Pahwa ssl

Objective

• Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)

chmod 1755 /package

cd /package/

wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Extract both the packages

cd /package/host/superscript.com/net/ucspi-ssl-0.84/

package/compile

package/install

cd /usr/src/qmail/ucspi-tcp-0.88

patch < /package/ucspi-tcp-ssl-20020705.patch

cd /certificate

openssl genrsa -des3 -out servercert.key.enc 2048

openssl genrsa -des3 -out servercert.key.enc 2048

openssl req -new -key servercert.key -out servercert.csr

openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650

cat servercert.key servercert.crt > /var/qmail/control/servercert.pem

chown root:qmail /var/qmail/control/servercert.pem

chmod 640 /var/qmail/control/servercert.pem

ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

IMPLEMENTATION OF POP3S

vim /var/qmail/boot/qmail-pop3d-ssl/run

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service

openssl s_client -connect localhost:995

vim /usr/local/etc/imapd-ssl

TLS_PROTOCOL=SSL3 TLS_STARTTLS_PROTOCOL=TLS1 TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2" TLS_CERTFILE=/var/qmail/control/servercert.pem

openssl s_client -connect localhost:993

SSL IMPLEMENTATION ON APACHE

vim /etc/httpd/conf.d/

SSLEngine on SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate) SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )

/etc/init.d/httpd restart

For SMTPS on POSTFIX

vim /etc/postfix/main.cf

smtpd_use_tls = yes smtpd_tls_auth_only = no smtpd_tls_loglevel = 3 smtpd_tls_key_file = /certificate/servercert.key smtpd_tls_cert_file = /certificate/servercert.crt smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom

vim /etc/postfix/master.cf

smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes