目录
建立网络连接后(参加 第 5 章 网络设置),你可以运行各种网络应用。
![]() |
提示 |
---|---|
对于现代的 Debian 网络基础设施的具体说明,阅读 Debian 管理员手册 —— 网络基础设施。 |
![]() |
警告 |
---|---|
本章是基于 2013 年发布的 Debian 7.0 ( |
有许多网页浏览器软件包,使用超文本传输协议(HTTP)访问远程内容。
表 6.1. 网页浏览器列表
软件包 | 流行度 | 大小 | 类型 | 网络浏览器说明 |
---|---|---|---|---|
chromium
|
V:68, I:148 | 167993 | X | Chromium,(来自 Google 的开源浏览器) |
iceweasel
|
V:239, I:491 | 231 | 同上 | 无商标的 Mozilla Firefox |
iceape-browser
|
N/A | N/A | 同上 | 无商标的Mozilla,处于安全考虑,移除了 bug#505565 |
epiphany-browser
|
V:10, I:48 | 2123 | 同上 | GNOME,兼容 HIG,Epiphany |
konqueror
|
V:30, I:114 | 3543 | 同上 | KDE,Konqueror |
dillo
|
V:1, I:5 | 1505 | 同上 | Dillo,(基于 FLTK 的轻量级浏览器) |
w3m
|
V:269, I:840 | 2289 | 文本 | w3m |
lynx
|
V:38, I:108 | 1901 | 同上 | Lynx |
elinks
|
V:15, I:33 | 1588 | 同上 | ELinks |
links
|
V:20, I:48 | 2135 | 同上 | Links(纯文本) |
links2
|
V:2, I:18 | 5403 | 图像 | Links(没有 X 的控制台图像) |
在某些浏览器中,你可以使用下列特殊的 URL 来确认它们的设置。
"about:
"
"about:config
"
"about:plugins
"
Debian 提供了在 main 档案库中提供了许多自由的浏览器插件软件包,不仅可以处理 Java(软件平台) 和 Flash,也可以处理 MPEG、MPEG2、MPEG4、DivX、Windows Media Video (.wmv)、QuickTime (.mov)、MP3 (.mp3)、Ogg/Vorbis 文件、DVD、VCD 等等。Debian 也提供相关辅助程序,可以用来安装来自 contrib 或 non-free 的 non-free 浏览器插件软件包。
表 6.2. 浏览器插件软件包列表
软件包 | 流行度 | 大小 | area | 说明 |
---|---|---|---|---|
icedtea-plugin
|
I:25 | 19 | main | 基于 OpenJDK 和 IcedTea 的 Java 插件 |
mozilla-plugin-gnash
|
I:2 | 39 | main | 基于 Gnash 的 Flash 插件 |
flashplugin-nonfree
|
V:14, I:166 | 71 | contrib | 安装 Adobe Flash Player 的 Flash 插件辅助程序(仅适用 i386、amd64) |
browser-plugin-vlc
|
V:5, I:18 | 202 | main | 基于 VLC 媒体播放器的多媒体插件 |
![]() |
提示 |
---|---|
尽管使用上述的 Debian 软件包会更容易,但你依旧可以手动启用插件,你需要将 “*.so” 文件安装到插件目录中(例如
“ |
有些网站拒绝基于你所使用浏览器的用户代理字符串的连接。你可以通过 伪装用户代理字符串
来解决这个问题。例如,你可以添加下面这行到用户配置文件中(例如
“~/.gnome2/epiphany/mozilla/epiphany/user.js
” 或
“~/.mozilla/firefox/*.default/user.js
”)。
user_pref{"general.useragent.override","Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)"};
或者,你也可以通过输入 “about:config
” 到 URL,并右击它所显示的内容,来添加并重置这个变量。
![]() |
小心 |
---|---|
伪装的用户代理字符串可以会导致 来自 Java 的不良副作用。 |
![]() |
小心 |
---|---|
如果你想设置邮件服务器来直接通过互联网交换邮件,你应该最好阅读一下这个基本文档。 |
邮件系统涉及到运行在多个主机上的许多服务器程序和客户端程序。从功能来说,有3种类型的邮件代理程序:
邮件传输代理(MTA,参见 第 6.3 节 “Mail transport agent (MTA)”),是不同主机之间传送邮件的程序。
邮件投递代理(MDA,参见 第 6.6 节 “Mail delivery agent (MDA) with filter”),是传递信息到一台主机内的用户邮箱的程序。
邮件用户代理(MUA,也被称为电子邮件客户端,参见 第 6.4 节 “Mail user agent (MUA)”),是生成信息和访问传递的信息的程序。
![]() |
注意 |
---|---|
The following configuration examples are only valid for the typical mobile workstation on consumer grade Internet connections. |
An email message consists of three components, the message envelope, the message header, and the message body.
The "To" and "From" information in the message envelope is used by the SMTP to deliver the email. (The "From" information in the message envelope is also called bounce address, From_, etc.).
The "To" and "From" information in the message header is displayed by the email client. (While it is most common for these to be the same as ones in the message envelope, such is not always the case.)
The email client (MUA) needs to interpret the message header and body data using Multipurpose Internet Mail Extensions (MIME) to deal the content data type and encoding.
In order to minimize exposure to the spam (unwanted and unsolicited email) problems, many ISPs which provide consumer grade Internet connections are implementing counter measures.
The smarthost service for their customers to send message uses the message submission port (587) specified in rfc4409 with the password (SMTP AUTH service) specified in rfc4954.
The SMTP port (25) connection from their internal network hosts (except ISP's own outgoing mail server) to the Internet are blocked.
