'] = null; // Example: array('*' => array('subject'=>1, 'from'=>1), 'Sent' => array('subject'=>1, 'to'=>1));
$rcmail_config['delete_always'] = false;
[13-Jul-2011 18:26:52 +0300]: IMAP Error: Authentication for klaxxx@gixxxx.eu failed (LOGIN): a001 NO [CLIENTBUG] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. in /usr/local/www/roundcube/program/include/rcube_imap.php on line 143 (POST /wmail/?_task=&_action=login)
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether xx:xx:xx:26:8e:2b
inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
inet 192.168.1.4 netmask 0xffffff00 broadcast 192.168.1.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
nfe0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=80008<VLAN_MTU,LINKSTATE>
ether xx:xx:xx:xx:2f:28
inet xx.xx.xx.101 netmask 0xfffffe00 broadcast xx.xx.xx.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=3<RXCSUM,TXCSUM>
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
add 1010 allow ip from any to any via rl0
add 1020 deny ip from any to 192.168.0.0/16 in recv nfe0
add 1030 deny ip from 192.168.0.0/16 to any in recv nfe0
add 1040 deny ip from any to 172.16.0.0/12 in recv nfe0
add 1050 deny ip from 172.16.0.0/12 to any in recv nfe0
add 1060 deny ip from any to 10.0.0.0/8 in recv nfe0
add 1070 deny ip from 10.0.0.0/8 to any in recv nfe0
add 1080 deny ip from any to 169.254.0.0/16 in recv nfe0
add 1090 deny ip from 169.254.0.0/16 to any in recv nfe0
nat 1 config log ip xx.xx.xx.101 reset same_ports deny_in
add 10100 nat 1 ip from any to any via nfe0
add 10200 pass all from xx.xx.xx.101 to any 80,25 out via nfe0
add 10210 pass all from any 80,25 to 192.168.1.0/24 in via nfe0
add 65534 deny all from any to any
nat 1 config log ip xx.xx.xx.101 reset same_ports deny_in redirect_port tcp 1.2.3.4:6881 6881
add 10100 nat 1 ip from any to any via nfe0
add 10200 allow all from any to any
add 10300 allow tcp from any 80, 443 to 192.168.1.10
В версии FreeBSD 8.1-RELEASE не работает параметр sysctl one_pass - трафик после прохода через нат возвращается обратно в фаервол. Чтобы избавиться от этой неприятности надо делать правило "allow all from any to any" после правила ната. Эту проблему должны будут исправить в релизе 8.2.
nat 1 config log ip xx.xx.xx.101 reset same_ports deny_in
add 10100 nat 1 ip from any to any via nfe0
add 10200 allow all from any to any
nat 1 config log ip xx.xx.xx.101 reset same_ports deny_in redirect_port tcp 1.2.3.4:6881 6881
ifconfig_nfe0="ether 00:xx:xx:xx:xx:xx"
ifconfig_nfe0_alias0="xx.xx.227.101 netmask 255.255.254.0 -rxcsum"
defaultrouter="xx.xx.226.1"
ifconfig_rl0="inet 192.168.1.1 netmask 255.255.255.0"
ifconfig_rl0_alias0="inet 192.168.1.4 netmask 255.255.255.0"
firewall_enable="YES"
firewall_type="/etc/firewall"
gateway_enable="YES"
firewall_logging="YES"
add 1010 allow ip from any to any via rl0
add 1020 deny ip from any to 192.168.0.0/16 in recv nfe0
add 1030 deny ip from 192.168.0.0/16 to any in recv nfe0
add 1040 deny ip from any to 172.16.0.0/12 in recv nfe0
add 1050 deny ip from 172.16.0.0/12 to any in recv nfe0
add 1060 deny ip from any to 10.0.0.0/8 in recv nfe0
add 1070 deny ip from 10.0.0.0/8 to any in recv nfe0
add 1080 deny ip from any to 169.254.0.0/16 in recv nfe0
add 1090 deny ip from 169.254.0.0/16 to any in recv nfe0
#nat 1 config log ip xx.xx.xx.101 reset same_ports deny_in
add 10100 nat 1 ip from any to any via nfe0
#add 65534 deny all from any to any // Если открываю это правило интернет падает.
(Очень много примеров из нета перепробывал эффект нулевой)