先說需要安裝哪些軟體,因為使用的平臺是Gentoo 作業系統，所以就用gentoo 的安裝方式

1 :安裝dns 域名伺服器，如果你在公網，並且有自已的域名，那麼不用自已安裝域名伺服器，（ 因為郵件伺服器要用到域名的解析，反向解析，所以要安裝，我嘗試用ip 地址代替郵箱域名，失敗,所以必須裝）

emerge bind bind-tools     版本沒要求，預設就行

2安裝sendmail

 USE='' mbox  ssl"   emerge  sendmail   

要加上mbox ssl 兩個標記，以便讓sendmail 支援mbox的郵件儲存方式（就是在/var/mail 目錄上存不同使用者的郵件，而不是在各個使用者的~目錄下,） 另外還有一個sasl 的標記，不加也可以，好像sendmail 從某個版本對於ssl 的支援不需要sasl 了， 當前的sendmail 是mail-mta/sendmail-8.14.4

3 要用到openssl 庫，在進行安全的ssl 連線時，需要用它生成幾個檔案，好像是證書之類，不太懂，但得裝上

emerge -av openssl

4 安裝dovecot

USE="ssl   maildir mbox" emerge dovecot  

確保ssl maildir mbox 這幾個標記的存在，

sendmail 只負責發郵件，要想收郵件，要用到dovecot

下面是具體的安裝過程

一安裝並配置bind

sendmail 要用到域名解析，反向域名解析，所以要選安裝dns 伺服器bind,安裝方法及配置見

簡要摘寫如下

/etc/bind/named.conf

options { directory "/var/bind"; // uncomment the following lines to turn on DNS forwarding, // and change the forwarding ip address(es) : //forward first; //forwarders { // 123.123.123.123; // 123.123.123.123; //}; listen-on-v6 { none; }; // 註釋掉這行 // listen-on { 127.0.0.1; }; // listen-on { 127.0.0.1;192.168.1.2; }; // to allow only specific hosts to use the DNS server: //allow-query { // 127.0.0.1; //}; // if you have problems and are behind a firewall: //query-source address * port 53; pid-file "/var/run/named/named.pid"; }; // Briefly, a zone which has been declared delegation-only will be effectively // limited to containing NS RRs for subdomains, but no actual data beyond its // own apex (for example, its SOA RR and apex NS RRset). This can be used to // filter out "wildcard" or "synthesized" data from NAT boxes or from // authoritative name servers whose undelegated (in-zone) data is of no // interest. // See http://www.isc.org/products/BIND/delegation-only.html for more info //zone "COM" { type delegation-only; }; //zone "NET" { type delegation-only; }; zone "." IN { type hint; file "named.cache"; }; zone "localhost" IN { type master; file "pri/localhost.zone"; allow-update { none; }; notify no; }; zone "127.in-addr.arpa" IN { type master; file "pri/127.zone"; allow-update { none; }; notify no; }; //vi /etc/conf.d/hostname //hostname="jixiuf.org" //主機名為jixiuf.org //我的ip是192.168.1.2 , //pri/jixiuf.org.zone 是/etc/bin/pri/jixiuf.org.zone //實際是/var/bind/pri/目錄的一個軟連結 //此檔案進行正向域名解析 ,由域名得ip zone "jixiuf.org" IN { type master; file "pri/jixiuf.org.zone"; allow-update { none; }; notify no; }; //此檔案進行反向域名解析，由ip 得域名 zone "192.in-addr.arpa" IN { type master; file "pri/jixiuf_r.zone"; allow-update { none; }; notify no; }; # Use with the following in named.conf, adjusting the allow list as neede # key "rndc-key" { # algorithm hmac-md5; # secret "kGKuKdPDjzvUPgJPncVZxw=="; # }; # # controls { # inet 127.0.0.1 port 953 # allow { 127.0.0.1; } keys { "rndc-key"; }; # }; # End of named.conf 

jf pri # cat   /var/bind/pri/jixiuf.org.zone

jixiuf.org 的正向解析檔案

$TTL 1W @ IN SOA jixiuf.org. root.jixiuf.org. ( 2010092203 ; Serial 28800 ; Refresh 14400 ; Retry 604800 ; Expire - 1 week 86400 ) ; Minimum @ IN NS jixiuf.org. @ IN A 192.168.1.2 ;三個別名mail.jixiuf.org. smtp.jixiuf.org. pop3.jixiuf.org. 實際上都是jixiuf.org.的別名,它們具有相同的ip 192.168.1.2 mail IN CNAME jixiuf.org. smtp IN CNAME jixiuf.org. pop3 IN CNAME jixiuf.org. @ IN MX 5 mail.jixiuf.org. 

