Tom*_*ogg 6 ssl firewall imap openssl nmap
* TLDR；如果您遇到连接问题，不仅要确保已将所需的规则添加到防火墙中，还要确保 ( $ iptables -L -v) 规则的顺序正确！*
现在已经几天了，我不明白为什么我的 IMAP 设置（在端口 993 上）拒绝工作（使用 Dovecot，版本 2.2.22）。连接不成功，由于某种原因我看不到。
对与 openssl 的连接进行故障排除：在端口 993 上连接不起作用：
$ openssl s_client -connect my-domain.com:993
返回：
connect: Connection timed out
connect:errno=110
但是使用的端口（993）似乎是开放的：
$ ufw status
返回：
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
443/tcp ALLOW Anywhere
25/tcp ALLOW Anywhere
587/tcp ALLOW Anywhere
993/tcp ALLOW Anywhere
143/tcp ALLOW Anywhere
465/tcp ALLOW Anywhere
110/tcp ALLOW Anywhere
995/tcp ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
443/tcp (v6) ALLOW Anywhere (v6)
25/tcp (v6) ALLOW Anywhere (v6)
587/tcp (v6) ALLOW Anywhere (v6)
993/tcp (v6) ALLOW Anywhere (v6)
143/tcp (v6) ALLOW Anywhere (v6)
465/tcp (v6) ALLOW Anywhere (v6)
110/tcp (v6) ALLOW Anywhere (v6)
995/tcp (v6) ALLOW Anywhere (v6)
我的鸽舍配置是：
$ dovecot -n
# 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.13 (7b14904)
# OS: Linux 4.4.0-38-generic x86_64 Ubuntu 16.04.1 LTS ext4
auth_debug = yes
auth_debug_passwords = yes
auth_mechanisms = plain login
auth_verbose = yes
auth_verbose_passwords = sha1
mail_debug = yes
mail_location = maildir:/var/mail/vhosts/%d/%n
mail_privileged_group = mail
namespace inbox {
inbox = yes
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix =
}
passdb {
args = /etc/dovecot/dovecot-sql.conf.ext
driver = sql
}
protocols = imap pop3 lmtp
service auth-worker {
user = vmail
}
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0666
user = postfix
}
unix_listener auth-userdb {
mode = 0600
user = vmail
}
user = dovecot
}
service imap-login {
inet_listener imaps {
port = 993
ssl = yes
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
mode = 0600
user = postfix
}
}
service pop3-login {
inet_listener pop3s {
port = 995
ssl = yes
}
}
ssl = required
ssl_cert = </etc/ssl/localcerts/www.my-domain.com.chained.crt
ssl_key = </etc/ssl/localcerts/www.my-domain.com.key
userdb {
args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
driver = static
}
verbose_ssl = yes
编辑 1：
密钥和证书做匹配：
$ (openssl x509 -noout -modulus -in /etc/ssl/localcerts/www.my-domain.com.crt | openssl md5 ;\
openssl rsa -noout -modulus -in /etc/ssl/localcerts/www.my-domain.com.key | openssl md5) | uniq
仅返回 1 个标识符：
(stdin)= cfcbed2e4061910c47c5008d8732e522
编辑2：
为 Dovecot 启用最大日志记录，使用：
auth_verbose=yes
auth_debug=yes
auth_debug_passwords=yes
mail_debug=yes
verbose_ssl=yes
auth_verbose_passwords=sha1
返回：
$ tail -f /var/log/mail.log
dovecot: master: Dovecot v2.2.22 (fe789d2) starting up for imap, pop3, lmtp (core dumps disabled)
[...]
