Iptables mit Postfix und Dovecot "Frage/Problem"

T

TheRoody

Member
Hallo zusammen,

ich habe bisher immer mit der Plesk Firewall gearbeitet. Nun habe ich mich aber mal direkt mit Iptables auseinandergesetzt u.a. auch um vernünftig Chains zu erstellen und um Geoip zu nutzen.

Soweit funktioniert alles super.

Gestern bemerkte ich, dass ich den ganzen Tag keine E-Mail erhalten habe, was mich gewundert hat. Ich habe mir also selbst mal eine Mail geschickt, diese kam nicht an und im Log erschien sie auch nicht. Das senden klappte problemlos.

Ich sende über Port 587 und empfange über 993 - Die beiden Ports habe ich in Iptables natürlich freigegeben. Aber der Empfang ging wie gesagt nicht, bis ich dann noch zusätzlich Port 25 freigegeben habe. Mit der Freigabe von Port 25 konnte ich dann wieder E-Mails empfangen, hier die Frage: Ist das normal?

Dann hatte ich noch was bemerkt, ich konnte keine E-Mail Konten z.B. mit Outlook hinzufügen, dort kam immer eine Meldung ähnlich wie "Es kann keine Verbindung über SSL aufgebaut werden" Hier war bei der Einrichtung auch der Pot 587 und 993 in Outlook eingetragen. Dann habe ich zusätzlich noch den Port 465 in Iptables freigegeben und nochmal versucht das E-Mail Konto in Outlook einzurichten, dass klappte dann problemlos nach der Freigabe von Port 465. Auch hier die Frage: Ist das normal?

Also warum muss ich Port 25 zusätzlich noch freigeben um Mails empfangen zu können, obwohl der Client (Outlook) auf Port 587 empfängt und warum muss ich Port 465 noch freigeben damit das hinzufügen eines Mail Kontos in Outlook über SSL funktioniert obwohl hier Port 993 angegeben ist?

Ist das alles korrekt so? Verstehe ich da etwas falsch?

Danke
 
Über Port 25 kommunizieren die Mailserver untereinander. Deshalb muss der Port in der Firewall immer frei sein.
 
Siehe mal dazu: https://kupschke.net/2011/01/23/smtp-submission-mit-postfix/

Mit Port 587 kanst du bsp die Auth. Erzwingen am MailSystem zum Senden!

IMAP Port 993 ist nur für TLS/SSL Verbindungen und 143 komplett Unverschlüsselt!

Aber um eine Echte Aussarge zu Treffen wo dein Problem begraben Liegt soltest du mal deine IPTables Hier reinpacken damit wir Nachvolziehen können wo und wie die Packete bei dir Geblockt & Rein gelassen werden.

Hast du die Plesk Firewall Deaktiviert voher? Und nur reine iptables via Script eingefügt?

Ohne Logauszug etc kann hier nur mit der Klasskugel Geholfen werden!

Lieben gruß
 
Last edited by a moderator:
rebuyit said:
Das Heute MailServer nur über Port 25 Kommunizieren ist nicht korrekt!
Click to expand...

Das hat hier auch niemand behauptet. Aber Mailserver untereinander kommunizieren eigentlich immer über Port 25, da es der Standardport für SMTP ist. Port 587 ist der Submission-Port und für die Kommunikation zwischen dem MUA (z.B. Thunderbird) und dem Mailserver vorgesehen. Als mittlerweile veraltet gilt Port 465, der war mal für explizit verschlüsseltes SMTP vorgesehen. Da Transport-Verschlüsselung auf den Ports 25 und 587 per StartTLS möglich ist, ist Port 465 (SMTPS) nur eigentlich noch für ältere MUAs notwendig, die noch kein StartTLS können.
Prinzipiell ist StartTLS übrigens auch bei IMAP und POP3 möglich, entsprechend sind auch verschlüsselte Verbindungen auf den Port 143 bzw. 110 möglich, sofern Client und Server das unterstützen.
 
Port 25 ist per RFC für die Kommunikation zwischen Mailservern vorgeschrieben und daran wird sich auch nichts ändern.
Port 465 ist schon seit 20 Jahren deprecated und sollte dementsprechend gar nicht mehr verwendet werden.
 
