linux下的抓包工具tshark的使用
首先按转发软件包wireshark.i386 0:1.0.8-1.el5_3.1,但是安装此包需要依赖libsmi.i386 0:0.4.5-2.el5 所以要先安装libsmi.i386 0:0.4.5-2.el5
# rpm -ivh libsmi-0.4.5-2.el5.i386.rpm
warning: libsmi-0.4.5-2.el5.i386.rpm: Header V3 DSA signature: NOKEY, key ID 37017186
Preparing... ########################################### [100%]
1:libsmi ########################################### [100%]
�Cni eth0 �CR “tcp.srcport eq 110 or tcp.dsport eq 110”
]# rpm -ivh wireshark-1.0.8-1.el5_3.1.i386.rpm
warning: wireshark-1.0.8-1.el5_3.1.i386.rpm: Header V3 DSA signature: NOKEY, key ID 37017186
Preparing... ########################################### [100%]
1:wireshark ########################################### [100%]
使用# tshark -ni eth0 -R "tcp.srcport eq 110 or tcp.dstport eq 110"
可以监听网卡是eth0 监听端口是110
当natasha用户给wendy发送邮件时捕获到的数据如下:
# tshark -ni eth0 -R "tcp.srcport eq 110 or tcp.dstport eq 110"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
5.050080 192.168.0.139 -> 192.168.0.130 TCP 50939 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
5.050404 192.168.0.130 -> 192.168.0.139 TCP 110 > 50939 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 WS=4
5.050815 192.168.0.139 -> 192.168.0.130 TCP 50939 > 110 [ACK] Seq=1 Ack=1 Win=65700 Len=0
5.053543 192.168.0.130 -> 192.168.0.139 POP Response: +OK Dovecot ready. 开始捕获数据
5.065706 192.168.0.139 -> 192.168.0.130 POP Request: USER natasha 用户名
5.065737 192.168.0.130 -> 192.168.0.139 TCP 110 > 50939 [ACK] Seq=21 Ack=15 Win=5840 Len=0
5.066035 192.168.0.130 -> 192.168.0.139 POP Response: +OK
5.067035 192.168.0.139 -> 192.168.0.130 POP Request: PASS redhat 密码
5.093972 192.168.0.130 -> 192.168.0.139 POP Response: +OK Logged in.
5.097352 192.168.0.139 -> 192.168.0.130 POP Request: STAT
5.097751 192.168.0.130 -> 192.168.0.139 POP Response: +OK 0 0
5.098788 192.168.0.139 -> 192.168.0.130 POP Request: QUIT
5.099301 192.168.0.130 -> 192.168.0.139 POP Response: +OK Logging out.
5.099572 192.168.0.139 -> 192.168.0.130 TCP 50939 > 110 [ACK] Seq=40 Ack=70 Win=65632 Len=0
5.106453 192.168.0.139 -> 192.168.0.130 TCP 50939 > 110 [FIN, ACK] Seq=40 Ack=70 Win=65632 Len=0
5.106500 192.168.0.130 -> 192.168.0.139 TCP 110 > 50939 [ACK] Seq=70 Ack=41 Win=5840 Len=0
37.184708 192.168.0.139 -> 192.168.0.130 TCP 50945 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
37.185004 192.168.0.130 -> 192.168.0.139 TCP 110 > 50945 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 WS=4
37.185563 192.168.0.139 -> 192.168.0.130 TCP 50945 > 110 [ACK] Seq=1 Ack=1 Win=65700 Len=0
37.188414 192.168.0.130 -> 192.168.0.139 POP Response: +OK Dovecot ready.
37.203161 192.168.0.139 -> 192.168.0.130 POP Request: USER natasha
37.203186 192.168.0.130 -> 192.168.0.139 TCP 110 > 50945 [ACK] Seq=21 Ack=15 Win=5840 Len=0
37.203482 192.168.0.130 -> 192.168.0.139 POP Response: +OK
37.204302 192.168.0.139 -> 192.168.0.130 POP Request: PASS redhat
37.220470 192.168.0.130 -> 192.168.0.139 POP Response: +OK Logged in.
37.222186 192.168.0.139 -> 192.168.0.130 POP Request: STAT
37.242817 192.168.0.130 -> 192.168.0.139 POP Response: +OK 0 0
37.248955 192.168.0.139 -> 192.168.0.130 POP Request: QUIT
37.249877 192.168.0.130 -> 192.168.0.139 POP Response: +OK Logging out.
