CyrusIMap的安装配置.doc

Cyrus IMAP的安装Cyrus IMAP的官方安装文档在：/docs/cyrus-imapd/2.2.13p1/install.php但是经过测试，发现文档和真正的最新cyrus-imapd版本不能完全对得上号。我们可以在这里下载最新的cyrus-imapd版本：/index.php本文档中，我们使用了下面两个包：l cyrus-sasl-2.1.26.tar.gzl cyrus-imapd-2.4.17.tar.gzcyrus-imapd是一个可以使用SASL来获得认证帮助的IMAP，POP3服务器软件。SASL是cyrus-imapd对用户认证的一种方法，但是并不是唯一的方法。我们通过调用configure help命令可以看到有多种认证方法。详细的认证方法可以查看下面链接：/docs/cyrus-imapd/2.2.13p1/install-auth.php在这里我们使用SASL方法来为cyrus-imapd提供认证服务。下图是我们打算安装的整个邮件系统的结构图：+-+| | 25/25 25/25 110/993 143/995 80/443 | Incoming Outgoing POP3 IMAP WEB-MAIL | / / / / / | | | | | | | / / / / / |+-+-+-+| Postfix | | IMP | | +-+| | Cyrus-IMAP | +-+-+| | Cyrus-SASL | +-+| | saslauthd | +-+| | PAM | +-+| | pam_mysql |+-+-+| MySQL |+-+这个结构图是来自于下面链接：Postfix + Cyrus-IMAP + Cyrus-SASL + MySQL + IMP/tech/Postfix_I.html这个页面详细的介绍了整个webmail邮件系统的安装方法，但是编写的年代有些久远，但是有非常好的参考价值。乍看下去，上面的图有些复杂，下面做一些简单的介绍：1. 本系统的主要功能是：使用postfix实现smtp的功能；使用cyrus-imapd实现pop3和imapd的功能；使用IMP来实现Webmail的功能；2. postfix，cyrus，IMP的认证方法都使用Cyrus-sasl来实现；SASL是一个不同通信协议的认证管理层，能把认证的接口和具体的实现分开；Cyrus-sasl是SASL的一个主要实现；3. Cyrus-sasl有多种的认证实现机制saslauthd是其中的一种；使用saslauthd的原因是因为cyrus-imapd是用cyrus用户来启动的，没权限访问系统的用户密码文件：/etc/shadow。因此需要使用saslauthd这个服务来获取相关的信息。Saslauthd本身用root来启动，有访问/etc/shadow的权限，而且saslauthd提供了一个UNIX本地套接字的接口，可以让其他非root用户访问。4. Linux的本地用户认证又可以使用PAM来做认证，所以saslauthd直接使用了PAM作为认证的手段，而PAM也有多种认证数据的存储方法，其中一种方法是pam_mysql；5. 既然使用到pam_mysql这个模块，最终认证数据自然保存在pam_mysql中。1. PAM与SASL的简单介绍1.1. PAM的简介PAM全称是：Pluggable Authentication Modules。在当前的CentOS中都是用这个模块作各种认证通道。具体可以man 一下pam。PAM的主要配置文件都集中在/etc/pam.d目录里面，里面有多个文件，每个文件表示了一种服务的认证方法，例如：sshd，login。管理员可以根据自己的需要定义出自己的服务的认证配置，详细的配置信息可以man pam.d。1.2. SASL的简介在对PAM做测试之前，需要一个sasl的工具集。SASL是一个用于认证处理的协议，全称是Simple Authentication and Security Layer。这个协议在rfc4422中定义，具体作用大概如下： SMTP LDAP XMPP Other protocols . | | / | | / SASL abstraction layer / | | / | | EXTERNAL GSSAPI PLAIN Other mechanisms .从上面图可以看到，不同的应用通过SASL使用各种方法来进行用户认证。SASL的作用是为各种协议产生一个认证的抽象层，让用户登录的时候不用理会最终用户认证信息的出处。一般情况下，当前的centos系统都会安装这套工具。在我的系统中，对应的版本是：rootkernel pam_mysql-0.7RC1# rpm -ql cyrus-sasl-2.1.22-5.el5_4.3/etc/rc.d/init.d/saslauthd/etc/sysconfig/saslauthd/usr/lib/sasl2/usr/lib/sasl2/libsasldb.la/usr/lib/sasl2/libsasldb.so/usr/lib/sasl2/libsasldb.so.2/usr/lib/sasl2/libsasldb.so.2.0.22/usr/sbin/dbconverter-2/usr/sbin/pluginviewer/usr/sbin/saslauthd/usr/sbin/sasldblistusers2/usr/sbin/saslpasswd2/usr/sbin/testsaslauthd/usr/share/doc/cyrus-sasl-2.1.22/usr/share/doc/cyrus-sasl-2.1.22/LDAP_SASLAUTHD/usr/share/man/man8/pluginviewer.8.gz/usr/share/man/man8/saslauthd.8.gz/usr/share/man/man8/sasldblistusers2.8.gz/usr/share/man/man8/saslpasswd2.8.gz/var/run/saslauthd下面是SASL的配置文件，这个配置文件说明，SASL使用PAM作为获取认证数据的机制。 