Editing Pahwa ssl

[[category:Qmail]]
[[category:Installation]]
[[category:Pahwa Group]]



'''[[The Certificate Got Renewed on 7th DEC 2014 Once again , The Renewal Process is at the Bottom ]]'''


== '''Objective'''  ==
* '''Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)
'''

 chmod 1755 /package

 cd /package/

 wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

 wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

 cd /package/host/superscript.com/net/ucspi-ssl-0.84/

 package/compile

 package/install

 cd /usr/src/qmail/ucspi-tcp-0.88

 patch < /package/ucspi-tcp-ssl-20020705.patch

 cd /certificate

 openssl genrsa -des3 -out servercert.key.enc 2048

 openssl rsa -in servercert.key.enc -out servercert.key
 
 openssl req -new -key servercert.key -out servercert.csr

 openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650 [self signed cert]


 cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

 chown root:qmail /var/qmail/control/servercert.pem

 chmod 640 /var/qmail/control/servercert.pem

 ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem


=='''IMPLEMENTATION OF POP3S'''==

 vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}


 ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service


To Verify-

 openssl s_client -connect localhost:995


=='''IMPLEMENTATION OF IMAPS'''==

 vim /usr/local/etc/imapd-ssl


TLS_PROTOCOL=SSL3

TLS_STARTTLS_PROTOCOL=TLS1

TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"

TLS_CERTFILE=/var/qmail/control/servercert.pem


To Verfiy -

 openssl s_client -connect localhost:993



=='''SSL IMPLEMENTATION ON APACHE'''==

 vim /etc/httpd/conf.d/

SSLEngine on

SSLProtocol -ALL +SSLv3 +TLSv1

SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)

SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

 /etc/init.d/httpd restart

=='''For SMTPS on POSTFIX'''==

 vim /etc/postfix/main.cf

 smtpd_use_tls = yes
 smtpd_tls_auth_only = no
 smtpd_tls_loglevel = 3
 smtpd_tls_key_file = /certificate/servercert.key
 smtpd_tls_cert_file = /certificate/servercert.crt
 smtpd_tls_received_header = yes
 smtpd_tls_session_cache_timeout = 3600s
 tls_random_source = dev:/dev/urandom


 vim /etc/postfix/master.cf

smtps    inet  n       -       n       -       -       smtpd
-o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes



=='''Test the settings on thunderbird/outlook/evolution'''==

 incoming mailserver - mail21c.pahwa.com
 outgoing mailserver - mail21c.pahwa.com
 smtps port          - 587
 imaps port          - 993
 pop3s port          - 995
 https://mail21c.pahwa.com


'''Reference''' http://192.168.1.15/wiki/index.php/Implementation_of_smtps_pop3s_imaps_and_Https_on_Qmail_Based_Server



== Renewal of Certificate andits implementation ==

First down load the Certificate from Godaddy Certificate site with authorization information ( For information get in touch with Biswajit Banerjee )

The Certificate , the Root Certificates and the OLd certicate Key is kept in /certificate/2014-2015

For Postfix - Changes are made in main.cf file by converting "/certicate/.........." to "/certifate/2014-2015/......." 

For Apache - Changes are made in /etc/httpd/conf.d/ssl.conf file by converting "/certicate/.........." to "/certifate/2014-2015/......."

For Qmail ( Pop3d and Imap) - From /certificate/2014-2015 directory 
 cat servercert.key servercert.crt gd_bundle.crt > /var/qmail/control/servercert.pem