POP3+SSL 协议密码应用模拟仿真实验

一、实验概述1. 实验目的掌握Postfix邮件发送服务、Dovecot邮件接收服务的安装与配置方法。实现POP3SSL/TLS加密传输保障邮件接收过程的通信安全。完成客户端与服务端的邮件收发、加密接收全流程验证理解SSL在邮件协议中的应用。2. 实验环境操作系统openEuler 22.03服务端IP192.168.0.100主机名mail.b.com客户端IP192.168.0.101主机名mail.a.com实验平台天枢一体化虚拟仿真平台3. 实验拓扑二、实验前置准备服务端客户端通用为避免防火墙、SELinux拦截邮件通信服务端与客户端均执行以下操作# 关闭防火墙systemctl stop firewalld# 查看防火墙状态确认inactivesystemctl status firewalld# 临时关闭SELinuxsetenforce 0# 查看SELinux状态确认Permissivegetenforce三、服务端配置1. 安装邮件服务依赖包进入软件包存放目录执行批量安装[rootlocalhost ~]# cd pop/[rootlocalhost pop]# lsclucene-core-2.3.3.4-35.oe2203sp3.x86_64.rpmlibstemmer-0-12.oe2203sp3.x86_64.rpmpostfix-3.3.1-21.oe2203sp3.x86_64.rpmdovecot-2.3.15-6.oe2203sp3.x86_64.rpmmariadb-connector-c-3.1.13-4.oe2203sp3.x86_64.rpmpostfix-help-3.3.1-21.oe2203sp3.noarch.rpmlibpq-13.21-1.oe2203sp3.x86_64.rpmpcre-8.45-5.oe2203sp3.x86_64.rpmtar-1.34-5.oe2203sp3.x86_64.rpm[rootlocalhost pop]# rpm -Uvh *.rpm警告clucene-core-2.3.3.4-35.oe2203sp3.x86_64.rpm: 头V4 RSA/SHA256 Signature, 密钥 ID fb37bc6f: NOKEY警告dovecot-2.3.15-6.oe2203sp3.x86_64.rpm: 头V4 RSA/SHA256 Signature, 密钥 ID b675600b: NOKEYVerifying... ################################# [100%]准备中... ################################# [100%]正在升级/安装...1:mariadb-connector-c-3.1.13-4.oe22################################# [ 11%]2:tar-2:1.34-5.oe2203sp3 ################################# [ 22%]3:postfix-help-2:3.3.1-21.oe2203sp3################################# [ 33%]4:pcre-8.45-5.oe2203sp3 ################################# [ 44%]5:libstemmer-0-12.oe2203sp3 ################################# [ 56%]6:libpq-13.21-1.oe2203sp3 ################################# [ 67%]7:clucene-core-2.3.3.4-35.oe2203sp3################################# [ 78%]8:dovecot-1:2.3.15-6.oe2203sp3 ################################# [ 89%]9:postfix-2:3.3.1-21.oe2203sp3 ################################# [100%]安装包清单postfix、dovecot、mariadb-connector-c、pcre、clucene-core等。2. 配置Postfix进入配置文件目录cd /etc/postfix/编辑main.cf核心配置项如下# 基础配置compatibility_level 2inet_interfaces allinet_protocols allmydestination $myhostname, localhost.$mydomain, localhostmynetworks 168.100.189.0/28, 127.0.0.0/8home_mailbox Maildir/# 域名与主机名myhostname mail.b.commydomain b.commyorigin $mydomain# TLS加密配置smtpd_tls_cert_file /etc/pki/tls/certs/postfix.pemsmtpd_tls_key_file /etc/pki/tls/private/postfix.keysmtpd_tls_security_level maysmtp_tls_CApath /etc/pki/tls/certssmtp_tls_CAfile /etc/pki/tls/certs/ca-bundle.crtsmtp_tls_security_level may重启并验证Postfix服务systemctl restart postfixsystemctl status postfix3. 配置Dovecot1生成SSL自签名证书cd /etc/dovecot/# 创建证书存放目录mkdir sslcd ssl/# 生成RSA密钥与证书有效期365天openssl req -new -x509 -days 365 -nodes -out /etc/dovecot/ssl/dovecot.pem -keyout /etc/dovecot/ssl/dovecot.key -subj /CCN/STBeijing/LBeijing/OExample Corp/OUMail Server/CNmail.example.com/emailAddresspostmastermail.example.com生成后目录下会出现dovecot.pem证书、dovecot.key私钥。2核心配置修改启用POP3协议编辑/etc/dovecot/dovecot.confdict {}!include conf.d/*.conf!include_try local.conf# 新增启用POP3协议protocols pop3SSL加密配置编辑/etc/dovecot/conf.d/10-ssl.confssl requiredssl_cert /etc/dovecot/ssl/dovecot.pemssl_key /etc/dovecot/ssl/dovecot.keyssl_cipher_list HIGH:!aNULL:!MD5ssl_min_protocol TLSv1.2ssl_prefer_server_ciphers yes开放POP3S加密端口编辑/etc/dovecot/conf.d/10-master.confservice pop3-login {inet_listener pop3 {}# 开启995端口POP3SSL默认端口inet_listener pop3s {port 995ssl yes}}配置邮件存储路径编辑/etc/dovecot/conf.d/10-mail.confmail_location maildir:~/Maildirnamespace inbox {inbox yes}mbox_write_locks fcntl3启动Dovecot服务systemctl start dovecotsystemctl status dovecot✅ 启动成功显示如下dovecot.service - Dovecot IMAP/POP3 email serverLoaded: loaded (/usr/lib/systemd/system/dovecot.service; disabled; vendor preset: disabled)Active: active (running) since Fri 2025-08-29 12:01:12 CST; 17s agoDocs: man:dovecot(1)https://doc.dovecot.org/Process: 2599 ExecStartPre/usr/libexec/dovecot/prestartscript (codeexited, status0/SUCCESS)Main PID: 2607 (dovecot)Status: v2.3.15 (0503334ab1) runningTasks: 5 (limit: 20421)Memory: 4.1MCGroup: /system.slice/dovecot.service├─ 2607 /usr/sbin/dovecot -F├─ 2611 dovecot/anvil├─ 2612 dovecot/log├─ 2613 dovecot/config└─ 2617 dovecot/stats8月 29 12:01:12 localhost.localdomain systemd[1]: Starting Dovecot IMAP/POP3 email server...8月 29 12:01:12 localhost.localdomain dovecot[2607]: Warning: Corrected permissions for login directory /var/run/dovecot/token-login8月 29 12:01:12 localhost.localdomain dovecot[2607]: master: Warning: Corrected permissions for login directory /var/run/dovecot/token-login8月 29 12:01:12 localhost.localdomain dovecot[2607]: master: Dovecot v2.3.15 (0503334ab1) starting up for pop38月 29 12:01:12 localhost.localdomain systemd[1]: Started Dovecot IMAP/POP3 email server.4. 创建邮件测试用户# 创建用户userbuseradd userb# 设置用户密码passwd userb四、客户端配置1. 安装邮件客户端工具[rootlocalhost ~]# cd pop/[rootlocalhost pop]# lsmariadb-connector-c-3.1.13-4.oe2203sp3.x86_64.rpmpostfix-3.3.1-21.oe2203sp3.x86_64.rpmpcre-8.45-5.oe2203sp3.x86_64.rpmpostfix-help-3.3.1-21.oe2203sp3.noarch.rpm[rootlocalhost pop]# rpm -Uvh *.rpm警告mailx-12.5-32.oe2203sp3.x86_64.rpm: 头V4 RSA/SHA256 Signature, 密钥 ID fb37bc6f: NOKEYVerifying... ################################# [100%]准备中... ################################# [100%]正在升级/安装...1:postfix-help-2:3.3.1-21.oe2203sp3################################# [ 20%]2:pcre-8.45-5.oe2203sp3 ################################# [ 40%]3:mariadb-connector-c-3.1.13-4.oe22################################# [ 60%]4:postfix-2:3.3.1-21.oe2203sp3 ################################# [ 80%]5:mailx-12.5-32.oe2203sp3 ################################# [100%]安装包postfix、mailx命令行邮件发送工具。2. 配置Postfix客户端邮件发送进入配置目录cd /etc/postfix/编辑main.cf核心配置# 基础配置compatibility_level 2inet_interfaces allinet_protocols allmydestination $myhostname, localhost.$mydomain, localhostmynetworks 192.168.0.0/24, 127.0.0.0/8home_mailbox Maildir/# 域名与主机名myhostname mail.a.commydomain a.commyorigin $mydomain# 转发与解析relayhost smtp_host_lookup nativeignore_mx_lookup_error yes启动Postfix服务systemctl start postfixsystemctl status postfix3. 配置本地hosts解析将服务端域名与IP绑定避免DNS解析失败[rootlocalhost ~]# cat /etc/hosts127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4::1 localhost localhost.localdomain localhost6 localhost6.localdomain6192.168.0.102 mail.b.com五、实验测试收发加密接收1. 客户端发送邮件到服务端# 发送测试邮件主题Test Mail内容Hello from Aecho Hello from A | mail -s Test Mail userbmail.b.com查看Postfix日志显示removed表示邮件已成功投递。