サーバーネットワーク技術録

pptpd サーバ

Mon, 06 May 2013 21:36:23 +0900

鍵認証を必要としない簡単なVPN接続
環境 CentOS5.9 x86_64

# wget http://poptop.sourceforge.net/yum/beta/packages/pptpd-1.3.4-2.rhel5.x86_64.rpm
# rpm -vhi pptpd-1.3.4-2.rhel5.x86_64.rpm
# yum whatprovides "libpcap.so.0.9.4"
# yum install libpcap
# wget http://poptop.sourceforge.net/yum/beta/packages/ppp-2.4.4-14.1.rhel5.x86_64.rpm
# rpm -vhi ppp-2.4.4-14.1.rhel5.x86_64.rpm
# rpm -vhi pptpd-1.3.4-2.rhel5.x86_64.rpm

# diff /etc/pptpd.conf{,.org}
----
96,97c96,97
< localip 192.168.0.1
< remoteip 192.168.0.100-169
---
> #localip 192.168.0.1
> #remoteip 192.168.0.234-238,192.168.0.245
----

diff /etc/ppp/options.pptpd{,.org}
変更なし

/etc/init.d/pptpd start

クライアント側では、暗号化して接続にチェックを入れる

bind 外部公開用ネームサーバ設定

Tue, 23 Apr 2013 00:45:54 +0900

BIND設定ファイル
/etc/named.conf
｜公開ドメイン設定
↓ (内部･外部ホストの許可･拒否設定)
ゾーンリストファイル
/etc/named.external.zone
｜ DNS公開ドメイン･ゾーンの追加
↓
ゾーンファイル
/var/name/XXXXX.com
   ドメイン毎にゾーンファイル作成

* パッケージインストール
# yum install bind

* 設定ファイルのコピー
# rpm -ql bind |grep name

# cp /usr/share/doc/bind-9.3.3/sample/etc/named.conf /etc/.
# cp /usr/share/doc/bind-9.3.3/sample/etc/named.root.hints /etc/.
# cp /usr/share/doc/bind-9.3.3/sample/var/named/named.root /var/named/.

* 設定

BIND設定ファイル
/etc/named.conf
-------------------------------------------------------------
view "internal"          <---内部から見る設定
        match-clients           { 10.0.0.0/24; }; <--- "any"にすると外部許可になる。
        recursion yes;   <---再帰問い合わせ有り無し        下の外部から見る設定は省略される。

        zone "linuxtest.net" {    <---ゾーン名はドメイン名
                type master;
                file "/var/named/linuxtest.zone"; <---ゾーンファイル名
        };

        include "/etc/named.external.zone"; <---外部から見る設定(内部からも見える様に)

};

view    "external" <---外部から見る設定
{
        recursion no;

        include "/etc/named.root.hints";

        include "/etc/named.external.zone"; <---外部から見る設定

};
-------------------------------------------------------------

/etc/named.external.zone
-------------------------------------------------------------
zone "pet.net" {    <---ゾーン名はドメイン名
   type master;
   file "/var/named/pet.net.zone";
};

zone "yakan.com" {
   type master;
   file "/var/named/yakan.com.zone";
};
-------------------------------------------------------------

etc/named.root.hints
-------------------------------------------------------------
        type hint;
        file "/var/named/named.root"; <---フルパスで記述

-------------------------------------------------------------

/var/named/linuxtest.zone
-------------------------------------------------------------
$TTL    86400
@       IN      SOA     linuxtest.net. hostmaster.linuxtest.net. (
                                      2013042300 ; Serial
                                      28800      ; Refresh
                                      14400      ; Retry
                                      3600000    ; Expire
                                      86400 )    ; Minimum
@       IN      NS      ns1
ns1     IN      A       10.0.0.12
@       IN      MX      10      mx1
@       IN      MX      20      @
@       IN      A       10.0.0.12
www     IN      A       10.0.0.12
mx1     IN      A       10.0.0.12
-------------------------------------------------------------
"@"は起点(etc/named.external.zoneで書かれた各ゾーン名{ドメイン名})
"."を省略すると、それぞれのエイリアス名の後ろに起点名(ドメイン名)が付く
例:linuxtest.net. --->linuxtest.net
例:ns1            --->ns1.linuxtest
例:mx1            --->mx1.linuxtest
-------------------------------------------------------------