Last edited by a moderator:
Ich muss mich hier mal einklinken.
Ich habe auf einem Server Plesk installiert. Nach 10 Jahren der Administration über die Console wollte ich es mal darüber versuchen.

Zertifikate für den Hostname, Webserver und Mailserver via Lets encrypt erstellt.

IMAP: 993 SSL/TLS
SMTP: 465 SSL/TLS

Ich kann erst gar nicht über Port 587 verschlüsselt versenden. Nur über Port 465. Sowohl über Outlook als auch über Thunderbird.
 
In der master.cf:
submission aktivieren
smtps deaktivieren

postfix restart

Outlook und/oder Thunderbird:
Ausgangsserver: Port 587 TLS/STARTTLS
SMTP-AUTH: User/Pass
 
Das heisst also während der Installation von Plesk wird er bereits falsch konfiguriert, mit einem alten Port?
 
Oder es ist in Plesk falsch eingestellt? Ich nutze Plesk nicht, aber dort solltest du als erstes nachschauen, bevor du direkt die Konfigdateien änderst. Sonst kann es passieren, dass deine Änderung irgendwann von Plesk wieder zurückgenommen wird.
 
Plesk hat hier nichts falsch konfiguriert.
Es liegt der Verantwortung derjenigen, die den Server selbst administrieren, sich zu informieren was eingestellt ist, nach der Installation des Linux.
Eine Benutzeroberfläche ersetzt kein Fachwissen. Server sind keine One-Click-Angelegenheit!

Mail seitens der Clients läuft doch gut (auch mit Plesk) über die Ports 465 und 995. Ich versteh das Problem nicht.
Außer man benutzt natürlich kein korrektes SSL-Zertifikat. Aber das muss man halt erwerben oder mit Let's Encrypt erstellen.

Ansonsten: Submission über Port 587 muss man erst aktivieren in Plesk.
 
Last edited by a moderator:
Sollten sich die Clients besser über 465 oder über 587 verbinden?

Hier meine Iptables Regeln (Plesk Firewall/Iptables ist nicht installiert)

