Implementation of smtps pop3s imaps and Https on Qmail Based Server

Document for Implementation of smtps , pop3s ,imaps and Https on Qmail Based Server

This Document was prepared for RDM

Objective

• Setup SSL Based Qmail SMTPD , POP3D and IMAPD server on smtps(465) , pop3s (995) , imaps (993) .
• Also integrated a authorized SSL Certificate ( in this document Godaddy Based Certificate)
• Ensure that SSLv2 ( Not recommened Cipher) is used and it is disabled . We are useing strong and recommended SSL Ciphers .
• Integration of Authorized Certificate with Https environment

Out of Scope

Please note following is not the scope of this document and you should know before implementing or refering this document

• Qmail – LDAP installation , implementation or troubleshooting , prior knowledge is required .
• HTTPS activation , prior knowledge of Apache and its configuration is required .

Current Environment details

• There are 2 Server running Qmail LDAP ( LDAP in Master Slave mode )
• Only IMAP , POP3 and SMTP is running without SSL

Procedure

Making the Environment Ready

• We need to have UCSPI-SSL to be installed . we can get it from http://www.superscript.com/ucspi-ssl/ucspi-ssl-0.73.tar.gz
• We also needs to have patch for ssl for qmail from http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz .
• We also needs to have mod_ssl for apache via Yum .

Installation of UCSPI-SSL

• Reference Document - http://www.superscript.com/ucspi-ssl/install.html

and the new version can be downloaded from http://qmailrocks.thibs.com/downloads/ucspi-ssl-0.84.tgz

mkdir /package
chmod 1755 /package

Unpack ucspi-ssl in /package.

cd /package
gunzip ucspi-ssl-0.73.tar
tar -xpf ucspi-ssl-0.73.tar
rm ucspi-ssl-0.73.tar
cd host/superscript.com/net/ucspi-ssl-0.73

Compile the package:

package/compile

Install the package. This will compile the package if you have not already done so:

package/install

We will have sslserver in /usr/local/bin

sslserver is only used in smtps configuration

Installation of patch (ucspi-tcp-ssl) for qmail

Download http://www.nrg4u.com/qmail/ucspi-tcp-ssl-20020705.patch.gz

Identify the UCSPI-TCP Src and patch it , and rebuild the UCSPI-TCP .

Assuming /usr/src/qmail/ucspi-tcp-0.88 is Source for ucspi-tcp

cd  /usr/src/qmail/ucspi-tcp-0.88 ( qmail source directory )
patch < ucspi-tcp-ssl-20050405.patch

As you have already patched with error patch , this might throw error at error patch , please skip as shown below

--Snip--
patching file error.h
Reversed (or previously applied) patch detected!  Assume -R? [n] 
Apply anyway? [n] 
Skipping patch.
1 out of 1 hunk ignored -- saving rejects to file error.h.rej
--snip--

Once completed please do

make && make setup check

Implementation of Certificate

• Create a private key using the triple des encryption standard (recommended):

openssl genrsa -des3 -out servercert.key.enc 2048

• Remove the pass phrase from the private key

openssl rsa -in servercert.key.enc -out servercert.key

• Generate the CSR (Certificate Service Request ) for getting a authorized Certificate .

openssl req -new -key servercert.key -out servercert.csr

• Submit the CSR to the Authorized Body to generate certificate
• Download the Certicate ( In our case servercert.crt ) and Intermediate Certicates from the site
• Create standard .pem in /var/qmail/control/servercert.pem

cat servercert.key servercert.crt intermediate.crt > /var/qmail/control/servercert.pem

• Do qmail related changes

chown root:qmail /var/qmail/control/servercert.pem
chmod 640 /var/qmail/control/servercert.pem
ln -s /var/qmail/control/servercert.pem /var/qmail/control/clientcert.pem

Implementation of SMTPS

• Use file from http://qmail.jms1.net/scripts/service-qmail-smtpd-run
• Make Supervise script of smtpd-ssl as /service/qmail-smtpd-ssl/run
• Modify - the Script to suite the environment
  • PORT=465
  • SSL=1
  • FORCE_TLS=1
  • AUTH=1
  • REQUIRE_AUTH=1
  • ALLOW_INSECURE_AUTH=0
  • After - export CERTFILE=${SSL_CERT}

(Introduce the following lines)

export KEYFILE=""

export DHFILE=""

export CIPHERS="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"

( This line is introduced to ensure high Cipher levels and deny of use of SSL2)

• Activate it and check the logs
• Offline Client like Outlook , evolution etc needs to be configured to use port 465 with ssl

Testing of SMTPS via commands

openssl s_client -crlf -connect localhost:465

Also from remote Client ( insure this port is not blocked via firewall )

openssl s_client -crlf -connect IP:465

Should result in certificate details

Implementation of POP3s

• Pop3s activation is fairly simple
• You already have pop3s scripts in /var/qmail/boot/qmail-pop3d-ssl/
• Modify the run script to suite your environment

TLSCERT=${TLSCERT:="$QMAIL/control/clientcert.pem"}

Point to the right .pem file

Also it is possible that you are not using "qmail-pop3d.cdb" as mentioned in this run script so comment and remove "-x$QMAIL/control/qmail-pop3d.cdb"

#tcpserver -v -HRl $ME -x$QMAIL/control/qmail-pop3d.cdb \
tcpserver -v -HRl $ME \

• link var/qmail/boot/qmail-pop3d-ssl/ to /service
• Activate it and check the logs
• Offline Client like Outlook , evolution etc needs to be configured to use port 995 with ssl

Testing for pop3s via command line

openssl s_client -connect localhost:995

Implementation of IMAPs

• This implementation is done taking courier Imap into consideration
• you already have imaps activated in the environment . You have to integrate right certificate and right Cipher .
• To do this , modify /usr/local/etc/imapd-ssl with following lines

TLS_PROTOCOL=SSL3
TLS_STARTTLS_PROTOCOL=TLS1
TLS_CIPHER_LIST="SSLv3:TLS:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:-SSLv2"
TLS_CERTFILE=/var/qmail/control/servercert.pem

• Restart the imaps service and check the logs for testing
• Offline Client like Outlook , evolution etc needs to be configured to use port 993 with ssl

Testing for IMAPS via command line

openssl s_client -connect localhost:993

Implementation of HTTPs

• Ensure that mod_ssl is installed and configured
• If you are using complied apache ( and not default apache ) then ensure that you have ssl activated . If required activate it with

/configure --prefix=/usr/local/apache --enable-shared=max --enable-module=rewrite --enable-module=so --enable-ssl –enable-so

• Modify the ssl.conf ( In our test case we had at /usr/local/apache/conf/extra/httpd-ssl.conf) for the following in the VirtualHost configurations

SSLEngine on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile "/var/qmail/cert/mailserver.rdm.co.in.crt" ( the Actual Certificate)
SSLCertificateKeyFile "/var/qmail/cert/servercert.key" ( The Actual Key used )
SSLCertificateChainFile "/var/qmail/cert/gd_bundle.crt" ( The actual Intermediate Certicate from the Authorized Body )

• Restart the apache
• Point the browser to https://server_name , you should get a authorized https page .