dovecot: lmtp(5491): Connect from local
dovecot: lmtp(info@my-domain.com): +rg7LUpw6ldzFQAAxWOCog: msgid=<57ea704a99e89_b638aedb491d2@chbh.mail>: saved mail to INBOX
dovecot: lmtp(5491): Disconnect from local: Successful quit
编辑 3：
通过 SSL 连接到在端口 443 上使用相同证书和密钥的网络服务器 (Nginx) 完全正常：
$ openssl s_client -connect my-domain.com:443
编辑 4：
我在旧服务器上使用了相同版本的 Dovecot、相同的 Dovecot 配置和相同的证书+密钥，其中与 Dovecot 的 IMAP 连接完全正常。
编辑 5：
尝试openssl s_client使用参数在 IMAP 端口 993 (via )上建立连接-dtls1似乎做了一些事情：
$ openssl s_client -connect my-domain.com:993 -dtls1 -debug
返回（非常缓慢）是这样的：
CONNECTED(00000003)
write to 0x1425de0 [0x142f970] (202 bytes => 202 (0xCA))
0000 - 16 fe ff 00 00 00 00 00-00 00 00 00 bd 01 00 00 ................
0010 - b1 00 00 00 00 00 00 00-b1 fe ff 79 ab 6e 7d 25 ...........y.n}%
0020 - ac b9 bb 4b d9 4e 10 70-d4 fa 89 1b 72 bc 10 c1 ...K.N.p....r...
0030 - 46 30 c6 16 d8 46 63 4d-9f 75 9c 00 00 00 56 c0 F0...FcM.u....V.
[...]
0090 - 03 00 0a 00 ff 01 00 00-31 00 0b 00 04 03 00 01 ........1.......
00a0 - 02 00 0a 00 1c 00 1a 00-17 00 19 00 1c 00 1b 00 ................
00b0 - 18 00 1a 00 16 00 0e 00-0d 00 0b 00 0c 00 09 00 ................
00c0 - 0a 00 23 00 00 00 0f 00-01 01 ..#.......
read from 0x1425de0 [0x142b413] (17741 bytes => -1 (0xFFFFFFFFFFFFFFFF))
write to 0x1425de0 [0x1434ed0] (202 bytes => 202 (0xCA))
0000 - 16 fe ff 00 00 00 00 00-00 00 01 00 bd 01 00 00 ................
0010 - b1 00 00 00 00 00 00 00-b1 fe ff 79 ab 6e 7d 25 ...........y.n}%
0020 - ac b9 bb 4b d9 4e 10 70-d4 fa 89 1b 72 bc 10 c1 ...K.N.p....r...
0030 - 46 30 c6 16 d8 46 63 4d-9f 75 9c 00 00 00 56 c0 F0...FcM.u....V.
[...]
00a0 - 02 00 0a 00 1c 00 1a 00-17 00 19 00 1c 00 1b 00 ................
00b0 - 18 00 1a 00 16 00 0e 00-0d 00 0b 00 0c 00 09 00 ................
00c0 - 0a 00 23 00 00 00 0f 00-01 01 ..#.......
[...]
0070 - 45 00 44 00 43 00 42 c0-0e c0 04 00 2f 00 96 00 E.D.C.B...../...
0080 - 41 c0 12 c0 08 00 16 00-13 00 10 00 0d c0 0d c0 A...............
0090 - 03 00 0a 00 ff 01 00 00-31 00 0b 00 04 03 00 01 ........1.......
00a0 - 02 00 0a 00 1c 00 1a 00-17 00 19 00 1c 00 1b 00 ................
00b0 - 18 00 1a 00 16 00 0e 00-0d 00 0b 00 0c 00 09 00 ................
00c0 - 0a 00 23 00 00 00 0f 00-01 01 ..#.......