[rootlocalhost ~]# systemctl status postfixpostfix.service - Postfix Mail Transport AgentLoaded: loaded (/usr/lib/systemd/system/postfix.service; disabled; vendor preset: disabled)Active: active (running) since Fri 2025-08-29 14:57:59 CST; 6min agoProcess: 2908 ExecStartPre/usr/libexec/postfix/aliasesdb (codeexited, status0/SUCCESS)Process: 2913 ExecStartPre/usr/libexec/postfix/chroot-update (codeexited, status0/SUCCESS)Process: 2916 ExecStart/usr/sbin/postfix start (codeexited, status0/SUCCESS)Main PID: 2983 (master)Tasks: 8 (limit: 20421)Memory: 10.1MCGroup: /system.slice/postfix.service├─ 2983 /usr/libexec/postfix/master -w├─ 2984 pickup -l -t unix -u├─ 2985 qmgr -l -t unix -u├─ 2989 tlsmgr -l -t unix -u├─ 3016 cleanup -z -t unix -u├─ 3017 trivial-rewrite -n rewrite -t unix -u├─ 3018 smtp -t unix -u└─ 3056 smtp -t unix -u8月 29 15:04:43 localhost.localdomain postfix/pickup[2984]: 114A254013E: uid0 fromroot8月 29 15:04:43 localhost.localdomain postfix/cleanup[3016]: 114A254013E: message-id20250829070443.114A254013Email.a.com8月 29 15:04:43 localhost.localdomain postfix/qmgr[2985]: 114A254013E: fromroota.com, size418, nrcpt1 (queue active)8月 29 15:04:52 localhost.localdomain postfix/smtp[3056]: 114A254013E: touserbmail.b.com, relaymail.b.com[192.168.0.100]:25, delay0.5, delays0.01/0/0.5/0, dsn8月 29 15:04:52 localhost.localdomain postfix/qmgr[2985]: 114A254013E: removed2. 服务端验证邮件接收# 进入用户邮件目录cd /home/userb/Maildir/new# 查看邮件文件[rootlocalhost new]# ls1756451092.Vfd02I10000aM610453.localhost.localdomain# 读取邮件内容[rootlocalhost new]# cat 1756451092.Vfd02I10000aM610453.localhost.localdomainReturn-Path: roota.comX-Original-To: userbmail.b.comDelivered-To: userbmail.b.comReceived: from mail.a.com (unknown [192.168.0.101])by mail.b.com (Postfix) with ESMTPS id 940DD54014Dfor userbmail.b.com; Fri, 29 Aug 2025 15:04:52 0800 (CST)Received: by mail.a.com (Postfix, from userid 0)id 114A254013E; Fri, 29 Aug 2025 15:04:43 0800 (CST)Date: Fri, 29 Aug 2025 15:04:43 0800To: userbmail.b.comSubject: Test MailUser-Agent: Heirloom mailx 12.5 6/20/10MIME-Version: 1.0Content-Type: text/plain; charsetus-asciiContent-Transfer-Encoding: 7bitMessage-Id: 20250829070443.114A254013Email.a.comFrom: root roota.comHello from A可看到完整邮件头、发件人、主题、正文证明发送成功。3. 客户端POP3SSL加密下载邮件通过openssl s_client建立SSL加密连接模拟POP3客户端接收邮件(echo USER userb; echo PASS Test123; echo LIST; echo RETR 1; echo QUIT; sleep 1) | openssl s_client -connect mail.b.com:995 -tls1_2 -quiet关键返回结果OK Dovecot ready.服务端就绪OK Logged in.用户登录成功LIST列出邮件列表RETR 1读取第一封邮件含完整加密传输内容OK Logging out.安全退出✅ 全程基于TLS1.2加密传输无明文泄露完成POP3SSL仿真目标。mail.b.com:995 -tls1_2 -quietdepth0 C CN, ST Beijing, L Beijing, O Example Corp, OU Mail Server, CN mail.example.com, emailAddress postmastermail.example.comverify error:num18:self signed certificateverify return:1depth0 C CN, ST Beijing, L Beijing, O Example Corp, OU Mail Server, CN mail.example.com, emailAddress postmastermail.example.comverify return:1OK Dovecot ready.OKOK Logged in.OK 6 messages:1 6802 6803 6804 6805 6806 680.OK 680 octetsReturn-Path: roota.comX-Original-To: userbmail.b.comDelivered-To: userbmail.b.comReceived: from mail.a.com (unknown [192.168.0.101])by mail.b.com (Postfix) with ESMTPS id 940DD54014Dfor userbmail.b.com; Fri, 29 Aug 2025 15:04:52 0800 (CST)Received: by mail.a.com (Postfix, from userid 0)id 114A254013E; Fri, 29 Aug 2025 15:04:43 0800 (CST)Date: Fri, 29 Aug 2025 15:04:43 0800To: userbmail.b.comSubject: Test MailUser-Agent: Heirloom mailx 12.5 6/20/10MIME-Version: 1.0Content-Type: text/plain; charsetus-asciiContent-Transfer-Encoding: 7bitMessage-Id: 20250829070443.114A254013Email.a.comFrom: root roota.comHello from A.OK Logging out.