The SMTP port (25) connection to the ISP's incoming mail server from some suspicious external network hosts are blocked. (The connection from hosts on the dynamic IP address range used by the dial-up and other consumer grade Internet connections are the first ones to be blocked.)
Anti-spam techniques such as DomainKeys Identified Mail (DKIM) and Sender_Policy_Framework (SPF) are widely used for the email filtering.
The DomainKeys Identified Mail service may be provided for your mail sent through the smarthost.
When configuring your mail system or resolving mail delivery problems, you must consider these new limitations.
In light of these hostile Internet situation and limitations, some independent Internet mail ISPs such as Yahoo.com and Gmail.com offer the secure mail service which can be connected from anywhere on the Internet using Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL).
![]() |
小心 |
---|---|
It is not realistic to run SMTP server on consumer grade network to send mail directly to the remote host reliably. They are very likely to be rejected. You must use some smarthost services offered by your connection ISP or independent mail ISPs. |
For the simplicity, I assume that the smarthost is located at
"smtp.hostname.dom
", requires SMTP Authentication, and uses the message
submission port (587) with the STARTTLS in
the following text.
The most simple mail configuration is that the mail is sent to the ISP's smarthost and received from ISP's POP3 server by the MUA (see 第 6.4 节 “Mail user agent (MUA)”) itself. This type of configuration is popular with full featured GUI based MUA such as icedove(1), evolution(1), etc. If you need to filter mail by their types, you use MUA's filtering function. For this case, the local MTA (see 第 6.3 节 “Mail transport agent (MTA)”) need to do local delivery only (when sender and receiver are on the same host).
Please note that the Debian system is the multiuser system. Even if you are the only user, there are many programs running as root and they may send you a mail.
The alternative mail configuration is that the mail is sent via local MTA to the ISP's smarthost and received from ISP's POP3 by the mail retriever (see 第 6.5 节 “The remote mail retrieval and forward utility”) to the local mailbox. If you need to filter mail by their types, you use MDA with filter (see 第 6.6 节 “Mail delivery agent (MDA) with filter”) to filter mail into separate mailboxes. This type of configuration is popular with simple console based MUA such as mutt(1), mew(1), etc., although this is possible with any MUAs (see 第 6.4 节 “Mail user agent (MUA)”). For this case, the local MTA (see 第 6.3 节 “Mail transport agent (MTA)”) need to do both smarthost delivery and local delivery. Since mobile workstation does not have valid FQDN, you must configure the local MTA to hide and spoof the real local mail name in outgoing mail to avoid mail delivery errors (see 第 6.3.3 节 “The mail address configuration”).
![]() |
提示 |
---|---|
You may wish to configure MUA/MDA to use Maildir for storing email messages somewhere under your home directory. |
For normal workstation, the popular choice for Mail transport agent (MTA) is
either exim4-*
or postfix
packages.
It is really up to you.
表 6.3. List of basic mail transport agent related packages for workstation
软件包 | 流行度 | 大小 | 说明 |
---|---|---|---|
exim4-daemon-light
|
V:606, I:700 | 1141 | Exim4 mail transport agent (MTA: Debian default) |
exim4-base
|
V:616, I:712 | 1542 | Exim4 documentation (text) and common files |
exim4-doc-html
|
I:1 | 3434 | Exim4 documentation (html) |
exim4-doc-info
|
I:1 | 584 | Exim4 documentation (info) |
postfix
|
V:148, I:165 | 3620 | Postfix mail transport agent (MTA: alternative) |
postfix-doc
|
I:11 | 4006 | Postfix documentation (html+text) |
sasl2-bin
|
V:8, I:26 | 411 | Cyrus SASL API implementation (supplement postfix for SMTP AUTH) |
cyrus-sasl2-doc
|
I:2 | 240 | Cyrus SASL - documentation |
Although the popcon vote count of exim4-*
looks several
times popular than that of postfix
, this does not mean
postfix
is not popular with Debian developers. The
Debian server system uses both exim4
and
postfix
. The mail
header analysis of mailing list postings from prominent Debian
developers also indicate both of these MTAs are as popular.
The exim4-*
packages are known to have very small memory
consumption and very flexible for its configuration. The
postfix
package is known to be compact, fast, simple, and
secure. Both come with ample documentation and are as good in quality and
license.
There are many choices for mail transport agent (MTA) packages with different capability and focus in Debian archive.
表 6.4. List of choices for mail transport agent (MTA) packages in Debian archive
软件包 | 流行度 | 大小 | capability and focus |
---|---|---|---|
exim4-daemon-light
|
V:606, I:700 | 1141 | full |
postfix
|
V:148, I:165 | 3620 | full (security) |
exim4-daemon-heavy
|
V:9, I:10 | 1270 | full (flexible) |
sendmail-bin
|
V:11, I:12 | 1781 | full (only if you are already familiar) |
nullmailer
|
V:5, I:7 | 372 | strip down, no local mail |
ssmtp
|
V:13, I:21 | 8 | strip down, no local mail |
courier-mta
|
V:0, I:0 | 1950 | very full (web interface etc.) |
masqmail
|
V:0, I:0 | 337 | light |
esmtp
|
V:0, I:0 | 124 | light |
esmtp-run
|
V:0, I:0 | 32 |
light (sendmail compatibility extension to esmtp )
|
msmtp
|
V:3, I:7 | 260 | light |
msmtp-mta
|
V:1, I:1 | 35 |
light (sendmail compatibility extension to msmtp )
|
For the Internet mail via smarthost, you (re)configure
exim4-*
packages as the following.
$ sudo /etc/init.d/exim4 stop $ sudo dpkg-reconfigure exim4-config
Select "mail sent by smarthost; received via SMTP or fetchmail" for "General type of mail configuration".
