邮件服务器的安全传输及账号验证

一.邮件的加密原理

使用ssl证书加密传输

二.账号验证原理

使用saslauthd验证服务器

案例一：加密的发送邮件

服务器的名为“mail.sisco.com” ip地址为 192.168.20.244的服务器上进行配置

第一步：搭建CA服务器

[root@mail mail]# cd  /etc/pki/CA/

编辑CA的配置文件

[root@mail CA]# vim  ../tls/openssl.cnf

45 dir             = /etc/pki/CA           # Where everything is kept

:88,90 s/match/optional/g   如下

88 countryName             = optional

89 stateOrProvinceName     = optional

90 organizationName        = optional

136 countryName_default             = CN

141 stateOrProvinceName_default     = zhengzhou

144 localityName_default            = zhengzhou

147 0.organizationName_default      = huawei

创建 newcerts  certs  crl  三个目录

mkdir  newcerts  certs  crl 

创建 index.txt serial  两个文件

touch index.txt  serial

echo “01” >>serial

[root@mail CA]# openssl genrsa 1024 > private/cakey.pem 

//生成 1024 位的私钥

[root@mail CA]# chmod 600 private/cakey.pem     //修改私钥权限

[root@mail CA]# openssl req -new -key private/cakey.pem -x509 -days 3650  -out  cacert.pem   //生成自签名证书

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [CN]:

State or Province Name (full name) [zhengzhou]:

Locality Name (eg, city) [zhengzhou]:

Organization Name (eg, company) [huawei]:

Organizational Unit Name (eg, section) []:etc

Common Name (eg, your name or your server's hostname) []:ca.huawei.com

Email Address []:

第二步：创建服务器本地的密钥，请求，证书

[root@mail CA]# mkdir -pv /etc/mail/certs

mkdir: created directory `/etc/mail/certs'

[root@mail CA]# cd  /etc/mail/certs

[root@mail certs]# openssl genrsa  1024 > sendmail.key //生成密钥

[root@mail certs]#chmod 600  sendmail.key

[root@mail certs]# openssl req -new -key sendmail.key -out sendmail.csr

//生成证书请求文件

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [CN]:

State or Province Name (full name) [zhengzhou]:

Locality Name (eg, city) [zhengzhou]:

Organization Name (eg, company) [huawei]:

Organizational Unit Name (eg, section) []:tec

Common Name (eg, your name or your server's hostname) []:smtp.huawei.com

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@mail certs]#

[root@mail certs]# openssl ca -in sendmail.csr -out sendmail.cert

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 1 (0x1)

        Validity

            Not Before: Aug  5 11:34:28 2012 GMT

            Not After : Aug  5 11:34:28 2013 GMT

        Subject:

            countryName               = CN

            stateOrProvinceName       = zhengzhou

            organizationName          = huawei

            organizationalUnitName    = tec

            commonName                = smtp.huawei.com //接收服务器的主机名

        X509v3 extensions:

            X509v3 Basic Constraints:

                CA:FALSE

            Netscape Comment:

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier:

                97:7E:88:21:A1:8B:92:66:C6:2B:69:E8:9D:5E:11:9F:4E:00:81:86

            X509v3 Authority Key Identifier:

                keyid:F3:A6:3B:B5:9C:7D:3E:61:A8:63:50:B2:8D:EA:3E:6D:38:AD:82:CD

Certificate is to be certified until Aug  5 11:34:28 2013 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

[root@mail certs]# chmod 600 *  //修改权限提高安全性

[root@mail certs]# ll

total 12

-rw------- 1 root root 3088 Aug  5 19:34 sendmail.cert

-rw------- 1 root root  655 Aug  5 19:32 sendmail.csr

-rw------- 1 root root  887 Aug  5 19:31 sendmail.key

第三步：将加密与sendmail结合

sendmail在默认情况下已经安装

Vim    /etc/mail/sendmail.mc

60 define(`confCACERT_PATH', `/etc/pki/CA')dnl

//指定CA服务器的证书路径

61 define(`confCACERT', `/etc/pki/CA/cacert.pem')dnl

//指定CA服务器的证书的位置

62 define(`confSERVER_CERT', `/etc/mail/certs/sendmail.cert')dnl

//指定sendmail服务器的证书的位置

63 define(`confSERVER_KEY', `/etc/mail/certs/sendmail.key')dnl

//指定sendmail服务器的私钥的位置

134 DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl

//强制使用安全的传输协议

在服务器上查看

[root@mail ~]# telnet 127.0.0.1 25

Trying 127.0.0.1...

Connected to localhost (127.0.0.1).

Escape character is '^]'.

220 mail.sisco.com ESMTP Sendmail 8.13.8/8.13.8; Sun, 5 Aug 2012 21:05:27 +0800

EHLO 127.0.0.1

250-mail.huawei.com Hello localhost [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES

250-PIPELINING

250-8BITMIME

250-SIZE

250-DSN

250-ETRN

250-STARTTLS   //启用了安全的传输

250-DELIVERBY

250 HELP

将客户端上的 user1 与 user2 调成 如下：

发送邮件

Aug  5 22:18:05 mail sendmail[4105]: STARTTLS=server, relay=[192.168.10.99], version=TLSv1/SSLv3, verify=NO, cipher=RC4-MD5, bits=128/128

Aug  5 22:18:05 mail sendmail[4105]: q75EI5AE004105: from=<[email protected]>, size=1173, class=0, nrcpts=1, msgid=<86026205572F4FF3BF64B42C4685F2A1@201208231440>, proto=SMTP, daemon=MTA, relay=[192.168.10.99]

Aug  5 22:18:05 mail sendmail[4106]: q75EI5AE004105: to=<[email protected]>, ctladdr=<[email protected]> (500/500), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31399, dsn=2.0.0, stat=Sent

案例二：加密的接收邮件

“mail.huawei.com” ip地址为 192.168.10.244的服务器上进行配置

第一步：创建服务器本地的密钥，请求，证书

[root@mail certs]# mkdir -pv  /etc/dovecot/certs

mkdir: created directory `/etc/dovecot'

mkdir: created directory `/etc/dovecot/certs'

[root@mail certs]# cd /etc/dovecot/certs

[root@mail certs]# openssl  genrsa  1024 &gt; dovecot.key

Generating RSA private key, 1024 bit long modulus

........................++++++

................++++++

e is 65537 (0x10001)

[root@mail certs]# openssl req  -new -key dovecot.key -out dovecot.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [CN]:

State or Province Name (full name) [zhengzhou]:

Locality Name (eg, city) [zhengzhou]:

Organization Name (eg, company) [huawei]:

Organizational Unit Name (eg, section) []:mkt

Common Name (eg, your name or your server's hostname) []:pop3.huawei.com

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@mail certs]# openssl  ca -in  dovecot.csr   -out dovecot.cert

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 2 (0x2)

        Validity

            Not Before: Aug  5 16:06:29 2012 GMT

            Not After : Aug  5 16:06:29 2013 GMT

        Subject:

            countryName               = CN

            stateOrProvinceName       = zhengzhou

            organizationName          = huawei

            organizationalUnitName    = mkt

            commonName                = pop3.huawei.com

        X509v3 extensions:

            X509v3 Basic Constraints:

                CA:FALSE

            Netscape Comment:

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier:

                3E:CD:B7:3E:97:97:53:6D:84:73:FB:22:69:F5:F0:86:B2:A2:53:EE

            X509v3 Authority Key Identifier:

keyid:83:95:06:E9:79:B9:02:8B:99:70:B3:8A:DF:7B:80:42:28:F3:FD:5C

Certificate is to be certified until Aug  5 16:06:29 2013 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