read from 0x1e8dde0 [0x1e93413] (17741 bytes => -1 (0xFFFFFFFFFFFFFFFF))
139876009338520:error:1413C138:SSL routines:dtls1_check_timeout_num:read timeout expired:d1_lib.c:495:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 2424 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : DTLSv1
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1474892601
Timeout : 7200 (sec)
Verify return code: 0 (ok)
---
...然后连接关闭。
然而，使用的参数-tls1（使用TLSv1）或-tls1_1（TLSv1.1）或-tls1_2（TLSv1.2工作）返回超时消息：connect: Connection timed out和connect:errno=110
编辑 6：
如果我在 Dovecot 中启用了安全 POP 端口 995，请重新启动它，在防火墙中打开此端口，然后尝试：
openssl s_client -connect my-domain.com:995
...我也收到超时错误connect: Connection timed out和connect:errno=110，显然表明问题的根源适用于 IMAP和POP。
编辑 7：
正确的进程似乎在正确的端口上侦听：
$ netstat -tulpn
返回：
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 2597/master
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 2827/nginx
tcp 0 0 127.0.0.1:8891 0.0.0.0:* LISTEN 2327/opendkim
tcp 0 0 127.0.0.1:2812 0.0.0.0:* LISTEN 1918/monit
tcp 0 0 127.0.0.1:34305 0.0.0.0:* LISTEN 2915/public
tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 2306/dovecot
tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 2306/dovecot
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 2269/mysqld
tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN 2597/master
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 2306/dovecot
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 2306/dovecot
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 2827/nginx
tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN 2597/master
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2249/sshd
tcp6 0 0 :::25 :::* LISTEN 2597/master
tcp6 0 0 :::993 :::* LISTEN 2306/dovecot
tcp6 0 0 :::995 :::* LISTEN 2306/dovecot
tcp6 0 0 :::587 :::* LISTEN 2597/master
tcp6 0 0 :::110 :::* LISTEN 2306/dovecot
tcp6 0 0 :::143 :::* LISTEN 2306/dovecot
tcp6 0 0 :::465 :::* LISTEN 2597/master
编辑 8：
Telnet 仅适用于端口 80 和 443（由 Nginx 使用），所有其他端口似乎都没有响应（超时）。
编辑 9：
我只是使用了端口扫描nmap 12.34.56.78，它只显示22/tcp | open | sshand80/tcp | open | http和443/tcp | open | https。如果您查看ufw status上面发布的结果，您可以看到我允许了 nmap 未“找到”的完整端口列表。其原因及解决方法是什么？（我知道这不是我的网络或提供商 - 我可以连接到我的旧/“相同”服务器，并且 nmap 扫描将所需的 IMAP 端口显示为“开放”）。
编辑 10：
$ iptables -L -v
返回：
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
387K 57M f2b-HTTPS tcp -- any any anywhere anywhere tcp dpt:https
118K 7235K f2b-SSH tcp -- any any anywhere anywhere tcp dpt:ssh
387K 57M f2b-HTTPS tcp -- any any anywhere anywhere tcp dpt:https
488K 64M f2b-nginx-http-auth tcp -- any any anywhere anywhere multiport dports http,https
118K 7228K f2b-sshd tcp -- any any anywhere anywhere multiport dports ssh
118K 7226K f2b-SSH tcp -- any any anywhere anywhere tcp dpt:ssh
387K 57M f2b-HTTPS tcp -- any any anywhere anywhere tcp dpt:https
387K 57M f2b-HTTPS tcp -- any any anywhere anywhere tcp dpt:https
488K 64M f2b-nginx-http-auth tcp -- any any anywhere anywhere multiport dports http,https
118K 7226K f2b-sshd tcp -- any any anywhere anywhere multiport dports ssh
1381K 214M ACCEPT all -- lo any anywhere anywhere
222K 45M ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
398 23248 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
7903 443K ACCEPT tcp -- any any anywhere anywhere multiport dports http,https
7460 441K DROP all -- any any anywhere anywhere
0 0 ufw-before-logging-input all -- any any anywhere anywhere
0 0 ufw-before-input all -- any any anywhere anywhere
0 0 ufw-after-input all -- any any anywhere anywhere
0 0 ufw-after-logging-input all -- any any anywhere anywhere
0 0 ufw-reject-input all -- any any anywhere anywhere
0 0 ufw-track-input all -- any any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw-before-logging-forward all -- any any anywhere anywhere
0 0 ufw-before-forward all -- any any anywhere anywhere
0 0 ufw-after-forward all -- any any anywhere anywhere
0 0 ufw-after-logging-forward all -- any any anywhere anywhere