rootkernel pam_mysql-0.7RC1# cat /etc/sysconfig/saslauthd # Directory in which to place saslauthds listening socket, pid file, and so# on. This directory must already exist.SOCKETDIR=/var/run/saslauthd# Mechanism to use when checking passwords. Run saslauthd -v to get a list# of which mechanism your installation was compiled with the ablity to use.MECH=pam# Additional flags to pass to saslauthd on the command line. See saslauthd(8)# for the list of accepted flags.FLAGS=1.3. 使用SASL工具对PAM进行测试我们可以用下面方法来对sasl和pam进行测试： rootkernel pam.d# testsaslauthd -u root -p xxxx -s su0: OK Success.rootkernel pam.d# testsaslauthd -u root -p xxxx -s sshd0: OK Success.rootkernel pam.d# testsaslauthd testsaslauthd: usage: testsaslauthd -u username -p password-r realm -s servicename-f socket path -R repeatnum在上面例子中，xxxx要修改为真正的密码。1.4. 使用MYSQL作为PAM的数据源我们还可以用mysql作为PAM存储用户数据的数据库。如果使用这种方法，我们需要安装pam_mysql。可以在下面链接中获得：/projects/pam-mysql/具体的安装方法可以看INSTALL，具体的配置方法可以看里面的README。安装很简单，就是configure一下，然后执行make，最后把生成的库拷贝到pam的库目录中：rootkernel pam_mysql-0.7RC1# cp .libs/pam_mysql.so /lib/security/下面是一个配置例子： rootkernel pam.d# testsaslauthd -u cyrus -p test -s smtp0: OK Success.rootkernel pam.d# cat smtpauth sufficient pam_mysql.so user=root passwd=admin host=localhost db=postfix table=accountuser usercolumn=username passwdcolumn=passwordauth sufficient pam_unix_auth.soaccount required pam_mysql.so user=root passwd=admin host=localhost db=postfix table=accountuser usercolumn=username passwdcolumn=passwordaccount sufficient pam_unix_acct.sosmtp中主要是定义了mysql的连接方式和对应的库表，字段。具体可以看READM文件和man pam.d。根据上面的配置和测试，需要创建数据库postfix，登录帐号密码是root/admin，表是accountuser，列有：username，password。创建用户信息：cyrus/test。插入数据SQL：INSERT INTO accountuser(username, password) VALUE(cyrus,test)1.5. 相关的资料l /docs/cyrus-sasl/2.1.25/l /projects/pam-mysql/files/?source=navbar2. cyrus-imapd的配置选项在具体介绍如何安装cyrus-imapd之前，有必要分析一下cyrus-imapd的配置方法。在这里并不想对configure中的通用参数做说明，只分析cyrus-imapd特定的一些配置选项。在官方文档中也有对应的参数介绍，但是和最新版本似乎有不少不同：/docs/cyrus-imapd/2.2.13p1/install-compile.php2.1. 可选特征 Optional Features2.1.1. -disable-option-checkingignore unrecognized -enable/-with options2.1.2. -disable-FEATUREdo not include FEATURE (same as -enable-FEATURE=no)2.1.3. -enable-FEATURE=ARGinclude FEATURE ARG=yes2.1.4. -disable-sievedisable Sieve supportsieve是一个邮件过滤的语言，对应的RFC是rfc5228：/html/rfc52282.1.5. -disable-pcredisable PCRE library2.1.6. -enable-afsEnable AFS with ptloader2.1.7. -enable-krb5afspts compile