/var/named/yakan.com.zone   他DNSサーバに依存する場合
-------------------------------------------------------------
$TTL    86400
@       IN      SOA     yakan.com. hostmaster.yakan.com. (
                                      2008040100 ; Serial
                                      28800      ; Refresh
                                      14400      ; Retry
                                      604800     ; EXPIRE
                                      86400 )    ; Minimum
@       IN      NS      ns1.linuxtest.net
@       IN      A       10.0.0.12
@       IN      MX      10      mx
www     IN      A       10.0.0.12
mx      IN      A       10.0.0.12
-------------------------------------------------------------

/var/named/pet.net.zone    独立してDNSサーバを持つ場合
-------------------------------------------------------------
$TTL    86400
@       IN      SOA     pet.net. hostmaster.pet.net. (
                                      2008040100 ; Serial
                                      28800      ; Refresh
                                      14400      ; Retry
                                      604800     ; EXPIRE
                                      86400 )    ; Minimum
@       IN      NS      ns1
ns1     IN      A       10.0.0.12
@       IN      A       10.0.0.12
@       IN      MX      10      mx
www     IN      A       10.0.0.12
mx      IN      A       10.0.0.12
[root@linuxtest /]#
-------------------------------------------------------------

[root@linuxtest ~]# rndc reload
server reload successful
[root@linuxtest ~]#

ログローテート設定
named.conf
---------------------------------------------
logging
{
/*      If you want to enable debugging, eg. using the 'rndc trace' command,
*      named will try to write the 'named.run' file in the $directory
*      (/var/named).
*      By default, SELinux policy does not allow named to modify
*      the /var/named directory,
*      so put the default debug log file in data/ :
*/
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };

        channel log_default {
                file "/var/log/named/named.log" versions 10 size 1M;
                severity info;
                print-time yes;
                print-category yes;
        };

        category default { "log_default"; };

        channel log_query {
                file "/var/log/named/query.log" versions 5 size 1M;
                severity info;
                print-time yes;
                print-category yes;
        };

        category queries { "log_query"; };

        category lame-servers { null; };
};

---------------------------------------------

# mkdir /var/log/named
# touch /var/log/named/named.log
# touch /var/log/named/query.log

ethtoolコマンドメモ

Sat, 20 Apr 2013 23:26:57 +0900

* autonegotiation off
ethtool -s eth0 autoneg off

* speed 100Mbps
ethtool -s eth0 speed 100

* duplex full
ethtool -s eth0 duplex full

* 設定ファイルに記述の場合
ifcfg-eth0
----
DEVICE=eth0
BOOTPROTO=static
IPADDR=***.***.***.***
NETMASK=255.255.255.0
ONBOOT=yes
ETHTOOL_OPTS="autoneg off speed 100 duplex full"
TYPE=Ethernet
----

qmail + vpopmail install

Thu, 11 Apr 2013 00:19:20 +0900

* アカウント作成
groupadd nofiles
groupadd qmail
groupadd vchkpw
useradd alias -g nofiles -d /opt/qmail/alias -s /bin/false -M
useradd qmaild -g nofiles -d /opt/qmail -s /bin/false -M
useradd qmaill -g nofiles -d /opt/qmail -s /bin/false -M
useradd qmailp -g nofiles -d /opt/qmail -s /bin/false -M
useradd qmailq -g qmail    -d /opt/qmail -s /bin/false -M
useradd qmailr -g qmail    -d /opt/qmail -s /bin/false -M
useradd qmails -g qmail    -d /opt/qmail -s /bin/false -M