/var/bind/pri/localhost.zone  ,預設即可

反向解析檔案

jf pri # cat   /var/bind/pri/jixiuf_r.zone

$ORIGIN 192.in-addr.arpa. $TTL 1W @ 1D IN SOA jixiuf.org. root.jixiuf.org. ( 2010092204 ; serial 3H ; refresh 15M ; retry 1W ; expiry 1D ) ; minimum ; @ 在這裡相當於 jixiuf @ 1D IN NS jixiuf.org. ;192.168.1.2 解析為jixiuf.org. 及mail.jixiuf.org. .... 2.1.168 1D IN PTR jixiuf.org. 2.1.168 1D IN PTR mail.jixiuf.org. 2.1.168 1D IN PTR smtp.jixiuf.org. 2.1.168 1D IN PTR pop3.jixiuf.org.

測試一下是否成功

正向解析

jixiuf pri # host smtp.jixiuf.org
smtp.jixiuf.org is an alias for jixiuf.org.
jixiuf.org has address 192.168.1.2
jixiuf.org mail is handled by 5 mail.jixiuf.org.
jixiuf pri # host pop3.jixiuf.org
pop3.jixiuf.org is an alias for jixiuf.org.
jixiuf.org has address 192.168.1.2
jixiuf.org mail is handled by 5 mail.jixiuf.org.
jixiuf pri # host mail.jixiuf.org
mail.jixiuf.org is an alias for jixiuf.org.
jixiuf.org has address 192.168.1.2
jixiuf.org mail is handled by 5 mail.jixiuf.org.
jixiuf pri # host jixiuf.org
jixiuf.org has address 192.168.1.2
jixiuf.org mail is handled by 5 mail.jixiuf.org.

反向解析

jixiuf pri # nslookup  192.168.1.2
Server:        127.0.0.1
Address:    127.0.0.1#53

2.1.168.192.in-addr.arpa    name = pop3.jixiuf.org.
2.1.168.192.in-addr.arpa    name = jixiuf.org.
2.1.168.192.in-addr.arpa    name = mail.jixiuf.org.
2.1.168.192.in-addr.arpa    name = smtp.jixiuf.org.

jixiuf pri #

==========================================================================================================

下面是關於sendmail 的了

1 新增兩個測試使用者

useradd -m -g mail -s /bin/false mail1
useradd       -g mail -s /bin/false mail2

passwd mail1

passwd mail2

mail1 有/home/mail1 目錄，而mail2 沒有

為mail1 mail2 起個別名， 不起也可以

/etc/mail/aliases

zhang3: mail1 li4: mail2 manager: mail1, mail2 # zhang3@jixiuf.org means mail1@jixiuf.org #and mail send to manager@jixiuf.org will be send to mail1@jixiuf.org and mail@jixiuf.org

然後執行命令newaliases

編輯 /etc/mail/access

127.0.0.1 RELAY #192.168.1.2 RELAY mail.jixiuf.org RELAY jixiuf.org RELAY

然後執行 makemap  hash <access access.db

表示傳送到jixiuf.org mail.jixiuf.org 地址的信才給傳送，其他地址的不送

/etc/init.d/sendmail start

此時sendmail 已經可以發信了，但是不能向外閘道器郵件，因為外網的郵箱伺服器無法以我們的ip進行域名反解析（好像是，不太清楚）

在同一網段找另外一臺機器，當然用虛擬機器也可以（網路橋接）用Outlook Express  發[email protected]   [email protected]  傳送郵件 ，

