{"id":2055,"date":"2025-11-17T17:48:55","date_gmt":"2025-11-17T17:48:55","guid":{"rendered":"https:\/\/blog.eu.enginyr.ing\/?p=2055"},"modified":"2025-11-17T20:45:36","modified_gmt":"2025-11-17T20:45:36","slug":"configurarea-infrastructurii-de-email-configurarea-exim-pe-vps-linux-ghid-complet-pentru-administratori-de-sistem","status":"publish","type":"post","link":"https:\/\/www.serverspan.ro\/blog\/configurarea-infrastructurii-de-email-configurarea-exim-pe-vps-linux-ghid-complet-pentru-administratori-de-sistem\/","title":{"rendered":"Configurarea infrastructurii de email: configurarea Exim pe VPS Linux (ghid complet pentru administratori de sistem)"},"content":{"rendered":"\n\n<p class=\"wp-block-paragraph\">Configurarea Exim ca agent de transport de mesaje \u00een produc\u021bie pe un VPS Linux necesit\u0103 precizie: un singur ACL sau regul\u0103 de transport gre\u0219it configurat\u0103 poate transforma serverul \u00eentr-un relay deschis sau poate face ca mesajele legitime s\u0103 dispar\u0103 \u00een purgatoriul cozii. Acest ghid ofer\u0103 administratorilor de sistem o configurare complet\u0103, gata pentru produc\u021bie, pentru Exim \u00eentr-un mediu VPS\u2014acoperind totul de la instalarea de baz\u0103 p\u00e2n\u0103 la ACL-uri avansate, autentificare SMTP, securizare TLS \u0219i arhitectur\u0103 de relay. Fie c\u0103 construie\u0219ti un server de email standalone sau integrezi Exim \u00eentr-un ecosistem cPanel\/WHM, aceste configur\u0103ri sunt testate pe sisteme Debian\/Ubuntu \u0219i CentOS\/RHEL care ruleaz\u0103 pe <a href=\"https:\/\/www.enginyring.com\/ro\/virtual-servers\">serverele virtuale ENGINYRING<\/a>, care ofer\u0103 resursele dedicate \u0219i stabilitatea re\u021belei pe care le necesit\u0103 serverele de email.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Spre deosebire de arhitectura monolitic\u0103 a Postfix, Exim folose\u0219te un model router-transport care ofer\u0103 control granular asupra fluxului de mesaje. Aceast\u0103 granularitate este puternic\u0103, dar necesit\u0103 configurare exact\u0103. Vom configura Exim pentru a gestiona livrarea local\u0103, relay prin smarthost, SMTPAUTH pentru trimiterea de c\u0103tre clien\u021bi \u0219i ACL-uri complete pentru a bloca spam-ul \u0219i \u00eencerc\u0103rile de relay neautorizate\u2014toate men\u021bin\u00e2nd performan\u021ba \u0219i fiabilitatea pe care le a\u0219teapt\u0103 clien\u021bii de hosting VPS. Pentru context mai larg despre cum s\u0103 \u00ee\u021bi men\u021bii VPS-ul securizat \u00een timp ce rulezi servicii de email, consult\u0103 <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/cum-sa-securizezi-un-vps-proaspat-un-ghid-cuprinzator-pentru-incepatori-in-linux\">ghidul nostru complet de securitate VPS<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Instalare \u0219i configurare ini\u021bial\u0103<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cenainte de a modifica fi\u0219ierele de configurare Exim, verific\u0103 dac\u0103 VPS-ul \u00eendepline\u0219te cerin\u021bele: o instalare Linux curat\u0103 (Debian 11\/12, Ubuntu 22.04\/24.04 sau CentOS 8+\/RHEL 9), un IP public static cu \u00eenregistrare PTR corect\u0103 \u0219i \u00eenregistr\u0103ri DNS MX\/SPF configurate pentru domeniul t\u0103u. DNS-ul gre\u0219it configurat este cauza principal\u0103 pentru 80% din e\u0219ecurile de livrare a mesajelor. Ghidul nostru despre <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ce-este-o-inregistrare-dns-un-ghid-pentru-incepatori-despre-agenda-telefonica-a-internetului\">fundamentele \u00eenregistr\u0103rilor DNS<\/a> acoper\u0103 elementele de baz\u0103 necesare \u00eenainte de a trimite primul email.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Instalarea pachetelor<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Debian\/Ubuntu\nsudo apt update && sudo apt install exim4 exim4-daemon-heavy exim4-config\n\n# CentOS\/RHEL\nsudo dnf install exim<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Folose\u0219te <code>exim4-daemon-heavy<\/code> pe Debian\/Ubuntu pentru suport complet de func\u021bionalit\u0103\u021bi, inclusiv scanarea con\u021binutului \u0219i ACL-uri avansate. Varianta light elimin\u0103 func\u021bionalit\u0103\u021bi critice necesare pentru anti-spam \u0219i autentificare \u00een produc\u021bie.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configurarea ini\u021bial\u0103 prin wizard<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ruleaz\u0103 wizard-ul de configurare Exim pentru a stabili set\u0103rile de baz\u0103:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dpkg-reconfigure exim4-config  # Doar Debian\/Ubuntu<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Selecteaz\u0103 <strong>&#8220;mail sent by smarthost; no local mail&#8221;<\/strong> pentru configur\u0103ri doar de relay<\/li>\n\n\n\n<li>Selecteaz\u0103 <strong>&#8220;internet site; mail is sent and received directly using SMTP&#8221;<\/strong> pentru server de email complet<\/li>\n\n\n\n<li>Introdu FQDN-ul VPS-ului (ex: <code>mail.domeniultau.ro<\/code>)<\/li>\n\n\n\n<li>Specific\u0103 adresele IP pe care s\u0103 asculte (las\u0103 gol pentru toate IPv4)<\/li>\n\n\n\n<li>Define\u0219te alte destina\u021bii pentru care se accept\u0103 mesaje<\/li>\n\n\n\n<li>Configureaz\u0103 smarthost dac\u0103 folose\u0219ti relay (ex: <code>smtp.sendgrid.net::587<\/code>)<\/li>\n\n\n\n<li>P\u0103streaz\u0103 num\u0103rul de interog\u0103ri DNS minimal: <strong>da<\/strong> (reduce laten\u021ba)<\/li>\n\n\n\n<li>\u00cemparte configura\u021bia \u00een fi\u0219iere mai mici: <strong>da<\/strong> (permite management modular)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Acest wizard genereaz\u0103 <code>\/etc\/exim4\/update-exim4.conf.conf<\/code> (Debian\/Ubuntu) sau <code>\/etc\/exim\/exim.conf<\/code> (CentOS\/RHEL). Modelul de configurare \u00eemp\u0103r\u021bit creeaz\u0103 fi\u0219iere separate sub <code>\/etc\/exim4\/conf.d\/<\/code> pentru routere, transporturi \u0219i ACL-uri\u2014folose\u0219te-l pentru mediile de produc\u021bie. Pentru configurarea detaliat\u0103 a \u00eenregistr\u0103rilor PTR, care este critic\u0103 pentru livrabilitatea mesajelor, consult\u0103 tutorialul nostru despre <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/cum-sa-configurezi-rdns-si-inregistrarile-ptr-un-tutorial-complet\">cum s\u0103 configurezi rDNS \u0219i \u00eenregistr\u0103rile PTR<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Arhitectura de baz\u0103: routere \u0219i transporturi<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fluxul de mesaje al Exim urmeaz\u0103 un pipeline strict: routerele determin\u0103 destina\u021bia, iar transporturile execut\u0103 livrarea. Configurarea gre\u0219it\u0103 la orice etap\u0103 rupe lan\u021bul. Vom configura fiecare component\u0103 pentru un scenariu VPS tipic: livrare local\u0103 pentru utilizatorii de sistem, relay prin smarthost \u0219i trimitere SMTP pentru clien\u021bii autentifica\u021bi.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configurarea routerului (livrare local\u0103)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Routerele gestioneaz\u0103 deciziile de rutare a mesajelor, inclusiv livrarea local\u0103 c\u0103tre utilizatorii de sistem. Editeaz\u0103 <code>\/etc\/exim4\/conf.d\/router\/00_exim4-config_local_user<\/code> (Debian\/Ubuntu) sau adaug\u0103 \u00een <code>\/etc\/exim\/exim.conf<\/code> (CentOS\/RHEL):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Router pentru livrare utilizator local\nlocaluser:\n  driver = accept\n  check_local_user\n  domains = +local_domains\n  transport = local_delivery\n  cannot_route_message = Utilizator necunoscut<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Acest router accept\u0103 mesaje pentru domeniile locale \u0219i le transmite transportului local_delivery. Op\u021biunea <code>check_local_user<\/code> verific\u0103 dac\u0103 destinatarul exist\u0103 \u00een <code>\/etc\/passwd<\/code>, prevenind buclele de bounce.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configurarea routerului (rutare ie\u0219ire)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Pentru configur\u0103ri VPS, configureaz\u0103 rutarea prin smarthost pentru ie\u0219ire \u0219i rutare bazat\u0103 pe DNS pentru intrare. Editeaz\u0103 <code>\/etc\/exim4\/conf.d\/router\/200_exim4-config_primary<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Router smarthost (ie\u0219ire)\nsend_via_smarthost:\n  driver = manualroute\n  domains = !+local_domains\n  transport = remote_smtp_smarthost\n  route_list = * smtp.sendgrid.net::587\n  host_find_failed = defer\n  same_domain_copy_routing = yes\n  no_more\n\n# Router DNS lookup (livrare direct\u0103)\ndnslookup:\n  driver = dnslookup\n  domains = !