ืืขืจ ืึทืจืืืงื ืืื ืืืขืื ืืื ืฆื ืฉืืขืื ืึทืจืืืฃ ืึท ืืึธืืขืจื ืคึผืึธืกื ืกืขืจืืืขืจ.
ืคึผืึธืกืืคืืงืก + ืืึธืืืขืงืึธื. ืกืคึผืฃ + DKIM + ืจืื ืก. ืืื IPv6.
ืืื TSL ืขื ืงืจืืคึผืฉืึทื. ืืื ืฉืืืฆื ืคึฟืึทืจ ืงืืืคื ืืึธืืืืื ื - ืืืื ืืื ืึท ืคืึทืงืืืฉ SSL ืืึทืืืืึทืื.
ืืื ืึทื ืื-ืกืคึผืึทื ืฉืืฅ ืืื ืึท ืืืื ืึทื ืื-ืกืคึผืึทื ืจืึทื ื ืคืื ืื ืืขืจืข ืคึผืึธืกื ืกืขืจืืืขืจืก.
ืฉืืืฆื ืงืืืคื ืืฉืืืืช ืื ืืขืจืคืืืกืื.
ืืื OpenVPN, ืื ืงืฉืจ ืฆื ืืืึธืก ืืื ืืืจื IPv4 ืืื ืืืึธืก ืืื IPv6.
ืืืื ืืืจ ืืึธื ื ืืฉื ืืืขืื ืฆื ืืขืจื ืขื ืึทืืข ืื ืืขืงื ืึทืืึทืืืฉืื, ืึธืืขืจ ืืืจ ืืืืื ืฆื ืื ืกืืึทืืืจื ืึทืืึท ืึท ืกืขืจืืืขืจ, ืืขืจ ืึทืจืืืงื ืืื ืคึฟืึทืจ ืืืจ.
ืืขืจ ืึทืจืืืงื ืืืื ืงืืื ืคึผืจืืืื ืฆื ืืขืจืงืืขืจื ืืขืืขืจ ืืขืืึทื. ืื ืืขืจืงืืขืจืื ื ืืืื ืฆื ืืืึธืก ืืื ื ืืฉื ืงืึทื ืคืืืืขืจื ืืื ื ืึธืจืืึทื ืึธืืขืจ ืืื ืืืืืืืง ืคึฟืื ืื ืงืึธื ืกืืืขืจ ืก ืคืื ื ืคืื ืืืื ืื ื.
ืื ืืึธืืืึทืืืืืฉืึทื ืฆื ืฉืืขืื ืึท ืคึผืึธืกื ืกืขืจืืืขืจ ืืื ืืขืืืขื ืืืื ืืึทื ื-ืืขืจืืื ืืืื. ืืึธืก ืงืขื ืืขืืื ื ื ืึทืจืืฉ, ืึธืืขืจ IMHO, ืขืก ืืื ืคืื ืืขืกืขืจ ืืื ืืจืืืื ื ืคืื ืึท ื ืืึท ืืึทืฉืื ืคืื ืืืื ืืึทืืืืกืืข ืกืึธืจื.
ืขืก ืืขื ืขื ืฆืืืื ืืึธืืืึทืืืืืฉืึทื ื ืคึฟืึทืจ ืืึทืฉืืขืืืงื IPv6. ืึทื IT ืืืืืข ืืึทืจืฃ ืงืขืกืืืืขืจ ืืขืจื ืขื ื ืืึทืข ืืขืงื ืึทืืึทืืืฉืื ืฆื ืืืืึทืื ืืขืื. ืืื ืืืึธืื ืืื ืฆื ืืึทืื ืืืื ืืึทืฉืืืื ืฆืืฉืืืึทืขืจ ืฆื ืืขื ืงืึทืืฃ ืงืขืื ืฆืขื ืืืจ.
ืื ืืึธืืืึทืืืืืฉืึทื ืคึฟืึทืจ ืืึทืฉืืขืืืงื OpenVPN ืืื ื ืึธืจ ืฆื ืืึทืงืืืขื IPv6 ืืจืืขืื ืืืืฃ ืื ืืืืข ืืึทืฉืื.
ืื ืืึธืืืึทืืืืืฉืึทื ืคึฟืึทืจ ืืึทืฉืืขืืืงื ืขืืืขืืข ืืฉืืืืช ืื ืืขืจืคืืืกืื ืืื ืึทื ืืืืฃ ืืืื ืกืขืจืืืขืจ ืืื ืืึธืื ืืืื ืฆืืืื ื "ืคึผืึทืืขืืขื ืึธืืขืจ ืึทื ืืืืึทืืึทื" ืืื ืื ืืขืจื "ืฉื ืขื ืึธืืขืจ ืืื ืึท ืฆืึธื".
ืื ืืึธืืืึทืืืืืฉืึทื ืคึฟืึทืจ ืืึทืฉืืขืืืงื ืืื ื ืกืขืืืื ืืก ืืื ืึทื ืืืื ืืกืคึผ ืืื ืึทื ืึทื ืกืืืืืึทื ืื ืก ืกืขืจืืืขืจ, ืืื Google ืืืื ืืื ืคืืืื. ืืื ืืืืื ืึท ืกืืึทืืื ืื ืก ืกืขืจืืืขืจ ืคึฟืึทืจ ืคึผืขืจืืขื ืืขื ื ืืฆื.
ืืึธืืืึทืืืืืฉืึทื ืฆื ืฉืจืืึทืื ืึทื ืึทืจืืืงื - ืืื ืืขืฉืจืืื ืึท ืคึผืืึทื 10 ืืืฉืื ืฆืืจืืง, ืืื ืืื ืืึธืื ืฉืืื ืืขืงืืงื ืืืืฃ ืขืก ืฆืืืื ืืึธื. ืืคืืื ืืืื ืืขืจ ืืืืจ ืืึทืจืฃ ืขืก ืงืขืกืืืืขืจ, ืขืก ืืื ืึท ืืืื ืืึทืฉืืึธืขืก ืึทื ืื ืืขืจืข ืืืขืื ืืืื ืืึทืจืคึฟื ืขืก.
ืขืก ืืื ืงืืื ืื ืืืืขืจืกืึทื ืืืืืื ื ืคึฟืึทืจ ืึท ืคึผืึธืกื ืกืขืจืืืขืจ. ืึธืืขืจ ืืื ืืืขื ืคึผืจืืืืจื ืฆื ืฉืจืืึทืื ืขืคึผืขืก ืืื "ืืึธื ืืึธืก ืืื ืืึทื, ืืืขื ืึทืืฅ ืึทืจืืขื ืืื ืขืก ืืึธื, ืืืึทืจืคื ืืืืก ืื ืขืงืกืืจืข ืฉืืึธืคึผื."
ืื ืคืืจืืข tech.ru ืืื ืึท ืงืึธืืึธืงืึทืืืึธื ืกืขืจืืืขืจ. ืขืก ืืื ืืขืืืขื ืฆื ืคืึทืจืืืืึทืื ืืื OVH, Hetzner, AWS. ืฆื ืกืึธืืืืข ืืขื ืคึผืจืึธืืืขื, ืงืืืึทืคึผืขืจืืืฉืึทื ืืื tech.ru ืืืขื ืืืื ืคืื ืืขืจ ืขืคืขืงืืืื.
ืืขืืืึทื 9 ืืื ืืื ืกืืึทืืืจื ืืืืฃ ืื ืกืขืจืืืขืจ.
ืืขืจ ืกืขืจืืืขืจ ืืื 2 ืื ืืขืจืคืืืกืื `eno1` ืืื `eno2`. ืืขืจ ืขืจืฉืืขืจ ืืื ืึทื ืืืืึทืืึทื, ืืื ืื ืจืืข ืืื ืฉื ืขื, ืจืืกืคึผืขืงืืืืืื.
ืขืก ืืขื ืขื 3 ืกืืึทืืืง IP ืึทืืจืขืกืขืก, XX.XX.XX.X0 ืืื XX.XX.XX.X1 ืืื XX.XX.XX.X2 ืืืืฃ ืื 'eno1' ืฆืืืื ื ืืื XX.XX.XX.X5 ืืืืฃ ืื 'eno2' ืฆืืืื ื .
ืื ืืืฆื XXXX:XXXX:XXXX:XXXX::/64 ืึท ืืขืงื ืคืื IPv6 ืึทืืจืขืกืขืก ืืืึธืก ืืขื ืขื ืึทืกืืื ื ืฆื ืื 'eno1' ืฆืืืื ื ืืื ืคึฟืื ืขืก XXXX:XXXX:XXXX:XXXX:1:2::/96 ืืื ืึทืกืืื ื ืฆื 'eno2' ืืืืฃ ืืืื ืืงืฉื.
ืขืก ืืขื ืขื 3 ืืึธืืืืื ื `domain1.com`, `domain2.com`, `domain3.com`. ืขืก ืืื ืึทื SSL ืืึทืืืืึทืื ืคึฟืึทืจ `domain1.com` ืืื `domain3.com`.
ืืื ืืึธืื ืึท Google ืืฉืืื ืฆื ืืืึธืก ืืื ืืืึธืื ืืื ืฆื ืคืึทืจืืื ืื ืืืื ืืจืืืืงืึทืกืื[ืืืืขืื ืืืฉืืฆื]` (ืืึทืงืืืขื ืคึผืึธืกื ืืื ืฉืืงื ืคึผืึธืกื ืืืืื ืคึฟืื ืื Gmail ืฆืืืื ื).
ืขืก ืืื ืืืื ืึท ืืจืืืืงืึทืกืื`[ืืืืขืื ืืืฉืืฆื]`, ืึท ืงืึธืคึผืืข ืคืื โโโโืื E- ืืจืืื ืคืื ืืืึธืก ืืื ืืืืื ืฆื ืืขื ืืื ืืืื Gmail. ืืื ืขืก ืืื ืืขืืื ืฆื ืงืขื ืขื ืฆื ืฉืืงื ืขืคึผืขืก ืืืืฃ ืืืืึทืฃ ืคืื `[ืืืืขืื ืืืฉืืฆื]`ืืืจื ืื ืืืขื ืฆืืืื ื.
ืขืก ืืื ืืืื ืึท ืืจืืืืงืึทืกืื`[ืืืืขืื ืืืฉืืฆื]`, ืืืึธืก ืืืืึทื ืึธืื ืืืขื ื ืืฆื ืคึฟืื ืืืื iPhone.
ืืขืฉืืงื ืืืืืื ืืืื ื ืึธืืงืืืขื ืืื ืึทืืข ืืึธืืขืจื ืึทื ืืืกืคึผืึทื ืจืขืงืืืืจืขืืขื ืฅ.
ืขืก ืืืื ืืืื ืื ืืขืืกืื ืฉืืึทืคึผื ืคืื ืขื ืงืจืืคึผืฉืึทื ืฆืืืขืฉืืขืื ืืื ืฆืืืืจ ื ืขืืืืึธืจืงืก.
ืขืก ืืึธื ืืืื IPv6 ืฉืืืฆื ืคึฟืึทืจ ืฉืืงื ืืื ืจืืกืืืืื ื ืืืชืืืช.
ืขืก ืืึธื ืืืื ืึท SpamAssassin ืืืึธืก ืืืขื ืงืืื ืืึธื ืืืกืืขืงื ืืืืืื. ืืื ืขืก ืืืขื ืึธืคึผืฉืคึผืจืื ื ืึธืืขืจ ืืึธืคึผืงืขื ืึธืืขืจ ืฉืืงื ืฆื ืื IMAP "ืกืคึผืึทื" ืืขืงืข.
ืกืคึผืึทืืึทืกืึทืกืกืื ืึทืืืึธ-ืืขืจื ืขื ืืืื ืืืื ืงืึทื ืคืืืืขืจื: ืืืื ืืื ืืึทื ืึท ืืจืืื ืฆื ืื ืกืคึผืึทื ืืขืงืข, ืขืก ืืืขื ืืขืจื ืขื ืคืื ืืขื; ืืืื ืืื ืืึทื ืึท ืืจืืื ืคืื ืื ืกืคึผืึทื ืืขืงืข, ืขืก ืืืขื ืืขืจื ืขื ืคืื ืืขื. ืื ืจืขืืืืืึทืื ืคืื ืื SpamAssassin ืืจืืื ืื ื ืืึธื ืืฉืคึผืขื ืฆื ืืขืจ ืืจืืื ืขื ืืก ืืื ืื ืกืคึผืึทื ืืขืงืข.
ืคืคึผ ืกืงืจืืคึผืก ืืืื ืงืขื ืขื ืฆื ืฉืืงื ืคึผืึธืกื ืืืืฃ ืืืืึทืฃ ืคืื ืงืืื ืคืขืื ืืืืฃ ืึท ืืขืืขืื ืกืขืจืืืขืจ.
ืขืก ืืึธื ืืืื ืึทื openvpn ืืื ืกื, ืืื ืื ืคืืืืงืืื ืฆื ื ืืฆื IPv6 ืืืืฃ ืึท ืงืืืขื ื ืืืึธืก ืืื ื ืืฉื IPv6.
ืขืจืฉืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ ืื ืืขืจืคืืืกืื ืืื ืจืืืื ื, ืึทืจืืึทื ืืขืจืขืื ื IPv6.
ืืขืจื ืึธื ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ OpenVPN, ืืืึธืก ืืืขื ืคืึทืจืืื ืื ืืืจื IPv4 ืืื ืฆืืฉืืขืื ืืขื ืงืืืขื ื ืึท ืกืืึทืืืง-ืคืึทืงืืืฉ IPv6 ืึทืืจืขืก. ืืขืจ ืงืืืขื ื ืืืขื ืืึธืื ืึทืงืกืขืก ืฆื ืึทืืข IPv6 ืืึทืืื ืื ืืก ืืืืฃ ืื ืกืขืจืืืขืจ ืืื ืึทืงืกืขืก ืฆื ืงืืื IPv6 ืจืขืกืืจืกื ืืืืฃ ืืขืจ ืืื ืืขืจื ืขืฅ.
ืืขืจื ืึธื ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ ืคึผืึธืกืืคืืงืก ืฆื ืฉืืงื ืืืชืืืช + SPF + DKIM + rDNS ืืื ืื ืืขืจืข ืขื ืืขื ืงืืืื ืืื ืื.
ืืขืจื ืึธื ืืืจ ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ ืืึธืืืขืงืึธื ืืื ืงืึทื ืคืืืืขืจ ืืืืืืืึธืืึทืื.
ืืขืจื ืึธื ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ SpamAssassin ืืื ืงืึทื ืคืืืืขืจ ืืจืืื ืื ื.
ืฆืื ืกืืฃ, ืื ืกืืึทืืืจื Bind.
