我试图在Postfix上启用TLS，但守护进程崩溃：
Sep 16 16:00:38 core postfix/master[1689]: warning: process /usr/libexec/postfix/smtpd pid 1694 killed by signal 11 Sep 16 16:00:38 core postfix/master[1689]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling 这是两个IP的OpenVZ容器（CentOS 6.3 x86_64）
# postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 disable_vrfy_command = yes home_mailbox = Maildir/ html_directory = no inet_interfaces = all inet_protocols = all local_recipient_maps = mail_owner = postfix mailbox_command = mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost mydomain = domain.com myhostname = mail.domain.com mynetworks = 127.0.0.0/8 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES relay_domains = sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtp_tls_note_starttls_offer = yes smtp_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_cache.db smtp_use_tls = yes smtpd_delay_reject = yes smtpd_error_sleep_time = 1s smtpd_hard_error_limit = 20 smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_hostname, reject_invalid_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_destination reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, permit smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_soft_error_limit = 10 smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls = yes tls_random_source = dev:/dev/urandom unknown_local_recipient_reject_code = 550
# postconf -a cyrus dovecot
# ldd /usr/libexec/postfix/smtpd linux-vdso.so.1 => (0x00007fff10dfe000) libldap-2.4.so.2 => /lib64/libldap-2.4.so.2 (0x00007f8a01c2c000) liblber-2.4.so.2 => /lib64/liblber-2.4.so.2 (0x00007f8a01a1d000) libpcre.so.0 => /lib64/libpcre.so.0 (0x00007f8a017f0000) libmysqlclient.so.16 => /usr/lib64/libmysqlclient.so.16 (0x00007f8a014ea000) libm.so.6 => /lib64/libm.so.6 (0x00007f8a01266000) libsasl2.so.2 => /usr/lib64/libsasl2.so.2 (0x00007f8a0104b000) libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007f8a00df0000) libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007f8a00a56000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f8a00851000) libz.so.1 => /lib64/libz.so.1 (0x00007f8a0063b000) libdb-4.7.so => /lib64/libdb-4.7.so (0x00007f8a002c7000) libnsl.so.1 => /lib64/libnsl.so.1 (0x00007f8a000ad000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f89ffe93000) libc.so.6 => /lib64/libc.so.6 (0x00007f89ffb00000) libssl3.so => /usr/lib64/libssl3.so (0x00007f89ff8c3000) libsmime3.so => /usr/lib64/libsmime3.so (0x00007f89ff697000) libnss3.so => /usr/lib64/libnss3.so (0x00007f89ff35b000) libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f89ff134000) libplds4.so => /lib64/libplds4.so (0x00007f89fef30000) libplc4.so => /lib64/libplc4.so (0x00007f89fed2b000) libnspr4.so => /lib64/libnspr4.so (0x00007f89feaed000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f89fe8d0000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f89fe699000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007f89fe456000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007f89fe177000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007f89fdf73000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007f89fdd46000) /lib64/ld-linux-x86-64.so.2 (0x00007f8a02102000) libfreebl3.so => /lib64/libfreebl3.so (0x00007f89fdae4000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007f89fd8d8000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007f89fd6d5000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f89fd4b5000)
# cat /etc/postfix/master.cf | grep -v "^#" smtp inet n - n - - smtpd -v smtps inet n - n - - smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_reject_unlisted_sender=yes -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject -o broken_sasl_auth_clients=yes pickup fifo n - n 60 1 pickup cleanup unix n - n - 0 cleanup qmgr fifo n - n 300 1 qmgr tlsmgr unix - - n 1000? 1 tlsmgr rewrite unix - - n - - trivial-rewrite bounce unix - - n - 0 bounce defer unix - - n - 0 bounce trace unix - - n - 0 bounce verify unix - - n - 1 verify flush unix n - n 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - n - - smtp relay unix - - n - - smtp -o smtp_fallback_relay= showq unix n - n - - showq error unix - - n - - error retry unix - - n - - error discard unix - - n - - discard local unix - nn - - local virtual unix - nn - - virtual lmtp unix - - n - - lmtp anvil unix - - n - 1 anvil scache unix - - n - 1 scache
从评论请求的信息：