Code: 
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  195 84760 f2b-plesk-login  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 8443
  983 95633 f2b-BadBots  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
  983 95633 f2b-apache  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
  983 95633 f2b-plesk-roundcube  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
32882 5682K f2b-plesk-dovecot  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 143,220,993,110,995,4190
 1695  677K f2b-plesk-postfix  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587
    7   418 f2b-plesk-proftpd  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 21,20,990,989
58271   24M f2b-recidive  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
  195 84760 f2b-plesk-login  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 8443
  983 95633 f2b-BadBots  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
  983 95633 f2b-apache  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
  983 95633 f2b-plesk-roundcube  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
32882 5682K f2b-plesk-dovecot  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 143,220,993,110,995,4190
 1582  671K f2b-plesk-postfix  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587
    7   418 f2b-plesk-proftpd  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 21,20,990,989
58158   24M f2b-recidive  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0           
 5345 1703K LOCAL      all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
  177 81791 f2b-plesk-login  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 8880,8443
  858 87918 f2b-BadBots  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
  858 87918 f2b-apache  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
  858 87918 f2b-plesk-roundcube  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,7080,7081
32216 5623K f2b-plesk-dovecot  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 143,220,993,110,995,4190
 1553  667K f2b-plesk-postfix  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587
    7   418 f2b-plesk-proftpd  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 21,20,990,989
52813   22M f2b-recidive  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
  345 23596 ICMP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
52813   22M FTP        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
35565 6510K TCP        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
 1506  151K GEOIP      all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  814  116K UDP        udp  --  *      *       0.0.0.0/0            0.0.0.0/0           
   88  5788 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:!0x17/0x02 state NEW reject-with tcp-reset
   66  2640 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
  205  9880 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:!0x17/0x02 state NEW reject-with tcp-reset
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
    0     0 ACCEPT     all  --  lo     lo      0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun0   eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
51454   15M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW,RELATED,ESTABLISHED
    4   160 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      tun0    0.0.0.0/0            0.0.0.0/0           
    1   148 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FTP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:20 /* FTP 20 */
    7   418 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:21 /* FTP 21 */
17241   16M ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          multiport dports 1024:65535 state NEW,ESTABLISHED /* FTP Passive */
35565 6510K RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain GEOIP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country A1  /* GEOPIP A1 */
    1    40 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country AR  /* GEOPIP AR */
    4   160 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country BG  /* GEOPIP BG */
    9   360 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country BR  /* GEOPIP BR */
   36  1540 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country CN  /* GEOPIP CN */
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country CZ  /* GEOPIP CZ */
   78  4680 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country HU  /* GEOPIP HU */
    1    40 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country HK  /* GEOPIP HK */
   41  2056 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country IN  /* GEOPIP IN */
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country KG  /* GEOPIP KG */
    5   200 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country KR  /* GEOPIP KR */
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country MY  /* GEOPIP MY */
   21   844 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country PL  /* GEOPIP PL */
    7   364 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country PK  /* GEOPIP PK */
   51  2212 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country RU  /* GEOPIP RU */
    7   364 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country TH  /* GEOPIP TH */
   12   576 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country TR  /* GEOPIP TR */
    4   184 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country UA  /* GEOPIP UA */
   11   548 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country VN  /* GEOPIP VN */
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country AF  /* GEOPIP AF */
   36  1844 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country ID  /* GEOPIP ID */
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country KP  /* GEOPIP KP */
    4   208 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country MX  /* GEOPIP MX */
    1    40 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country RO  /* GEOPIP RO */
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country SK  /* GEOPIP SI */
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country SK  /* GEOPIP SK */
    4   160 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country TW  /* GEOPIP TW */
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country RO  /* GEOPIP RO */
 1173  134K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ICMP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  *      *       104.84.176.0/20      X.X.X.X.X.X          /* Lets Encrypt PING */
    0     0 ACCEPT     icmp --  *      *       23.45.96.0/20        X.X.X.X.X.X          /* Lets Encrypt PING */
  344 23562 LOGGING    icmp --  *      *       0.0.0.0/0            X.X.X.X.X.X         
    1    34 ACCEPT     icmp --  *      *       0.0.0.0/0            X.X.X.X.X.X         
    0     0 LOGGING    icmp --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain LOCAL (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 5345 1703K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       127.0.0.1            127.0.0.1           
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain LOGGING (36 references)
 pkts bytes target     prot opt in     out     source               destination         
  601 28816 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4 prefix "TCP LOGGING: "
   63 16230 LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4 prefix "UDP LOGGING: "
  344 23562 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4 prefix "ICMP LOGGING: "
 1008 68608 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain TCP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:113 /* TCP AUTH */
  202 23541 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:XX /* SSH */
  371 33730 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:80 /* HTTP */
  162 80831 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:8443 /* Plesk */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:8447 /* Plesk Updates and Upgrades */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:5224 /* Plesk Key update */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:53 /* DNS */
  484 54068 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:443 /* SSL APACHE */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:953 /* SSL DNS */
32214 5623K ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:993 /* IMAP */
 1199  471K ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:587 /* SMTP */
  227  188K ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:25 /* SMTP */
   17  2092 ACCEPT     tcp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          tcp dpt:465 /* SMTP */
  689 34604 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain UDP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          udp dpt:113
  754 99875 ACCEPT     udp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          udp spt:53
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            X.X.X.X.X.X          udp dpt:1194
   60 16106 LOGGING    udp  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-BadBots (3 references)
 pkts bytes target     prot opt in     out     source               destination         
 2824  279K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-apache (3 references)
 pkts bytes target     prot opt in     out     source               destination         
 2824  279K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-plesk-dovecot (3 references)
 pkts bytes target     prot opt in     out     source               destination         
97980   17M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-plesk-login (3 references)
 pkts bytes target     prot opt in     out     source               destination         
  567  251K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-plesk-postfix (3 references)
 pkts bytes target     prot opt in     out     source               destination         
 4830 2016K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-plesk-proftpd (3 references)
 pkts bytes target     prot opt in     out     source               destination         
   21  1254 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-plesk-roundcube (3 references)
 pkts bytes target     prot opt in     out     source               destination         
 2824  279K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-recidive (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    2   120 REJECT     all  --  *      *       94.102.50.96         0.0.0.0/0            reject-with icmp-port-unreachable
   69  3496 REJECT     all  --  *      *       91.200.12.152        0.0.0.0/0            reject-with icmp-port-unreachable
   42  2128 REJECT     all  --  *      *       91.200.12.103        0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       94.102.50.96         0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       91.200.12.152        0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       91.200.12.103        0.0.0.0/0            reject-with icmp-port-unreachable
 169K   70M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Wie gesagt, wenn ich Port 25 nicht akzeptiere dann kommen keine E-Mails an und wen ich 465 nicht akzeptiere, dann ist die E-Mail Einrichtung z.B. unter Outlook, Mac Mail ect nicht via SSL möglich. Es kommt dann eine Meldung ähnlich wie "Das E-Mail Konto kann nicht über SSL eingerichtet werden, soll es ohne SSL eingerichtet werden?"