afskrb PTS module with krb5 support2.1.8. -disable-server disable compiling servers2.1.9. -enable-statickrb link Kerberos statically2.1.10. -enable-idled enable IMAP idled support2.1.11. -enable-nntp enable NNTP support2.1.12. -enable-murder enable IMAP Murder support2.1.13. -enable-replication enable replication support (experimental)2.1.14. -enable-cmulocal enable CMU-specific local support2.1.15. -enable-oldsievename enable the use of imap as the sieve service name2.1.16. -enable-netscapehack enable Netscape hack for the menu option in Communicator to Administrate Mail2.1.17. -enable-gssapi= enable GSSAPI authentication yes2.2. 可选包 Optional Packages在这里，我们主要关注的是用什么方法来获取认证信息。2.2.1. -with-PACKAGE=ARGuse PACKAGE ARG=yes2.2.2. -without-PACKAGEdo not use PACKAGE (same as -with-PACKAGE=no)2.2.3. -with-extraident=STRINGuse STRING as extra version information2.2.4. -with-cyrus-prefix=DIRuse DIR as cyrus server install directory默认似乎是：/usr/cyrus，如果-with-service-path设置，该参数被-with-service-path取代。2.2.5. -with-service-path=DIRuse DIR as service install directory2.2.6. -with-cyrus-user=USERIDuse USERID cyrus userid2.2.7. -with-cyrus-group=GROUPIDuse GROUPID cyrus group2.2.8. -with-bdb=DIRuse Berkeley DB (in DIR) yes2.2.9. -with-bdb-libdir=DIRBerkeley DB lib files are in DIR2.2.10. -with-bdb-incdir=DIRBerkeley DB include files are in DIR2.2.11. -with-mysql=DIRuse MySQL (in DIR) no2.2.12. -with-mysql-libdir=DIRMySQL lib files are in DIR2.2.13. -with-mysql-incdir=DIRMySQL include files are in DIR2.2.14. -with-pgsql=DIRuse PostgreSQL (in DIR) no2.2.15. -with-pgsql-libdir=DIRPgsql lib files are in DIR2.2.16. -with-pgsql-incdir=DIRPgsql include files are in DIR2.2.17. -with-sqlite=DIRuse SQLite (in DIR) no2.2.18. -with-sqlite-libdir=DIRSQLite lib files are in DIR2.2.19. -with-sqlite-incdir=DIRSQLite include files are in DIR2.2.20. -with-lock=METHODforce use of METHOD for locking (flock or fcntl)2.2.21. -with-afs-libdir=PATHuse AFS libraries from PATH /usr/lib2.2.22. -with-afs-incdir=PATHuse AFS headers from PATH /usr/include2.2.23. -with-ldap=DIRuse LDAP (in DIR) (experimental) /usr/local2.2.24. -with-krb=PATHuse Kerberos from PATHKerberos验证的名字来自于古希腊神话中的守护地狱之王Hades的三头犬的名字，其实现过程恰恰用到了三台服务器进行，即验证服务器（AS）、票据凭证服务器（TGS）和数据服务器（下文以Bob代称）。