* tcprules インストール
wget "http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz"
wget "http://qmail.org/moni.csi.hu/pub/glibc-2.3.1/ucspi-tcp-0.88.errno.patch"
wget "http://qmail.org/moni.csi.hu/pub/glibc-2.3.1/ucspi-tcp-0.88.a_record.patch"
wget "http://qmail.org/moni.csi.hu/pub/glibc-2.3.1/ucspi-tcp-0.88.nobase.patch"
tar zxf ucspi-tcp-0.88.tar.gz
(cd ucspi-tcp-0.88 && \
patch -s -p1 <../ucspi-tcp-0.88.errno.patch && \
patch -s -p1 <../ucspi-tcp-0.88.a_record.patch && \
patch -s -p1 <../ucspi-tcp-0.88.nobase.patch && \
make && make setup check)

* daemontool インストール
wget "http://cr.yp.to/daemontools/daemontools-0.76.tar.gz"
wget "http://qmail.org/moni.csi.hu/pub/glibc-2.3.1/daemontools-0.76.errno.patch"
tar zxfp daemontools-0.76.tar.gz
(cd admin/daemontools-0.76 && \
patch -s -p1 <../../daemontools-0.76.errno.patch && \
./package/compile && cp -a command/* /usr/local/bin/ )
mkdir /service
chmod 755 /service
vi /etc/init.d/svscan
----------------------------------------------------------
#!/bin/bash
# djb svscan
#
# description: svscan
#
# chkconfig: 2345 96 98

# Source function library
. /etc/rc.d/init.d/functions

#!/bin/sh
# /etc/init.d/daemontools : start or stop daemontools
# written by Adam McKenna

export PATH=$PATH:/usr/local/bin

l=/var/log/svscan

if [ ! -d $l ]; then
mkdir $l
chown daemon $l
fi

case "$1" in
    start)
        echo -n "Starting daemontools: "
        if [ ! `pidof svscan` ]; then
                echo -n "svscan "
                env - PATH="$PATH" svscan /service 2>&1 | setuidgid daemon multilog t /var/log/svscan &
                echo "."
        else
                echo "already running."
        fi
        ;;
    stop)
        echo -n "Stopping daemontools: "
        if [ `pidof svscan` ]; then
                echo -n "svscan"
                while [ `pidof svscan` ]; do
                     kill `pidof svscan`
                     echo -n "."
                done
        fi
        echo -n " services"
        for i in `ls -d /service/*`; do
                svc -dx $i
                echo -n "."
        done
        echo -n " logging "
        for i in `ls -d /service/*/log`; do
                svc -dx $i
                echo -n "."
        done
        echo ""
        ;;
    restart|force-reload)
        $0 stop
        $0 start
        ;;
    *)
        echo 'Usage: /etc/init.d/svscan {start|stop|restart|force-reload}'
        exit 1
esac
----------------------------------------------------------
chmod 755 /etc/init.d/svscan
chkconfig --add svscan
chkconfig svscan on
/etc/init.d/svscan start

* qmail インストール
wget "http://qmail.org/netqmail-1.06.tar.gz"
wget "http://qmail.org/qmail-smtpd-relay-reject"
#wget "http://www.ksknet.net/sample/qmail-date-localtime.patch"
wget "http://www.tymy.net/%7Ematsu/blog/wp-content/uploads/2008/03/qmail-date-localtime.patch"
wget "http://sourceforge.net/projects/qmhandle/files/qmhandle-1.3/qmhandle-1.3.2/qmhandle-1.3.2.tar.gz/download"
tar zxf netqmail-1.06.tar.gz
(cd netqmail-1.06 && \
patch < ../qmail-smtpd-relay-reject && \
patch < ../qmail-date-localtime.patch && \
echo "/opt/qmail" > conf-qmail && \
rm -rf /var/qmail && \
ln -s /opt/qmail /var/qmail && \
make setup check && \
./config-fast `hostname` && \
cp dnscname dnsfq dnsip dnsmxip dnsptr hostname ipmeprint /opt/qmail/bin/. )
mv /usr/sbin/sendmail{,.org}
ln -s /opt/qmail/bin/sendmail /usr/sbin/sendmail
(cd /var/qmail/alias
echo "&info" > .qmail-postmaster
echo "#" > .qmail-root
echo "&postmaster" > .qmail-mailer-daemon
chown alias .qmail-*)
(cd /opt/qmail
mkdir -p supervise/qmail-send/log/main
mkdir -p supervise/qmail-smtpd/log/main
mkdir -p supervise/qmail-pop3d/log/main )
cat < /var/qmail/supervise/qmail-send/log/run
#!/bin/sh
exec setuidgid qmaill multilog t s1000000 n100 ./main
END
chmod 755 /var/qmail/supervise/qmail-send/log/run
cp -p /var/qmail/supervise/qmail-send/log/run /var/qmail/supervise/qmail-smtpd/log/.
cp -p /var/qmail/supervise/qmail-send/log/run /var/qmail/supervise/qmail-pop3d/log/.
cat < /var/qmail/supervise/qmail-send/run
#!/bin/sh