Hier noch meine Configs von Postfix und Dovecot...

main.cf:
Code: 
# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/postfix.pem
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.xxxxxx.de
alias_maps = hash:/etc/aliases, hash:/var/spool/postfix/plesk/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = xxxxxx.xxxxxx.de, localhost.xxxxxx.de, localhost, localhost.localdomain
relayhost = 
mynetworks = X.X.X.X.X, 127.0.0.1
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = X.X.X.X.X, 127.0.0.1
mailman_destination_recipient_limit = 1
inet_protocols = all
virtual_mailbox_domains = $virtual_mailbox_maps,
 hash:/var/spool/postfix/plesk/virtual_domains
virtual_alias_maps = $virtual_maps, hash:/var/spool/postfix/plesk/virtual
virtual_mailbox_maps = , hash:/var/spool/postfix/plesk/vmailbox
transport_maps = , hash:/var/spool/postfix/plesk/transport
smtpd_tls_security_level = may
smtp_tls_security_level = may
smtp_use_tls = no
smtpd_timeout = 3600s
smtpd_proxy_timeout = 3600s
disable_vrfy_command = yes
smtpd_sender_restrictions = check_sender_access hash:/var/spool/postfix/plesk/blacklists,
         permit_sasl_authenticated,
         permit_mynetworks,
         reject_unknown_client,
         reject_non_fqdn_sender,
         reject_non_fqdn_recipient,
         reject_unauth_pipelining,
         reject_unknown_recipient_domain,
         check_client_access hash:/etc/postfix/rbl_override,
         reject_rbl_client bl.spamcop.net,
         reject_rbl_client zen.spamhaus.org,
         reject_rbl_client allinone.bl.blocklist.de,
         reject_rbl_client ix.dnsbl.manitu.net,
         reject_unknown_sender_domain
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access hash:/etc/postfix/rbl_override, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client allinone.bl.blocklist.de, reject_rbl_client ix.dnsbl.manitu.net
smtp_send_xforward_command = yes
smtpd_authorized_xforward_hosts = 127.0.0.0/8 [::1]/128
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
virtual_mailbox_base = /var/qmail/mailnames
virtual_uid_maps = static:30
virtual_gid_maps = static:31
smtpd_milters = inet:127.0.0.1:12768 inet:127.0.0.1:12345
sender_dependent_default_transport_maps = hash:/var/spool/postfix/plesk/sdd_transport_maps
virtual_transport = plesk_virtual
plesk_virtual_destination_recipient_limit = 1
virtual_mailbox_limit = 0
#smtpd_tls_ciphers = high
#smtpd_tls_mandatory_ciphers = high
#tls_medium_cipherlist = DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ALL:!LOW:!EXP:!aNULL
#smtpd_tls_mandatory_protocols = TLSv1 TLSv1.1 TLSv1.2
#smtpd_tls_protocols = TLSv1 TLSv1.1 TLSv1.2
message_size_limit = 20480000
#milter_connect_macros = j {daemon_name} {client_connections} {client_addr} {client_ptr} v
#milter_default_action = accept
#new
tls_preempt_cipherlist = yes
smtpd_tls_loglevel = 2
smtp_tls_loglevel = 2
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 120s
smtp_sasl_security_options = noplaintext, noanonymous
smtpd_helo_required = yes
broken_sasl_auth_clients = yes
strict_rfc821_envelopes = yes
smtpd_error_sleep_time = 3600s
smtpd_soft_error_limit = 3
smtpd_hard_error_limit = 1
tls_random_source = dev:/dev/urandom
smtpd_helo_restrictions = permit_sasl_authenticated,
         permit_mynetworks,
         reject_unauth_destination,
         reject_non_fqdn_sender,
         reject_non_fqdn_recipient,
         reject_unknown_recipient_domain,
         reject_non_fqdn_hostname,
         reject_invalid_hostname,
         reject_unauth_pipelining
tls_high_cipherlist = DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ALL:!LOW:!EXP:!aNULL
tls_random_bytes = 256
tls_daemon_random_bytes = 128
tls_preempt_cipherlist = yes
smtpd_tls_ciphers = high
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_protocols = TLSv1 TLSv1.1 TLSv1.2
smtpd_tls_mandatory_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
### new ###
initial_destination_concurrency = 20
default_destination_concurrency_limit = 20
local_destination_concurrency_limit = 20
smtp_destination_concurrency_limit = 20
smtpd_client_connection_count_limit = 25
smtpd_client_message_rate_limit = 20
smtpd_client_new_tls_session_rate_limit = 30
default_destination_recipient_limit = 50
smtpd_recipient_limit = 100
queue_run_delay = 300s
minimal_backoff_time = 300s
maximal_backoff_time = 4000s
default_process_limit = 20
smtpd_tls_eecdh_grade = strong
tls_eecdh_strong_curve = prime256v1
tls_eecdh_ultra_curve = secp384r1
smtpd_junk_command_limit = 5
smtpd_starttls_timeout = 180s
smtpd_per_record_deadline = yes
address_verify_poll_count = 2
smtpd_client_connection_rate_limit = 20
smtpd_client_recipient_rate_limit = 50
smtpd_tls_protocols = TLSv1 TLSv1.1 TLSv1.2
plesk_virtual_destination_recipient_limit = 1
milter_connect_macros = j {daemon_name} {client_connections} {client_addr} {client_ptr} v
milter_default_action = accept
smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem
smtpd_tls_dh512_param_file = /etc/postfix/dh512.pem

