2008 - Debian 4 - Postfix + SASL + TLS

|=--------------------------=[ Postfix + SASL + TLS ]=---------------------=|
+---------------------------------------------------------------------------+
|                                                                           |
|       Instalacia Postfixu s podporou overovania SASL + TLS                |
|                                  Debian 4.0 Etch                          |
|                                                                           |
+---------------------------------------------------------------------------+
|=-------------------------------=[ BH 2007 ]=-----------------------------=|

Konfiguracia postfixu s podporou overovania SASL. SASL je nastavene tak, ze
uzivatel sa bude autentifikovat pomocou PAM, cize pomocou svojho hesla k uctu.
Kedze tieto data putuju po sieti v nezasifrovanej forme pouzijeme aj SSL.

        # apt-get install postfix libsasl2 sasl2-bin libsasl2-modules libdb3-util procmail

        # dpkg-reconfigure postfix
        --------------------------
        General type of configuration? <-- Internet Site
        Where should mail for root go <-- [prazdne]
        Mail name? <-- server1.example.com
        Other destinations to accept mail for? (blank for none) <-- server.domena.sk, localhost.domena.sk, localhost.localdomain, localhost
        Force synchronous updates on mail queue? <-- No
        Local networks? <-- 127.0.0.0/8
        Use procmail for local delivery? <-- Yes
        Mailbox size limit <-- 0
        Local address extension character? <-- +
        Internet protocols to use? <-- all

        # postconf -e 'smtpd_sasl_local_domain ='
        # postconf -e 'smtpd_sasl_auth_enable = yes'
        # postconf -e 'smtpd_sasl_security_options = noanonymous'
        # postconf -e 'broken_sasl_auth_clients = yes'
        # postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'
        # postconf -e 'inet_interfaces = all'
        # echo 'pwcheck_method: saslauthd' >> /etc/postfix/sasl/smtpd.conf
        # echo 'mech_list: plain login' >> /etc/postfix/sasl/smtpd.conf

        Kedze postfix bezi v chroote vo /var/spool/postfix musime do klietky pridat aj SASL.
        ------------------------------------------------------------------------------------
        # mkdir -p /var/spool/postfix/var/run/saslauthd

        Editujeme subor /etc/default/saslauthd a tym zapneme SASL. Nastavime direktivu
        START = yes
        a zmenime riadok
        OPTIONS="-c" na OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"

        Restartneme SASL demona
        -----------------------
        # /etc/init.d/saslauthd start

        # mkdir /etc/postfix/ssl
        # cd /etc/postfix/ssl/
        # openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024
        # chmod 600 smtpd.key
        # openssl req -new -key smtpd.key -out smtpd.csr
        ------------------------------------------------
        Country Name (2 letter code) [AU]:SK
        State or Province Name (full name) [Some-State]:Slovakia
        Locality Name (eg, city) []:Mesto
        Organization Name (eg, company) [Internet Widgits Pty Ltd]:domena.sk
        Organizational Unit Name (eg, section) []:
        Common Name (eg, YOUR name) []:server.domena.sk
        Email Address []:postmaster@domena.sk

        Please enter the following 'extra' attributes
        to be sent with your certificate request
        A challenge password []: prazdne
        An optional company name []: prazdne
        ------------------------------------------------
        # openssl x509 -req -days 3650 -in smtpd.csr -signkey smtpd.key -out smtpd.crt
        # openssl rsa -in smtpd.key -out smtpd.key.unencrypted
        # mv -f smtpd.key.unencrypted smtpd.key
        # openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650

        # postconf -e 'smtpd_tls_auth_only = no'
        # postconf -e 'smtp_use_tls = yes'
        # postconf -e 'smtpd_use_tls = yes'
        # postconf -e 'smtp_tls_note_starttls_offer = yes'
        # postconf -e 'smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key'
        # postconf -e 'smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt'
        # postconf -e 'smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem'
        # postconf -e 'smtpd_tls_loglevel = 1'
        # postconf -e 'smtpd_tls_received_header = yes'
        # postconf -e 'smtpd_tls_session_cache_timeout = 3600s'
        # postconf -e 'tls_random_source = dev:/dev/urandom'
        # postconf -e 'myhostname = server.domena.sk'

        # /etc/init.d/postfix restart

        tools -> accounts -> mail -> nazov_uctu -> servers -> log_on_using_secure_password_authentication = check
        tools -> accounts -> mail -> nazov_uctu -> servers -> my_server_requires_authentication = check
        tools -> accounts -> mail -> nazov_uctu -> advanced -> this_server_requires_a_secure_connection(SSL) = check

============================================================================================
 Nastavenie postfixu, aby sa overoval pomocou SASL vtedy, ked sa pripaja na iny SMTP server,
 ktory vyzaduje overovanie. Ked sa postfix bude chciet napojit na server mail.domena.sk
 pouzije sa login a heslo zo suboru /etc/postfix/sasl_passwd
============================================================================================

        # touch /etc/postfix/sasl_passwd
        # nano /etc/postfix/sasl_passwd
        -------------------------------
        domena.sk       ucet:heslo

        # postmap /etc/postfix/sasl_passwd
        # nano /etc/postfix/main.cf
        ---------------------------
        smtp_sasl_auth_enable=yes
        smtp_sasl_password_maps=hash:/etc/postfix/sasl_passwd

        # /etc/init.d/postfix reload

        Install stunnel
        ---------------
        # apt-get install stunnel4

        Pridanie uzivatela a skupiny smtps
        ----------------------------------
        # groupadd smtps
        # useradd -d /dev/null -g smtps -s /bin/false smtps

        Nastartujeme stunnel v client mode pre protokol smtp pocuvajuci na localhoste:465 a
        napajajuci sa na vzdialeny stroj mail.client23.example:465 pod uzivatelom a skupinou smtps.
        ------------------------------------------------------------------------------------
        # stunnel -c -d 127.0.0.1:465 -o /var/log/SMTPS_tunnel.log -n smtp -s smtps -g smtps -r mail.client23.example:465

        # touch /etc/postfix/sasl_passwd
        # nano /etc/postfix/sasl_passwd
        -------------------------------
        localhost       ucet@server:HESLO

        # postmap /etc/postfix/sasl_passwd
        # nano /etc/postfix/main.cf
        ---------------------------
        relayhost = localhost:465
        smtp_sasl_auth_enable=yes
        smtp_sasl_password_maps=hash:/etc/postfix/sasl_passwd
        smtp_sasl_security_options = noanonymous
        smtp_use_tls = no

        # /etc/init.d/postfix reload