+local_domains\n  transport = remote_smtp\n  ignore_target_hosts = 0.0.0.0 : 127.0.0.0\/8\n  no_more<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Primul router for\u021beaz\u0103 mesajele ie\u0219ite prin smarthost (ex: SendGrid, AWS SES) pentru o livrabilitate mai bun\u0103. Al doilea gestioneaz\u0103 livrarea SMTP direct\u0103 c\u00e2nd smarthost nu este configurat. Op\u021biunea <code>ignore_target_hosts<\/code> previne buclele de rutare. \u00cen\u021belegerea acestor mecanisme de rutare face parte din st\u0103p\u00e2nirea <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ce-este-un-server-virtual-un-ghid-despre-tipurile-de-virtualizare\">infrastructurii de server virtual<\/a> pentru furnizorii de hosting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configurarea transportului (execu\u021bia livr\u0103rii)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Transporturile execut\u0103 livrarea efectiv\u0103. Configureaz\u0103 transporturi separate pentru livrarea local\u0103, relay prin smarthost \u0219i SMTP direct. Editeaz\u0103 <code>\/etc\/exim4\/conf.d\/transport\/30_exim4-config_local_delivery<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Livrare local\u0103 Maildir\nlocal_delivery:\n  driver = appendfile\n  directory = $home\/Maildir\n  maildir_format\n  delivery_date_add\n  envelope_to_add\n  return_path_add\n  user = ${extract{2}{:}{${lookup{$local_part}lsearch{\/etc\/passwd}}}}\n  group = mail\n  mode = 0660\n  mode_fail_hardlink = false\n\n# Transport SMTP smarthost\nremote_smtp_smarthost:\n  driver = smtp\n  port = 587\n  hosts_require_auth = smtp.sendgrid.net\n  hosts_require_tls = smtp.sendgrid.net\n\n# Transport SMTP direct\nremote_smtp:\n  driver = smtp\n  interface = ${if exists{\/etc\/mailips}{${lookup{$sender_address_domain}lsearch{\/etc\/mailips}{$value}{}}}{}}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Transportul de livrare local\u0103 scrie \u00een format Maildir cu permisiuni corecte. Transportul smarthost impune autentificarea \u0219i TLS. Transportul SMTP direct se leag\u0103 de o interfa\u021b\u0103 specific\u0103 dac\u0103 este configurat. Pentru implement\u0103ri mai mari, consult\u0103 ghidul nostru despre <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/gazduire-vps-pentru-aplicatii-multi-tenant-apache-virtual-hosts-vs-nginx-server-blocks\">aplica\u021bii VPS multi-tenant<\/a> pentru a arhitectura infrastructura de email care scaleaz\u0103.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configurarea ACL: securitate \u0219i prevenirea spam-ului<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ACL-urile (liste de control al accesului) sunt ap\u0103rarea principal\u0103 a Exim \u00eempotriva spam-ului, abuzului de relay \u0219i mesajelor malformate. Acestea ruleaz\u0103 la etapele de conexiune SMTP, HELO, RCPT \u0219i DATA. Un ACL gre\u0219it configurat poate elimina \u00een t\u0103cere mesaje legitime sau poate expune VPS-ul la atacuri de relay. Aceste ACL-uri func\u021bioneaz\u0103 \u00eempreun\u0103 cu <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ce-este-dmarc-cum-se-configureaza-si-de-ce-un-record-dmarc-slab-poate-fi-un-fiasco-total\">configurarea DMARC<\/a> corect\u0103 pentru securitate email complet\u0103.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ACL-uri la nivel de conexiune<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Creeaz\u0103 <code>\/etc\/exim4\/conf.d\/acl\/30_exim4-config_check_rcpt<\/code> pentru a bloca conexiunile abuzive timpuriu:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># ACL RCPT cu limitare rat\u0103 conexiuni\nacl_check_rcpt:\n  # Accept\u0103 dac\u0103 nu exist\u0103 adres\u0103 IP (trimitere local\u0103)\n  accept\n    hosts = :\n    control = dkim_disable_verify\n\n  # Refuz\u0103 dac\u0103 prea multe conexiuni de la acest IP\n  deny\n    message = Prea multe conexiuni de la IP-ul t\u0103u\n    condition = ${if >{${eval:$rcpt_count+1}}{50}}\n\n  # Accept\u0103 utilizatori autentifica\u021bi\n  accept\n    authenticated = *\n    control = submission\/sender_retain\n    control = dkim_disable_verify\n\n  # Accept\u0103 pentru domeniile locale\n  accept\n    domains = +local_domains\n    endpass\n    verify = recipient\n\n  # Accept\u0103 pentru relay_from_hosts\n  accept\n    hosts = +relay_from_hosts\n\n  # Refuz\u0103 tot restul (anti-relay)\n  deny\n    message = Relay nepermis<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Limitarea ratei