============= ืืืืื ืื ืืขืจืคืืืกืื ==============
ืฆื ืงืึทื ืคืืืืขืจ ืื ืืขืจืคืืืกืื, ืืืจ ืืึทืจืคึฟื ืฆื ืฉืจืืึทืื ืืขื ืืื "/etc/network/interfaces".
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug eno1
iface eno1 inet static
address XX.XX.XX.X0/24
gateway XX.XX.XX.1
dns-nameservers 127.0.0.1 213.248.1.6
post-up ip route add XX.XX.XX.0/24 dev eno1 src XX.XX.XX.X0 table eno1t
post-up ip route add default via XX.XX.XX.1 table eno1t
post-up ip rule add table eno1t from XX.XX.XX.X0
post-up ip rule add table eno1t to XX.XX.XX.X0
auto eno1:1
iface eno1:1 inet static
address XX.XX.XX.X1
netmask 255.255.255.0
post-up ip rule add table eno1t from XX.XX.XX.X1
post-up ip rule add table eno1t to XX.XX.XX.X1
post-up ip route add 10.8.0.0/24 dev tun0 src XX.XX.XX.X1 table eno1t
post-down ip route del 10.8.0.0/24 dev tun0 src XX.XX.XX.X1 table eno1t
auto eno1:2
iface eno1:2 inet static
address XX.XX.XX.X2
netmask 255.255.255.0
post-up ip rule add table eno1t from XX.XX.XX.X2
post-up ip rule add table eno1t to XX.XX.XX.X2
iface eno1 inet6 static
address XXXX:XXXX:XXXX:XXXX:1:1::/64
gateway XXXX:XXXX:XXXX:XXXX::1
up ip -6 addr add XXXX:XXXX:XXXX:XXXX:1:1:1:1/64 dev $IFACE
up ip -6 addr add XXXX:XXXX:XXXX:XXXX:1:1:1:2/64 dev $IFACE
down ip -6 addr del XXXX:XXXX:XXXX:XXXX:1:1:1:1/64 dev $IFACE
down ip -6 addr del XXXX:XXXX:XXXX:XXXX:1:1:1:2/64 dev $IFACE
# The secondary network interface
allow-hotplug eno2
iface eno2 inet static
address XX.XX.XX.X5
netmask 255.255.255.0
post-up ip route add XX.XX.XX.0/24 dev eno2 src XX.XX.XX.X5 table eno2t
post-up ip route add default via XX.XX.XX.1 table eno2t
post-up ip rule add table eno2t from XX.XX.XX.X5
post-up ip rule add table eno2t to XX.XX.XX.X5
post-up ip route add 10.8.0.0/24 dev tun0 src XX.XX.XX.X5 table eno2t
post-down ip route del 10.8.0.0/24 dev tun0 src XX.XX.XX.X5 table eno2t
iface eno2 inet6 static
address XXXX:XXXX:XXXX:XXXX:1:2::/96
up ip -6 addr add XXXX:XXXX:XXXX:XXXX:1:2:1:1/64 dev $IFACE
up ip -6 addr add XXXX:XXXX:XXXX:XXXX:1:2:1:2/64 dev $IFACE
down ip -6 addr del XXXX:XXXX:XXXX:XXXX:1:2:1:1/64 dev $IFACE
down ip -6 addr del XXXX:XXXX:XXXX:XXXX:1:2:1:2/64 dev $IFACE
# OpenVPN network
iface tun0 inet6 static
address XXXX:XXXX:XXXX:XXXX:1:3::/80ืื ืกืขืืืื ืืก ืงืขื ืขื ืืืื ืืขืืืขื ืื ืืืืฃ ืงืืื ืกืขืจืืืขืจ ืืื tech.ru (ืืื ืึท ืืืกื ืงืึธืืึธืจืืึทื ืืืฉืึทื ืืื ืฉืืืฆื) ืืื ืขืก ืืืขื ืืืืื ืึทืจืืขื ืืื ืขืก ืืึธื.
ืืืื ืืืจ ืืึธื ืืขืจืคืึทืจืื ื ืืื ืกืขืืึทืคึผ ืขื ืืขื ืืื ืื ืคึฟืึทืจ Hetzner, OVH, ืืึธืก ืืื ืึทื ืืขืจืฉ. ืฉืืืขืจืขืจ.
eno1 ืืื ืืขืจ ื ืึธืืขื ืคืื ื ืขืฅ ืงืึธืจื #1 (ืคึผืึทืืขืืขื ืึธืืขืจ ืึทื ืืืืึทืืึทื).
eno2 ืืื ืืขืจ ื ืึธืืขื ืคืื ื ืขืฅ ืงืึธืจื #2 (ืฉื ืขื, ืึธืืขืจ ืืื ืึท ืฆืึธื).
tun0 ืืื ืื ื ืึธืืขื ืคืื ืื ืืืืจืืืึทื ื ืขืฅ ืงืึธืจื ืคึฟืื OpenVPN.
XX.XX.XX.X0 - IPv4 #1 ืืืืฃ ืขื ืึธ1.
XX.XX.XX.X1 - IPv4 #2 ืืืืฃ ืขื ืึธ1.
XX.XX.XX.X2 - IPv4 #3 ืืืืฃ ืขื ืึธ1.
XX.XX.XX.X5 - IPv4 #1 ืืืืฃ ืขื ืึธ2.
XX.XX.XX.1 - IPv4 ืืืืืืืื.
XXXX:XXXX:XXXX:XXXX::/64 - IPv6 ืคึฟืึทืจ ืื ืืื ืฆืข ืกืขืจืืืขืจ.
XXXX:XXXX:XXXX:XXXX:1:2::/96 - IPv6 ืคึฟืึทืจ ืขื ืึธ2, ืึทืืฅ ืึทื ืืขืจืฉ ืคืื ืื ืึทืจืืืก ืืืื ืืื ืขื ืึธ1.
XXXX:XXXX:XXXX:XXXX::1 โ IPv6 ืืืืืืืื (ืขืก ืืื ืืืื ืฆื ืืืืขืจืงื ืึทื ืืึธืก ืงืขื / ืืึธื ืืืื ืืขืืื ืืืคืขืจืขื ืืื. ืกืคึผืขืฆืืคืืฆืืจื ืื IPv6 ืืึทืฉืืืืขื).
dns-nameservers - 127.0.0.1 ืืื ืื ืืขืืืืื (ืืืืึทื ืืื ืื ืืื ืืื ืกืืึทืืืจื ืืึธืืงืึทืื) ืืื 213.248.1.6 (ืืึธืก ืืื ืคึฟืื tech.ru).
"ืืืฉ ืขื ืึธ1ื" ืืื "ืืืฉ ืขื ืึธ2ื" - ืื ืืืึทืืฉ ืคืื ืื ืืึทืจืฉืจืื ืึผืืืื ืืื ืึทื ืคืึทืจืงืขืจ ืงืืื ืืืจื ืขื ืึธ1 -> ืืืึธืื ืืึธืื ืืืจื ืขืก, ืืื ืคืึทืจืงืขืจ ืืืึธืก ืงืืื ืืืจื ืขื ืึธ2 -> ืืืึธืื ืืึธืื ืืืจื ืขืก. ืืื ืืืื ืงืึทื ืขืงืฉืึทื ื ืื ืืฉืืืืืื ืืืจื ืื ืกืขืจืืืขืจ ืืืึธืื ืืืื ืืืจื ืขื ืึธ1.
ip route add default via XX.XX.XX.1 table eno1tืืื ืืขื ืืึทืคึฟืขื ืืืจ ืกืคึผืขืฆืืคืืฆืืจื ืึทื ืงืืื ืื ืืงืึทืืคึผืจืึทืืขื ืกืืืึทื ืคืึทืจืงืขืจ ืืืึธืก ืคืืื ืืื ืืขืจ ืงืืื ืืขืจืฉื ืื ืืขืฆืืืื ื "ืืืฉ ืขื ืึธ1ื" -> ืืืขืจื ืืขืฉืืงื ืฆื ืื ืขื ืึธ1 ืฆืืืื ื.
ip route add XX.XX.XX.0/24 dev eno1 src XX.XX.XX.X0 table eno1tืืื ืืขื ืืึทืคึฟืขื ืืืจ ืกืคึผืขืฆืืคืืฆืืจื ืึทื ืงืืื ืคืึทืจืงืขืจ ืื ืืฉืืืืืื ืืืจื ืื ืกืขืจืืืขืจ ืืึธื ืืืื ืืืจืขืงืืขื ืฆื ืื eno1 ืฆืืืื ื.
ip rule add table eno1t from XX.XX.XX.X0
ip rule add table eno1t to XX.XX.XX.X0ืืื ืืขื ืืึทืคึฟืขื ืืืจ ืฉืืขืื ืื ืึผืืืื ืคึฟืึทืจ ืืึทืจืงืื ื ืคืึทืจืงืขืจ.
auto eno1:2
iface eno1:2 inet static
address XX.XX.XX.X2
netmask 255.255.255.0
post-up ip rule add table eno1t from XX.XX.XX.X2
post-up ip rule add table eno1t to XX.XX.XX.X2ืืขืจ ืืืึธืง ืกืคึผืขืฆืืคืืฆืืจื ืึท ืฆืืืืื IPv4 ืคึฟืึทืจ ืื eno1 ืฆืืืื ื.
ip route add 10.8.0.0/24 dev tun0 src XX.XX.XX.X1 table eno1t
ืืื ืืขื ืืึทืคึฟืขื ืืืจ ืฉืืขืื ืื ืืึทืจืฉืจืื ืคืื OpenVPN ืงืืืืึทื ืฅ ืฆื ืืืืข IPv4 ืึทืืืฅ XX.XX.XX.X0.
ืืื ื ืึธื ืืึธื ื ืื ืคึฟืึทืจืฉืืืื ืืืึธืก ืืขื ืืึทืคึฟืขื ืืื ืืขื ืื ืคึฟืึทืจ ืึทืืข IPv4.
iface eno1 inet6 static
address XXXX:XXXX:XXXX:XXXX:1:1::/64
gateway XXXX:XXXX:XXXX:XXXX::1ืืึธืก ืืื ืืื ืืืจ ืฉืืขืื ืื ืึทืืจืขืก ืคึฟืึทืจ ืื ืฆืืืื ื ืืื. ืืขืจ ืกืขืจืืืขืจ ืืืขื ื ืืฆื ืขืก ืืื ืึท "ืึทืืืืึธืืื ื" ืึทืืจืขืก. ืืืขื ื ืื ืืืื ืืขืืืืื ื ืืื ืงืืื ืืืขื ืืืืืขืจ.
ืคืืจืืืืก ืืื ":1:1::" ืึทืืื ืงืึธืืคึผืืืฆืืจื? ืึทืืื ืึทื OpenVPN ืึทืจืืขื ืจืืืืืง ืืื ืืืืื ืคึฟืึทืจ ืืขื. ืืขืจ ืืืืฃ ืืขื ืฉืคึผืขืืขืจ.
ืืืืฃ ืืขืจ ืืขืืข ืคืื โโืืืืืืืื - ืืึธืก ืืื ืืื ืขืก ืึทืจืืขื ืืื ืืึธืก ืืื ืืื. ืึธืืขืจ ืืขืจ ืจืืืืืง ืืืขื ืืื ืฆื ืึธื ืืืืึทืื ืืึธ ืื IPv6 ืคืื ืื ืืึทืฉืืืืขื ืฆื ืืืึธืก ืื ืกืขืจืืืขืจ ืืื ืงืึธื ื ืขืงืืขื.
ืึธืืขืจ, ืคึฟืึทืจ ืขืืืขืืข ืกืืื, IPv6 ืกืืึทืคึผืก ืืจืืขืื ืืืื ืืื ืืึธื ืืึธืก. ืืึธืก ืืื ืืืกืืึธืืข ืึท ืืื ืคืื tech.ru ืคึผืจืึธืืืขื.
ip -6 addr add XXXX:XXXX:XXXX:XXXX:1:1:1:1/64 dev $IFACEืืึธืก ืืื ืึทืืื ื ืึทื IPv6 ืึทืืจืขืก ืฆื ืื ืฆืืืื ื. ืืืื ืืืจ ืืึทืจืคึฟื ืึท ืืื ืืขืจื ืึทืืจืขืกืขืก, ืืึธืก ืืืื ื ืึท ืืื ืืขืจื ืฉืืจืืช ืืื ืืขื ืืขืงืข.
iface eno1 inet6 static
address XXXX:XXXX:XXXX:XXXX:1:1::/64
...
iface eno2 inet6 static
address XXXX:XXXX:XXXX:XXXX:1:2::/96
...
iface tun0 inet6 static
address XXXX:XXXX:XXXX:XXXX:1:3::/80ืืื ืืืืขืจืงื ืื ืึทืืจืขืกืขืก ืืื ืกืืื ืขืฅ ืคืื ืึทืืข ืื ืืขืจืคืืืกืื ืฆื ืืึทืื ืขืก ืงืืึธืจ.
eno1 - ืืืื ืืืื "/64" - ืืืืึทื ืืึธืก ืืื ืืื ืืืขืจ ืืื ืฆืข ืืขืงื ืคืื ืึทืืจืขืกืขืก.
tun0 - ืื ืกืืื ืขื ืืืื ืืืื ืืจืขืกืขืจ ืืื ืขื ืึธ1. ืึทื ืืขืจืฉ, ืขืก ืืืขื ื ืื ืืืื ืืขืืืขื ืฆื ืงืึทื ืคืืืืขืจ ืึทื IPv6 ืืืืืืืื ืคึฟืึทืจ OpenVPN ืงืืืืึทื ืฅ.
eno2 - ืื ืกืืื ืขื ืืืื ืืืื ืืจืขืกืขืจ ืืื tun0. ืึทื ืืขืจืฉ, OpenVPN ืงืืืืึทื ืฅ ืงืขื ืขื ื ืืฉื ืึทืงืกืขืก ืืืืข IPv6 ืึทืืจืขืกืขืก.
ืคึฟืึทืจ ืงืืขืจืืื, ืืื ืืืืกืืขืจืืืืืื ืึท ืกืืื ืขื ืฉืจืื ืคืื 16, ืึธืืขืจ ืืืื ืืืจ ืืืืื, ืืืจ ืงืขื ืขื ืืคืืื ืืึธื "1" ืฉืจืื.
ืึทืงืงืึธืจืืื ืืื, 64+16 = 80, ืืื 80+16 = 96.ืคึฟืึทืจ ืืคืืื ืืขืจ ืงืืึธืจืงืืื:
XXXX:XXXX:XXXX:XXXX:1:1:YYYY:YYYY ืืขื ืขื ืึทืืจืขืกืขืก ืืืึธืก ืืึธื ืืืื ืึทืกืืื ื ืฆื ืกืคึผืขืฆืืคืืฉ ืืืืืืขื ืึธืืขืจ ืืึทืืื ืื ืืก ืืืืฃ ืื ืขื ืึธ1 ืฆืืืื ื.