[root@mail certs]# chmod 600 *

[root@mail certs]# ll

total 12

-rw------- 1 root root 3096 Aug  6 00:06 dovecot.cert

-rw------- 1 root root  660 Aug  6 00:06 dovecot.csr

-rw------- 1 root root  891 Aug  6 00:05 dovecot.key

第二步：将加密与 dovecot 结合起来

[root@mail certs]# vim /etc/dovecot.conf

  91 ssl_cert_file = /etc/dovecot/certs/dovecot.cert

  92 ssl_key_file = /etc/dovecot/certs/dovecot.key

重新启动服务

[root@mail certs]# service sendmail restart

Shutting down sm-client:                                   [  OK  ]

Shutting down sendmail:                                    [  OK  ]

Starting sendmail:                                         [  OK  ]

Starting sm-client:                                        [  OK  ]

[root@mail certs]# service dovecot restart

Stopping Dovecot Imap:                                     [  OK  ]

Starting Dovecot Imap:                                     [  OK  ]

客户端的配置

测试服务器的发送邮件的安全性

案例三：使用认证的邮件发送及接收

linux中有一个用于账号认证的软件 cyrus-sasl （默认已经安装）

第一步：查看认证服务器配置并启用

[root@mail ~]# cat  /usr/lib/sasl2/sendmail.conf

pwcheck_method:saslauthd

[root@mail ~]# cd  /usr/lib/sasl2/

service saslauthd restart

第二步：编辑sendmail的配置文件 sendmail.mc

[root@mail ~]# vim /etc/mail/sendmail.mc

39 define(`confAUTH_OPTIONS', `A y')dnl

52 TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

53 define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

116 DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA ,M=Ea ')dnl    //开启强制身份验证

第三步：启动认证服务并登陆查看测试

[root@mail ~]# service  saslauthd  start

Starting saslauthd:                                        [  OK  ]

测试：

在linux中使用openssl 生成一个64位的完整账号及密码

echo –n  “[email protected]” |openssl base64

echo –n  “123456” |openssl base64

[root@mail ~]# telnet 127.0.0.1 25

Trying 127.0.0.1...

Connected to localhost (127.0.0.1).

Escape character is '^]'.

220 mail.huawei.com ESMTP Sendmail 8.13.8/8.13.8; Mon, 6 Aug 2012 14:01:26 +0800

EHLO 127.0.0.1

250-mail.huawei.com Hello localhost [127.0.0.1], pleased to meet you

250-ENHANCEDSTATUSCODES

250-PIPELINING

250-8BITMIME

250-SIZE

250-DSN

250-ETRN

250-AUTH LOGIN PLAIN

250-STARTTLS

250-DELIVERBY

250 HELP

AUTH LOGIN cm9vdEBodWF3ZWkuY29t

334 UGFzc3dvcmQ6

MTIzNDU2

235 2.0.0 OK Authenticated

mail from:[email protected]

250 2.1.0 [email protected]... Sender ok

rcpt to:[email protected]

250 2.1.5 [email protected]... Recipient ok

data

354 Enter mail, end with "." on a line by itself

subject:ok1111

ok111

.

250 2.0.0 q7661Q8B003877 Message accepted for delivery

500 5.5.1 Command unrecognized: ""

quit

221 2.0.0 mail.huawei.com closing connection

Connection closed by foreign host.

[root@mail ~]# su - user2

[user2@mail ~]$ mail

Mail version 8.1 6/6/93.  Type ? for help.

"/var/spool/mail/user2": 1 message 1 new

&gt;N  1 [email protected]      Mon Aug  6 14:03  13/414   "ok1111"

&

Message 1:

From [email protected]  Mon Aug  6 14:03:59 2012

Date: Mon, 6 Aug 2012 14:01:26 +0800

From: [email protected]

subject: ok1111

ok111

& q

使用outlook客户端测试

在客户端主机上新创建一个账号为 user5 的用户

验证出错

在服务器上创建 user5 账号

[root@mail ~]# useradd user5

[root@mail ~]# passwd user5

Changing password for user user5.

New UNIX password:

BAD PASSWORD: it is WAY too short

Retype new UNIX password:

passwd: all authentication tokens updated successfully.

此时就可以通过验证

        嗯，韩宇说的对！！！