smtp pop3 伺服器都填寫成mail.jixiuf.org 或者jixiuf.org 也可以

但是此時sendmail 發信不支援ssl 連線，所以使用者名稱密碼很容易被人監聽到

下面進行sendmail 發件通過ssl

在/etc/mail/sendmail.mc 中新增

TRUST_AUTH_MECH("EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN")dnl define(`confAUTH_MECHANISMS', `EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN GSSAPI KERBEROS_V4')dnl dnl define(`CERT_DIR', `MAIL_SETTINGS_DIR`'certs')dnl define(`CERT_DIR', `/etc/mail/certs')dnl define(`confCACERT_PATH', `CERT_DIR')dnl define(`confCACERT', `CERT_DIR/cacert.pem')dnl 1 define(`confSERVER_CERT', `CERT_DIR/cert.pem')dnl 2 define(`confSERVER_KEY', `CERT_DIR/key.pem')dnl 3 define(`confCLIENT_CERT', `CERT_DIR/cert.pem')dnl define(`confCLIENT_KEY', `CERT_DIR/key.pem')dnl

然後執行

m4 sendmail.mc  >sendmail.cf  

接下來需要生成證書  這個過程不必理解，

生成的過程

 從這篇文章的 1.9.7. 配置 sendmail — 證書管理 ^做就可以

摘錄如下:
$ mkdir /tmp/CA
$ cd /tmp/CA
$ mkdir certs crl newcerts private
$ echo "01" > serial
$ cp /dev/null index.txt
$ cp /usr/local/openssl/openssl.cnf.sample openssl.cnf
    改成cp /etc/ssl/openssl.cnf   openssl.cnf
$ vi openssl.cnf   (set values)       這一步主要修改openssl.cnf 檔案中
               dir             = ./demoCA              # Where everything is kept
              改成
               dir             = /tmp/CA              #修改成我們實際的目錄
$ openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf
$ openssl req -nodes -new -x509 -keyout newreq.pem -out newreq.pem -days 365 -config openssl.cnf
$ openssl x509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem
$ openssl ca -config openssl.cnf -policy policy_anything -out newcert.pem -infiles tmp.pem
$ rm -f tmp.pem
手動修改生成的 newreq.pem檔案
Remove the unsigned certificate (leaving the private key 刪除證書部分，只保留私鑰部分
mkdir /etc/mail/certs
cp cacert.pem   /etc/mail/certs/cacert.pem
cp newreq.pem   /etc/mail/certs/key.pem
cp newcert.pem  /etc/mail/certs/cert.pem
cd /etc/mail/certs/
chmod 400 key.pem
Check key properties
$ openssl x509 -noout -in cacert.pem -text
Make sure that the CN of the CA certificate and CN of the server
certificate are different, because newer versions of Mozilla and
Netscape won't accept the server certificate if it is self-signed
這句不理解，

/etc/init.d/sendmail restart 

現在可以通過安全的ssl 進行認證了.

關於sendmail ssl tls 配置兩篇不錯的文章

====================================================================================================

下面是關於收郵件的   dovecot-1.2.11 ,用到這個軟體，安裝在上面提過，下面說配置

cd /etc/dovecot/

修改dovecot.conf

新增

protocols = imap imaps pop3 pop3s listen = * disable_plaintext_auth = no log_path = /var/log/mail/err info_log_path = /var/log/mail/info ssl = no #mail_location = mbox:~/mail:INBOX=/var/mail/%u ,這個指定郵件在什麼位置，以便比那兒存取，

/etc/init.d/dovecot/start

此時可以收郵件，但是沒使用ssl 不安全

protocols = imap imaps pop3 pop3s listen = * disable_plaintext_auth =yes log_path = /var/log/mail/err info_log_path = /var/log/mail/info ssl = yes # 或者required ssl_cert_file = /etc/ssl/dovecot/server.pem ssl_key_file = /etc/ssl/dovecot/server.key #mail_location = mbox:~/mail:INBOX=/var/mail/%u ,這個指定郵件在什麼位置，以便比那兒存取，

=========================================================================================================了附 客戶端的一些資訊