XXXX:XXXX:XXXX:XXXX:1:2:YYYY:YYYY ืืขื ืขื ืึทืืจืขืกืขืก ืืืึธืก ืืึธื ืืืื ืึทืกืืื ื ืฆื ืกืคึผืขืฆืืคืืฉ ืืืืืืขื ืึธืืขืจ ืืึทืืื ืื ืืก ืืืืฃ ืื ืขื ืึธ2 ืฆืืืื ื.
XXXX:XXXX:XXXX:XXXX:1:3:YYYY:YYYY ืืขื ืขื ืึทืืจืขืกืขืก ืืืึธืก ืืึธื ืืืื ืึทืกืืื ื ืฆื OpenVPN ืงืืืืึทื ืฅ ืึธืืขืจ ืืขืืืืื ื ืืื OpenVPN ืกืขืจืืืืก ืึทืืจืขืกืขืก.
ืฆื ืงืึทื ืคืืืืขืจ ืื ื ืขืฅ, ืขืก ืืึธื ืืืื ืืขืืืขื ืฆื ืจืืกืืึทืจื ืื ืกืขืจืืืขืจ.
IPv4 ืขื ืืขืจืื ืืขื ืืขื ืขื ืคึผืืงื ืืื ืืืขื ืขืงืกืึทืงืืืืึทื (ืืืื ืืืืขืจ ืฆื ืืึทื ืืืืงืืขื ืขืก ืืื ืคืึทืจืฉืืขืื - ืึทื ืืขืจืฉ ืืขื ืืึทืคึฟืขื ืืืขื ืคืฉืื ืงืจืึทื ืื ื ืขืฅ ืืืืฃ ืื ืกืขืจืืืขืจ):
/etc/init.d/networking restartืืืื ืฆื ืื ืกืืฃ ืคืื ืืขืจ ืืขืงืข "/etc/iproute2/rt_tables":
100 eno1t
101 eno2t
ืึธื ืืขื, ืืืจ ืงืขื ืขื ื ืืฉื ื ืืฆื ืื ืื ืืืฉื ืืื ืื "/etc/network/interfaces" ืืขืงืข.
ืื ื ืืืขืจื ืืืื ืืืื ืืื ืฆืืง ืืื ืืืืื ืืงืขืจ ืืื 65535.
IPv6 ืขื ืืขืจืื ืืขื ืงืขื ืขื ืืืื ืืฉืืื ืืืฉื ืืืืื ืึธื ืจืขืืึธืึธืืื ื, ืึธืืขืจ ืฆื ืืึธื ืืึธืก, ืืืจ ืืึทืจืคึฟื ืฆื ืืขืจื ืขื ืืื ืืื ืืกืืขืจ ืืจืื ืงืึทืืึทื ืื:
ip -6 addr ...
ip -6 route ...
ip -6 neigh ...ืืึทืฉืืขืืืงื "/etc/sysctl.conf"
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward = 1
# Do not accept ICMP redirects (prevent MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
# Do not send ICMP redirects (we are not a router)
net.ipv4.conf.all.send_redirects = 0
# For receiving ARP replies
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.default.arp_filter = 0
# For sending ARP
net.ipv4.conf.all.arp_announce = 0
net.ipv4.conf.default.arp_announce = 0
# Enable IPv6
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.lo.disable_ipv6 = 0
# IPv6 configuration
net.ipv6.conf.all.autoconf = 1
net.ipv6.conf.all.accept_ra = 0
# For OpenVPN
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.proxy_ndp = 1
# For nginx on boot
net.ipv6.ip_nonlocal_bind = 1ืืึธืก ืืขื ืขื ืื ืกืขืืืื ืืก ืคืื ืืืื ืกืขืจืืืืจืขืจ "Sysctl". ืืืืื ืื ืืืืืื ืขืคืขืก ืืืืืืื.
net.ipv4.ip_forward = 1ืึธื ืืขื, OpenVPN ืืืขื ื ืืฉื ืึทืจืืขืื ืืื ืึทืืข.
net.ipv6.ip_nonlocal_bind = 1ืืืขืจ ืขืก ืื ืืืืก ืคืจืืืื ืฆื ืืื ืื IPv6 (ืืืฉื nginx) ืืืืื ื ืึธื ืื ืฆืืืื ื ืืื ืึทืจืืืฃ ืืืขื ืืึทืงืืืขื ืึท ืืขืืช. ืึทื ืืึธืก ืึทืืจืขืก ืืื ื ืืฉื ืื ืืืฆื.
ืฆื ืืืกืืืืื ืึทืืึท ืึท ืกืืืืึทืฆืืข, ืึทืืึท ืึท ืืึทืฉืืขืืืงื ืืื ืืขืืืื.
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.proxy_ndp = 1ืึธื ืื IPv6 ืกืขืืืื ืืก, ืคืึทืจืงืขืจ ืคืื ืื OpenVPN ืงืืืขื ื ืืื ื ืืฉื ืืื ืืขืจ ืืืขืื.
ืื ืืขืจืข ืกืขืืืื ืืก ืืขื ืขื ืึธืืขืจ ื ืืฉื ืืึทืืืึทืืืง ืึธืืขืจ ืืื ืืึธื ื ืื ืืขืืขื ืงืขื ืืืึธืก ืืื ืืขื ืขื ืคึฟืึทืจ.
ืึธืืขืจ ื ืึธืจ ืืื ืคืึทื, ืืื ืืึธืื ืขืก "ืืื ืืื."
ืึผืื ืขื ืืขืจืื ืืขื ืฆื ืืขื ืืขืงืข ืืึธื ืืืื ืคึผืืงื ืึธื ืจืืกืืึทืจืืื ื ืื ืกืขืจืืืขืจ, ืืืจ ืืึทืจืคึฟื ืฆื ืืืืคื ืื ืืึทืคึฟืขื:
sysctl -pืืขืจ ืืขืืึทืืืก ืืืขืื "ืืืฉ" ืึผืืืื:
============== OpenVPN =============
OpenVPN IPv4 ืืื ื ืืฉื ืึทืจืืขืื ืึธื ืืคึผืืึทืืืขืก.
ืืืึทื ืืคึผืืึทืืืขืก ืืขื ืขื ืืื ืืึธืก ืคึฟืึทืจ VPN:
iptables -A INPUT -p udp -s YY.YY.YY.YY --dport 1194 -j ACCEPT
iptables -A FORWARD -i tun0 -o eno1 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eno1 -j SNAT --to-source XX.XX.XX.X0
##iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eno1 -j MASQUERADE
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j DROP
iptables -A FORWARD -p udp --dport 1194 -j DROP
YY.YY.YY.YY ืืื ืืืื ืกืืึทืืืง IPv4 ืึทืืจืขืก ืคืื ืื ืืืืข ืืึทืฉืื.
10.8.0.0/24 - IPv4 openvpn ื ืขืฅ. IPv4 ืึทืืจืขืกื ืคึฟืึทืจ ืึธืคึผืขื ืืืคึผื ืงืืืืึทื ืฅ.
ืื ืงืึธื ืกืืกืืขื ืกื ืคืื ืื ืึผืืืื ืืื ืืืืืืืง.
iptables -A INPUT -p udp -s YY.YY.YY.YY --dport 1194 -j ACCEPT
iptables -A FORWARD -i tun0 -o eno1 -j ACCEPT
...
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j DROP
iptables -A FORWARD -p udp --dport 1194 -j DROPืืึธืก ืืื ืึท ืืึทืืจืขื ืขืฆืื ื ืึทืืื ืึทื ืืืืื ืืื ืงืขื ืขื ื ืืฆื OpenVPN ืคึฟืื ืืืื ืกืืึทืืืง IP.
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eno1 -j SNAT --to-source XX.XX.XX.X0
-- ะธะปะธ --
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eno1 -j MASQUERADEืฆื ืคึฟืึธืจืืืขืจืืก IPv4 ืคึผืึทืงืืฅ ืฆืืืืฉื OpenVPN ืงืืืืึทื ืฅ ืืื ืื ืืื ืืขืจื ืขื, ืืืจ ืืึทืจืคึฟื ืฆื ืจืขืืืกืืจืืจื ืืืื ืขืจ ืคืื ืื ืงืึทืืึทื ืื.
ืคึฟืึทืจ ืคืึทืจืฉืืืขื ืข ืงืึทืกืขืก, ืืืื ืขืจ ืคืื ืื ืึธืคึผืฆืืขืก ืืื ื ืืฉื ืคึผืึทืกืืง.
ืืืืืข ืงืึทืืึทื ืื ืืขื ืขื ืคึผืึทืกืืง ืคึฟืึทืจ ืืืื ืคืึทื.
ื ืึธื ืืืืขื ืขื ืื ืืึทืงืืืืขื ืืืืฉืึทื, ืืื ืืืืกืืขืจืืืืืื ืืขืจ ืขืจืฉืืขืจ ืึธืคึผืฆืืข ืืืืึทื ืขืก ื ืืฆื ืืืืื ืืงืขืจ ืงืคึผื.
ืึผืื ืึทืืข ืืคึผืืึทืืืขืก ืกืขืืืื ืืก ืืึธื ืืืื ืคึผืืงื ืืื ื ืึธื ืจืขืืึธืึธื, ืืืจ ืืึทืจืคึฟื ืฆื ืจืึทืืขืืืขื ืืื ืขืจืืขืฅ.
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6ืืืขืื ืข ื ืขืืข ื ืืฒื ืข ื ื ืืฉ ื ืืขืงืืื ื ืืขืฐืืจื . ืืื ืืขื ืขื ืืขื ืืฆื ืืืจื ืื "iptables-persistent" ืคึผืขืงื.
apt-get install iptables-persistentืื ืกืืึธืืื ื ืื ืืืืคึผื OpenVPN ืคึผืขืงื:
apt-get install openvpn easy-rsaืืึธืืืจ ืฉืืขืื ืึท ืืืกืืขืจ ืคึฟืึทืจ ืกืขืจืืืคืืงืึทืฅ (ืคืึทืจืืจืขืืขืจ ืืืื ืืืึทืืืขืก):
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
ln -s openssl-1.0.0.cnf openssl.cnfืืื ืก ืจืขืืึทืืืจื ืื ืืึทืืืืึทืื ืืืกืืขืจ ืกืขืืืื ืืก:
mcedit vars...
# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="RU"
export KEY_PROVINCE="Krasnodar"
export KEY_CITY="Dinskaya"
export KEY_ORG="Own"
export KEY_EMAIL="[email protected]"
export KEY_OU="VPN"
# X509 Subject Field
export KEY_NAME="server"
...ืฉืึทืคึฟื ืึท ืกืขืจืืืขืจ ืืึทืืืืึทืื:
cd ~/openvpn-ca
source vars
./clean-all
./build-ca
./build-key-server server
./build-dh
openvpn --genkey --secret keys/ta.keyืืึธืืืจ ืฆืืืจืืืื ืื ืคืืืืงืืื ืฆื ืฉืึทืคึฟื ืื ืืขืฆื "ืงืืืขื ื-ื ืึทืืข.ืึธืคึผืืื" ืืขืงืขืก:
mkdir -p ~/client-configs/files
chmod 700 ~/client-configs/files
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/client-configs/base.conf
mcedit ~/client-configs/base.conf# Client mode
client
# Interface tunnel type
dev tun
# TCP protocol
proto tcp-client
# Address/Port of VPN server
remote XX.XX.XX.X0 1194
# Don't bind to local port/address
nobind
# Don't need to re-read keys and re-create tun at restart
persist-key
persist-tun
# Remote peer must have a signed certificate
remote-cert-tls server
ns-cert-type server
# Enable compression
comp-lzo
# Custom
ns-cert-type server
tls-auth ta.key 1
cipher DES-EDE3-CBCืืึธืืืจ ืฆืืืจืืืื ืึท ืฉืจืืคื ืืืึธืก ืืืขื ืฆืื ืืืคืืืกื ืึทืืข ืืขืงืขืก ืืื ืึท ืืืื ืึธืคึผืืื ืืขืงืข.
mcedit ~/client-configs/make_config.sh
chmod 700 ~/client-configs/make_config.sh#!/bin/bash
# First argument: Client identifier
KEY_DIR=~/openvpn-ca/keys
OUTPUT_DIR=~/client-configs/files
BASE_CONFIG=~/client-configs/base.conf
cat ${BASE_CONFIG}
<(echo -e '<ca>')
${KEY_DIR}/ca.crt
<(echo -e '</ca>n<cert>')
${KEY_DIR}/.crt
<(echo -e '</cert>n<key>')
${KEY_DIR}/.key
<(echo -e '</key>n<tls-auth>')
${KEY_DIR}/ta.key
<(echo -e '</tls-auth>')
> ${OUTPUT_DIR}/.ovpnืงืจืืืืืื ื ืืขืจ ืขืจืฉืืขืจ OpenVPN ืงืืืขื ื:
cd ~/openvpn-ca
source vars
./build-key client-name
cd ~/client-configs
./make_config.sh client-nameืืขืจ ืืขืงืข "~/client-configs/files/client-name.ovpn" ืืื ืืขืฉืืงื ืฆื ืืขื ืงืืืขื ื ืก ืืืื.
ืคึฟืึทืจ ืืึธืก ืงืืืืึทื ืฅ ืืืจ ืืึทืจืคึฟื ืฆื ืืึธื ืื ืคืืืืขื ืืข ืืจืืง:
ืืขืจ ืืื ืืึทืื ืคืื ืื "tls-auth" ืงืืืืื ืืืื ืืืื ืึธื ืืึทืืขืจืงืื ืืขื.
ืืื ืืืื ืฉืืขืื "ืฉืืืกื-ืจืืืืื ื 1" ืืืืื ืืืืืขืจ ืื "tls-auth" ืงืืืืื.