Set "System mail name:" to its default as the FQDN (see 第 5.1.1 节 “主机名解析”).
Set "IP-addresses to listen on for incoming SMTP connections:" to its default as "127.0.0.1 ; ::1".
Unset contents of "Other destinations for which mail is accepted:".
Unset contents of "Machines to relay mail for:".
Set "IP address or host name of the outgoing smarthost:" to "smtp.hostname.dom:587".
Select "<No>" for "Hide local mail name in outgoing mail?". (Use
"/etc/email-addresses
" as in 第 6.3.3 节 “The mail address configuration”, instead.)
Reply to "Keep number of DNS-queries minimal (Dial-on-Demand)?" as one of the following.
"No" if the system is connected to the Internet while booting.
"Yes" if the system is not connected to the Internet while booting.
Set "Delivery method for local mail:" to "mbox format in /var/mail/".
Select "<Yes>" for "Split configuration into small files?:".
Create password entries for the smarthost by editing
"/etc/exim4/passwd.client
".
$ sudo vim /etc/exim4/passwd.client ... $ cat /etc/exim4/passwd.client ^smtp.*\.hostname\.dom:username@hostname.dom:password
Start exim4
by the following.
$ sudo /etc/init.d/exim4 start
The host name in "/etc/exim4/passwd.client
" should not be
the alias. You check the real host name with the following.
$ host smtp.hostname.dom smtp.hostname.dom is an alias for smtp99.hostname.dom. smtp99.hostname.dom has address 123.234.123.89
I use regex in "/etc/exim4/passwd.client
" to work around
the alias issue. SMTP AUTH probably works even if the ISP moves host
pointed by the alias.
You can manually update exim4
configuration by the
following:
Update exim4
configuration files in
"/etc/exim4/
".
creating "/etc/exim4/exim4.conf.localmacros
" to set
MACROs and editing
"/etc/exim4/exim4.conf.template
". (non-split
configuration)
creating new files or editing existing files in the
"/etc/exim4/exim4.conf.d
" subdirectories. (split
configuration)
Run "invoke-rc.d exim4 reload
".
Please read the official guide at:
"/usr/share/doc/exim4-base/README.Debian.gz
" and
update-exim4.conf(8).
![]() |
小心 |
---|---|
Starting |
![]() |
警告 |
---|---|
It is insecure to use plain text password without encryption even if your ISP allows it. |
![]() |
提示 |
---|---|
Although use of SMTP with STARTTLS on port 587 is recommended, some ISPs still use deprecated SMTPS (SSL on port 465). Exim4 after 4.77 supports this deprecated SMTPS protocol for both as client and as server. |
![]() |
提示 |
---|---|
If you are looking for a light weight MTA that respects
" |
For the Internet mail via smarthost, you should first read postfix documentation and key manual pages.
表 6.5. List of important postfix manual pages
命令 | 功能 |
---|---|
postfix(1) | Postfix control program |
postconf(1) | Postfix configuration utility |
postconf(5) | Postfix configuration parameters |
postmap(1) | Postfix lookup table maintenance |
postalias(1) | Postfix alias database maintenance |
You (re)configure postfix
and
sasl2-bin
packages as follows.
$ sudo /etc/init.d/postfix stop $ sudo dpkg-reconfigure postfix
Chose "Internet with smarthost".
Set "SMTP relay host (blank for none):" to
"[smtp.hostname.dom]:587
" and configure it by the
following.
$ sudo postconf -e 'smtp_sender_dependent_authentication = yes' $ sudo postconf -e 'smtp_sasl_auth_enable = yes' $ sudo postconf -e 'smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd' $ sudo postconf -e 'smtp_sasl_type = cyrus' $ sudo vim /etc/postfix/sasl_passwd
Create password entries for the smarthost.
$ cat /etc/postfix/sasl_passwd [smtp.hostname.dom]:587 username:password $ sudo postmap hush:/etc/postfix/sasl_passwd
Start the postfix
by the following.
$ sudo /etc/init.d/postfix start
Here the use of "[
" and "]
" in the
dpkg-reconfigure
dialog and
"/etc/postfix/sasl_passwd
" ensures not to check MX record
but directly use exact hostname specified. See "Enabling SASL
authentication in the Postfix SMTP client" in
"/usr/share/doc/postfix/html/SASL_README.html
".
There are a few mail address configuration files for mail transport, delivery and user agents.
表 6.6. List of mail address related configuration files
文件 | 功能 | application |
---|---|---|
/etc/mailname
|
default host name for (outgoing) mail | Debian specific, mailname(5) |
/etc/email-addresses
|
host name spoofing for outgoing mail | exim(8) specific, exim4-config_files(5) |
/etc/postfix/generic
|
host name spoofing for outgoing mail | postfix(1) specific, activated after postmap(1) command execution. |
/etc/aliases
|
account name alias for incoming mail | general, activated after newaliases(1) command execution. |
The mailname in the
"/etc/mailname
" file is usually a fully qualified domain
name (FQDN) that resolves to one of the host's IP addresses. For the mobile
workstation which does not have a hostname with resolvable IP address, set
this mailname to the value of
"hostname -f
". (This is safe choice and works for both
exim4-*
and postfix
.)
![]() |
提示 |
---|---|
The contents of " |
![]() |
提示 |
---|---|
The |
When setting the mailname to
"hostname -f
", the spoofing of the source mail address
via MTA can be realized by the following.
"/etc/email-addresses
" file for
exim4(8)
as explained in the
exim4-config_files(5)
"/etc/postfix/generic
" file for
postfix(1)
as explained in the
generic(5)
For postfix
, the following extra steps are needed.