PATH=/opt/qmail/bin:/opt/vpopmail/bin:/usr/local/bin:/usr/bin:/bin
export PATH

sleep 1

exec env - PATH=\$PATH \\
qmail-start ./Maildir/ 2>&1
END

cat < /var/qmail/supervise/qmail-smtpd/run
#!/bin/sh

PATH=/opt/qmail/bin:/opt/vpopmail/bin:/usr/local/bin:/usr/bin:/bin
export PATH

sleep 1

_RULE=/opt/vpopmail/etc/tcp.smtp.cdb

exec env - PATH=\$PATH \\
envuidgid qmaild tcpserver -vHRDl0 -x \$_RULE 0 smtp \\
qmail-smtpd 2>&1
END

cat < /var/qmail/supervise/qmail-pop3d/run
#!/bin/sh

PATH=/opt/qmail/bin:/opt/vpopmail/bin:/opt/djbtools/bin:/usr/local/bin:/usr/bin:/bin
export PATH

sleep 1

_host=\`hostname\`

exec env - PATH=\$PATH \\
tcpserver -vHRDl0 -u vpopmail -g vchkpw 0 pop3 \\
qmail-popup \$_host vchkpw qmail-pop3d Maildir 2>&1
END

chmod 755 /var/qmail/supervise/qmail-*/run

ln -s /var/qmail/supervise/qmail-send /service/
ln -s /var/qmail/supervise/qmail-smtpd /service/.qmail-smtpd
ln -s /var/qmail/supervise/qmail-pop3d /service/.qmail-pop3d
chown qmaill:nofiles /var/qmail/supervise/qmail-{send,smtpd,pop3d}/log/main

tar zxfp qmhandle-1.3.2.tar.gz
cp qmhandle-1.3.2/qmHandle /usr/local/bin/.

vpopmail install
useradd vpopmail -g vchkpw -M -d /opt/vpopmail

wget "http://sourceforge.net/projects/vpopmail/files/vpopmail-devel/5.5.0/vpopmail-5.5.0.tar.bz2/download"
bzip2 -dc vpopmail-5.5.0.tar.bz2 | tar xfp -
( cd vpopmail-5.5.0 && \
./configure --enable-roaming-users --prefix=/opt/vpopmail --enable-relay-clear-minutes=30 --enable-passwd && \
make && make install && \
cd backends/cdb && ./configure && make && make install )
( cd /opt/vpopmail/etc/vpopmail
tcprules tcp.smtp.cdb tcp.smtp.tmp < tcp.smtp )
ln -s /opt/vpopmail/var/vpopmail /opt/vpopmail/domains
ln -s /opt/vpopmail/etc/vpopmail/* /opt/vpopmail/etc/.