ืืึธืืืจ ืงืึทื ืคืืืืขืจ ืื OpenVPN ืกืขืจืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื:
cd ~/openvpn-ca/keys
cp ca.crt ca.key server.crt server.key ta.key dh2048.pem /etc/openvpn
gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz | tee /etc/openvpn/server.conf
mcedit /etc/openvpn/server.conf# Listen port
port 1194
# Protocol
proto tcp-server
# IP tunnel
dev tun0
tun-ipv6
push tun-ipv6
# Master certificate
ca ca.crt
# Server certificate
cert server.crt
# Server private key
key server.key
# Diffie-Hellman parameters
dh dh2048.pem
# Allow clients to communicate with each other
client-to-client
# Client config dir
client-config-dir /etc/openvpn/ccd
# Run client-specific script on connection and disconnection
script-security 2
client-connect "/usr/bin/sudo -u root /etc/openvpn/server-clientconnect.sh"
client-disconnect "/usr/bin/sudo -u root /etc/openvpn/server-clientdisconnect.sh"
# Server mode and client subnets
server 10.8.0.0 255.255.255.0
server-ipv6 XXXX:XXXX:XXXX:XXXX:1:3::/80
topology subnet
# IPv6 routes
push "route-ipv6 XXXX:XXXX:XXXX:XXXX::/64"
push "route-ipv6 2000::/3"
# DNS (for Windows)
# These are OpenDNS
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
# Configure all clients to redirect their default network gateway through the VPN
push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway ipv6" #For iOS
# Don't need to re-read keys and re-create tun at restart
persist-key
persist-tun
# Ping every 10s. Timeout of 120s.
keepalive 10 120
# Enable compression
comp-lzo
# User and group
user vpn
group vpn
# Log a short status
status openvpn-status.log
# Logging verbosity
##verb 4
# Custom config
tls-auth ta.key 0
cipher DES-EDE3-CBCืืึธืก ืืื ืืืจืฃ ืืื ืกืืจ ืฆื ืฉืืขืื ืึท ืกืืึทืืืง ืึทืืจืขืก ืคึฟืึทืจ ืืขืืขืจ ืงืืืขื ื (ื ืื ื ืืืืืง, ืึธืืขืจ ืืื ื ืืฆื ืขืก):
# Client config dir
client-config-dir /etc/openvpn/ccdืื ืืขืจืกื ืฉืืืขืจ ืืื ืฉืืืกื ืืขืืึทื.
ืฆืื ืืึทืืืืขืจื, OpenVPN ืงืขื ื ืึธื ื ืืฉื ืืืืกื ืืื ืฆื ืื ืืืคึผืขื ืืึทื ืืื ืงืึทื ืคืืืืขืจ ืึทื IPv6 ืืืืืืืื ืคึฟืึทืจ ืงืืืืึทื ืฅ.
ืืืจ ืืึธืื ืฆื "ืืึทื ืืืึทืื" ืคืึธืจืืืก ืืขื ืคึฟืึทืจ ืืขืืขืจ ืงืืืขื ื.
# Run client-specific script on connection and disconnection
script-security 2
client-connect "/usr/bin/sudo -u root /etc/openvpn/server-clientconnect.sh"
client-disconnect "/usr/bin/sudo -u root /etc/openvpn/server-clientdisconnect.sh"ืืขืงืข "/etc/openvpn/server-clientconnect.sh":
#!/bin/sh
# Check client variables
if [ -z "$ifconfig_pool_remote_ip" ] || [ -z "$common_name" ]; then
echo "Missing environment variable."
exit 1
fi
# Load server variables
. /etc/openvpn/variables
ipv6=""
# Find out if there is a specific config with fixed IPv6 for this client
if [ -f "/etc/openvpn/ccd/$common_name" ]; then
# Get fixed IPv6 from client config file
ipv6=$(sed -nr 's/^.*ifconfig-ipv6-push[ t]+([0-9a-fA-F:]+).*$/1/p' "/etc/openvpn/ccd/$common_name")
echo $ipv6
fi
# Get IPv6 from IPv4
if [ -z "$ipv6" ]; then
ipp=$(echo "$ifconfig_pool_remote_ip" | cut -d. -f4)
if ! [ "$ipp" -ge 2 -a "$ipp" -le 254 ] 2>/dev/null; then
echo "Invalid IPv4 part."
exit 1
fi
hexipp=$(printf '%x' $ipp)
ipv6="$prefix$hexipp"
fi
# Create proxy rule
/sbin/ip -6 neigh add proxy $ipv6 dev eno1ืืขืงืข "/etc/openvpn/server-clientdisconnect.sh":
#!/bin/sh
# Check client variables
if [ -z "$ifconfig_pool_remote_ip" ] || [ -z "$common_name" ]; then
echo "Missing environment variable."
exit 1
fi
# Load server variables
. /etc/openvpn/variables
ipv6=""
# Find out if there is a specific config with fixed IPv6 for this client
if [ -f "/etc/openvpn/ccd/$common_name" ]; then
# Get fixed IPv6 from client config file
ipv6=$(sed -nr 's/^.*ifconfig-ipv6-push[ t]+([0-9a-fA-F:]+).*$/1/p' "/etc/openvpn/ccd/$common_name")
fi
# Get IPv6 from IPv4
if [ -z "$ipv6" ]; then
ipp=$(echo "$ifconfig_pool_remote_ip" | cut -d. -f4)
if ! [ "$ipp" -ge 2 -a "$ipp" -le 254 ] 2>/dev/null; then
echo "Invalid IPv4 part."
exit 1
fi
hexipp=$(printf '%x' $ipp)
ipv6="$prefix$hexipp"
fi
# Delete proxy rule
/sbin/ip -6 neigh del proxy $ipv6 dev eno1ืืืืืข ืกืงืจืืคึผืก ื ืืฆื ืื ืืขืงืข "/etc/openvpn/variables":
# Subnet
prefix=XXXX:XXXX:XXXX:XXXX:2:
# netmask
prefixlen=112ืืื ืืืืื ืฉืืืขืจ ืฆื ืืขืืขื ืงืขื ืคืืจืืืืก ืขืก ืฉืืืื ืืืื ืืขืฉืจืืื.
ืืืฆื ื ืขืืืึทืกืง = 112 ืงืืงื ืืึธืื ืข (ืขืก ืืึธื ืืืื 96 ืจืขืื ืืึธืจื).
ืืื ืื ืคึผืจืขืคืืงืก ืืื ืืึธืื ืข, ืขืก ืงืขื ื ืืฉื ืืืืึทืื ืื tun0 ื ืขืฅ.
ืืืขืจ ืึธืืงืื, ืืื ืืืขื ืืึธืื ืขืก ืืื ืืื.
cipher DES-EDE3-CBCืืึธืก ืืื ื ืืฉื ืคึฟืึทืจ ืึทืืขืืขื - ืืื ืืืืกืืขืจืืืืืื ืืขื ืืืคึฟื ืคืื ืขื ืงืจืืคึผืืื ื ืื ืงืฉืจ.
============= ืคึผืึธืกืืคืืงืก =============
ืื ืกืืึทืืืจื ืื ืืืืคึผื ืคึผืขืงื:
apt-get install postfixืืืขื ืื ืกืืึธืืื ื, ืกืขืืขืงืืืจื "ืืื ืืขืจื ืขื ืคึผืืึทืฅ".
ืืืื "/etc/postfix/main.cf" ืงืืงื ืืื ืืึธืก:
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
readme_directory = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
# fresh installs.
compatibility_level = 2
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/domain1.com.2018.chained.crt
smtpd_tls_key_file=/etc/ssl/domain1.com.2018.key
smtpd_use_tls=yes
smtpd_tls_auth_only = yes
smtp_bind_address = XX.XX.XX.X0
smtp_bind_address6 = XXXX:XXXX:XXXX:XXXX:1:1:1:1
smtp_tls_security_level = may
smtp_tls_ciphers = export
smtp_tls_protocols = !SSLv2, !SSLv3
smtp_tls_loglevel = 1
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = domain1.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = domain1.com
mydestination = localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4
internal_mail_filter_classes = bounce
# Storage type
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
# SMTP-Auth settings
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
#reject_invalid_hostname,
#reject_unknown_recipient_domain,
reject_unauth_destination,
reject_rbl_client sbl.spamhaus.org,
check_policy_service unix:private/policyd-spf
smtpd_helo_restrictions =
#reject_invalid_helo_hostname,
#reject_non_fqdn_helo_hostname,
reject_unknown_helo_hostname
smtpd_client_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_non_fqdn_helo_hostname,
permit
# SPF
policyd-spf_time_limit = 3600
# OpenDKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = unix:var/run/opendkim/opendkim.sock
non_smtpd_milters = unix:var/run/opendkim/opendkim.sock
# IP address per domain
sender_dependent_default_transport_maps = pcre:/etc/postfix/sdd_transport.pcreืืื ืก ืงืืง ืืื ืื ืืขืืึทืืืก ืคืื ืืขื ืงืึธื ืคืืืืจืึทืืืึธื.
smtpd_tls_cert_file=/etc/ssl/domain1.com.2018.chained.crt
smtpd_tls_key_file=/etc/ssl/domain1.com.2018.keyืืืื ืื ืืึทืืจืึธืืืกืง ืจืขืืืืึทื ืฅ, ืืขื ืืืึธืง ืึผืืื "ืืืก ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืคืึทืืฉ ืืขืืืก."ืืืืื 8 ืืึธืจ ื ืึธื ืื ืึธื ืืืื ืคืื ืืืื ืงืึทืจืืขืจืข ืืื ืื ืืขืืืืื ืฆื ืคึฟืึทืจืฉืืืื ืืื SSL ืึทืจืืขื.
ืืขืจืืืขืจ, ืืื ืืืขื ื ืขืืขื ืื ืคืจืืืืืื ืคืื ืืืกืงืจืืืืื ื ืืื ืฆื ื ืืฆื SSL (ืึธื ืขื ืืคึฟืขืจื ืื ืคืจืืืขืก "ืืื ืืื ืขืก ืึทืจืืขื?" ืืื "ืคืืจืืืืก ืืื ืขืก ืึทืจืืขื?").
ืื ืืงืขืจ ืคืื ืืึธืืขืจื ืขื ืงืจืืคึผืฉืึทื ืืื ืื ืฉืึทืคืื ื ืคืื ืึท ืฉืืืกื ืคึผืึธืจ (ืฆืืืื ืืืืขืจ ืืึทื ื ืกืืจืื ืืก ืคืื ืืืชืืืช).
ืืืื "ืฉืืืกื" ืืื ืคึผืจืืืืึทื, ืื ืื ืืขืจืข ืฉืืืกื ืืื "ืฆืืืืจ". ืืืจ ืืึทืืื ืื ืคึผืจืืืืึทื ืฉืืืกื ืืืืขืจ ืงืขืจืคืึทืื ืกืื. ืืืจ ืคืึทืจืฉืคึผืจืืืื ืืขื ืฆืืืืจ ืฉืืืกื ืฆื ืึทืืขืืขื.
ื ืืฆื ืึท ืฆืืืืจ ืฉืืืกื, ืืืจ ืงืขื ืขื ืขื ืงืจืืคึผื ืึท ืฉืืจืืงื ืคืื ืืขืงืกื ืึทืืื ืึทื ืืืืื ืื ืืึทืืืฆืขืจ ืคืื ืื ืคึผืจืืืืึทื ืฉืืืกื ืงืขื ืขื ืืขืงืจืืคึผื ืขืก.
ื ื, ืืึธืก ืืื ืื ืืื ืฆืข ืืงืขืจ ืคืื ืื ืืขืื ืึธืืึธืืืข.ืฉืจืื #1 - ืืืืคึผืก ืืืืืืขื.
ืืืขื ืึทืงืกืขืกืื ื ืึท ืคึผืืึทืฅ, ืืขืจ ืืืขืืขืจืขืจ ืืขืจื ื ืคืื ืื ืืืขื ืกืขืจืืืขืจ ืึทื ืื ืคึผืืึทืฅ ืืื https ืืื ืืขืจืืืขืจ ืจืืงืืืขืก ืึท ืฆืืืืจ ืฉืืืกื.
ืืขืจ ืืืขื ืกืขืจืืืขืจ ืืื ืืขื ืฆืืืืจ ืฉืืืกื. ืืขืจ ืืืขืืขืจืขืจ ื ืืฆื ืืขื ืฆืืืืจ ืฉืืืกื ืฆื ืขื ืงืจืืคึผื ืื ืืืืคึผ-ืืขืื ืืื ืฉืืงื ืขืก.
ืืขืจ ืืื ืืึทืื ืคืื ืึท ืืืืคึผ-ืืขืื ืงืขื ืขื ืืืื ืืืืขื ืขื ืืืืื ืืืจื ืื ืืืืก ืืึธืื ืื ืคึผืจืืืืึทื ืฉืืืกื, ืืึธืก ืืื ืืืืื ืื ืกืขืจืืืขืจ ืฆื ืืืึธืก ืื ืืงืฉื ืืื ืืขืืืื.
ืืืืคึผ ืืขืื ืึผืืื ืืคึผืืืช ืึท URI. ืืขืจืืืขืจ, ืืืื ืึท ืืืื ื ืืื ืืจืืื ื ืฆื ืืึทืืจืขื ืขืฆื ืึทืงืกืขืก ื ืืฉื ืฆื ืื ืืื ืฆืข ืคึผืืึทืฅ, ืึธืืขืจ ืฆื ืึท ืกืคึผืขืฆืืคืืฉ ืืืึทื, ืืึธืก ืืื ืืืืืขืืืขื ืฆื ืืึธื ืคึฟืึทืจ https ืืืืืืขื.ืฉืจืื #2 - ืื ืงืจืืคึผืืื ืขื ืืคืขืจ.
ืืขืจ ืืืขื ืกืขืจืืืขืจ ืืื ืึทื ืขื ืืคืขืจ ืืืึธืก ืงืขื ืขื ืืืื ืืืืื ืืืืขื ืขื ืืืืฃ ืื ืืืขื.
ืื ืืืืืื ื ืืื ืืึธืจ ืคึผืฉืื - ืืขืจ ืืืขืืขืจืขืจ ืืึธืืงืึทืื ืืืฉืขื ืขืจืืืฅ ืื ืืขืืืข ืคึผืจืืืืึทื-ืฆืืืืจ ืฉืืืกื ืคึผืึธืจ ืคึฟืึทืจ ืืขืืขืจ https ืคึผืืึทืฅ.
ืืื ืฆืืืืืขื ืืื ืื ืืขืื ืคึฟืึทืจ ืื ืคึผืืึทืฅ ืก ืฆืืืืจ ืฉืืืกื, ืขืก ืกืขื ืื ืืืื ืืืืข ืฆืืืืจ ืฉืืืกื.
ืืขืจ ืืืขื ืกืขืจืืืขืจ ืืขืืขื ืงื ืขืก ืืื, ืืืขื ืฉืืงื ืืืืคึผ-ืขื ืืคืขืจ, ืขื ืงืจืืคึผื ืขืก ืืื ืื ืฆืืืืจ ืฉืืืกื ืคืื ืึท ืกืคึผืขืฆืืคืืฉ ืงืืืขื ื.
ืืืฆื http-ืขื ืืคืขืจ ืงืขื ืขื ืืืื ืืขืงืจืืคึผืืื ืืืืื ืืืจื ืื ืืึทืืืฆืขืจ ืคืื ืืขื ืงืืืขื ื ืก ืืืขืืขืจืขืจ ืคึผืจืืืืึทื ืฉืืืกื (ืืึธืก ืืื, ืืขืจ ืงืืืขื ื ืืื).ืฉืจืื ื ืื 3 - ืืจืื ืื ืึท ืืืืขืจ ืงืฉืจ ืืืจื ืึท ืฆืืืืจ ืงืึทื ืึทื.