0 0 ufw-reject-forward all -- any any anywhere anywhere
0 0 ufw-track-forward all -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 53 packets, 3160 bytes)
pkts bytes target prot opt in out source destination
1575K 531M ufw-before-logging-output all -- any any anywhere anywhere
1575K 531M ufw-before-output all -- any any anywhere anywhere
537 97799 ufw-after-output all -- any any anywhere anywhere
537 97799 ufw-after-logging-output all -- any any anywhere anywhere
537 97799 ufw-reject-output all -- any any anywhere anywhere
537 97799 ufw-track-output all -- any any anywhere anywhere
Chain f2b-HTTPS (4 references)
pkts bytes target prot opt in out source destination
1547K 228M RETURN all -- any any anywhere anywhere
0 0 RETURN all -- any any anywhere anywhere
0 0 RETURN all -- any any anywhere anywhere
0 0 RETURN all -- any any anywhere anywhere
Chain f2b-SSH (2 references)
pkts bytes target prot opt in out source destination
235K 14M RETURN all -- any any anywhere anywhere
0 0 RETURN all -- any any anywhere anywhere
Chain f2b-nginx-http-auth (2 references)
pkts bytes target prot opt in out source destination
975K 128M RETURN all -- any any anywhere anywhere
0 0 RETURN all -- any any anywhere anywhere
Chain f2b-sshd (2 references)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- any any 62-210-106-228.rev.poneytelecom.eu anywhere reject-with icmp-port-unreachable
235K 14M RETURN all -- any any anywhere anywhere
0 0 RETURN all -- any any anywhere anywhere
Chain ufw-after-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw-after-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw-skip-to-policy-input udp -- any any anywhere anywhere udp dpt:netbios-ns
0 0 ufw-skip-to-policy-input udp -- any any anywhere anywhere udp dpt:netbios-dgm
0 0 ufw-skip-to-policy-input tcp -- any any anywhere anywhere tcp dpt:netbios-ssn
0 0 ufw-skip-to-policy-input tcp -- any any anywhere anywhere tcp dpt:microsoft-ds
0 0 ufw-skip-to-policy-input udp -- any any anywhere anywhere udp dpt:bootps
0 0 ufw-skip-to-policy-input udp -- any any anywhere anywhere udp dpt:bootpc
0 0 ufw-skip-to-policy-input all -- any any anywhere anywhere ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-after-logging-input (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-after-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw-after-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw-before-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmp -- any any anywhere anywhere icmp destination-unreachable
0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench
0 0 ACCEPT icmp -- any any anywhere anywhere icmp time-exceeded
0 0 ACCEPT icmp -- any any anywhere anywhere icmp parameter-problem
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request
0 0 ufw-user-forward all -- any any anywhere anywhere
Chain ufw-before-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
0 0 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 ufw-logging-deny all -- any any anywhere anywhere ctstate INVALID
0 0 DROP all -- any any anywhere anywhere ctstate INVALID
0 0 ACCEPT icmp -- any any anywhere anywhere icmp destination-unreachable
0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench
0 0 ACCEPT icmp -- any any anywhere anywhere icmp time-exceeded
0 0 ACCEPT icmp -- any any anywhere anywhere icmp parameter-problem
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-requ
您在ufw拒绝imaps连接的规则之前有一个 DROP 规则。这并不是唯一可能产生问题的规则。您应该检查它们是如何到达那里的，也许您使用了-I而不是-Ainbefore.rules或after.rules。
1381K 214M ACCEPT all -- lo any anywhere anywhere
222K 45M ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
398 23248 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
7903 443K ACCEPT tcp -- any any anywhere anywhere multiport dports http,https
7460 441K DROP all -- any any anywhere anywhere
所有上述规则都插入在ufw规则之前，并且可能会产生问题。例如，如果您配置ufw为拒绝 http 或 https，则这些规则无论如何都会允许这些端口。
| 归档时间： |
|
| 查看次数： |
5748 次 |
| 最近记录： |