sendmail的数据加密：smtps ：提供ssl
                       tls的服务：starttls通过25端口实现ssl加密
              做smtps加密只是实现一段数据的加密，中继时候不支持 点到点的(主机到主机)
       基于ip的
       端口：465
查看sendmail是否支持starttls
              1、telnet mail.a.com 25
                 ehlo mail.a.com 在开启的情况下会显示starttls表示已经启用
              2、sendmail -d0.1 -bv 查看是否出现STARTTLS ，有表示在sendmail二进制编译过程
                                                 中支持tls功能，并不表示已经启用
配置：
              1、证书 ，做CA认证/etc/pki/CA/cacert.pem
              2、mkdir /etc/mail/certs
              cd /etc/mail/certs
              openssl genrsa 1024 >sendmail_key.pem
              openssl req -new -key sendmail_key.pem -out sendmail_cert.csr
              openssl ca -in sendmail_cert.csr -out sendmail_cert.pem -days 3650
              rm -rf sendmail_cert.csr
              cp /etc/pki/CA/cacert.pem
              chmod 600 ./*
              3、sendmail启用认证
              vim /etc/mail/sendmail.mc
              启用    define(`confCACERT_PATH', `/etc/mail/certs')dnl
                     define(`confCACERT', `/etc/mail/certs/cacert.pem')dnl
                     define(`confSERVER_CERT', `/etc/mail/certs/sendmail_cert.pem')dnl
                     define(`confSERVER_KEY', `/etc/mail/certs/sendmail_key.pem')dnl
              启用      define(`confLOG_LEVEL', `14')dnl启用日志功能
              启用     DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl开启会监听465端口
              vim /etc/mail/access 添加为192.168.0网段做转发
              service sendmail restart
       测试：telnet mail.a.com 25
              ehlo mail.a.com 会有starttls
              可以用outlook测试--创建用户-->属性勾选服务器需要安全的连接ssl--fa邮件
      
 
 
smtps本身并没有认证的功能，需要借助sasl进行认证：
              组件：cyrus-sasl
              进程为saslauthd
              sendmail -d0.1 -bv 会显示SASLv2 表示支持
              sasl配置：
                     service saslauthd restart
                     chkconfig saslauthd on
                     vim /etc/mail/sendmail.mc
                     添加    define(`confAUTH_OPTIONS', `A y')dnl
                            TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
                            define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
                            DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA', M=Ea')dnl
                     vim /usr/lib/sasl2/Sendmail.conf 添加
                       mech_list: login plain 支持的认证机制
              测试：telent mail.a.com 25 会显示login 、plain
                     ehlo mail.a.com
                     auhtlogin 账号要编码base64--->  echo -n '[email protected]' | openssl base64
                     密码----->      echo -n 'redhat' | openssl base64
                     mail from:[email protected]
                     rcpt to:[email protected]
                     hello
                     .
                     quit
              一般发邮件不要为root用户
              使用outlook测试：工具--账户--属性--服务器勾选我的服务器需要身份认证
                     发邮件 ，可以不用/etc/mail/access里的配置 这时的过程是基于sasl的
 
接受邮件加密：
       dovecot配置---ssl
       pop3---pop3s 端口995<---- grep pop /etc/services
       imap---imaps 端口993<----grep imap /etc/services
              配置：192.168.0.85
                     1、给dovecot发证书
                            mkdir -pv /etc/dovecot/ssl
                            cd /etc/dovecot/ssl
                            openssl genrsa 1024 >dovecot.key
                            openssl req -new -key dovecot.key -out dovecot.csr
                            openssl ca -in dovecot.csr -out dovecot.crt -days 3650
                     2、配置dovecot.conf
                            vim /etc/dovecot.conf
                                 ssl_cert_file = /etc/dovecot/ssl/dovecot.crt
                                 ssl_key_file = /etc/dovecot/ssl/dovecot.key
                                 protocols = imaps
                            service dovevot restart
                            netstat -ntlp | grep 993
                     2、测试：
                            outlook发邮件--账户--
                            收邮件 mutt -f imap://[email protected] 或imap://[email protected]
                            验证加密过程是加密的：抓包wireshark
                            yum install wireshark -y
                            打开110端口 vim /etc/dovecot.conf 在protocol添加pop3协议
                            service dovecot restart
                            netstat -ntlp | grep 110
                            抓包 tshark -ni eth0 "tcp.srcport eq 110 or tcp.dsport eq 110"
                            1、发邮件测试 telnet 192.168.0.85 110 (windows下命令模式)
                                          USER sara
                                          PASS redhat
                                          LIST
                                          RETR 1
                                   可以看到邮件的详细信息 110为明文，加密后就为更为的安全
                            tshark -ni eth0 "tcp.srcport eq 993 or tcp.dsport eq 993"
                             使用加密的账户发邮件 过程是加密的
                            2、模拟加密连接：192.168.0.121
                            openssl s_client -connect 192.168.0.85:993
                            USER sara
                            在192.168.0.85 上查看是加密的看不到信息