ืขืก ืืื ืึท ืืืึทืื ืขืจืึทืืืืืื ืืื ืืืึทืฉืคึผืื ื ืื 2 - ืืึธืจื ืืฉื ืคึผืจืืืืขื ืฅ ืืขืืื ื-ืืืืฉืขืจื ืคืื ืื ืืขืจืกืขืคึผืืื ื ืึท ืืืืคึผ-ืืขืื ืืื ืจืขืืึทืืืจื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืืขื ืฆืืืืจ ืฉืืืกื.
ืืืื, ืื ืื ืืขืจืืืืืขืจื ืืืขื ืงืืืจ ืืขื ืึทืืข ืื ืืื ืืึทืื ืคืื ืืขืฉืืงื ืืื ืืืงืืืขื ืึทืจืืืงืืขื ืืื ืื ืงืึธืืื ืืงืึทืฆืืข ืงืึทื ืึทื ืขื ืืขืจืื ืืขื.
ืื ืืึทื ืืืื ื ืืื ืืขื ืืื ืืึธืจ ืคึผืฉืื - ื ืึธืจ ืฉืืงื ืืขื ืืืขืืขืจืขืจ ืก ืฆืืืืจ ืฉืืืกื ืืื ืึท ืึธื ืืึธื ืื ืงืจืืคึผืืื ืืื ืื ืืืขื ืกืขืจืืืขืจ ืก ืฆืืืืจ ืฉืืืกื.
ืืขืจ ืืืขื ืกืขืจืืืขืจ ืขืจืฉืืขืจ ืกืขื ืื ืึท ืขื ืืคืขืจ ืืื "ืืืื ืฆืืืืจ ืฉืืืกื ืืื ืืื ืืึธืก" ืืื ืขื ืงืจืืคึผื ืืขื ืึธื ืืึธื ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืืืจ ืฉืืืกื.
ืืขืจ ืืืขืืขืจืขืจ ืงืืงื ืืืืฃ ืืขื ืขื ืืคืขืจ - ืืืื ืืขืจ ืึธื ืืึธื "ืืืื ืฆืืืืจ ืฉืืืกื ืืื ืืื ืืึธืก" ืืื ืืืงืืืขื - ืืึธืก ืืื ืึท 100% ืืึทืจืึทื ืืืจื ืึทื ืืขืจ ืงืึธืืื ืืงืึทืฆืืข ืงืึทื ืึทื ืืื ืืืืขืจ.
ืืื ืืืืขืจ ืืื ืขืก?
ืื ืฉืึทืคืื ื ืคืื ืึทืืึท ืึท ืืืืขืจ ืงืึธืืื ืืงืึทืฆืืข ืงืึทื ืึทื ืึทืงืขืจื ืืื ืึท ืืืืงืืึทื ืคืื ืคึผืื ื * 2. ืคึฟืึทืจ ืืืึทืฉืคึผืื 20ms.
ืืขืจ ืึทืืึทืงืขืจ ืืืื ืืึธืื ืื ืคึผืจืืืืึทื ืฉืืืกื ืคืื ืืืื ืขืจ ืคืื ืื ืคึผืึทืจืืืขืก ืืื ืฉืืืึทืื. ืึธืืขืจ ืืขืคึฟืื ืขื ืึท ืคึผืจืืืืึทื ืฉืืืกื ืืื ืึท ืคึผืึธืจ ืคืื ืืืืืกืขืงืึทื ืื.
ืืึทืงืื ื ืืืื ืืึธืืขืจื ืคึผืจืืืืึทื ืฉืืืกื ืืืขื ื ืขืืขื ืืขืงืึทืืขืก ืืืืฃ ืึท ืกืืคึผืขืจืงืึทืืคึผืืืืขืจ.ืฉืจืื #4 - ืขืคื ืืืขื ืืึทืืึทืืืืก ืคืื ืฆืืืืจ ืฉืืืกืืขื.
ืืึธื, ืืื ืืขืจ ืืื ืฆืขืจ ืืขืฉืืืืข ืขืก ืืื ืึท ืืขืืขืื ืืืื ืคึฟืึทืจ ืึท ืึทืืึทืงืขืจ ืฆื ืืืฆื ืืืืฃ ืื ืงืึธืืื ืืงืึทืฆืืข ืงืึทื ืึทื ืฆืืืืฉื ืืขื ืงืืืขื ื ืืื ืื ืกืขืจืืืขืจ.
ืืขืจ ืงืืืขื ื ืงืขื ืขื ืคืึทืจืืืื ืฆื ืืืื ืืขืจ ืกืขืจืืืขืจ, ืืื ืืขืจ ืกืขืจืืืขืจ ืงืขื ืคืึทืจืืืื ืฆื ืืืื ืืขืจ ืงืืืขื ื. ืืื ืขืืืึทืืืื ืึท ืคึผืึธืจ ืคืื ืฉืืืกืืขื ืืื ืืืืืข ืืื ืกืืจืืงืฆืืขืก.
ืืขืจื ืึธื ืืขืจ ืึทืืึทืงืขืจ ืืืขื ืืขื ืึทืืข ืื ืคืึทืจืงืขืจ ืืื ืงืขื ืขื "ืจืขืืึทืืืจื" ืืขื ืคืึทืจืงืขืจ.
ืืืฉื, ืืืืฉื ืื ืึทืืจืขืก ืืื ืฆื ืฉืืงื ืืขืื ืึธืืขืจ ื ืึธืืืึทืื ืื ืคึผืึทืจืึธื ืคืื ืึธื ืืืื ืืึทื ืงืื ื ืึธืืขืจ ืคืึทืจืฉืคึผืึทืจื "ืึทืืืืฉืขืงืฉืึทื ืึทืืึทื" ืืื ืืึทืื.
ืฆื ืงืึทืืืึทื ืึทืืึท ืึทืืึทืงืขืจื, ืืื ืืึธืื ืึท ืขืคื ืืืขื ืืึทืืึทืืืืก ืืื ืขืคื ืืืขื ืฉืืืกืืขื ืคึฟืึทืจ ืืขืืขืจ https ืคึผืืึทืฅ.
ืืขืืขืจ ืืืขืืขืจืขืจ "ืืืืกื" ืืืขืื ืื ืขืงืืืกืืขื ืฅ ืคืื ืืืขืื 200 ืึทืืึท ืืึทืืึทืืืืกืื. ืืึธืก ืืื ืคืึทืจ-ืืื ืกืืึทืืืจื ืืื ืืขืืขืจ ืืืขืืขืจืขืจ.
"ืืืืกื" ืืื ืืึทืงื ืืืจื ืึท ืฆืืืืจ ืฉืืืกื ืคืื ืืขืืขืจ ืืึทืืืืึทืื. ืึทื ืืื, ืื ืงืฉืจ ืฆื ืืขืืขืจ ืกืคึผืขืฆืืคืืฉ ืกืขืจืืึทืคืึทืงืืืฉืึทื ืืืืืึธืจืืืขื ืงืขื ืขื ื ืื ืืืื ืคืืืืง.ืืืฆื ืขืก ืืื ืึท ืคึผืฉืื ืคืืจืฉืืื ื ืคืื ืืื ืฆื ื ืืฆื SSL ืคึฟืึทืจ https.
ืืืื ืืืจ ื ืืฆื ืืืื ืืึทืจื, ืขืก ืืืขื ืืืื ืงืืึธืจ ืืื ืื ืกืคึผืขืฆืืขื ืกืขืจืืืืกืขืก ืงืขื ืขื ืืึทืง ืขืคึผืขืก ืืื ืืขื ืกืืจืืงืืืจ. ืืืขืจ ืขืก ืืืขื ืงืึธืกืื ืืื ืืึทื ืกืืจืึทืก ืืฉืชืืืืช.
ืืื ืึธืจืืึทื ืึทืืืืฉืึทื ื ืงืืขื ืขืจืขืจ ืืื ืื NSA ืึธืืขืจ CIA - ืขืก ืืื ืึผืืขื ืืืืืขืืืขื ืฆื ืืึทืง ืื ืืืืืกืืื ื ืืืจืื ืคืื ืฉืืฅ, ืืคืืื ืคึฟืึทืจ ืืืืคึผืก.ืืื ืืืขื ืืืื ืืืืื ืืืขืื ssh ืงืึทื ืขืงืฉืึทื ื. ืขืก ืืขื ืขื ืงืืื ืฆืืืืจ ืฉืืืกืืขื ืืึธืจื, ืึทืืื ืืืึธืก ืงืขื ืขื ืืืจ ืืึธื? ืืขืจ ืขื ืื ืืื ืกืึทืืืื ืืื ืฆืืืื ืืืขืื.
ืึธืคึผืฆืืข ssh-by-password:
ืืขืฉืึทืก ืืขืจ ืขืจืฉืืขืจ ืงืฉืจ, ืืขืจ ssh ืงืืืขื ื ืืึธื ืืืึธืจืขื ืขื ืึทื ืืืจ ืืึธืื ืึท ื ืืึทืข ืฆืืืืจ ืฉืืืกื ืคึฟืื ืื ssh ืกืขืจืืืขืจ.
ืืื ืืขืฉืึทืก ืืืืึทืืขืจ ืงืึทื ืขืงืฉืึทื ื, ืืืื ืื ืืืืจืขื ืื ื "ื ืืึทืข ืฆืืืืจ ืฉืืืกื ืคึฟืื ืื ssh ืกืขืจืืืขืจ" ืืื ืืจืืืก, ืืึธืก ืืืขื ืืืื ืขื ืึทื ืืื ืืขื ืขื ืืจืืื ื ืฆื ืขืืืืจืึธืคึผ ืืืืฃ ืืืจ.
ืึธืืขืจ ืืืจ ืืขื ืขื ืืืืืืจืึทืคึผื ืืืืฃ ืืืื ืขืจืฉืืขืจ ืงืฉืจ, ืึธืืขืจ ืืืฆื ืืืจ ืืืขืจืืขืื ืืื ืื ืกืขืจืืืขืจ ืึธื ืื ืขืจืืืืืขืจืื.
ืึทืงืืืึทืืื, ืจืขืื ืฆื ืืขื ืคืึทืงื ืึทื ืืขืจ ืคืึทืงื ืคืื ืืืืจืขืืึทืคึผืื ื ืืื ืืืืื, ืืขืฉืืืื ื ืืื ืขืคืขืจืืืึทืกืื ืืืืื, ืืขื ืืึทืคืึทืื ืืื ืืขื ืืฆื ืืืืื ืืื ืกืคึผืขืฆืืขื ืงืึทืกืขืก ืคึฟืึทืจ ืึท ืกืคึผืขืฆืืคืืฉ ืงืืืขื ื.ืึธืคึผืฆืืข ssh-by-key:
ืืืจ ื ืขืืขื ืึท ืืืืฅ ืคืึธืจ, ืฉืจืืึทืื ืื ืคึผืจืืืืึทื ืฉืืืกื ืคึฟืึทืจ ืื ssh ืกืขืจืืืขืจ ืืืืฃ ืขืก (ืขืก ืืขื ืขื ืืขืจืืื ืขื ืืื ืึท ืคึผืืึทืฅ ืคืื ืืืืืืืง ื ืืึทื ืกืื ืคึฟืึทืจ ืืขื, ืึธืืขืจ ืืื ืฉืจืืึทืื ืึท ืืืืืื ืืงืจืืื ืคึผืจืึธืืจืึทื, ื ืืฉื ืื ืกืืจืึทืงืฉืึทื ื ืคึฟืึทืจ ื ืืฆื).
ืืืจ ืืึธืื ืื ืฆืืืืจ ืฉืืืกื ืืืืฃ ืื ืืึทืฉืื ืืื ืืขืจ ssh ืงืืืขื ื ืืืขื ืืืื ืืื ืืืจ ืืืื ืืึทืืื ืขืก ืกืื.
ืืืจ ืืจืขื ืืขื ืื ืืืืฅ ืคืึธืจ ืฆื ืื ืกืขืจืืืขืจ, ืึทืจืืึทื ืืืืื ืขืก, ื ืึธืืืึทืื ืื ืคึผืจืืืืึทื ืฉืืืกื, ืืื ืคืึทืจืืจืขื ืขื ืื ืืืืฅ ืคืึธืจ ืืื ืฆืขืืืึทืจืคื ืื ืืฉ ืฆื ืื ืืืื ื (ืึธืืขืจ ืืคึผืืืช ืคึฟืึธืจืืึทื ืขืก ืืื ืืขืจืึธืก).
ืึทื ืก ืึทืืข - ื ืึธื ืึทืืึท ืึท ืึธืคึผืขืจืึทืฆืืข ืขืก ืืืขื ืืืื ืืืืืขืืืขื ืฆื ืืึทืง ืึทืืึท ืึท ืกืฉ ืงืฉืจ. ืืึธื, ืืื 10 ืืึธืจ ืขืก ืืืขื ืืืื ืืขืืืขื ืฆื ืืขื ืคืึทืจืงืขืจ ืืืืฃ ืึท ืกืืคึผืขืจืงืึทืืคึผืืืืขืจ - ืึธืืขืจ ืืึธืก ืืื ืึท ืึทื ืืขืจืฉ ืืขืฉืืืืข.ืืื ืืื ืึทื ืืฉืืืืืงื ืคึฟืึทืจ ืื ืึธืคืืึธืคึผืืง.
ืึทืืื ืืืฆื ืึทื ืื ืืขืึธืจืืข ืืื ืืืงืื ื. ืืื ืืืขื ืืึธืื ืืืจ ืืืขืื ืื ืืืืคื ืคืื ืงืจืืืืืื ื ืึท SSL ืืึทืืืืึทืื.
ื ืืฆื "ืึธืคึผืขื ืกืกื ืืขื ืจืกืึท" ืืืจ ืืึทืื ืึท ืคึผืจืืืืึทื ืฉืืืกื ืืื "ืืืึทื ืงืก" ืคึฟืึทืจ ืื ืฆืืืืจ ืฉืืืกื.
ืืืจ ืฉืืงื ืื "ืืืึทื ืงืก" ืฆื ืึท ืืจืื-ืคึผืึทืจืืื ืคืืจืืข, ืฆื ืืืึธืก ืืืจ ืืึทืฆืึธืื ืืขืขืจืขื $ 9 ืคึฟืึทืจ ืื ืกืืืคึผืืึทืกื ืืึทืืืืึทืื.
