Ubuntu
如何對 postfix-policyd-spf-python 進行故障排除？
我已經遵循了幾個關於如何為 postfix 配置 SPF 的教程，但我無法讓它工作。我在本地網路的 virtualbox 中有 ubuntu 14 lts、postfix 3.1、dovecot 和 BIND9 設置的測試環境。這是我的後綴配置：
main.cf
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) biff = no # appending .domain is the MUA's job. append_dot_mydomain = no # Uncomment the next line to generate "delayed mail" warnings #delay_warning_time = 4h readme_directory = no # TLS parameters smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt smtpd_tls_key_file = /etc/ssl/private/smtpd.key smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_tls_loglevel = 1 # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for # information on enabling SSL in the smtp client. smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination check_policy_service myhostname = example.loc alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases myorigin = /etc/mailname mydestination = $myhostname, example.loc, ubuntu, localhost.localdomain, localhost #relayhost = mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.20.0/24 192.168.3.0/24 mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all inet_protocols = all smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes #SPF policy-spf_time_limit = 3600s smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,check_policy_service unix:private/policy-spfmaster.cf
smtp inet n - y - - smtpd submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes pickup unix n - y 60 1 pickup cleanup unix n - y - 0 cleanup qmgr unix n - n 300 1 qmgr tlsmgr unix - - y 1000? 1 tlsmgr rewrite unix - - y - - trivial-rewrite bounce unix - - y - 0 bounce defer unix - - y - 0 bounce trace unix - - y - 0 bounce verify unix - - y - 1 verify flush unix n - y 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - y - - smtp relay unix - - y - - smtp showq unix n - y - - showq error unix - - y - - error retry unix - - y - - error discard unix - - y - - discard local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - y - - lmtp anvil unix - - y - 1 anvil scache unix - - y - 1 scache maildrop unix - n n - - pipe flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient} uucp unix - n n - - pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) ifmail unix - n n - - pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) bsmtp unix - n n - - pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient scalemail-backend unix - n n - 2 pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension} mailman unix - n n - - pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user} #SPF policy-spf unix - n n - - spawn user=nobody argv=/usr/bin/policyd-spf策略-spf.conf
debugLevel = 1 defaultSeedOnly = 1 HELO_reject = False #SPF_Not_Pass Mail_From_reject = Fail PermError_reject = False TempError_Defer = False skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1/var/log/mail.log 中沒有關於 SPF 檢查的日誌，並且電子郵件中沒有標題。如何找出 spf 策略守護程序是否正常工作？
在本地環境中，在 192.168.3.0 使用 2 台伺服器，我不得不將 smtpd_recipient_restrictions 更改為：
smtpd_recipient_restrictions = permit_sasl_authenticated,reject_unauth_destination,check_policy_service unix:private/policy-spf省略 (permit_mynetworks) 參數。現在我可以在電子郵件和日誌中看到 SPF 標頭。
我猜你沒有正確版本的 python 即執行 policyd-spf python 程式碼所需的 python3。最簡單的方法是安裝python3（如果你沒有的話）並直接指向它，
master.cf如下圖所示。user=nobody argv=/usr/bin/python3 /usr/bin/policyd-spf除此之外，一切對我來說都是正確的。
mail.log一旦你讓它工作，你應該在假設郵件發件人客戶端不符合你的策略時看到類似於下面的內容。Dec 6 22:39:06 gorilla policyd-spf[14506]: 550 5.7.23 Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=helo;id=hrs.com;ip=183.128.34.50;r=<UNKNOWN>