# AUTORESPOND
wget "http://www.inter7.com/devel/autorespond-2.0.5.tar.gz"
tar zxfp autorespond-2.0.5.tar.gz
( cd autorespond-2.0.5
patch < ../autorespond-2.0.5.iso-2022-jp.patch && make && make install )
cp qmail-queue.iso-2022-jp /var/qmail/bin/.

mv /service/.qmail-smtpd /service/qmail-smtpd
mv /service/.qmail-pop3d /service/qmail-pop3d

pxeboot

Tue, 02 Apr 2013 00:29:54 +0900

OS自動インストーラの設定

dhcpd でtftpファイル指定
↓
tftpbootでftp or http キックスタートファイル指定
↓
キックスタートファイル(.ks.cfg)でOS指定

* dhcpサーバ設定
rpm -ql dhcp

less /etc/dhcpd.conf
-----------
ddns-update-style none;

option domain-name "hoge.com";
option domain-name-servers 192.168.0.1;
option routers 192.168.12.6;

default-lease-time 600;
max-lease-time 7200;

subnet 192.168.0.0 netmask 255.255.255.0 {
next-server 192.168.0.254;
range dynamic-bootp 192.168.0.101 192.168.0.149;
filename "pxelinux.0";
}
-----------

* tftpサーバ設定
rpm -ql tftp-server
vi /etc/xinetd.d/tftp
-----------
disable = yes
-----------
vi /etc/init.d/tftpd
#!/bin/sh
# chkconfig: 3 65 35
# description: tftpd-server
#

case "$1" in

start)
echo "Starting tftp-server: "

/usr/sbin/in.tftpd -l -s /tftpboot

;;

stop)
echo "Shutting down tftp-server: "

/usr/bin/killall in.tftpd

;;

restart)
$0 stop
$0 start
;;

*)
echo "Usage: $0 {start|stop|restart}"
exit 1
esac

exit 0
-----------
chmod +x /etc/rc.d/rc3.d/S65tftpd

* bootイメージの準備
cp -ip /var/www/os/cent6/images/pxeboot/initrd.img /tftpboot/cedntos/.
cp -ip /var/www/os/cent6/images/pxeboot/vmlinuz /tftpboot/centos/.

/tftpboot/pxelinux.cfg/default
-----------
#DISPLAY readme.txt
PROMPT 1
TIMEOUT 1

#DEFAULT centos5.7-64 text ext4
#DEFAULT centos6 text ext4 ks=http://hoge.moge/cent6-64
DEFAULT centos6 text ext4

LABEL centos6
kernel centos/vmlinuz-6
append initrd=centos/initrd-6.img
-----------

必要に応じてキックスタートファイルの準備

dnsキャッシュ用bind設定ファイル

Sat, 30 Mar 2013 01:34:07 +0900

dnsキャッシュ用bind設定ファイル

cat /etc/named.conf

options {
directory "/var/named"; #ZONEファイルの保存場所を指定
# forwarders { #ZONEファイルにないホスト名の検索先を指定
# 12.34.56.7; # プロバイダのDNSサーバーのアドレス
# 12.34.56.8;
# };
allow-query { #DNSサーバーに接続できる端末を制限する
127.0.0.1; #サーバー自身を示す
192.168.0.0/24; #LAN内の端末を示す
};
};

zone "localhost" IN { #localhostの正引きの設定
type master;
file "localhost.zone";
};

zone "0.0.127.in-addr.arpa" IN { #localhostの逆引きの設定
type master;
file "0.0.127.in-addr.arpa";
};

spamassassin

Fri, 22 Mar 2013 01:00:57 +0900

postfixでの迷惑メールフィルタ spamassassin の設定

filterから呼び出す方法と、procmailから呼び出す方法がある。
# yum install spamassassin

* filterから呼び出す方法
-----------------------------
http://www.kobitosan.net/postfix/trans-2.1/jhtml/FILTER_README.html
# groupadd -g 5001 filter
# useradd -g filter -u 5001 -d /home/filter -s /bin/false filter
# chown -R filter:filter /home/filter/
# mkdir /var/spool/filter
# chown filter:filter /var/spool/filter
# chmod 700 /var/spool/filter
# vi /usr/local/bin/spam-filter
# chmod 700 /usr/local/bin/spam-filter
# chown filter:filter /usr/local/bin/spam-filter

-----------------------------
#!/bin/sh

# Simple shell-based filter. It is meant to be invoked as follows:
# /path/to/script -f sender recipients...

# Localize these.
INSPECT_DIR=/var/spool/filter
SENDMAIL="/usr/sbin/sendmail -i"
SPAMASSASSIN=/usr/bin/spamc

# Exit codes from
EX_TEMPFAIL=75
EX_UNAVAILABLE=69

# Clean up when done or when aborting.
trap "rm -f in.$$" 0 1 2 3 15

# Start processing.
cd $INSPECT_DIR || {
echo $INSPECT_DIR does not exist; exit $EX_TEMPFAIL; }

# Specify your content filter here.
$SPAMASSASSIN -x > in.$$
$SENDMAIL "$@" < in.$$

exit $?
-----------------------------

/etc/postfix/master.cf
-----------------------------
filter unix - n n - 10 pipe
flags=Rq user=filter argv=/usr/local/bin/spam-filter -f ${sender} -- ${recipient}
smtp inet n - n - - smtpd
-o content_filter=filter:dummy

submission inet n - n - - smtpd
-o content_filter=filter:dummy
-----------------------------

* procmailから呼び出す方法
/etc/postfix/main.cf
-----------------------------
mailbox_command = /usr/bin/procmail
virtual_transport = procmail
procmail_destination_recipient_limit = 1
-----------------------------

/etc/postfix/master.cf
-----------------------------
#filter unix - n n - 10 pipe # filter無効化
# flags=Rq user=filter argv=/usr/local/bin/spam-filter -f ${sender} -- ${recipient}

smtp inet n - n - - smtpd
# -o content_filter=filter:dummy

submission inet n - n - - smtpd
# -o content_filter=filter:dummy

procmail unix - n n - - pipe
# 一括で制御する場合
flags=R user=vuser argv=/usr/bin/procmail -t -m USER=${user} DOMAIN=${nexthop} /etc/procmailrc
# ユーザーごとに制御する場合
# flags=R user=vuser argv=/usr/bin/procmail -t -m USER=${user} DOMAIN=${nexthop} /path/to/${nexthop}/${user}@${nexthop}/.procmailrc
-----------------------------

/etc/procmailrc
-----------------------------
PATH=/bin:/usr/bin
DEFAULT=/var/mail/vhosts/$DOMAIN/$USER\@$DOMAIN/Maildir/
MAILDIR=/var/mail/vhosts/$DOMAIN/$USER\@$DOMAIN/Maildir
LOGFILE=${DEFAULT}.procmail.log
LOCKFILE=/var/mail/vhosts/$USER.$DOMAIN.procmail.lock
VERBOSE=OFF
#VERBOSE=ON

:0fw
|/usr/bin/spamc
-----------------------------

dovecot1

Tue, 19 Mar 2013 00:21:09 +0900

dovecot1系 VirtualDomain 標準config

---------------
base_dir = /var/run/dovecot/
protocols = imap imaps
disable_plaintext_auth = yes
ssl_disable = no
mail_location = maildir:~/
mail_debug = yes
log_path = /var/log/dovecot/dovecot.log

protocol imap { #imap使用しない場合はコメントアウト
} #imap使用しない場合はコメントアウト

protocol pop3 {
pop3_uidl_format = %u #POP3 の UIDL (ユニークなメール識別子)フォーマット %u…メール UID
}
auth_verbose = yes #詳細なログ出力
auth_debug = yes #詳細なログ出力
auth_debug_passwords = yes #パスワードと使われたやり取りのログ出力
auth default {
mechanisms = login cram-md5 #SMTP-AUTHの認証メカニズム
passdb passwd-file { #SMTP-AUTHの認証パスワード指定 userdb passwd-file と合わせる。
args = /etc/dovecot-passwd
}
# passdb pam {
# }
# userdb passwd {
# }
socket listen {
client {
path = /var/spool/postfix/private/auth #smtpd_sasl_pathで指定したpath
mode = 0660
user = postfix
group = postfix
}
}
userdb passwd-file {
args = /etc/dovecot-passwd
}
user = root
}
# 64bit
login_process_size = 64