2.2.25. -with-krbimpl=kth|mitassume Kerberos 4 from KTH or MIT2.2.26. -with-krbdesuse Kerberos DES implementation yes2.2.27. -with-openssl=PATHuse OpenSSL from PATH2.2.28. -with-egd-socket=FILEEntropy Gathering Daemon socket pathname for systems without /dev/urandom2.2.29. -with-lib-subdir=DIRFind libraries in DIR instead of lib2.2.30. -with-zlib=PATHuse zlib from PATH2.2.31. -with-zephyr=PATHenable Zephyr notification (installed on PATH)2.2.32. -with-pidfile=PATHpidfile in PATH (/var/run/cyrus-master.pid)2.2.33. -with-com_err=PATHuse com_err from path - includes in PATH/include, libs in PATH/lib, and compile_et in PATH/bin2.2.34. -with-syslogfacility=FACILITYset the syslog facility to use (default LOCAL6)2.2.35. -with-gss_impl=heimdal|mit|cybersafe|seam|autochoose specific GSSAPI implementation auto2.2.36. -with-sasl=DIRCompile with libsasl2 in 2.2.37. -with-staticsasl=DIRCompile with staticly linked libsasl2 in 2.2.38. -with-perl=PERLuse PERL for perl 2.2.39. -with-libwrap=DIRuse libwrap (rooted in DIR) yes2.2.40. -with-snmp=DIRuse ucd|net snmp (rooted in DIR) yes3. 安装cyrus-sasl由于在当前安装中选用SASL，所以必须先安装这个包。在安装之前，先检查当前系统中是否已经安装了该库，如果已经安装了就不用再安装：rootkernel cyrus-imapd-2.4.17# ldconfig -v|grep sasl libsasl2.so.3 - libsasl2.so.3.0.0 libsasl2.so.2 - libsasl2.so.2.0.22 libkdesasl.so.1 - libkdesasl.so.1.2.0在我安装的Linux版本中已经安装了该库，所以我没安装最新版本的cyrus-sasl。我安装的库是：rootkernel cyrus-imapd-2.4.17# rpm -qf /usr/lib/sasl2/libsasldb.socyrus-sasl-2.1.22-5.el5_4.3不过在这里，还是介绍一下cyrus-sasl的安装和使用方法。下面是配置参数：rootkernel cyrus-sasl-2.1.26#./configure -enable-anon -enable-plain -enable-login -disable-krb4 -disable-otp -disable-cram -disable-digest -with-saslauthd=/var/run/saslauthd -with-pam=/lib/security -with-dblib=berkeley -with-bdb-libdir -with-bdb-incdir -with-openssl -with-plugindir=/usr/local/lib/sasl2安装方法：rootkernel cyrus-sasl-2.1.26#makerootkernel cyrus-sasl-2.1.26# make installrootkernel cyrus-sasl-2.1.26# mkdir -p /var/run/saslauthdrootkernel cyrus-sasl-2.1.26# cd saslauthdrootkernel cyrus-sasl-2.1.26# make testsaslauthdrootkernel cyrus-sasl-2.1.26# cp testsaslauthd /usr/local/binrootkernel cyrus-sasl-2.1.26# echo /usr/local/lib/sasl2 /etc/ld.so.confrootkernel cyrus-sasl-2.1.26# ldconfigCyrus-sasl的源码包中在doc目录下有详细的安装使用文档，建议在安装使用SASL之前，过一遍目录中的文档。在上面configure中，开启了各种认证的机制，其中在本文档中使用的认证方式是带有PAM功能的saslauthd方式。因此，下面两个选项是必须的：-with-saslauthd=/var/run/saslauthd -with-pam=/lib/security4. cyrus-imapd的安装步骤具体的安装步骤可以查阅下面的页面：/docs/cyrus-imapd/2.2.13p1/install-configure.php4.1. 创建系统用户Cyrus-imapd的运行需要一个用户一个组：rootkernel # useradd cyrusrootkernel # groupadd mail很多时候，系统默认会存在组mail。在创建mail组前请查看：rootkernel # grep mail /etc/groupmail:x:12:mailmailnull:x:47:当系统存在mail组的时候，会报下面错误：rootkernel # groupadd mailgroupadd: group mail exists4.2. 编译配置rootkernel cyrus-imapd-2.4.17# ./configure -prefix=/opt/cyrus -with-cyrus-user=cyrus -with-cyrus-group=mail -with-openssl -with-sasl如果sasl安装在/usr/local目录中，请把with-sasl设置为：-with-sasl=/usr/local。