# postmap hash:/etc/postfix/generic # postconf -e 'smtp_generic_maps = hash:/etc/postfix/generic' # postfix reload
You can test mail address configuration using the following.
exim(8)
with -brw, -bf, -bF, -bV, …
options
postmap(1)
with -q
option.
![]() |
提示 |
---|---|
Exim comes with several utility programs such as
exiqgrep(8)
and
exipick(8).
See " |
There are several basic MTA operations. Some may be performed via sendmail(1) compatibility interface.
表 6.7. List of basic MTA operation
exim command | postfix command | 说明 |
---|---|---|
sendmail
|
sendmail
|
read mails from standard input and arrange for delivery
(-bm )
|
mailq
|
mailq
|
list the mail queue with status and queue ID (-bp )
|
newaliases
|
newaliases
|
initialize alias database (-I )
|
exim4 -q
|
postqueue -f
|
flush waiting mails (-q )
|
exim4 -qf
|
postsuper -r ALL deferred; postqueue -f
|
flush all mails |
exim4 -qff
|
postsuper -r ALL; postqueue -f
|
flush even frozen mails |
exim4 -Mg queue_id
|
postsuper -h queue_id
|
freeze one message by its queue ID |
exim4 -Mrm queue_id
|
postsuper -d queue_id
|
remove one message by its queue ID |
N/A |
postsuper -d ALL
|
remove all messages |
![]() |
提示 |
---|---|
It may be a good idea to flush all mails by a script in
" |
If you subscribe to Debian related mailing list, it may be a good idea to
use such MUA as mutt
and mew
which are
the de facto standard for the participant and known to behave as expected.
表 6.8. List of mail user agent (MUA)
软件包 | 流行度 | 大小 | 类型 |
---|---|---|---|
evolution
|
V:44, I:309 | 426 | X GUI program (GNOME3, groupware suite) |
icedove
|
V:54, I:151 | 82544 | X GUI program (GNOME2, unbranded Mozilla Thunderbird) |
kmail
|
V:43, I:98 | 6396 | X GUI program (KDE) |
mutt
|
V:263, I:845 | 6507 |
character terminal program probably used with vim
|
mew
|
V:0, I:0 | 2328 |
character terminal program under (x)emacs
|
Customize "~/.muttrc
" as the following to use
mutt
as the mail user agent (MUA) in combination with
vim
.
# # User configuration file to override /etc/Muttrc # # spoof source mail address set use_from set hostname=example.dom set from="Name Surname <username@example.dom>" set signature="~/.signature" # vim: "gq" to reformat quotes set editor="vim -c 'set tw=72 et ft=mail'" # "mutt" goes to Inbox, while "mutt -y" lists mailboxes set mbox_type=Maildir # use qmail Maildir format for creating mbox set mbox=~/Mail # keep all mail boxes in $HOME/Mail/ set spoolfile=+Inbox # mail delivered to $HOME/Mail/Inbox set record=+Outbox # save fcc mail to $HOME/Mail/Outbox set postponed=+Postponed # keep postponed in $HOME/Mail/postponed set move=no # do not move Inbox items to mbox set quit=ask-yes # do not quit by "q" only set delete=yes # always delete w/o asking while exiting set fcc_clear # store fcc as non encrypted # Mailboxes in Maildir (automatic update) mailboxes `cd ~/Mail; /bin/ls -1|sed -e 's/^/+/' | tr "\n" " "` unmailboxes Maillog *.ev-summary ## Default #set index_format="%4C %Z %{%b %d} %-15.15L (%4l) %s" ## Thread index with senders (collapse) set index_format="%4C %Z %{%b %d} %-15.15n %?M?(#%03M)&(%4l)? %s" ## Default #set folder_format="%2C %t %N %F %2l %-8.8u %-8.8g %8s %d %f" ## just folder names set folder_format="%2C %t %N %f"
Add the following to "/etc/mailcap
" or
"~/.mailcap
" to display HTML mail and MS Word attachments
inline.
text/html; lynx -force_html %s; needsterminal; application/msword; /usr/bin/antiword '%s'; copiousoutput; description="Microsoft Word Text"; nametemplate=%s.doc
![]() |
提示 |
---|---|
Mutt can be used as the IMAP client and the
mailbox format converter. You can tag messages with " |
Instead of running a MUA to access remote mails and to process them manually, you may wish to automate such process to have all the mails delivered to the local host. The remote mail retrieval and forward utility is the tool for you.
Although
fetchmail(1)
has been de facto standard for the remote mail retrieval on GNU/Linux, the
author likes
getmail(1)
now. If you want to reject mail before downloading to save bandwidth,
mailfilter
or mpop
may be useful.
Whichever mail retriever utilities are used, it is a good idea to configure
system to deliver retrieved mails to MDA, such as
maildrop
, via pipe.
表 6.9. List of remote mail retrieval and forward utilities
软件包 | 流行度 | 大小 | 说明 |
---|---|---|---|
fetchmail
|
V:8, I:23 | 2389 | mail retriever (POP3, APOP, IMAP) (old) |
getmail4
|
V:2, I:11 | 591 | mail retriever (POP3, IMAP4, and SDPS) (simple, secure, and reliable) |
mailfilter
|
V:0, I:0 | 264 | mail retriever (POP3) with with regex filtering capability |
mpop
|
V:0, I:0 | 222 | mail retriever (POP3) and MDA with filtering capability |
getmail(1) configuration is described in getmail documentation. Here is my set up to access multiple POP3 accounts as user.
Create "/usr/local/bin/getmails
" as the following.
#!/bin/sh set -e if [ -f $HOME/.getmail/running ]; then echo "getmail is already running ... (if not, remove $HOME/.getmail/running)" >&2 pgrep -l "getmai[l]" exit 1 else echo "getmail has not been running ... " >&2 fi if [ -f $HOME/.getmail/stop ]; then echo "do not run getmail ... (if not, remove $HOME/.getmail/stop)" >&2 exit fi if [ "x$1" = "x-l" ]; then exit fi rcfiles="/usr/bin/getmail" for file in $HOME/.getmail/config/* ; do rcfiles="$rcfiles --rcfile $file" done date -u > $HOME/.getmail/running eval "$rcfiles $@" rm $HOME/.getmail/running
Configure it as the following.
$ sudo chmod 755 /usr/local/bin/getmails $ mkdir -m 0700 $HOME/.getmail $ mkdir -m 0700 $HOME/.getmail/config $ mkdir -m 0700 $HOME/.getmail/log
Create configuration files
"$HOME/.getmail/config/pop3_name
" for each POP3 accounts
as the following.
[retriever] type = SimplePOP3SSLRetriever server = pop.example.com username = pop3_name@example.com password = <your-password> [destination] type = MDA_external path = /usr/bin/maildrop unixfrom = True [options] verbose = 0 delete = True delivered_to = False message_log = ~/.getmail/log/pop3_name.log
Configure it as the following.
$ chmod 0600 $HOME/.getmail/config/*
Schedule "/usr/local/bin/getmails
" to run every 15
minutes with
cron(8)
by executing "sudo crontab -e -u <user_name>
" and
adding following to user's cron entry.
5,20,35,50 * * * * /usr/local/bin/getmails --quiet
![]() |
提示 |
---|---|
Problems of POP3 access may not come from |
Most MTA programs, such as postfix
and
exim4
, function as MDA (mail delivery agent). There are
specialized MDA with filtering capabilities.
Although procmail(1) has been de facto standard for MDA with filter on GNU/Linux, author likes maildrop(1) now. Whichever filtering utilities are used, it is a good idea to configure system to deliver filtered mails to a qmail-style Maildir.
maildrop(1)
configuration is described in maildropfilter documentation.
Here is a configuration example for "$HOME/.mailfilter
".
# Local configuration MAILROOT="$HOME/Mail" # set this to /etc/mailname contents MAILHOST="example.dom" logfile $HOME/.maildroplog # rules are made to override the earlier value by the later one. # mailing list mails ? if ( /^Precedence:.*list/:h || /^Precedence:.*bulk/:h ) { # rules for mailing list mails # default mailbox for mails from mailing list MAILBOX="Inbox-list" # default mailbox for mails from debian.org if ( /^(Sender|Resent-From|Resent-Sender): .*debian.org/:h ) { MAILBOX="service.debian.org" } # default mailbox for mails from bugs.debian.org (BTS) if ( /^(Sender|Resent-From|Resent-sender): .*@bugs.debian.org/:h ) { MAILBOX="bugs.debian.org" } # mailbox for each properly maintained mailing list with "List-Id: foo" or "List-Id: ...<foo.bar>" if ( /^List-Id: ([^<]*<)?([^<>]*)>?/:h ) { MAILBOX="$MATCH2" } } else { # rules for non-mailing list mails # default incoming box MAILBOX="Inbox-unusual" # local mails if ( /Envelope-to: .*@$MAILHOST/:h ) { MAILBOX="Inbox-local" } # html mails (99% spams) if ( /DOCTYPE html/:b ||\ /^Content-Type: text\/html/ ) { MAILBOX="Inbox-html" } # blacklist rule for spams if ( /^X-Advertisement/:h ||\ /^Subject:.*BUSINESS PROPOSAL/:h ||\ /^Subject:.*URGENT.*ASISSTANCE/:h ||\ /^Subject: *I NEED YOUR ASSISTANCE/:h ) { MAILBOX="Inbox-trash" } # whitelist rule for normal mails if ( /^From: .*@debian.org/:h ||\ /^(Sender|Resent-From|Resent-Sender): .*debian.org/:h ||\ /^Subject: .*(debian|bug|PATCH)/:h ) { MAILBOX="Inbox" } # whiltelist rule for BTS related mails if ( /^Subject: .*Bug#.*/:h ||\ /^(To|Cc): .*@bugs.debian.org/:h ) { MAILBOX="bugs.debian.org" } # whitelist rule for getmails cron mails if ( /^Subject: Cron .*getmails/:h ) { MAILBOX="Inbox-getmails" } } # check existance of $MAILBOX `test -d $MAILROOT/$MAILBOX` if ( $RETURNCODE == 1 ) { # create maildir mailbox for $MAILBOX `maildirmake $MAILROOT/$MAILBOX` } # deliver to maildir $MAILBOX to "$MAILROOT/$MAILBOX/" exit
![]() |
警告 |
---|---|
Unlike |
Here is a similar configuration with "$HOME/.procmailrc
"
for
procmail(1).
MAILDIR=$HOME/Maildir DEFAULT=$MAILDIR/Inbox/ LOGFILE=$MAILDIR/Maillog # clearly bad looking mails: drop them into X-trash and exit :0 * 1^0 ^X-Advertisement * 1^0 ^Subject:.*BUSINESS PROPOSAL * 1^0 ^Subject:.*URGENT.*ASISSTANCE * 1^0 ^Subject: *I NEED YOUR ASSISTANCE X-trash/ # Delivering mailinglist messages :0 * 1^0 ^Precedence:.*list * 1^0 ^Precedence:.*bulk * 1^0 ^List- * 1^0 ^X-Distribution:.*bulk { :0 * 1^0 ^Return-path:.*debian-devel-admin@debian.or.jp jp-debian-devel/ :0 * ^Resent-Sender.*debian-user-request@lists.debian.org debian-user/ :0 * ^Resent-Sender.*debian-devel-request@lists.debian.org debian-devel/ :0 * ^Resent-Sender.*debian-announce-request@lists.debian.org debian-announce :0 mailing-list/ } :0 Inbox/
You need to manually deliver mails to the sorted mailboxes in your home
directory from "/var/mail/<username>
" if your home
directory became full and
procmail(1)
failed. After making disk space in the home directory, run the following.