37.251921 192.168.0.139 -> 192.168.0.130 TCP 50945 > 110 [ACK] Seq=40 Ack=70 Win=65632 Len=0
37.271218 192.168.0.139 -> 192.168.0.130 TCP 50945 > 110 [FIN, ACK] Seq=40 Ack=70 Win=65632 Len=0
37.271263 192.168.0.130 -> 192.168.0.139 TCP 110 > 50945 [ACK] Seq=70 Ack=41 Win=5840 Len=0
260.513129 192.168.0.139 -> 192.168.0.142 TCP 50962 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
260.513299 192.168.0.142 -> 192.168.0.139 TCP 110 > 50962 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
260.937211 192.168.0.139 -> 192.168.0.142 TCP 50962 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
260.937533 192.168.0.142 -> 192.168.0.139 TCP 110 > 50962 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
261.437576 192.168.0.139 -> 192.168.0.142 TCP 50962 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1460
261.437581 192.168.0.142 -> 192.168.0.139 TCP 110 > 50962 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
通过分析可以看到双方的用户和使用的密码
虚拟用户的建立
虚拟用户表的定义就是可以把发给一个不存在的用户的邮件,转发给一个已经存在的用户编辑/etc/mail /virtusertable可以进行定义
例如将发给wen的邮件转发给wendy,可以做以下设置
#/etc/mail /virtusertable
在里面加入
[email protected] wendy
发送邮件如下:
可以看到wendy收到了此邮件
[wendy@mail ~]$ mail
Mail version 8.1 6/6/93. Type ? for help.
"/var/spool/mail/wendy": 1 message 1 new
>N 1
[email protected] Mon Mar 8 21:10 43/1381 "hello wen"
&
有时我们可以明确拒绝对某些用户或者某些地址发送邮件
编辑/etc/mail/access
#vim /etc/mail/access例如加上下面的行
To:
[email protected] ERROR:550 mail discared
表示凡是发给wendy的用户的邮件都会被拒绝并且返回错误信息
定义别名
定义别名,就是说将发给某个用户的邮件转给另外一用户
编辑vim /etc/aliases
在最下面可以在下面加上以下行
root: wendy
表示凡是发给root用户的邮件都转发给wendy
例如给root用户发邮件
查看root是否有邮件可以看到
[root@mail ~]# mail
No mail for root
切换到wendy可以看到刚发送的邮件
[root@mail ~]# su - wendy
[wendy@mail ~]$ mail
Mail version 8.1 6/6/93. Type ? for help.
"/var/spool/mail/wendy": 1 message 1 unread
>U 1
[email protected] Mon Mar 8 16:47 44/1372 "hello !!!!"
同时也可以定义组
everybody : wendy,redhat,root
就是说如果发给everybody组的邮件,全部发给组里面的任何用户,例如下面的邮件
可以看到root,wendy,natasha都收的了邮件
[root@mail ~]# mail
Mail version 8.1 6/6/93. Type ? for help.
"/var/spool/mail/root": 1 message 1 new
>N 1
[email protected] Mon Mar 8 16:57 44/1432 "this is welcome"
&
[wendy@mail ~]$ mail
Mail version 8.1 6/6/93. Type ? for help.
"/var/spool/mail/wendy": 1 message 1 new
>N 1
[email protected] Mon Mar 8 16:57 44/1432 "this is welcome"
&
使用Web方式收发邮件
虽然postfix没有直接提供Web邮件服务功能,但是通常可通过将它与Apache以及第三方的Webmail软件(如squirrelmailopenwebmail等)集成在一起,提供Web邮件服务。
1,首先安装
squirrelmail-1.4.8-5.el5_3.7.noarch.rpm
由于他是基于web的所以要安装php-5.1.6-23.2.el5_3.i386.rpm
httpd-2.2.3-31.el5.i386.rpm和 php-mbstring-5.1.6-23.2.el5_3.i386.rpm 在安装之前首先检查上面的包是否已经安装锅炉,若没安装则要进行安装。
2,squirrelmail的主配置文件为/etc/squirrelmail/config.php。要配置squirrelmail,可以直接修改该文件的内容,
3,使用squirrelmail收发邮件,安装squirrelmail后,安装程序会在Apache服务器的默认Web站点中配置一个别名webmail,该别名被定义在/etc/httpd/conf.d/squirrelmail.conf文件中,即:Alias /webmail /usr/share/squirrelmail,因此,启动http服务后,# service httpd start
可直接在浏览器的地址栏中输入
http://192.168.0.130/webmail,从而打开squirrelmail的登录页面。
输入正确的用户名和密码后就可以进入主界面收发邮件了