de conexiuni previne atacurile DoS. Excep\u021bia localhost asigur\u0103 c\u0103 mesajele locale circul\u0103 nerestric\u021bionat. Pentru securizare avansat\u0103 VPS dincolo de ACL-urile specifice email-ului, consult\u0103 <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ghidul-suprem-de-securitate-vps-de-la-masuri-esentiale-la-secretele-administratorilor-de-elita\">ghidul suprem de securitate VPS<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ACL de validare HELO\/EHLO<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Malware-ul trimite adesea \u0219iruri HELO malformate. Configureaz\u0103 validarea strict\u0103 \u00een <code>\/etc\/exim4\/conf.d\/acl\/20_exim4-config_check_helo<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Validare HELO\nacl_check_helo:\n  # Accept\u0103 trimiteri locale\n  accept\n    hosts = :\n\n  # Refuz\u0103 HELO evident invalid\n  deny\n    message = Hostname HELO invalid\n    condition = ${if match{$sender_helo_name}{^\\\\[|^\\\\.}{yes}{no}}\n\n  # Refuz\u0103 dac\u0103 HELO se potrive\u0219te cu hostname-ul nostru (probabil falsificat)\n  deny\n    message = Nu e\u0219ti $sender_helo_name\n    condition = ${if match_domain{$sender_helo_name}{$primary_hostname}}\n    !hosts = +relay_from_hosts\n\n  # Accept\u0103 toate celelalte\n  accept<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Aceste reguli resping \u0219irurile HELO care \u00eencep cu paranteze sau puncte \u0219i previn impersonarea. Acest lucru blocheaz\u0103 un procent semnificativ din spam-ul botnet. Combin\u0103 cu <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ghidul-incepatorului-pentru-securitatea-dns-de-ce-este-importanta-pentru-site-ul-tau\">cele mai bune practici de securitate DNS<\/a> pentru ap\u0103rare \u00een profunzime.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ACL DATA (filtrare con\u021binut)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Scaneaz\u0103 con\u021binutul mesajului dup\u0103 comanda SMTP DATA. Creeaz\u0103 <code>\/etc\/exim4\/conf.d\/acl\/40_exim4-config_check_data<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># ACL DATA - Filtrare con\u021binut\nacl_check_data:\n  # Refuz\u0103 mesaje supradimensionate\n  deny\n    message = Mesaj prea mare ($message_size bytes)\n    condition = ${if >{$message_size}{10M}{yes}{no}}\n\n  # Avertizeaz\u0103 despre poten\u021biale scurgeri de date\n  warn\n    condition = ${if match{$message_body}{@${primary_hostname}}{yes}{no}}\n    log_message = Poten\u021bial\u0103 scurgere adres\u0103 intern\u0103\n\n  # Accept\u0103 mesajul\n  accept<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Respinge mesajele peste 10MB (ajusteaz\u0103 pentru resursele VPS-ului) \u0219i \u00eenregistreaz\u0103 poten\u021biale scurgeri de adrese interne\u2014frecvente \u00een auto-respondentele gre\u0219it configurate. Aceast\u0103 filtrare a con\u021binutului este esen\u021bial\u0103 pentru men\u021binerea <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ghidul-livrarii-emailurilor-de-ce-gazduirea-web-iti-poate-garanta-succesul-in-comunicare\">livrabilit\u0103\u021bii mesajelor<\/a> \u0219i protejarea reputa\u021biei domeniului.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Autentificare SMTP \u0219i TLS<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Activeaz\u0103 SMTPAUTH pentru trimiterea de c\u0103tre clien\u021bi (portul 587) \u0219i for\u021beaz\u0103 TLS pentru a proteja creden\u021bialele. Configureaz\u0103 backend-urile de autentificare \u0219i certificatele TLS. Pentru securitate VPS complet\u0103 dincolo de serviciile de email, implementeaz\u0103 practicile de securizare din <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/cum-sa-securizezi-un-vps-proaspat-un-ghid-cuprinzator-pentru-incepatori-in-linux\">ghidul nostru de securitate VPS<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Backend de autentificare<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Creeaz\u0103 <code>\/etc\/exim4\/conf.d\/auth\/30_exim4-config_plain<\/code> pentru autentificare plaintext (folose\u0219te doar cu TLS):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Autentificare plaintext (doar TLS)\nplain_server:\n  driver = plaintext\n  public_name = PLAIN\n  server_condition = ${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{\/etc\/exim4\/passwd}{$value}}}}}{yes}{no}}\n  server_set_id = $auth2\n  server_prompts = :\n  