Pahwa ssl: Difference between revisions
No edit summary |
|||
| Line 31: | Line 31: | ||
openssl genrsa -des3 -out servercert.key.enc 2048 | openssl genrsa -des3 -out servercert.key.enc 2048 | ||
openssl | openssl rsa -in servercert.key.enc -out servercert.key | ||
openssl req -new -key servercert.key -out servercert.csr | openssl req -new -key servercert.key -out servercert.csr | ||
Revision as of 08:53, 14 December 2013
Objective
- Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(587) , pop3s (995) , imaps (993), https (443)
chmod 1755 /package
cd /package/
wget http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz
wget http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz
Extract both the packages
cd /package/host/superscript.com/net/ucspi-ssl-0.84/
package/compile
package/install
cd /usr/src/qmail/ucspi-tcp-0.88
patch < /package/ucspi-tcp-ssl-20020705.patch
cd /certificate
openssl genrsa -des3 -out servercert.key.enc 2048
openssl rsa -in servercert.key.enc -out servercert.key openssl req -new -key servercert.key -out servercert.csr
openssl x509 -in servercert.csr -out servercert.crt -req -signkey servercert.key -days 3650 [self signed cert]
cat servercert.key servercert.crt > /var/qmail/control/servercert.pem
chown root:qmail /var/qmail/control/servercert.pem
chmod 640 /var/qmail/control/servercert.pem
ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem
IMPLEMENTATION OF POP3S
vim /var/qmail/boot/qmail-pop3d-ssl/run
TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}
TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}
ln -s /var/qmail/boot/qmail-pop3d-ssl/ /service
To Verify-
openssl s_client -connect localhost:995
IMPLEMENTATION OF IMAPS
vim /usr/local/etc/imapd-ssl
TLS_PROTOCOL=SSL3
TLS_STARTTLS_PROTOCOL=TLS1
TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"
TLS_CERTFILE=/var/qmail/control/servercert.pem
To Verfiy -
openssl s_client -connect localhost:993
SSL IMPLEMENTATION ON APACHE
vim /etc/httpd/conf.d/
SSLEngine on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile "/var/qmail/cert/servercert.crt" ( the Actual Certificate)
SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )
/etc/init.d/httpd restart
For SMTPS on POSTFIX
vim /etc/postfix/main.cf
smtpd_use_tls = yes smtpd_tls_auth_only = no smtpd_tls_loglevel = 3 smtpd_tls_key_file = /certificate/servercert.key smtpd_tls_cert_file = /certificate/servercert.crt smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom
vim /etc/postfix/master.cf
smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
Test the settings on thunderbird/outlook/evolution
incoming mailserver - mail21c.pahwa.com outgoing mailserver - mail21c.pahwa.com smtps port - 587 imaps port - 993 pop3s port - 995 https://mail21c.pahwa.com