master.cf:
Code: 
#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       -       -       -       smtpd
#smtp      inet  n       -       -       -       1       postscreen
#smtpd     pass  -       -       -       -       -       smtpd
#dnsblog   unix  -       -       -       -       0       dnsblog
#tlsproxy  unix  -       -       -       -       0       tlsproxy
#submission inet n       -       -       -       -       smtpd
#  -o syslog_name=postfix/submission
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
#smtps     inet  n       -       -       -       -       smtpd
#  -o syslog_name=postfix/smtps
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628       inet  n       -       -       -       -       qmqpd
cleanup   unix  n       -       -       -       0       cleanup
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp
relay     unix  -       -       -       -       -       smtp
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
#  mailbox_transport = lmtp:inet:localhost
#  virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus     unix  -       n       n       -       -       pipe
#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix  -       n       n       -       -       pipe
#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix	-	n	n	-	2	pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe flags=R user=list:list argv=/usr/lib/plesk-9.0/postfix-mailman ${nexthop} ${user} ${recipient}


plesk_virtual unix - n n - - pipe flags=DORhu user=popuser:popuser argv=/usr/lib/plesk-9.0/postfix-local -f ${sender} -d ${recipient} -p /var/qmail/mailnames
pickup fifo n - - 60 1 pickup
qmgr fifo n - n 1 1 qmgr
smtps inet n - - - - smtpd -o smtpd_tls_wrappermode=yes

plesk_saslauthd unix y y y - 1 plesk_saslauthd status=5 listen=6 dbpath=/plesk/passwd.db

#submission inet n - - - - smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination

submission inet n - - - - smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination -o smtpd_tls_dh1024_param_file=/etc/postfix/dh2048.pem

plesk-X.X.X.X.X- unix - n n - - smtp -o smtp_bind_address=X.X.X.X.X- -o smtp_bind_address6= -o smtp_address_preference=ipv4

Dovecot...

dovecot.conf:
Code: 
## Dovecot configuration file

# PLEASE DON'T EDIT ANYTHING IN THIS FILE! ANY CHANGES WILL BE LOST ON UPGRADE.
# Instead add your custom configuration to /etc/dovecot/conf.d/
# See the end of this file for details on customization.