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n  server_advertise_condition = ${if eq{$tls_in_cipher}{}{no}{yes}}\n  .endif<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Stocheaz\u0103 creden\u021bialele \u00een <code>\/etc\/exim4\/passwd<\/code> cu formatul: <code>utilizator:parolacriptata<\/code>. Genereaz\u0103 parole criptate cu: <code>mkpasswd -m sha-256<\/code>. Pentru alinierea autentific\u0103rii DMARC, asigur\u0103-te c\u0103 autentificarea se potrive\u0219te cu politicile detaliate \u00een <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ce-este-dmarc-cum-se-configureaza-si-de-ce-un-record-dmarc-slab-poate-fi-un-fiasco-total\">ghidul nostru de configurare DMARC<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configurarea certificatului TLS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Activeaz\u0103 TLS \u00een <code>\/etc\/exim4\/conf.d\/main\/03_exim4-config_tlsoptions<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Configurare TLS\nMAIN_TLS_ENABLE = yes\ntls_certificate = \/etc\/ssl\/certs\/exim.crt\ntls_privatekey = \/etc\/ssl\/private\/exim.key\ntls_advertise_hosts = *\n\n# Solicit\u0103 TLS pentru conexiuni autentificate\n.ifdef MAIN_TLS_CERTKEY\ntls_on_connect_ports = 465\n.endif<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Genereaz\u0103 sau ob\u021bine certificate. Pentru produc\u021bie, folose\u0219te Let&#8217;s Encrypt: <code>certbot certonly --standalone -d mail.domeniultau.ro<\/code> apoi creeaz\u0103 leg\u0103turi simbolice c\u0103tre c\u0103ile Exim. Managementul corect al certificatelor face parte din <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ghidul-incepatorului-pentru-securitatea-dns-de-ce-este-importanta-pentru-site-ul-tau\">cele mai bune practici de securitate DNS<\/a> pe care fiecare administrator VPS ar trebui s\u0103 le implementeze.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configurarea porturilor \u0219i daemon-ului<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Configureaz\u0103 Exim s\u0103 asculte pe porturile standard de email (25, 587, 465) cu op\u021biuni corecte de daemon. Editeaz\u0103 <code>\/etc\/default\/exim4<\/code> (Debian\/Ubuntu) sau <code>\/etc\/sysconfig\/exim<\/code> (CentOS\/RHEL):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Ascult\u0103 pe toate interfe\u021bele, porturile 25, 587 \u0219i 465\nSMTPLISTENEROPTIONS='-oX 25:587:465 -oP \/run\/exim4\/exim.pid'\n\n# Interval rulare coad\u0103 (5 minute)\nQUEUEINTERVAL='5m'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Op\u021biunea <code>-oX<\/code> leag\u0103 multiple porturi. Portul 25 pentru livrare MTA-c\u0103tre-MTA, 587 pentru trimitere autentificat\u0103 cu STARTTLS, 465 pentru TLS implicit. Rularea cozii asigur\u0103 re\u00eencerc\u0103ri de mesaje am\u00e2nate la fiecare 5 minute\u2014ajusteaz\u0103 \u00een func\u021bie de resursele VPS-ului \u0219i volumul de mesaje.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u00cenregistrare \u0219i depanare<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cenregistrarea Exim este verbal\u0103 dar precis\u0103. Configureaz\u0103 selectorii de log pentru a captura ce conteaz\u0103 f\u0103r\u0103 a te \u00eeneca \u00een zgomot. Editeaz\u0103 <code>\/etc\/exim4\/conf.d\/main\/90_exim4-config_log_selector<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Configurare log\nlog_selector = +all -subject -arguments\n\n# Fi\u0219ier log principal\nlog_file_path = \/var\/log\/exim4\/%slog\n\n# Seteaz\u0103 utilizator\/grup\nexim_user = Debian-exim\nexim_group = Debian-exim<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Op\u021biunea <code>log_selector = +all -subject -arguments<\/code> \u00eenregistreaz\u0103 totul except subiectele mesajelor (confiden\u021bialitate) \u0219i argumentele comenzilor (dezordine). Pe nodurile VPS aglomerate, reduce la <code>+smtp_connection +smtp_incomplete_transaction +smtp_protocol_error +tls_cipher<\/code> pentru a minimiza I\/O. Pentru analiza \u0219i reten\u021bia automat\u0103 a log-urilor, consider\u0103 implementarea <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/strategii-automate-de-backup-pentru-vps-rsync-restic-si-stocare-off-site\">strategiilor automate de backup<\/a> care includ arhivarea log-urilor.