ื ืึธื ืึท ืคึผืึธืจ ืคืื ืฉืขื, ืืืจ ืืึทืงืืืขื ืืื ืืืขืจ "ืฆืืืืจ" ืฉืืืกื ืืื ืึท ืกืืื ืคืื ืขืืืขืืข ืฆืืืืจ ืฉืืืกืืขื ืคืื ืืขื ืืจืื-ืคึผืึทืจืืื ืคืืจืืข.
ืคืืจืืืืก ืืึธื ืึท ืืจืื-ืคึผืึทืจืืื ืคืืจืืข ืืึทืฆืึธืื ืคึฟืึทืจ ืื ืจืขืืืกืืจืึทืฆืืข ืคืื โโืืืื ืฆืืืืจ ืฉืืืกื ืืื ืึท ืืึทืืื ืืขืจ ืงืฉืื, ืืืจ ืืืขืื ื ืืฉื ืืึทืืจืึทืืื ืขืก ืืึธ.
ืืืฆื ืขืก ืืื ืงืืึธืจ ืืืึธืก ืื ืืืึทืืฉ ืคืื ืื ืื ืกืงืจืืคึผืฉืึทื ืืื:
smtpd_tls_key_file=/etc/ssl/domain1.com.2018.key
ืื "/etc/ssl" ืืขืงืข ืึผืืื ืึทืืข ืื ืืขืงืขืก ืคึฟืึทืจ ssl ืืฉืื.
domain1.com - ืคืขืื ื ืึธืืขื.
2018 ืืื ืื ืืึธืจ ืคืื ืฉืืืกื ืฉืึทืคืื ื.
"ืฉืืืกื" - ืืึทืฆืืืืขื ืื ื ืึทื ืื ืืขืงืข ืืื ืึท ืคึผืจืืืืึทื ืฉืืืกื.
ืืื ืืขืจ ืืืึทืืฉ ืคืื ืืขื ืืขืงืข:
smtpd_tls_cert_file=/etc/ssl/domain1.com.2018.chained.crt
domain1.com - ืคืขืื ื ืึธืืขื.
2018 ืืื ืื ืืึธืจ ืคืื ืฉืืืกื ืฉืึทืคืื ื.
chained - ืืึทืฆืืืืขื ืื ื ืึทื ืขืก ืืื ืึท ืงืืื ืคืื ืฆืืืืจ ืฉืืืกืืขื (ืืขืจ ืขืจืฉืืขืจ ืืื ืืื ืืืขืจ ืฆืืืืจ ืฉืืืกื ืืื ืื ืื ืืื ืืขื ืขื ืืืึธืก ืืขืงืืืขื ืคืื ืื ืคืืจืืข ืืืึธืก ืืจืืืก ืื ืฆืืืืจ ืฉืืืกื).
crt - ืืึทืฆืืืืขื ืื ื ืึทื ืขืก ืืื ืึท ืคืึทืจืืืง ืืึทืืืืึทืื (ืฆืืืืจ ืฉืืืกื ืืื ืืขืื ืืฉ ืืขืจืงืืขืจืื ืืขื).
smtp_bind_address = XX.XX.XX.X0
smtp_bind_address6 = XXXX:XXXX:XXXX:XXXX:1:1:1:1ืื ืืึทืฉืืขืืืงื ืืื ื ืืฉื ืืขื ืืฆื ืืื ืืขื ืคืึทื, ืึธืืขืจ ืืื ืืขืฉืจืืื ืืื ืึท ืืืึทืฉืคึผืื.
ืืืืึทื ืึท ืืขืืช ืืื ืืขื ืคึผืึทืจืึทืืขืืขืจ ืืืขื ืคืืจื ืฆื ืกืคึผืึทื ืคืื ืืืื ืกืขืจืืืขืจ (ืึธื ืืืื ืืืขื).
ืืขืืืื ืืืืืืืื ืืืขืืขื ืื ืื ืืืกื ื ืืฉื ืฉืืืืืง.
recipient_delimiter = +ืคืืืข ืืขื ืืฉื ืงืขื ื ืืฉื ืืืืกื, ืึธืืขืจ ืืึธืก ืืื ืึท ื ืึธืจืืึทื ืืึทืจืึทืงืืขืจ ืคึฟืึทืจ ืจืืืืื ื ืืืืืื, ืืื ืขืก ืืื ืืขืฉืืืฆื ืืืจื ืจืืึฟ ืืึธืืขืจื ืคึผืึธืกื ืกืขืจืืืขืจืก.
ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืื ืืืจ ืืึธืื ืึท ืืจืืืืงืึทืกืื "[ืืืืขืื ืืืฉืืฆื]"ืคึผืจืืืืจื ืฉืืงื ืฆื"[ืืืืขืื ืืืฉืืฆื]"- ืงืืง ืืืึธืก ืงืืื ืคืื ืืื.
inet_protocols = ipv4ืืึธืก ืงืขื ืืืื ืงืึทื ืคืืืืื ื.
ืืืขืจ ืขืก ืืื ื ืืฉื ื ืึธืจ ืึทืืื. ืืขืืขืจ ื ืืึท ืคืขืื ืืื ืืื ืคืขืืืงืืึทื ืืืืื IPv4, ืืื ืืื ืงืขืจ ืืืืฃ IPv6 ืคึฟืึทืจ ืืขืืขืจ ืืืื ืขืจ ืกืขืคึผืขืจืึทืืื.
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
ืืึธ ืืืจ ืกืคึผืขืฆืืคืืฆืืจื ืึทื ืึทืืข ืื ืงืึทืืื ื ืคึผืึธืกื ืืืื ืฆื ืืึธืืืขืงืึธื.
ืืื ืื ืึผืืืื ืคึฟืึทืจ ืคืขืื, ืืจืืืืงืึทืกืื, ืึทืืืึทืก - ืงืืง ืืื ืื ืืึทืืึทืืืืก.
/etc/postfix/mysql-virtual-mailbox-domains.cf
user = usermail
password = mailpassword
hosts = 127.0.0.1
dbname = servermail
query = SELECT 1 FROM virtual_domains WHERE name='%s'/etc/postfix/mysql-virtual-mailbox-maps.cf
user = usermail
password = mailpassword
hosts = 127.0.0.1
dbname = servermail
query = SELECT 1 FROM virtual_users WHERE email='%s'/etc/postfix/mysql-virtual-alias-maps.cf
user = usermail
password = mailpassword
hosts = 127.0.0.1
dbname = servermail
query = SELECT destination FROM virtual_aliases WHERE source='%s'# SMTP-Auth settings
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yesืืืฆื ืคึผืึธืกืืคืืงืก ืืืืืกื ืึทื ืขืก ืืื ืืขืืืขื ืฆื ืึธื ื ืขืืขื ืคึผืึธืกื ืคึฟืึทืจ ืืืืึทืืขืจ ืฉืืงื ืืืืื ื ืึธื ืืขืจืืืืืขื ืืฉ ืืื ืืึธืืืขืงืึธื.
ืืื ืืึทืงืข ืืึธื ื ืื ืคึฟืึทืจืฉืืืื ืืืึธืก ืืึธืก ืืื ืืืคึผืืืงืืืืื ืืึธ. ืืืจ ืืึธืื ืฉืืื ืกืคึผืขืฆืืคืืฆืืจื ืึทืืฅ ืืืึธืก ืืื ืืืจืฃ ืืื "ืืืืจืืืึทื_ืืจืึทื ืกืคึผืึธืจื".
ืึธืืขืจ ืื ืคึผืึธืกืืคืืงืก ืกืืกืืขื ืืื ืืืืขืจ ืึทืื - ืืืกืืึธืืข ืขืก ืืื ืึท ืฆืืจืืงืงืขืจ ืคืื ืื ืึทืื ืืขื.
smtpd_recipient_restrictions =
...
smtpd_helo_restrictions =
...
smtpd_client_restrictions =
...ืืขื ืงืขื ืขื ืืืื ืงืึทื ืคืืืืขืจื ืืืคืขืจืขื ืืื ืคึฟืึทืจ ืืขืืขืจ ืคึผืึธืกื ืกืขืจืืืขืจ.
ืืื ืืึธืื 3 ืคึผืึธืกื ืกืขืจืืืขืจืก ืฆื ืืืื ืืึทืืืึทืืืงืื ื ืืื ืื ืกืขืืืื ืืก ืืขื ืขื ืืืืขืจ ืึทื ืืขืจืฉ ืจืขืื ืฆื ืคืึทืจืฉืืืขื ืข ืืึทื ืืฅ ืจืขืงืืืืจืขืืขื ืฅ.
ืืืจ ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ ืขืก ืงืขืจืคืึทืื - ืึทื ืืขืจืฉ ืกืคึผืึทื ืืืขื ืืืกื ืืื ืืืจ, ืึธืืขืจ ืืคืืื ืขืจืืขืจ - ืกืคึผืึทื ืืืขื ืืืกื ืืืืก ืคืื ืืืจ.
# SPF
policyd-spf_time_limit = 3600ืืึทืฉืืขืืืงื ืคึฟืึทืจ ืขืืืขืืข ืคึผืืืืื ืฉืืึทืืืช ืฆื ืงืึธื ืืจืึธืืืจื ืื SPF ืคืื ืื ืงืึทืืื ื ืืืชืืืช.
# OpenDKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = unix:var/run/opendkim/opendkim.sock
non_smtpd_milters = unix:var/run/opendkim/opendkim.sockืื ืืึทืฉืืขืืืงื ืืื ืึทื ืืืจ ืืืื ืฆืืฉืืขืื ืึท DKIM ืืกืืืข ืืื ืึทืืข ืึทืืืืึธืืื ื ืืืืืื.
# IP address per domain
sender_dependent_default_transport_maps = pcre:/etc/postfix/sdd_transport.pcreืืึธืก ืืื ืึท ืฉืืืกื ืืขืืึทื ืืื ืืจืืื ืจืืืื ื ืืืขื ืืืจ ืฉืืงื ืืืชืืืช ืคึฟืื PHP ืกืงืจืืคึผืก.
ืืขืงืข "/etc/postfix/sdd_transport.pcre":
/^[email protected]$/ domain1:
/^[email protected]$/ domain2:
/^[email protected]$/ domain3:
/@domain1.com$/ domain1:
/@domain2.com$/ domain2:
/@domain3.com$/ domain3:ืืืืฃ ืื ืืื ืงืก ืืขื ืขื ืจืขืืืืขืจ ืืืืกืืจืืงื. ืืืืฃ ืื ืจืขืื ืืื ืึท ืคืืจืืข ืืืึธืก ืืึทืจืงืก ืื ืืจืืื.
ืคึผืึธืกืืคืืงืก ืืื ืืืื ืืื ืื ืคืืจืืข - ืืืขื ื ืขืืขื ืืื ืืฉืืื ืึท ืืืกื ืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื ืฉืืจืืช ืคึฟืึทืจ ืึท ืกืคึผืขืฆืืคืืฉ ืืจืืื.ืืื ืคึผืื ืงื ืคึผืึธืกืืคืืงืก ืืืขื ืืืื ืจืืงืึทื ืคืืืืขืจื ืคึฟืึทืจ ืึท ืกืคึผืขืฆืืคืืฉ ืืจืืื ืืืขื ืืืื ืื ืืขืืืืื ืืื "master.cf".
ืฉืืจืืช 4, 5, 6 ืืขื ืขื ืื ืืืืคึผื. ืืืืฃ ืืืืึทืฃ ืคืื ืืืึธืก ืคืขืื ืืืจ ืฉืืงื ืืขื ืืจืืื, ืืืจ ืฉืืขืื ืืขื ืคืืจืืข.
ืึธืืขืจ ืื "ืคึฟืื" ืคืขืื ืืื ื ืื ืฉืืขื ืืืง ืื ืืขืืืืื ืืื PHP ืกืงืจืืคึผืก ืืื ืื ืึทืื ืงืึธื. ืืขืจื ืึธื ืืขืจ ืืึทื ืืฆืขืจ ื ืึธืืขื ืงืืื ืฆื ืจืึทืืขืืืขื.ืืขืจ ืึทืจืืืงื ืืื ืฉืืื ืืจืืื - ืืื ืืืึธืื ื ืืฉื ืืืขืื ืฆื ืืืื ืืืกืืจืึทืงืืึทื ืืืจื ืืึทืฉืืขืืืงื nginx + fpm.
ืืขืงืืฆืขืจ, ืคึฟืึทืจ ืืขืืขืจ ืคึผืืึทืฅ ืืืจ ืฉืืขืื ืืืื ืืืืืขื ืข ืืื ืืงืก ืืึทื ืืฆืขืจ ืืึทืืืฆืขืจ. ืืื ืึทืงืึธืจืืื ืืื ืืืื fpm-ืืขืงื.
Fpm-pool ื ืืฆื ืงืืื ืืืขืจืกืืข ืคืื โโโโphp (ืขืก ืืื ืืจืืืก ืืืขื ืืืืฃ ืืขืจ ืืขืืืืงืขืจ ืกืขืจืืืขืจ ืืืจ ืงืขื ืขื ื ืืฆื ืคืึทืจืฉืืืขื ืข ืืืขืจืกืืขืก ืคืื php ืืื ืืคืืื ืคืึทืจืฉืืืขื ืข php.ini ืคึฟืึทืจ ืืจืืืืงืข ืืืืืืขื ืึธื ืคืจืืืืขืืขื).
ืึทืืื, ืึท ืกืคึผืขืฆืืคืืฉ ืืื ืืงืก ืืึทื ืืฆืขืจ "ืืืืืื-ืืึธืืึทืื2" ืืื ืึท ืืืขืืืืืื domain2.com. ืืขืจ ืคึผืืึทืฅ ืืื ืึท ืงืึธื ืคึฟืึทืจ ืฉืืงื ืืืืืื ืึธื ืกืคึผืขืฆืืคืืฆืืจื ืื ืคึฟืื ืคืขืื.
ืึทืืื, ืืคืืื ืืื ืืขื ืคืึทื, ืื ืืจืืื ืืืขื ืืืื ืืขืฉืืงื ืจืืืืืง ืืื ืืืขื ืงืืื ืืึธื ืกืืฃ ืืื ืกืคึผืึทื.
ืืืื "/etc/postfix/master.cf" ืงืืงื ืืื ืืึธืก:
...
smtp inet n - y - - smtpd
-o content_filter=spamassassin
...