# /etc/init.d/${MAILDAEMON} stop # formail -s procmail </var/mail/<username> # /etc/init.d/${MAILDAEMON} start
If you are to run a private server on LAN, you may consider to run POP3 / IMAP4 server for delivering mail to LAN clients.
表 6.11. List of POP3/IMAP4 servers
软件包 | 流行度 | 大小 | 类型 | 说明 |
---|---|---|---|---|
courier-pop
|
V:4, I:6 | 238 | POP3 | Courier mail server - POP3 server (maildir format only) |
cyrus-pop3d
|
V:0, I:0 | 146 | POP3 | Cyrus mail system (POP3 support) |
courier-imap
|
V:7, I:9 | 546 | IMAP | Courier mail server - IMAP server (maildir format only) |
cyrus-imapd
|
V:0, I:1 | 331 | IMAP | Cyrus mail system (IMAP support) |
In the old Unix-like system, the BSD Line printer daemon was the standard. Since the standard print out format of the free software is PostScript on the Unix like system, some filter system was used along with Ghostscript to enable printing to the non-PostScript printer.
Recently, Common UNIX Printing System (CUPS) is the new de facto standard. The CUPS uses Internet Printing Protocol (IPP). The IPP is now supported by other OSs such as Windows XP and Mac OS X and has became new cross-platform de facto standard for remote printing with bi-directional communication capability.
The standard printable data format for the application on the Debian system is the PostScript (PS) which is a page description language. The data in PS format is fed into the Ghostscript PostScript interpreter to produce the printable data specific to the printer. See 第 11.4.1 节 “Ghostscript”.
Thanks to the file format dependent auto-conversion feature of the CUPS
system, simply feeding any data to the lpr
command should
generate the expected print output. (In CUPS, lpr
can be
enabled by installing the cups-bsd
package.)
The Debian system has some notable packages for the print servers and utilities.
表 6.12. 打印服务和工具列表
软件包 | 流行度 | 大小 | port | 说明 |
---|---|---|---|---|
lpr
|
V:10, I:12 | 318 | printer (515) | BSD lpr/lpd (Line printer daemon) |
lprng
|
V:1, I:2 | 3431 | 同上 | , , (Enhanced) |
cups
|
V:244, I:457 | 764 | IPP (631) | Internet Printing CUPS server |
cups-client
|
V:83, I:504 | 456 | 同上 | System V printer commands for CUPS: lp(1), lpstat(1), lpoptions(1), cancel(1), lpmove(8), lpinfo(8), lpadmin(8), … |
cups-bsd
|
V:40, I:424 | 106 | 同上 | BSD printer commands for CUPS: lpr(1), lpq(1), lprm(1), lpc(8) |
printer-driver-gutenprint
|
V:90, I:429 | 816 | Not applicable | printer drivers for CUPS |
![]() |
提示 |
---|---|
You can configure CUPS system by pointing your web browser to "http://localhost:631/" . |
Secure SHell (SSH) 是因特网上的 安全 连接方式。在 Debian 里面,有一个叫 OpenSSH 的免费 SSH 版本,在
openssh-client
和 openssh-server
包里。
表 6.13. 服务器远程访问和工具列表
软件包 | 流行度 | 大小 | 工具 | 说明 |
---|---|---|---|---|
openssh-client
|
V:543, I:995 | 3792 | ssh(1) | SSH 客户端 |
openssh-server
|
V:662, I:801 | 898 | sshd(8) | SSH 服务端 |
ssh-askpass-fullscreen
|
V:0, I:1 | 24 | ssh-askpass-fullscreen(1) | 请求用户输入密码的 ssh-add (GNOME2) |
ssh-askpass
|
V:4, I:46 | 156 | ssh-askpass(1) | 请求用户输入密码的 ssh-add (plain X) |
![]() |
小心 |
---|---|
如果你的 SSH 是从因特网来访问,参见 第 4.7.3 节 “Extra security measures for the Internet”。 |
![]() |
提示 |
---|---|
请使用 screen(1) 程序来让远程 shell 在中断的连接上存活(参见 第 9.1 节 “screen 程序”). |
![]() |
警告 |
---|---|
如果想要运行 OpenSSH 服务," |
SSH 有两个认证协议。
表 6.14. SSH 认证协议和方式列表
SSH 协议 | SSH 方式 | 说明 |
---|---|---|
SSH-1 |
"RSAAuthentication "
|
基于 RSA 身份秘钥的用户认证 |
同上 |
"RhostsAuthentication "
|
".rhosts " 基于主机的认证(不安全,禁用)
|
同上 |
"RhostsRSAAuthentication "
|
".rhosts " 使用 RSA 主机秘钥的主机认证(禁用)
|
同上 |
"ChallengeResponseAuthentication "
|
RSA 质疑-应答 认证 |
同上 |
"PasswordAuthentication "
|
基于密码的认证 |
SSH-2 |
"PubkeyAuthentication "
|
基于公钥的用户认证 |
同上 |
"HostbasedAuthentication "
|
"~/.rhosts " or "/etc/hosts.equiv "
使用客户端主机公钥的主机认证(禁用)
|
同上 |
"ChallengeResponseAuthentication "
|
质疑-应答 认证 |
同上 |
"PasswordAuthentication "
|
基于密码的认证 |
![]() |
小心 |
---|---|
如果你使用一个非 Debian 的系统,请小心注意这些不同。 |
细节参见 "/usr/share/doc/ssh/README.Debian.gz
",
ssh(1),
sshd(8),
ssh-agent(1),
and
ssh-keygen(1).