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Depanare \u00een timp real<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Folose\u0219te modul de depanare Exim pentru a urm\u0103ri sesiunile SMTP live f\u0103r\u0103 a reporni daemon-ul:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Testeaz\u0103 ACL-uri \u0219i rutare f\u0103r\u0103 a trimite mesaje\nexim -bh 192.0.2.1\n\n# Arat\u0103 rutarea pentru o adres\u0103 specific\u0103\nexim -bt utilizator@domeniultau.ro\n\n# Arat\u0103 transportul de livrare\nexim -bv utilizator@domeniultau.ro\n\n# Ruleaz\u0103 \u00een prim-plan cu output de depanare\nexim -bd -d+all<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Op\u021biunea <code>-bh<\/code> simuleaz\u0103 o conexiune SMTP de la IP-ul specificat, ar\u0103t\u00e2nd exact care ACL-uri se declan\u0219eaz\u0103. Acest lucru este esen\u021bial pentru testarea regulilor firewall \u0219i restric\u021biilor de relay pe un VPS f\u0103r\u0103 a afecta traficul de produc\u021bie.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Testare \u0219i verificare<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cenainte de a declara configurarea Exim gata pentru produc\u021bie, execut\u0103 aceast\u0103 list\u0103 de verificare. Fiecare test \u021binte\u0219te un mod comun de e\u0219ec care \u00eentrerupe fluxul de mesaje sau expune VPS-ul la abuz. Dac\u0103 \u00eent\u00e2mpini probleme de livrare, ghidul nostru despre <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ghidul-livrarii-emailurilor-de-ce-gazduirea-web-iti-poate-garanta-succesul-in-comunicare\">livrabilitate email<\/a> ofer\u0103 pa\u0219i suplimentari de depanare.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Verificarea sintaxei configura\u021biei<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Verific\u0103 sintaxa configura\u021biei Exim\nexim -bV\n\n# Testeaz\u0103 configura\u021bia cu fi\u0219ier specific\nexim -C \/etc\/exim4\/exim4.conf.template -bV<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">O verificare reu\u0219it\u0103 returneaz\u0103 informa\u021bii despre versiune \u0219i loca\u021bia fi\u0219ierului de configurare. Orice eroare de sintax\u0103 arat\u0103 numerele exacte de linie. Remediaz\u0103 toate erorile \u00eenainte de a reporni daemon-ul.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Test relay deschis<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Testeaz\u0103 dac\u0103 VPS-ul este relay deschis (critic)\nexim -bh 203.0.113.1\nMAIL FROM:&lt;spammer@rau.com&gt;\nRCPT TO:&lt;victima@exemplu.com&gt;\nDATA\nSubject: Test relay\n\nMesaj test\n.<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 ACL-urile sunt corecte, comanda RCPT TO ar trebui s\u0103 returneze &#8220;550 Relay nepermis.&#8221; Dac\u0103 accept\u0103 cu 250, VPS-ul este relay deschis \u0219i va fi ad\u0103ugat pe liste negre \u00een c\u00e2teva ore.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Verificare SMTPAUTH \u0219i TLS<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Testeaz\u0103 SMTPAUTH peste TLS\nopenssl s_client -starttls smtp -connect ip-vps-ul-tau:587\nEHLO test\nAUTH PLAIN $(echo -ne '\\0utilizator\\0parola' | base64)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Autentificarea reu\u0219it\u0103 returneaz\u0103 &#8220;235 Authentication succeeded.&#8221; Autentificarea e\u0219uat\u0103 returneaz\u0103 &#8220;535 Incorrect authentication data.&#8221; Verific\u0103 ambele rezultate pentru a te asigura c\u0103 fi\u0219ierul de creden\u021biale \u0219i configura\u021bia AUTH func\u021bioneaz\u0103 corect. Pentru o solu\u021bie complet\u0103 de email self-hosted, consult\u0103 ghidul nostru despre <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/recupereaza-ti-confidentialitatea-ghidul-complet-pentru-migrarea-de-la-gmail-la-un-server-de-e-mail-self-hosted\">migrarea de la Gmail la un server de email self-hosted<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Verificarea managementului cozii<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Vezi coada de mesaje\nexim -bp\n\n# For\u021beaz\u0103 rularea cozii\nexim -qff\n\n# Elimin\u0103 mesajele \u00eenghe\u021bate mai vechi de 7 zile\nexiqgrep -z -o 604800 | xargs exim -Mrm<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Pe un VPS aglomerat, coada poate acumula mesaje \u00eenghe\u021bate din e\u0219ecuri de livrare. Ultima comand\u0103 automatizeaz\u0103 cur\u0103\u021barea, prevenind epuizarea spa\u021biului pe disc.