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
...
policyd-spf unix - n n - 0 spawn
user=policyd-spf argv=/usr/bin/policyd-spf
spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}
...
domain1 unix - - n - - smtp
-o smtp_bind_address=XX.XX.XX.X1
-o smtp_helo_name=domain1.com
-o inet_protocols=all
-o smtp_bind_address6=XXXX:XXXX:XXXX:XXXX:1:1:1:1
-o syslog_name=postfix-domain1
domain2 unix - - n - - smtp
-o smtp_bind_address=XX.XX.XX.X5
-o smtp_helo_name=domain2.com
-o inet_protocols=all
-o smtp_bind_address6=XXXX:XXXX:XXXX:XXXX:1:2:1:1
-o syslog_name=postfix-domain2
domain3 unix - - n - - smtp
-o smtp_bind_address=XX.XX.XX.X2
-o smtp_helo_name=domain3
-o inet_protocols=all
-o smtp_bind_address6=XXXX:XXXX:XXXX:XXXX:1:1:5:1
-o syslog_name=postfix-domain3
ืืขืจ ืืขืงืข ืืื ื ืืฉื ืฆืืืขืฉืืขืื ืืื ืคืื - ืขืก ืืื ืฉืืื ืืืืขืจ ืืจืืืก.
ืืื ืืื ื ืืจ ืืืืขืจืงื ืืืืก ืืื ืืขืขื ืืขืจื ืืขืืืืจื.
smtp inet n - y - - smtpd
-o content_filter=spamassassin
...
spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}ืืึธืก ืืขื ืขื ืกืขืืืื ืืก ืฉืืึทืืืช ืฆื ืกืคึผืึทืืึทืกืึทืกืกืื, ืืขืจ ืืืืฃ ืืขื ืฉืคึผืขืืขืจ.
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
ืืืจ ืืึธืื ืืืจ ืฆื ืคืึทืจืืื ืื ืฆื ืื ืคึผืึธืกื ืกืขืจืืืขืจ ืืืจื ืคึผืึธืจื 587.
ืฆื ืืึธื ืืึธืก, ืืืจ ืืืื ืงืืึธืฅ ืืื.
policyd-spf unix - n n - 0 spawn
user=policyd-spf argv=/usr/bin/policyd-spfืืขืื SPF ืืฉืขืง.
apt-get install postfix-policyd-spf-pythonืืึธืืืจ ืื ืกืืึทืืืจื ืืขื ืคึผืขืงื ืคึฟืึทืจ SPF ืืฉืขืงืก ืืืืื.
domain1 unix - - n - - smtp
-o smtp_bind_address=XX.XX.XX.X1
-o smtp_helo_name=domain1.com
-o inet_protocols=all
-o smtp_bind_address6=XXXX:XXXX:XXXX:XXXX:1:1:1:1
-o syslog_name=postfix-domain1ืืื ืืึธืก ืืื ืื ืืขืจืกื ืืฉืืงืึทืืืข ืืึทื. ืืึธืก ืืื ืื ืคืืืืงืืื ืฆื ืฉืืงื ืืืชืืืช ืคึฟืึทืจ ืึท ืกืคึผืขืฆืืคืืฉ ืคืขืื ืคึฟืื ืึท ืกืคึผืขืฆืืคืืฉ IPv4 / IPv6 ืึทืืจืขืก.
ืืึธืก ืืื ืืขืืื ืคึฟืึทืจ ืื ืฆืืืื ืคืื ืจืื ืก. rDNS ืืื ืืขืจ ืคึผืจืึธืฆืขืก ืคืื ืจืืกืืืืื ื ืึท ืฉืืจืืงื ืืืจื IP ืึทืืจืขืก.
ืืื ืคึฟืึทืจ ืคึผืึธืกื, ืืขื ืฉืืจืื ืืื ืืขื ืืฆื ืฆื ืืึทืฉืืขืืืงื ืึทื ืื ืืขืืึธ ืคึผืื ืงื ืฉืืืขืืขืืขื ืื ืจืื ืก ืคืื ืื ืึทืืจืขืก ืคึฟืื ืืืึธืก ืื E- ืืจืืื ืืื ืืขืฉืืงื.ืืืื ืื ืืขืืึธ ืืื ื ืืฉื ืคึผืึทืกืืง ืคึฟืึทืจ ืื ืืืืฆืคึผืึธืกื ืคืขืื ืืืืฃ ืืืืึทืฃ ืคืื ืืืขืืขื ืืขืจ ืืจืืื ืืื ืืขืฉืืงื, ืกืคึผืึทื ืคืื ืงืื ืืขื ืขื ืึทืืืึธืจืืื.
ืืขืืึธ ืงืขื ื ืืฉื ืืืืึทืื ืจืื ืก - ืึท ืคึผืืึทืฅ ืคืื ืกืคึผืึทื ืคืื ืงืื ืืขื ืขื ืึทืืืึธืจืืื.
ืึทืงืงืึธืจืืื ืืื, ืืขืืขืจ ืคืขืื ืืืื ืืึธืื ืืืื ืืืืืขื ืข IP ืึทืืจืขืก.
ืคึฟืึทืจ OVH - ืืื ืื ืงืึทื ืกืึธืื ืขืก ืืื ืืขืืืขื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืจืื ืก.
ืคึฟืึทืจ tech.ru - ืื ืึทืจืืืกืืขืื ืืื ืกืึทืืืื ืืืจื ืฉืืืฆื.
ืคึฟืึทืจ AWS, ืื ืึทืจืืืกืืขืื ืืื ืกืึทืืืื ืืืจื ืฉืืืฆื.
"inet_protocols" ืืื "smtp_bind_address6" - ืืืจ ืืขืื IPv6 ืฉืืืฆื.
ืคึฟืึทืจ IPv6 ืืืจ ืืืื ืืึทืจืคึฟื ืฆื ืจืขืืืกืืจืืจื ืจืื ืก.
"syslog_name" - ืืื ืืึธืก ืืื ืคึฟืึทืจ ืื ืคืื ืืืืขื ืขื ืืึธืืก.
ืงืืืคื ืกืขืจืืืคืืงืึทืฅ .
.
================================
apt-get install dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-mysql dovecot-antispamืืึทืฉืืขืืืงื mysql, ืื ืกืืึทืืืจื ืื ืคึผืึทืงืึทืืืฉืึทื ืืื.
ืืขืงืข "/etc/dovecot/conf.d/10-auth.conf"
disable_plaintext_auth = yes
auth_mechanisms = plain loginืืขืจืืืืืขื ืืฉ ืืื ืืืืื ืื ืงืจืืคึผืืื.
ืืขืงืข "/etc/dovecot/conf.d/10-mail.conf"
mail_location = maildir:/var/mail/vhosts/%d/%nืืึธ ืืืจ ืึธื ืืืืึทืื ืื ืกืืึธืจืืืืฉ ืึธืจื ืคึฟืึทืจ ืื ืืืชืืืช.
ืืื ืืืืื ืืื ืฆื ืืืื ืกืืึธืจื ืืื ืืขืงืขืก ืืื ืืจืืคึผื ืืืจื ืคืขืื.
ืืขืงืข "/etc/dovecot/conf.d/10-master.conf"
service imap-login {
inet_listener imap {
port = 0
}
inet_listener imaps {
address = XX.XX.XX.X1, XX.XX.XX.X2, XX.XX.XX.X5, [XXXX:XXXX:XXXX:XXXX:1:1:1:1], [XXXX:XXXX:XXXX:XXXX:1:2:1:1], [XXXX:XXXX:XXXX:XXXX:1:1:5:1]
port = 993
ssl = yes
}
}
service pop3-login {
inet_listener pop3 {
port = 0
}
inet_listener pop3s {
address = XX.XX.XX.X1, XX.XX.XX.X2, XX.XX.XX.X5, [XXXX:XXXX:XXXX:XXXX:1:1:1:1], [XXXX:XXXX:XXXX:XXXX:1:2:1:1], [XXXX:XXXX:XXXX:XXXX:1:1:5:1]
port = 995
ssl = yes
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
mode = 0600
user = postfix
group = postfix
}
}
service imap {
}
service pop3 {
}
service auth {
unix_listener auth-userdb {
mode = 0600
user = vmail
}
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user = postfix
group = postfix
}
user = dovecot
}
service auth-worker {
user = vmail
}
service dict {
unix_listener dict {
}
}
ืืึธืก ืืื ืื ืืืืคึผื ืืึธืืืขืงืึธื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข.
ืืึธ ืืืจ ืืืกืืืืึทื ืึทื ืกืืงืืืจื ืงืึทื ืขืงืฉืึทื ื.
ืืื ืืขืื ืืืืขืจ ืงืึทื ืขืงืฉืึทื ื.
ืืขืงืข "/etc/dovecot/conf.d/10-ssl.conf"
ssl = required
ssl_cert = </etc/nginx/ssl/domain1.com.2018.chained.crt
ssl_key = </etc/nginx/ssl/domain1.com.2018.key
local XX.XX.XX.X5 {
ssl_cert = </etc/nginx/ssl/domain2.com.2018.chained.crt
ssl_key = </etc/nginx/ssl/domain2.com.2018.key
}ืืึทืฉืืขืืืงื ssl. ืืืจ ืึธื ืืืืึทืื ืึทื ssl ืืื ืคืืจืืื ืื.
ืืื ืื ืืึทืืืืึทืื ืืื. ืืื ืึท ืืืืืืืง ืืขืืึทื ืืื ืื "ืืืืข" ืืืจืขืงืืืื. ืื ืืืงืืืฅ ืืืึธืก ssl ืืึทืืืืึทืื ืฆื ื ืืฆื ืืืขื ืงืึทื ืขืงืืื ื ืฆื ืืืึธืก ืืืืข IPv4.ืืืจื ืืขื ืืืขื, IPv6 ืืื ื ืืฉื ืงืึทื ืคืืืืขืจื ืืึธ, ืืื ืืืขื ืคืึทืจืจืืืื ืืขื ืึธืืืืฉืึทื ืฉืคึผืขืืขืจ.
XX.XX.XX.X5 (Domain2) - ืงืืื ืืึทืืืืึทืื. ืฆื ืคืึทืจืืื ืื ืงืืืืึทื ืฅ ืืืจ ืืึทืจืคึฟื ืฆื ืกืคึผืขืฆืืคืืฆืืจื domain1.com.
XX.XX.XX.X2 (domain3) - ืขืก ืืื ืึท ืืึทืืืืึทืื, ืืืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื domain1.com ืึธืืขืจ domain3.com ืฆื ืคืึทืจืืื ืื ืงืืืืึทื ืฅ.
ืืขืงืข "/etc/dovecot/conf.d/15-lda.conf"
protocol lda {
mail_plugins = $mail_plugins sieve
}ืืึธืก ืืืขื ืืืื ื ืืืืืง ืคึฟืึทืจ ืกืคึผืึทืืึทืกืึทืกืกืื ืืื ืืขืจ ืฆืืงืื ืคึฟื.
ืืขืงืข "/etc/dovecot/conf.d/20-imap.conf"
protocol imap {
mail_plugins = $mail_plugins antispam
}ืืึธืก ืืื ืึทื ืึทื ืืืกืคึผืึทื ืคึผืืืืื. ื ืืืืืง ืคึฟืึทืจ ืืจืืื ืื ื ืกืคึผืึทืืึทืกืึทืกืื ืืื ืืขืจ ืฆืืื ืคืื ืึทืจืืืขืจืคืืจื ืฆื / ืคึฟืื ืื "ืกืคึผืึทื" ืืขืงืข.
ืืขืงืข "/etc/dovecot/conf.d/20-pop3.conf"
protocol pop3 {
}ืขืก ืืื ืคึผืื ืงื ืึทืืึท ืึท ืืขืงืข.
ืืขืงืข "/etc/dovecot/conf.d/20-lmtp.conf"
protocol lmtp {
mail_plugins = $mail_plugins sieve
postmaster_address = [email protected]
}ืืึทืฉืืขืืืงื ืืืืคึผ.
ืืขืงืข "/etc/dovecot/conf.d/90-antispam.conf"
plugin {
antispam_backend = pipe
antispam_trash = Trash;trash
antispam_spam = Junk;Spam;SPAM
antispam_pipe_program_spam_arg = --spam
antispam_pipe_program_notspam_arg = --ham
antispam_pipe_program = /usr/bin/sa-learn
antispam_pipe_program_args = --username=%Lu
}ืกืคึผืึทืืึทืกืึทืกืื ืืจืืื ืื ื ืกืขืืืื ืืก ืืื ืืขืจ ืฆืืื ืคืื ืึทืจืืืขืจืคืืจื ืฆื / ืคึฟืื ืื ืกืคึผืึทื ืืขืงืข.
ืืขืงืข "/etc/dovecot/conf.d/90-sieve.conf"
plugin {
sieve = ~/.dovecot.sieve
sieve_dir = ~/sieve
sieve_after = /var/lib/dovecot/sieve/default.sieve
}ื ืืขืงืข ืืืึธืก ืกืคึผืขืฆืืคืืฆืืจื ืืืึธืก ืฆื ืืึธื ืืื ืื ืงืึทืืื ื ืืืชืืืช.
ืืขืงืข "/var/lib/dovecot/sieve/default.sieve"
require ["fileinto", "mailbox"];
if header :contains "X-Spam-Flag" "YES" {
fileinto :create "Spam";
}ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืืืขื ืื ืืขืงืข: "sievec default.sieve".
ืืขืงืข "/etc/dovecot/conf.d/auth-sql.conf.ext"
passdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf.ext
}
userdb {
driver = static
args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
}
ืกืคึผืขืฆืืคืืฆืืจื sql ืืขืงืขืก ืคึฟืึทืจ ืืขืจืืืืืขื ืืฉ.
ืืื ืืขืจ ืืขืงืข ืืื ืืื ืืขื ืืฆื ืืื ืึท ืืืคึฟื ืคืื ืืขืจืืืืืขื ืืฉ.
ืืขืงืข "/etc/dovecot/dovecot-sql.conf.ext"
driver = mysql
connect = host=127.0.0.1 dbname=servermail user=usermail password=password
default_pass_scheme = SHA512-CRYPT
password_query = SELECT email as user, password FROM virtual_users WHERE email='%u';ืืึธืก ืงืึธืจืึทืกืคึผืึทื ืื ืฆื ืขื ืืขื ืกืขืืืื ืืก ืคึฟืึทืจ ืคึผืึธืกืืคืืงืก.
ืืขืงืข "/etc/dovecot/dovecot.conf"
protocols = imap lmtp pop3
listen = *, ::
dict {
}
!include conf.d/*.conf
!include_try local.conf
ืืืืคึผื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข.
ืื ืืืืืืืง ืืึทื ืืื ืึทื ืืืจ ืึธื ืืืืึทืื ืืึธ - ืืืืื ืคึผืจืึธืืึธืงืึธืืก.