# See example configuration files in /usr/share/doc/dovecot/example-config/
# See stock configuration files in /usr/share/doc/plesk-dovecot/dist-config/


# Space separated list of wanted authentication mechanisms.
# NOTE: See also disable_plaintext_auth setting.
auth_mechanisms = plain login digest-md5 cram-md5 apop

# Valid UID range should include popuser.
first_valid_uid = 30

# List of allowed characters in username. "'&" is added here to the default list.
auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890&.-_@'

# Plesk Maildirs layout.
mail_home = /var/qmail/mailnames/%Ld/%Ln
mail_location = maildir:/var/qmail/mailnames/%Ld/%Ln/Maildir

# Enable Maildir++ quota support.
mail_plugins = $mail_plugins quota

plugin {
  # Take quota limits from maildirsize file. If it doesn't exist, don't enforce.
  quota = maildir:User quota
  # LDA/LMTP allows saving the last mail to bring user from under quota to
  # over quota, if the quota doesn't grow too high. Default is to allow as
  # long as quota will stay under 10% above the limit. Also allowed e.g. 10M.
  # 0 doesn't allow going over quota (compatibility with Courier-IMAP behavior).
  quota_grace = 0
}


service auth {
  # Allow userdb lookups for popuser.
  unix_listener auth-userdb {
    mode = 0600
    user = popuser
    group = popuser
  }
}


# PEM encoded X.509 SSL/TLS certificate and private key.
ssl_cert = </etc/dovecot/private/dovecot.pem
ssl_key =  </etc/dovecot/private/dovecot.pem


# Protocols support.

protocols = imap pop3

protocol imap {
  mail_plugins = $mail_plugins imap_quota
}

protocol pop3 {
  # POP3 UIDL format similar to the one used by Courier-IMAP.
  pop3_uidl_format = UID%u-%v
}

# Applicable workarounds for various client bugs.
imap_client_workarounds = delay-newmail
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh


# Default private namespace setup compatible with Courier-IMAP.

namespace inbox {
  separator = .
  prefix = INBOX.
  inbox = yes
}


# Logging verbosity and debugging.

# Log unsuccessful authentication attempts and the reasons why they failed.
#auth_verbose = yes

# In case of password mismatches, log the attempted password. Valid values are
# no, plain and sha1. sha1 can be useful for detecting brute force password
# attempts vs. user simply trying the same password over and over again.
#auth_verbose_passwords = no

# Even more verbose logging for debugging purposes.
#auth_debug = yes

# In case of password mismatches, log the passwords and used scheme so the
# problem can be debugged. Enabling this also enables auth_debug.
#auth_debug_passwords = yes

# Enable mail process debugging. This can help you figure out why Dovecot
# isn't finding your mails.
#mail_debug = yes

# Show protocol level SSL errors.
#verbose_ssl = yes


# Log format compatible with Plesk statistics collector.
mail_log_prefix = "service=%s, user=%u, ip=[%r]. "
pop3_logout_format = "rcvd=%i, sent=%o, top=%t/%p, retr=%r/%b, del=%d/%m, size=%s"
imap_logout_format = "rcvd=%i, sent=%o"

# Customizable part of configuration gets included below. The filenames are
# first sorted by their ASCII value and parsed in that order. The 00-prefixes
# in filenames are intended to make it easier to understand the ordering.
#
# Prefixes 10 through 20 and 90 through 95 (inclusive) are reserved for Plesk. 
# Please do not occupy them or edit files with these prefixes!
!include conf.d/*.conf

# vim:ts=2 sts=2 sw=2 et:
 
Last edited by a moderator:
TheRoody said:
Sollten sich die Clients besser über 465 oder über 587 verbinden?
Click to expand...

Port 587 (Submission), den der Port 465 für SMTPS ist veraltet. Und bei der Einrichtung nicht SSL/TLS im Outlook auswählen, sondern STARTTLS. Die Verbindung erfolgt initial unverschlüsselt und dann wird die Verschlüsselung vereinfacht gesagt per STARTTLS nachgestartet.
Und Port 25 ist notwendig, weil andere Mailserver darüber ihre Mails bei dir abliefern (die teilweise per STARTTLS dann die Verbindung übrigens auch verschlüsseln).
 
Ok, ich habe jetzt den Port 465 in Iptables wieder geblockt. Beim einrichten eines E-Mail Accounts kam sonst immer eine Meldung das der Account nicht über SSL hinzugefügt werden kann und ob die Einrichtung ohne SSL fortgesetzt werden soll. Nun klappt es aber und die Meldung kommt nicht mehr, warum auch immer.
 
You must log in or register to reply here.
Back
Top