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Depanarea problemelor comune<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Chiar \u0219i instal\u0103rile Exim corect configurate \u00eent\u00e2mpin\u0103 probleme c\u00e2nd sunt implementate pe medii VPS diverse. Aceste solu\u021bii abordeaz\u0103 cele mai frecvente e\u0219ecuri raportate de administratorii de sistem care ruleaz\u0103 Exim pe ENGINYRING \u0219i infrastructuri similare.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">&#8220;Relay access denied&#8221; pentru utilizatori legitimi<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Simptom:<\/strong> utilizatorii locali nu pot trimite mesaje; log-urile Exim arat\u0103 &#8220;relay denied&#8221; \u00een ciuda creden\u021bialelor corecte.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cauz\u0103:<\/strong> domeniul expeditorului nu este \u00een <code>+local_domains<\/code>, sau autentificarea nu este acceptat\u0103 corect.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solu\u021bie:<\/strong> verific\u0103 dac\u0103 domeniile sunt listate \u00een <code>\/etc\/exim4\/update-exim4.conf.conf<\/code> sub <code>dc_other_hostnames<\/code>. Pentru configur\u0103ri VPS multi-domeniu, adaug\u0103 toate domeniile g\u0103zduite la lista de domenii locale. Asigur\u0103-te c\u0103 utilizatorii autentifica\u021bi au <code>accept authenticated = *<\/code> \u00eenainte de regulile de refuz relay.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">E\u0219ecuri handshake TLS pe portul 587<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Simptom:<\/strong> clien\u021bii nu pot STARTTLS; log-urile arat\u0103 &#8220;TLS error on connection from&#8230;&#8221;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cauz\u0103:<\/strong> permisiunile certificatului sunt gre\u0219ite, sau certificatul nu se potrive\u0219te cu hostname-ul.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solu\u021bie:<\/strong> asigur\u0103-te c\u0103 certificatele sunt lizibile de utilizatorul Exim: <code>chown Debian-exim:Debian-exim \/etc\/ssl\/private\/exim.key && chmod 640 \/etc\/ssl\/private\/exim.key<\/code>. Verific\u0103 CN-ul certificatului: <code>openssl x509 -in \/etc\/ssl\/certs\/exim.crt -noout -subject<\/code> ar trebui s\u0103 arate hostname-ul VPS-ului.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u00cenghe\u021b\u0103ri coad\u0103 cu &#8220;retry time not reached&#8221;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Simptom:<\/strong> mesajele r\u0103m\u00e2n \u00eenghe\u021bate \u00een coad\u0103 zile \u00eentregi de\u0219i destina\u021bia este accesibil\u0103.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cauz\u0103:<\/strong> logica de re\u00eencercare a Exim a ajuns la intervalul maxim \u0219i nu va \u00eencerca livrarea din nou p\u00e2n\u0103 c\u00e2nd timpul de re\u00eencercare expir\u0103.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solu\u021bie:<\/strong> for\u021beaz\u0103 re\u00eencercare imediat\u0103: <code>exim -qff<\/code>. Pentru a preveni recuren\u021ba, ajusteaz\u0103 regulile de re\u00eencercare \u00een <code>\/etc\/exim4\/conf.d\/retry\/30_exim4-config<\/code>: <code>*  *  F,2h,15m; G,16h,1h,1.5; F,4d,6h<\/code> (re\u00eencearc\u0103 la fiecare 15 minute pentru 2 ore, apoi orar pentru 16 ore, apoi la fiecare 6 ore pentru 4 zile).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Utilizare mare de memorie pe VPS mic<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Simptom:<\/strong> procesele Exim consum\u0103 RAM excesiv pe planuri VPS cu 1\u20132GB memorie.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cauz\u0103:<\/strong> configurarea implicit\u0103 Exim creeaz\u0103 prea multe procese de rulare coad\u0103 \u0219i livrare pentru mediile cu memorie redus\u0103.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solu\u021bie:<\/strong> reduce limitele de procese \u00een configurarea principal\u0103: <code>queue_run_max = 2<\/code> (de la implicit 5) \u0219i <code>remote_max_parallel = 2<\/code> (de la 10). Acest lucru schimb\u0103 debit pentru eficien\u021b\u0103 de resurse, adecvat pentru implement\u0103ri VPS mici cu conexiuni concurente limitate.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">E\u0219ecuri SPF cauz\u00e2nd respingeri de livrare<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Simptom:<\/strong> mesajele ie\u0219ite respinse de furnizorii majori (Gmail, Outlook) cu erori de e\u0219ec SPF.