============= SpamAssassin =============
apt-get install spamassassin spamcืืึธืืืจ ืื ืกืืึทืืืจื ืื ืคึผืึทืงืึทืืืฉืึทื.
adduser spamd --disabled-loginืืืืืจ ืฆืืืขืื ื ืืื ืืฆืขืจ ืืืืฃ ืืืขืืขื ืก ื ืืืขื.
systemctl enable spamassassin.serviceืืืจ ืืขืื ืึทืืืึธ-ืืึธืืืื ื ืกืคึผืึทืืึทืกืึทืกืกืื ืืื ืกื ืืื ืืึธืืืื ื.
ืืขืงืข "/etc/default/spamassassin":
CRON=1ืืืจื ืืขืื ืึธืืึทืืึทืืืง ืึทืคึผืืืืืื ื ืคืื ืึผืืืื "ืืืจื ืคืขืืืงืืึทื".
ืืขืงืข "/etc/spamassassin/local.cf":
report_safe 0
use_bayes 1
bayes_auto_learn 1
bayes_auto_expire 1
bayes_store_module Mail::SpamAssassin::BayesStore::MySQL
bayes_sql_dsn DBI:mysql:sa:localhost:3306
bayes_sql_username sa
bayes_sql_password passwordืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ืืึทืืึทืืืืก "ืกืึท" ืืื mysql ืืื ืืขืจ ืืึทื ืืฆืขืจ "ืกืึท" ืืื ืื ืคึผืึทืจืึธื "ืคึผืึทืจืึธื" (ืคืึทืจืืืึทืื ืืื ืขืคึผืขืก ืืืืื).
report_safe - ืืึธืก ืืืขื ืฉืืงื ืึท ืืึทืจืืื ืคืื ืกืคึผืึทื ืืืืฆืคึผืึธืกื ืึทื ืฉืืึธื ืคืื ืึท ืืจืืื.
use_bayes ืืขื ืขื ืกืคึผืึทืืึทืกืึทืกืกืื ืกืขืืืื ืืก ืคึฟืึทืจ ืืึทืฉืื ืืขืจื ืขื.
ืื ืจืืขื ืกืคึผืึทืืึทืกืึทืกืกืื ืกืขืืืื ืืก ืืขื ืขื ืืขื ืืฆื ืคืจืืขืจ ืืื ืืขื ืึทืจืืืงื.
.
.
.
.
============= ืึทืคึผืขืืืจื ืฆื ืื ืงืื =============
ืืื ืืืึธืื ืืืื ืืื ืฆื ืืืึทืจืคื ืึท ืืขืืึทื ืง ืืื ืื ืงืื ืืื ืฆื ืคืึทืจืืจืขืกืขืจื ืื ืืืืขืจืืืื ืืืจืื ืคืื ืคืึธืจืืืขืจืืื ืืจืืื. ืืื ื ืืื ืืื ืึทืืื ืืืฃ ืคืึทืจืืืคื ืืื ืื ืืขืืข ืคืื โโืคึผืึธืกื.
ืึทืืื ืึทื ืืขืจ ืืึทื ืืฆืขืจ ืงืขื ืขื ืืึทืื ืึท ืคึผืึธืจ ืคืื ืฉืืืกืืขื ืืืืฃ ืืืื ืงืืืขื ื (ืึทืืืืืง, ืืึทื ืืขืจืืืจื, ืืืขืืขืจืขืจ-ืคึผืืืืื, ...). ืฆืืืืจ ืืื ืคึผืจืืืืึทื. ืฆืืืืจ - ืฉืืงื ืฆื ืื ืก. ืคึผืจืืืืึทื - ืจืึทืืขืืืขื ืืืืฃ ืืขื ืงืืืขื ื. ืืขืื ืกืขืจืืืขืจืก ืืืึธืื ืงืขื ืขื ืฆื ื ืืฆื ืึท ืฆืืืืจ ืฉืืืกื ืฆื ืฉืืงื ืฆื ืึท ืกืคึผืขืฆืืคืืฉ ืืึทืงืืืขืจ.
ืืื ืฆื ืืึทืฉืืฆื ืงืขืื ืกืคึผืึทื ืืื ืึทืืึท ืืืชืืืช (ืืึธ, ืื ืคึผืึธืกื ืกืขืจืืืขืจ ืืืขื ื ืืฉื ืงืขื ืขื ืฆื ืืขื ืื ืืื ืืึทืื) - ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืงืขื ืขื 3 ืึผืืืื:
- ืืึทื ืืึทืืึธืจื ืคืึทืงืืืฉ DKIM ืืกืืืข, ืืึทื ืืึทืืึธืจื ืกืคึผืฃ, ืืึทื ืืึทืืึธืจื ืจืื ืก.
- ื ื ืขืืจืึทื ื ืขืฅ ืืืืฃ ืื ืืขืืข ืคืื โโืึทื ืืืกืคึผืึทื ืืจืืื ืื ื + ืึท ืืึทืืึทืืืืก ืคึฟืึทืจ ืขืก ืืืืฃ ืืขืจ ืงืืืขื ื ืืืึทื.
- ืื ืขื ืงืจืืคึผืฉืึทื ืึทืืืขืจืืืึทื ืืืื ืืืื ืึทืืื ืึทื ืื ืฉืืงื ืืืึทื ืืืื ืคืึทืจืืจืขื ืืขื 100 ืืื ืืขืจ ืงืคึผื ืืึทืื ืืืืฃ ืขื ืงืจืืคึผืฉืึทื ืืื ืื ืจืืกืืืืื ื ืืืึทื.
ืืื ืึทืืืฉืึทื ืฆื ืฆืืืืจ ืืจืืื, ืึทื ืืืืืงืืขื ืึท ื ืึธืจืืึทื ืคืึธืจืฉืืึธื ืืจืืื "ืฆื ืึธื ืืืืื ืืืืขืจ ืงืึธืจืขืกืคึผืึธื ืืขื ืฅ." ืืืื ืขืจ ืคืื ืื ืืื ืืฆืขืจ ( ืืจืืืืงืึทืกืื ) ืฉืืงื ืึท ืืจืืื ืืื ืึท ืึทืืึทืืฉืืึทื ื ืฆื ืื ืื ืืขืจ ืืจืืืืงืึทืกืื. ืืขืจ ืืจืืื ืึผืืื ืึท ืืขืงืกื ืคืึธืจืฉืืึธื ืฆื ืึธื ืืืืื ืึท ืืืืขืจ ืงืึธืืื ืืงืึทืฆืืข ืงืึทื ืึทื ืคึฟืึทืจ ืงืึธืจืขืกืคึผืึธื ืืขื ืฅ ืืื ืืขืจ ืฆืืืืจ ืฉืืืกื ืคืื ืื ืืึทืืืฆืขืจ ืคืื ืื ืืจืืืืงืึทืกืื (ืืื ืึท ืคึผืจืืืืึทื ืฉืืืกื ืืืืฃ ืื ืงืืืขื ื ืืืึทื).
ืืืจ ืงืขื ืขื ืืคืืื ืืึทืื ืึท ืคึผืึธืจ ืคืื ืฉืืืกืืขื ืกืคึผืึทืกืืคืืงืื ืคึฟืึทืจ ืืขืืขืจ ืงืึธืจืขืกืคึผืึธื ืืขื ืฅ. ืืขืจ ืืึทืงืืืขืจ ืืึทื ืืฆืขืจ ืงืขื ืขื ืึธื ื ืขืืขื ืืขื ืคืึธืจืฉืืึธื ืืื ืฉืืงื ืืืื ืฆืืืืจ ืฉืืืกื (ืืืื ืืขืืืื ืกืคึผืึทืกืืคืืงืื ืคึฟืึทืจ ืืขื ืงืึธืจืขืกืคึผืึธื ืืขื ืฅ). ืืืืึทืืขืจ, ืืขืจ ืขืจืฉืืขืจ ืืึทื ืืฆืขืจ ืกืขื ืื ืึท ืกืขืจืืืืก ืงืึธื ืืจืึธื ืืจืืื (ืขื ืงืจืืคึผืืื ืืื ืื ืฆืืืืจ ืฉืืืกื ืคืื ืื ืจืืข ืืึทื ืืฆืขืจ) - ืืืืฃ ืงืึทืืึธืืข ืคืื โโืืืึธืก ืื ืจืืข ืืึทื ืืฆืขืจ ืงืขื ืขื ืืึทืืจืึทืืื ืื ืืขืืจืื ืืขื ืงืึธืืื ืืงืึทืฆืืข ืงืึทื ืึทื ืคืึทืจืืึธืืืขื. ืืขืจื ืึธื, ืืขืจ ืฆืืืืืืขืจ ืืึทื ืืฆืขืจ ืกืขื ืื ืึท ืงืึธื ืืจืึธื ืืจืืื - ืืื ืืขืจ ืขืจืฉืืขืจ ืืึทื ืืฆืขืจ ืงืขื ืขื ืืืื ืืึทืืจืึทืืื ืื ืืขืฉืืคื ืงืึทื ืึทื ืืืืขืจ.
ืฆื ืงืึทืืืึทื ืื ืื ืืขืจืกืขืคึผืฉืึทื ืคืื ืฉืืืกืืขื ืืืืฃ ืื ืืืขื, ืืขืจ ืคึผืจืึธืืึธืงืึธื ืืืื ืฆืืฉืืขืื ืื ืืขืืืขืืงืืื ืคืื ืืจืึทื ืกืืืืื ื ืืืึท ืืื ืืกืืขืจ ืืืื ืฆืืืืจ ืฉืืืกื ืืื ืึท ืืืืฅ ืคืึธืจ.
ืืื ืื ืืขืจืกื ืืืืืืืง ืืึทื ืืื ืึทื ืึทืืฅ ืึทืจืืขื (ืื ืงืฉืื ืืื "ืืืขืจ ืืืขื ืืึทืฆืึธืื ืคึฟืึทืจ ืขืก?"):
ืึทืจืืึทื ืคึผืึธืืกืืึทื ืกืขืจืืืคืืงืึทืฅ ืกืืึทืจืืื ื ืืืึท $ 10 ืคึฟืึทืจ 3 ืืึธืจ. ืืืึธืก ืืืขื ืืึธืื ืื ืกืขื ืืขืจ ืฆื ืึธื ืืืืึทืื ืืื ืื ืื ืก ืึทื "ืืืื ืฆืืืืจ ืฉืืืกืืขื ืืขื ืขื ืืึธืจื." ืืื ืืื ืืืขืื ืืขืื ืืืจ ืื ืืขืืขืื ืืืื ืฆื ืึธื ืืืืื ืึท ืืืืขืจ ืงืฉืจ. ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืึทื, ืึทืงืกืขืคึผืืื ื ืึทืืึท ืงืึทื ืขืงืฉืึทื ื ืืื ืคืจืื.
Gmail ืืื ืืขืกืึธืฃ ืืึธื ืขืืืืื ื ืืืื ืืืืขืจื. ืคึฟืึทืจ $ 10 ืคึผืขืจ 3 ืืึธืจ - ืื ืจืขืื ืฆื ืฉืึทืคึฟื ืืืืขืจ ืงืึธืจืขืกืคึผืึธื ืืขื ืฅ ืืฉืึทื ืึทืื.
============= ืืกืงื ื =============
ืฆื ืคึผืจืืืืจื ืื ืืื ืฆืข ืึทืจืืืงื, ืืื ืืขืืื ืืขื ืฆื ืืื ืืขื ืึท ืืขืืึทืงืืืืึทื ืกืขืจืืืขืจ ืคึฟืึทืจ ืึท ืืืืฉ ืืื ืงืืืคื ืึท ืคืขืื ืืื ืึท SSL ืืึทืืืืึทืื.
ืึธืืขืจ ืืขืื ืฆืืฉืืื ืื ืืขืืืขืืึธืคึผืขื ืึทืืื ืืขื ืึทืจืืืกืืขืื ืืจืึทืื ืืืืฃ ืคึฟืึทืจ 2 ืืืฉืื.
ืืื ืืขืจืคืืจ, ืืืขื ืืื ืืื ืืืืืขืจ ืืขืืื ืคืจืืืข ืฆืืื, ืืื ืืื ืืืฉืืืกื ืฆื ืคืืจืขืคื ืืืขืื ืืขื ืืจืืืงื ืืืื ืืื ืขืก ืืื, ื ืืฉื ืฆื ืจืืืืงืืจื ืื ืื ืืจืืืกืืขืื ืืืขื ืืื ืฉืืขืคื ื ืื ื ืืืจ.
ืืืื ืขืก ืืขื ืขื ืืึทื ืฅ ืึท ืคึผืืึทืฅ ืคืื ืคืจืืืขืก ืืื "ืึธืืขืจ ืืึธืก ืืื ื ืืฉื ืืืกืงืจืืืื ืืื ืืขื ืื ืืขืืึทื", ืขืก ืืืขื ืืืกืืึธืืข ืืืื ืฉืืึทืจืงืืื ืฆื ื ืขืืขื ืึท ืืขืืึทืงืืืืึทื ืกืขืจืืืขืจ ืืื ืึท ื ืืึทืข ืคืขืื ืืื ืึท ื ืืึทืข SSL ืืึทืืืืึทืื ืืื ืืึทืฉืจืืึทืื ืขืก ืืื ืืคืืื ืืขืจ ืืขืืึทื ืืื, ืจืืึฟ ืืืคึผืึธืจืืึทื ืืื, ืืืขื ืืืคืืฆืืจื ืึทืืข ืื ืคืขืื ืืืง ืืืืืืืง ืืขืืึทืืืก.
ืืื ืืืึธืื ืืืื ืืื ืฆื ืืึทืงืืืขื ืืึทืืขืจืงืื ืืขื ืืืืฃ ืืขืืื ืงืขื ืืืขืื ืคึผืึธืืกืืึทื ืกืขืจืืืคืืงืึทืฅ. ืืืื ืืืจ ืืื ืืขืจ ืืขืืึทื ืง, ืืื ืืืขื ืคึผืจืืืืจื ืฆื ืืขืคึฟืื ืขื ืื ืฉืืึทืจืงืืื ืฆื ืฉืจืืึทืื ืึท ืคึผืืึทื ืคึฟืึทืจ rfc.
ืืืขื ืงืึทืคึผืืื ื ืืจืืืก ืืืืื ืคืื ืึทื ืึทืจืืืงื, ืฆืืฉืืขืื ืึท ืืื ืง ืฆื ืืขื ืึทืจืืืงื.
ืืืขื ืืืืขืจืืขืฆื ืืื ืงืืื ืื ืืขืจืข ืฉืคึผืจืึทื, ืฆืืฉืืขืื ืึท ืืื ืง ืฆื ืืขื ืึทืจืืืงื.
ืืื ืืืขื ืืืืื ืคืจืืืืจื ืขืก ืืืืขืจืฆืืืขืฆื ืืืืฃ ืขื ืืืืฉ ืืื ืืืืขืจืืืื ืงืจืืื-ืจืขืคืขืจืขื ืฆื.
ืืงืืจ: www.habr.com