---------------

postfix

Sun, 17 Mar 2013 22:58:34 +0900

postfix2.3 標準設定(SMTP-Auth)

# groupadd vuser -g 5000
# useradd vuser -u 5000 -g 5000
# mkdir /var/mail/vhosts
# chown vuser:vuser /var/mail/vhosts
# touch /etc/postfix/vmailbox
# postmap /etc/postfix/vmailbox

main.cf
————-
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
mail_owner = postfix
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost
unknown_local_recipient_reject_code = 550
mynetworks_style = host
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases

debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.3.3/samples
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
virtual_mailbox_domains = /etc/postfix/vdomain
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_alias_maps = hash:/etc/postfix/virtual
local_recipient_maps =
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/spool/postfix/private/auth
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_security_options = noanonymous
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated, reject_unauth_destination
smtp_sasl_mechanism_filter = plain login cram-md5
broken_sasl_auth_clients = yes
————-

master.cf
下記コメントアウトの解除
————-
submission inet n – n – – smtpd

mod_rpaf -proxy経由でのバックエンドサーバのアクセスログの接続元IP表示-

Sat, 16 Mar 2013 00:36:53 +0900

バックエンドサーバのアクセスログの接続元がプロキシサーバIPになってしまう場合、mod_rpafを使う

■httpd2の場合
# wget http://stderr.net/apache/rpaf/download/mod_rpaf-0.6.tar.gz
# tar zxfp mod_rpaf-0.6.tar.gz && cd mod_rpaf-0.6
# apxs -i -c -n mod_rpaf-2.0.so mod_rpaf-2.0.c

# vi /etc/httpd/conf/httpd.conf
LoadModule rpaf_module modules/mod_rpaf-2.0.so

--------------------------
RPAFenable On
RPAFsethostname On
#RPAFsethostname Off
RPAFproxy_ips 1.2.3.4 5.6.7.8 # proxy server IP
#RPAFheader X-Forwarded-For
--------------------------

■httpd1.3の場合
# wget http://stderr.net/apache/rpaf/download/mod_rpaf-0.1.tar.gz
# tar zxfp mod_rpaf-0.1.tar.gz && cd mod_rpaf-0.1
# /opt/apache_1.3.41/bin/apxs -i -c -n mod_rpaf.so mod_rpaf.c

# vi /opt/apache_1.3.41/conf/httpd.conf
LoadModule rpaf_module /opt/apache_1.3.41/libexec/mod_rpaf.so

--------------------------
RPAFenable On
#RPAFsethostname On
#RPAFsethostname Off
RPAFproxy_ips 1.2.3.4 5.6.7.8 # proxy server IP
#RPAFheader X-Forwarded-For
--------------------------

■httpd2.4の場合
# git clone git://gist.github.com/2716030.git
# patch < 2716030/mod_rpaf-2.0.c.patch
patching file mod_rpaf-2.0.c
patch unexpectedly ends in middle of line
Hunk #3 succeeded at 180 with fuzz 1.
# apxs -i -c -n mod_rpaf-2.0.so mod_rpaf-2.0.c

httpd.conf
--------------------------
RPAFenable On
RPAFsethostname On
#RPAFsethostname Off
RPAFproxy_ips 1.2.3.4 5.6.7.8 # proxy server IP
#RPAFheader X-Forwarded-For
--------------------------

アクセスログにはIPが出るようにはなったが、order でアクセス制限が効かない場合もあるので、その場合はSetEnfIfを使用する。原因は不明です。。効く場合もあり
httpd.conf
--------------------------
SetEnvIf X-Forwarded-For ^(3.4.5.6|7.8.9.10)$ ok
order deny,allow
deny from all
allow from env=ok
allow from 127.0.0.1
--------------------------

サーバー ネットワーク 技術録