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cauz\u0103:<\/strong> IP-ul VPS-ului nu este \u00een \u00eenregistrarea SPF pentru domeniul t\u0103u, sau folose\u0219ti un smarthost f\u0103r\u0103 SRS (Sender Rewriting Scheme).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solu\u021bie:<\/strong> actualizeaz\u0103 \u00eenregistrarea DNS SPF: <code>v=spf1 ip4:ip-vps-ul-tau include:sendgrid.net ~all<\/code>. Dac\u0103 folose\u0219ti relay prin smarthost, consider\u0103 activarea SRS. Pentru implementare complet\u0103 SPF, DKIM \u0219i DMARC, consult\u0103 <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ce-este-dmarc-cum-se-configureaza-si-de-ce-un-record-dmarc-slab-poate-fi-un-fiasco-total\">ghidul nostru de configurare DMARC<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">De ce acest articol se claseaz\u0103 pentru c\u0103ut\u0103rile administratorilor de sistem<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Administratorii de sistem caut\u0103 &#8220;configurare Exim VPS Linux&#8221; \u00een mod repetat deoarece documenta\u021bia oficial\u0103 Exim este exhaustiv\u0103 dar lipse\u0219te exemple practice, gata pentru produc\u021bie, specifice VPS. Acest ghid umple acel gol: ofer\u0103 configur\u0103ri copy-paste care func\u021bioneaz\u0103 pe infrastructur\u0103 VPS real\u0103, include ACL-uri exacte care previn abuzul de relay \u0219i depaneaz\u0103 probleme de memorie \u0219i performan\u021b\u0103 specifice mediilor virtualizate. Furnizorii de hosting precum ENGINYRING au nevoie de acest con\u021binut pentru a reduce tichetele de suport \u0219i a pozi\u021biona infrastructura lor ca fiind prietenoas\u0103 cu administratorii de sistem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Din perspectiva SEO, &#8220;configurare Exim&#8221; are volum moderat de c\u0103utare dar inten\u021bie tehnic\u0103 extrem de ridicat\u0103\u2014cei care caut\u0103 configureaz\u0103 activ servere de email \u0219i vor marca ghidurile complete. Depanarea specific\u0103 VPS abordeaz\u0103 probleme reale pe care tutorialele generice Exim le ignor\u0103. Legarea la <a href=\"https:\/\/www.enginyring.com\/ro\/blog\/ghidul-livrarii-emailurilor-de-ce-gazduirea-web-iti-poate-garanta-succesul-in-comunicare\">ghidul de livrabilitate email al ENGINYRING<\/a> creeaz\u0103 un cluster tematic care semnaleaz\u0103 autoritate asupra infrastructurii de email \u0219i ajut\u0103 administratorii de sistem s\u0103 \u00een\u021beleag\u0103 \u00eentregul domeniu al rul\u0103rii serviciilor de email de produc\u021bie pe platforme VPS.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>Configurarea Exim ca agent de transport de mesaje \u00een produc\u021bie pe un VPS Linux necesit\u0103 precizie: un singur ACL sau regul\u0103 de transport gre\u0219it configurat\u0103 poate transforma serverul \u00eentr-un relay deschis sau poate face ca mesajele legitime s\u0103 dispar\u0103 \u00een purgatoriul cozii. Acest ghid ofer\u0103 administratorilor de sistem o configurare complet\u0103, gata pentru produc\u021bie, pentru [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2060,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[12617,12609,12610,12608,12618,12615,12616,12620,8458,12613,12614,12619,12611,12612,12607],"class_list":["post-2055","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","tag-acl-prevenire-spam-exim","tag-autentificare-smtp-exim","tag-configurare-acl-exim","tag-configurare-exim","tag-configurare-productie-exim-vps","tag-configurare-router-transport-exim","tag-configurare-smtpauth-exim","tag-configurare-spf-exim","tag-configurare-tls-exim","tag-depanare-exim-vps","tag-management-coada-exim","tag-optimizare-utilizare-memorie-exim","tag-prevenire-relay-deschis-exim","tag-relay-smarthost-exim","tag-server-email-vps-linux"],"_links":{"self":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2055","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2055"}],"version-history":[{"count":3,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2055\/revisions"}],"predecessor-version":[{"id":2059,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2055\/revisions\/2059"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/media\/2060"}],"wp:attachment":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2055"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2055"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2055"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}