邮件告警账号设置

买了一台阿里云ECS 准备做zabbix监控邮件报警,发现25号端口被屏蔽了,申请开通也失败,然后只能绕过25号端口,走465 ssl端口发邮件了。

步骤如下:

首先请求数字证书
[root@myfirstwon ~]# mkdir -p /root/.certs/                           #创建目录,用来存放证书
[root@myfirstwon ~]# echo -n | openssl s_client -connect smtp.163.com:465 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/.certs/163.crt   #向163请求证书

depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
verify return:1
depth=0 C = CN, L = Hangzhou, O = "NetEase (Hangzhou) Network Co., Ltd", OU = Mail Dept., CN = *.163.com
verify return:1
DONE

#添加一个证书到证书数据库中
[root@myfirstwon ~]# certutil -A -n "GeoTrust SSL CA" -t "C,," -d ~/.certs -i ~/.certs/163.crt   
#添加一个证书到证书数据库中
[root@myfirstwon ~]# certutil -A -n "GeoTrust Global CA" -t "C,," -d ~/.certs -i ~/.certs/163.crt               
#列出目录下证书
[root@myfirstwon ~]# certutil -L -d /root/.certs                                                                                         

Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI

GeoTrust SSL CA C,,
前往163邮箱打开smtp并获取客户端授权码
网页正上方:设置→POP3/SMTP/IMAP

网页左侧:客户端授权密码
最后配置 vim /etc/mail.rc 最后面添加
set bsdcompat
set from=my_test@163.com
set smtp=smtps://smtp.163.com:465
set smtp-auth-user=my_test@163.com
set smtp-auth-password=*********
set smtp-auth=login
set ssl-verify=ignore
set nss-config-dir=/root/.certs
发送测试邮件
[root@myfirstwon ~]# echo "test mail" | mail -s "nagios report" my_test@163.com

此时my_test@163.com收件箱就收到一封刚刚发的邮件了

看起来已经成功了,但是发送完邮件还有报错:证书不被信任,且命令行就此卡住,需要按键才能出现命令提示符

Error in certificate: Peer's certificate issuer is not recognized.

所以优化下
[root@myfirstwon ~]# cd /root/.certs/
[root@myfirstwon .certs]# ll
total 80
-rw-r--r-- 1 root root 1793 Jul 6 14:36 163.crt
-rw------- 1 root root 65536 Jul 6 14:37 cert8.db
-rw------- 1 root root 16384 Jul 6 14:37 key3.db
-rw------- 1 root root 16384 Jul 6 14:37 secmod.db
[root@myfirstwon .certs]# certutil -A -n "GeoTrust SSL CA - G3" -t "Pu,Pu,Pu" -d ./ -i 163.crt 
Notice: Trust flag u is set automatically if the private key is present.

到此问题解决,QQ邮箱同理 将 163设置为qq即可 需要注意的是配置里的密码是 授权码 非密码

comments powered by Disqus