下面是秘钥配置文件。
表 6.15. SSH 配置文件列表
配置文件 | 配置文件描述 |
---|---|
/etc/ssh/ssh_config
|
SSH 客户端默认, 参见 ssh_config(5) |
/etc/ssh/sshd_config
|
SSH 服务端默认, 参见 sshd_config(5) |
~/.ssh/authorized_keys
|
该账户连接到这个服务器上的客户端使用的默认 SSH 公钥 |
~/.ssh/identity
|
用户的 SSH-1 RSA 私钥 |
~/.ssh/id_rsa
|
用户的 SSH-2 RSA 私钥 |
~/.ssh/id_dsa
|
用户的 SSH-2 DSA 私钥 |
![]() |
提示 |
---|---|
参见 ssh-keygen(1), ssh-add(1) 和 ssh-agent(1) 来了解怎样使用 SSH 公钥和私钥。 |
![]() |
提示 |
---|---|
一定要通过连接测试来确认设置。有任何问题的连接,使用 " |
![]() |
提示 |
---|---|
稍后可以使用 " |
![]() |
提示 |
---|---|
你可以在 " |
从客户端启动一个 ssh(1) 连接.
表 6.16. SSH 客户端启动例子列表
命令 | 说明 |
---|---|
ssh username@hostname.domain.ext
|
使用默认模式连接 |
ssh -v username@hostname.domain.ext
|
有详细信息的默认连接模式 |
ssh -1 username@hostname.domain.ext
|
强制使用 SSH 1 版本连接 |
ssh -1 -o RSAAuthentication=no -l username
hostname.domain.ext
|
SSH 1 版本,强制使用密码 |
ssh -o PreferredAuthentications=password -l username
hostname.domain.ext
|
SSH 2 版本,强制使用密码 |
如果本地和远程主机,使用同样的用户名,你可以省略输入
"username@
". 即使在本地和远程主机使用不同的用户名,你可以使用
"~/.ssh/config
" 来省略输入用户名.对于 Debian Alioth 服务器,使用账户名
"foo-guest
",你可以设置 "~/.ssh/config
"
包含下面的内容。
Host alioth.debian.org svn.debian.org git.debian.org User foo-guest
对于用户来讲,
ssh(1)
功能比telnet(1)
更加智能和安全. 不像 telnet
命令, ssh
命令不会在遇到
telnet
的退出字符(初始默认是 CTRL-])时停止.
通过 ssh
建立一个这样的管道连接,从 localhost
的 4025
端口到 remote-server
的 25 端口,并从 localhost
的 4110 端口到 remote-server
的 110 端口,请在本机执行如下命令.
# ssh -q -L 4025:remote-server:25 4110:remote-server:110 username@remote-server
这是跨越因特网建立 SMTP/POP3
服务连接的安全方法。在远程主机"/etc/ssh/sshd_config
"里设置"AllowTcpForwarding
"条目为
"yes
".
使用 "RSAAuthentication
" (SSH-1 协议) 或
"PubkeyAuthentication
" (SSH-2 协议),人们可以避免记住远程系统的密码.
在远程系统的"/etc/ssh/sshd_config
"里,设置相应的条目,
"RSAAuthentication yes
" 或 "PubkeyAuthentication
yes
"。
在本地生成授权秘钥对,并安装公钥到远程系统。
"RSAAuthentication
": SSH-1 的 RSA key (不建议使用,因为已被废弃.)
$ ssh-keygen $ cat .ssh/identity.pub | ssh user1@remote "cat - >>.ssh/authorized_keys"
"PubkeyAuthentication
": SSH-2 的 RSA key
$ ssh-keygen -t rsa $ cat .ssh/id_rsa.pub | ssh user1@remote "cat - >>.ssh/authorized_keys"
"PubkeyAuthentication
": SSH-2 的 DSA key(不建议,因为慢.)
$ ssh-keygen -t dsa $ cat .ssh/id_dsa.pub | ssh user1@remote "cat - >>.ssh/authorized_keys"
![]() |
提示 |
---|---|
使用 SSH-2 的 DSA key 是不建议的,应为 key 较小并且慢。由于 RSA 专利已经过期,没有理由使用 DSA 来作为规避 RSA 专利的临时措施。DSA 表示 Digital Signature Algorithm,速度慢。同时参见 DSA-1571-1. |
![]() |
注意 |
---|---|
为了让 " |
其它平台上有一些免费的 SSH 客户端。
表 6.17. 其它平台上免费 SSH 客户端列表
环境 | 免费 SSH 程序 |
---|---|
Windows | puTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/) (GPL) |
Windows (cygwin) | cygwin 里的 SSH (http://www.cygwin.com/) (GPL) |
Macintosh 类 | macSSH (http://www.macssh.com/) (GPL) |
Mac OS X |
OpenSSH;在终端应用中使用 ssh (GPL)
|
用密码来保护你的 SSH 认证私钥是安全的。如果密码没有设置,使用 "ssh-keygen -p
" 来设置。
把你的公钥 (比如:"~/.ssh/id_rsa.pub
")
放到远程主机的"~/.ssh/authorized_keys
",这个远程主机使用上面描述的基于密码的连接方式。
$ ssh-agent bash $ ssh-add ~/.ssh/id_rsa Enter passphrase for /home/<username>/.ssh/id_rsa: Identity added: /home/<username>/.ssh/id_rsa (/home/<username>/.ssh/id_rsa)
从这里执行接下来的命令,就不再需要密码。
$ scp foo <username>@remote.host:foo
按 ^D 来终结 ssh 代理会话。
对于 X 服务端,通常的 Debian 启动脚本会作为父进程执行 ssh-agent
。所以你只需要执行一次
ssh-add
。进一步的信息,请阅读
ssh-agent(1)
和
ssh-add(1).
