如何在 postfix 中加密外发电子邮件

Question

我已经按照几个在线指南设置了 postfix 和 dovecot，但始终遇到我发送的电子邮件未加密的问题。我一直在通过向我的@gmail.com 帐户发送电子邮件来测试设置，因为我确信 google 服务器将支持 TLS 加密，并且 gmail 网络邮件中的电子邮件清楚地显示了红色划掉的挂锁以显示他们没有加密。

如果我设置

smtpd_tls_security_level = encrypt
smtp_tls_security_level = encrypt

我收到这个错误

TLS is required, but was not offered by host gmail-smtp-in.l.google.com[64.233.167.27]

如果我将其设置为 may，它会在不加密的情况下发送电子邮件。

这是 postconf -n

的输出

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
home_mailbox = Maildir/
inet_interfaces = all
inet_protocols = all
mailbox_command =
mailbox_size_limit = 0
mydestination = $myhostname, localdomain, localhost, localhost.localdomain, localhost, mail.example.com, example.com
myhostname = mail.example.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mynetworks_style = subnet
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
smtp_tls_CAfile = /routeto/my.ca-bundle
smtp_tls_cert_file = /routeto/my.crt
smtp_tls_key_file = /routeto/my.key
smtp_tls_loglevel = 1
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_client_hostname
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = example.com
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_tls_CAfile = /routeto/my.ca-bundle
smtpd_tls_cert_file = /routeto/my.crt
smtpd_tls_key_file = /routeto/my.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes

这是端口 25 上的 telnet 输出，然后是 ehlo 测试

250-mail.example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

在端口 587 上也是如此

250-mail.example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Answer 1

TLS is required, but was not offered by host gmail-smtp-in.l.google.com[64.233.167.27]

这清楚地表明，主机不向您的服务器提供 STARTTLS。但是，众所周知，gmail 提供 STARTTLS 并且您使用 telnet 进行的测试证实了这一点。我的猜测是您从另一个系统进行了 telnet，并且您的邮件服务器位于某个（透明）防火墙后面，该防火墙拦截流量以对其进行分析。为了不处理加密的 SMTP 流量，这通常通过简单地从服务器对 EHLO 的响应中剥离 STARTTLS 命令来完成，以便邮件服务器假定不支持 TLS。

另见 What happens if STARTTLS dropped in SMTP?。

如何在 postfix 中加密外发电子邮件

How to encrypt outgoing email in postfix

email

ssl

postfix

dovecot

starttls