由于我使用的sasl是系统已经安装的，所以不需要指定相应的路径。4.3. 编译安装rootkernel cyrus-imapd-2.4.17# makerootkernel cyrus-imapd-2.4.17# make install在安装完成后，/opt/cyrus/bin目录中是一些测试和管理工具，服务器端的功能据保存在/usr/cyrus目录中。如果在configure中使用参数-with-cyrus-prefix可以修改服务器端命令的目录位置。如果使用-with-service-path参数-with-cyrus-prefix无效。下面是安装后的文件：l /opt/cyrus/bin/imtestl /opt/cyrus/bin/cyradml /opt/cyrus/bin/mupdatetestl /opt/cyrus/bin/sieveshelll /opt/cyrus/bin/pop3testl /opt/cyrus/bin/sivtestl /opt/cyrus/bin/synctestl /opt/cyrus/bin/nntptestl /opt/cyrus/bin/smtptestl /opt/cyrus/bin/lmtptestl /opt/cyrus/bin/installsievell /usr/cyrus/bin/notifydl /usr/cyrus/bin/squatterl /usr/cyrus/bin/proxydl /usr/cyrus/bin/cyr_sequencel /usr/cyrus/bin/cyr_synclogl /usr/cyrus/bin/smmapdl /usr/cyrus/bin/pop3proxydl /usr/cyrus/bin/reconstructl /usr/cyrus/bin/mbexaminel /usr/cyrus/bin/quotal /usr/cyrus/bin/cyrdumpl /usr/cyrus/bin/sievedl /usr/cyrus/bin/arbitronl /usr/cyrus/bin/lmtpdl /usr/cyrus/bin/cyr_userseenl /usr/cyrus/bin/sievecl /usr/cyrus/bin/ipurgel /usr/cyrus/bin/cyr_dfl /usr/cyrus/bin/fudl /usr/cyrus/bin/pop3dl /usr/cyrus/bin/tls_prunel /usr/cyrus/bin/deliverl /usr/cyrus/bin/cvt_cyrusdbl /usr/cyrus/bin/unexpungel /usr/cyrus/bin/imapdl /usr/cyrus/bin/lmtpproxydl /usr/cyrus/bin/cyr_dbtooll /usr/cyrus/bin/ctl_cyrusdbl /usr/cyrus/bin/ctl_mboxlistl /usr/cyrus/bin/ctl_deliverl /usr/cyrus/bin/timsievedl /usr/cyrus/bin/chk_cyrusl /usr/cyrus/bin/cyr_expirel /usr/cyrus/bin/mbpathl /usr/cyrus/bin/master对应的man信息：l /opt/cyrus/share/man/man1l /opt/cyrus/share/man/man1/cyradm.1l /opt/cyrus/share/man/man1/imtest.1l /opt/cyrus/share/man/man1/installsieve.1l /opt/cyrus/share/man/man1/lmtptest.1l /opt/cyrus/share/man/man1/mupdatetest.1l /opt/cyrus/share/man/man1/nntptest.1l /opt/cyrus/share/man/man1/pop3test.1l /opt/cyrus/share/man/man1/sieveshell.1l /opt/cyrus/share/man/man1/sivtest.1l /opt/cyrus/share/man/man1/smtptest.1l /opt/cyrus/share/man/man3l /opt/cyrus/share/man/man3/Cyrus:IMAP.3pml /opt/cyrus/share/man/man3/Cyrus:IMAP:Admin.3pml /opt/cyrus/share/man/man3/Cyrus:IMAP:IMSP.3pml /opt/cyrus/share/man/man3/Cyrus:IMAP:Shell.3pml /opt/cyrus/share/man/man3/Cyrus:SIEVE:managesieve.3pml /opt/cyrus/share/man/man3/imclient.3l /opt/cyrus/share/man/man5l /opt/cyrus/share/man/man5/cyrus.conf.5l /opt/cyrus/share/man/man5/imapd.conf.5l /opt/cyrus/share/man/man5/krb.equiv.5l /opt/cyrus/share/man/man8l /opt/cyrus/share/man/man8/arbitron.8l /opt/cyrus/share/man/man8/chk_cyrus.8l /opt/cyrus/share/man/man8/ctl_cyrusdb.8l /opt/cyrus/share/man/man8/ctl_deliver.8l /opt/cyrus/share/man/man8/ctl_mboxlist.8l /opt/cyrus/share/man/man8/cvt_cyrusdb.8l /opt/cyrus/share/man/man8/cyr_dbtool.8l /opt/cyrus/share/man/man8/cyr_df.8l /opt/cyrus/share/man/man8/cyr_expire.8l /opt/cyrus/share/man/man8/cyr_synclog.8l /opt/cyrus/share/man/man8/deliver.8l /opt/cyrus/share/man/man8/fetchnews.8l /opt/cyrus/share/man/man8/fud.8l /opt/cyrus/share/man/man8/idled.8l /opt/cyrus/share/man/man8/imapd.8l /opt/cyrus/share/man/man8/ipurge.8l /opt/cyrus/share/man/man8/lmtpd.8l /opt/cyrus/share/man/man8/master.8l /opt/cyrus/share/man/man8/mbexamine.8l /opt/cyrus/share/man/man8/mbpath.8l /opt/cyrus/share/man/man8/nntpd.8l /opt/cyrus/share/man/man8/notifyd.8l /opt/cyrus/share/man/man8/pop3d.8l /opt/cyrus/share/man/man8/quota.8l /opt/cyrus/share/man/man8/reconstruct.8l /opt/cyrus/share/man/man8/rmnews.8l /opt/cyrus/share/man/man8/smmapd.8l /opt/cyrus/share/man/man8/squatter.8l /opt/cyrus/share/man/man8/sync_client.8l /opt/cyrus/share/man/man8/syncnews.8l /opt/cyrus/share/man/man8/sync_reset.8l /opt/cyrus/share/man/man8/sync_server.8l /opt/cyrus/share/man/man8/timsieved.8l /opt/cyrus/share/man/man8/tls_prune.8l /opt/cyrus/share/man/man8/unexpunge.84.4. 日志配置把./syslog/syslog.conf中的日志信息复制到/etc/syslog.conf中*.notice;news.err /usr/adm/syslog*.alert rootlocal6.debug /usr/adm/imapd.log创建日志文件：rootkernel cyrus-imapd-2.4.17# touch /var/log/imapd.log4.5. 编写配置文件4.5.1. /etc/imapd.confCyrus-imapd中imapd的配置文件是/etc/imapd.conf。具体的配置内容可以man imapd.conf这个文件定义了imapd的各种参数。下面是我的一个配置例子：postmaster: postmasterconfigdirectory: /var/imappartition-default: /var/spool/imapadmins: cyrus # no admins!allowanonymouslogin: noallowplaintext: yessasl_mech_list: PLAINservername: autocreatequota: 10000reject8bit: noquotawarn: 90timeout: 30poptimeout: 10dracinterval: 0drachost: localhostsasl_pwcheck_method: saslauthdsievedir: /usr/sievesendmail: /usr/sbin/sendmailsieve_maxscriptsize: 32sieve_maxscripts: 5其中是我的本机地址，我没有这个域名，是我在/etc/hosts中设置的。rootkernel cyrus-imapd-2.4.17# grep /etc/hosts05 如果需要使用TLS加密数据通道，还需要一些其他的配置和密钥文件。4.5.2. /etc/cyrus.conf/etc/cyrus.conf是cyrus-imapd中的master程序的配置文件。具体的配置内容可以man cyrus.conf获得。我的配置内容是：# standard standalone server implementationSTART # do not delete this entry! recover cmd=ctl_cyrusdb -r # this is only necessary if using idled for IMAP IDLE# idled cmd=idled# UNIX sockets start with a slash and are put into /var/imap/socketSERVICES # add or remove based on preferences imap cmd=imapd listen=imap prefork=0 imaps cmd=imapd -s listen=imaps prefork=0 pop3 cmd=pop3d listen=pop3 prefork=0 po