你可以使用
at(1)
命令 (参见 第 9.3.13 节 “单次任务时间安排”)来从 SSH
终端里保护"shutdown -h now
" (参见 第 1.1.8 节 “怎样关闭系统”)操作过程。
# echo "shutdown -h now" | at now
在
screen(1)
(参见 第 9.1 节 “screen 程序”) 会话里运行 "shutdown -h
now
",是另外一个方法来做这同样的事情。
这里是其它网络应用服务。
表 6.18. 其它网络应用服务列表
软件包 | 流行度 | 大小 | 协议 | 说明 |
---|---|---|---|---|
telnetd
|
V:1, I:3 | 105 | TELNET | TELNET 服务 |
telnetd-ssl
|
V:0, I:0 | 145 | 同上 | TELNET 服务( 支持SSL) |
nfs-kernel-server
|
V:32, I:103 | 459 | NFS | Unix 文件共享 |
samba
|
V:127, I:214 | 11012 | SMB | Windows 文件和打印共享 |
netatalk
|
V:3, I:7 | 3908 | ATP | Apple/Mac 文件和打印共享(AppleTalk) |
proftpd-basic
|
V:36, I:45 | 4389 | FTP | 通用文件下载 |
apache2
|
V:315, I:362 | 570 | HTTP | 通用 web 服务器 |
squid
|
V:13, I:16 | 7489 | 同上 | 通用 web 代理服务器 |
squid3
|
V:17, I:21 | 159 | 同上 | 同上 |
slpd
|
V:0, I:1 | 162 | SLP | OpenSLP 服务,提供 LDAP 服务 |
bind9
|
V:55, I:90 | 1773 | DNS | 其它主机的 IP 地址 |
isc-dhcp-server
|
V:26, I:62 | 1394 | DHCP | 客户端自身的 IP 地址 |
通用互联网文件系统协议(CIFS) 和服务消息块(SMB) 协议一样,被微软 Windows 广泛应用。
![]() |
提示 |
---|---|
参见 第 4.5.2 节 “现代的集中式系统管理” 服务系统集成。 |
![]() |
提示 |
---|---|
主机名解析通常由 DNS 服务提供. 对于由 DHCP 动态分配的主机 IP 地址, 动态
DNS 能够使用 |
![]() |
提示 |
---|---|
使用 |
这里是其它网络应用客户端。
表 6.19. 网络应用客户端列表
软件包 | 流行度 | 大小 | 协议 | 说明 |
---|---|---|---|---|
netcat
|
I:35 | 32 | TCP/IP | TCP/IP 瑞士军刀 |
openssl
|
V:772, I:987 | 1127 | SSL | 安全套接字层 (SSL)二进制和相关的加密工具 |
stunnel4
|
V:4, I:20 | 459 | 同上 | 通用 SSL 封装 |
telnet
|
V:77, I:909 | 151 | TELNET | TELNET 客户端 |
telnet-ssl
|
V:1, I:7 | 191 | 同上 | TELNET 服务( 支持SSL) |
nfs-common
|
V:448, I:815 | 674 | NFS | Unix 文件共享 |
smbclient
|
V:28, I:267 | 1454 | SMB | 微软 Windows 文件和打印共享客户端 |
cifs-utils
|
V:37, I:134 | 203 | 同上 | 远程微软 Windows 文件系统挂载和卸载命令 |
ftp
|
V:46, I:840 | 126 | FTP | FTP 客户端 |
lftp
|
V:6, I:41 | 2170 | 同上 | 同上 |
ncftp
|
V:5, I:31 | 1506 | 同上 | 全屏 FTP 客户端 |
wget
|
V:292, I:997 | 2746 | HTTP 和 FTP | web 下载工具 |
curl
|
V:105, I:404 | 331 | 同上 | 同上 |
axel
|
V:0, I:5 | 145 | 同上 | 下载加速器 |
aria2
|
V:1, I:14 | 4390 | 同上 | BitTorrent 和 Metalink 支持的下载加速器 |
bind9-host
|
V:428, I:945 | 283 | DNS | 来自 bind9 的
host(1),
"Priority: standard "
|
dnsutils
|
V:82, I:903 | 462 | 同上 | 来自 bind 的
dig(1),
"Priority: standard "
|
isc-dhcp-client
|
V:420, I:959 | 651 | DHCP | 获得 IP 地址 |
ldap-utils
|
V:18, I:79 | 667 | LDAP | 从 LDAP 服务获取数据 |
telnet
程序能够手工连接到系统后台守护进程(daemon),并进行诊断。
测试纯 POP3 服务,尝试用下面的操作
$ telnet mail.ispname.net pop3
部分 ISP 提供 TLS/SSL 加密的POP3 服务,为了测试它,你需要用到 telnet-ssl
包里支持
TLS/SSL 的 telnet
客户端,或 openssl
软件包。
$ telnet -z ssl pop.gmail.com 995
$ openssl s_client -connect pop.gmail.com:995
下面的 RFCs 提供每一个系统后台守护进程(daemon)所需要的知识。
在 "/etc/services
" 里,描述了端口用途.