# { postconf -d; postconf -d; postconf -n; } | sort | uniq -u alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes disable_vrfy_command = yes home_mailbox = Maildir/ inet_protocols = all local_recipient_maps = mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain myhostname = mail.domain.com mynetworks = 127.0.0.0/8 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES relay_domains = sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix smtpd_hard_error_limit = 20 smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_hostname, reject_invalid_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_destination, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, permit smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_tls_auth_only = yes smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key smtpd_tls_loglevel = 2 smtpd_tls_received_header = yes smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_tls_session_cache smtp_tls_note_starttls_offer = yes
后缀版本：
# postconf mail_version mail_version = 2.6.6
日志（telnet 127.0.0.1 25）：
Sep 18 14:07:25 core postfix/postfix-script[4078]: starting the Postfix mail system Sep 18 14:07:25 core postfix/master[4079]: daemon started -- version 2.6.6, configuration /etc/postfix Sep 18 14:07:49 core postfix/smtpd[4083]: initializing the server-side TLS engine Sep 18 14:07:49 core postfix/tlsmgr[4084]: open smtpd TLS cache btree:/var/lib/postfix/smtpd_tls_session_cache Sep 18 14:07:49 core postfix/tlsmgr[4084]: tlsmgr_cache_run_event: start TLS smtpd session cache cleanup Sep 18 14:07:49 core postfix/master[4079]: warning: process /usr/libexec/postfix/smtpd pid 4083 killed by signal 11 Sep 18 14:07:49 core postfix/master[4079]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling
smtp_tls_session_cache_database = btree：/var/lib/postfix/smtpd_tls_cache.db
注意，smtp！= smtp *** d ***。
您尚未设置smtpD_tls_session_cache_database，并且此设置没有默认值 。
添加并重新加载。
编辑：恩，实际上并不需要。 哦，也许索姆更多的采伐会给我们提供线索。
重新编辑：请执行以下操作：
postfix stop mv /var/log/mail.log ~/mail.log.bak清除日志，然后重启你的系统日志服务 { postconf -d; postconf -d; postconf -n; } | sort | uniq -u { postconf -d; postconf -d; postconf -n; } | sort | uniq -u { postconf -d; postconf -d; postconf -n; } | sort | uniq -u ，因为这会告诉我们在main.cf中设置的是不是默认的 postconf mail_version的输出 inet_interfaces = 127.0.0.1和debug_peer_list = 127.0.0.1 postfix start telnet 127.0.0.1 25 好的，所以我将这个与我工作的Postfix + Dovecot解决scheme进行比较，这个解决scheme使用TLS就好了。 该版本比在Ubuntu 12.04 LTS上运行的报告更新。
# postconf mail_version mail_version = 2.9.3
现在，如果我只检查我的非默认smtpd_*设置，我有以下几点：
# postconf -n |grep ^smtpd_ smtpd_banner = $myhostname ESMTP $mail_name smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client dnsbl.njabl.org smtpd_data_restrictions = reject_unauth_pipelining smtpd_delay_reject = yes smtpd_hard_error_limit = 12 smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit smtpd_recipient_limit = 16 smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit smtpd_soft_error_limit = 3 smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = /etc/ssl/certs/server.example.net.crt smtpd_tls_key_file = /etc/ssl/private/server.example.net.key smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_security_level = may smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls = yes
我的系统和你的另一个区别是我在chroot下运行，所以我的master.cf有以下的比较：
smtp inet n - - - - smtpd #smtp inet n - - - 1 postscreen #smtpd pass - - - - - smtpd #dnsblog unix - - - - 0 dnsblog #tlsproxy unix - - - - 0 tlsproxy submission inet n - - - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING #smtps inet n - - - - smtpd # -o syslog_name=postfix/smtps # -o smtpd_tls_wrappermode=yes # -o smtpd_sasl_auth_enable=yes # -o smtpd_client_restrictions=permit_sasl_authenticated,reject # -o milter_macro_daemon_name=ORIGINATING
正如你所看到的，我只听25 / tcp（smtp）和587 / tcp（提交），因为不需要465 / tcp（smtps），因为25 / tcp将支持STARTTLS和587 / tcp要求STARTTLS。
关于唯一真正的显着差异，我可以告诉从我的master.cf和你的是，你有smtp开始smtpd -v ，我只是有smtpd
我怀疑是什么导致postfix / tlsmgr的日志条目只是telnet到端口25，甚至不应该启动TLS连接，除非STARTTLS命令一旦连接，然后正确testing，你会更好的testing使用：
openssl s_client -connect localhost:25 -starttls smtp -CApath /etc/ssl/certs
我的SSL设置备注：我安装了ca-certificates包，然后将我的证书放在/etc/ssl/certs ，将我的密钥放在/etc/ssl/private 。 然后把我的中间CA放在/usr/local/share/ca-certificates ，运行update-ca-certificates. This re-generates the update-ca-certificates. This re-generates the ca-certificates.crt， and creates the proper symlinks under / etc / ssl / certs and creates the proper symlinks under 。