Linux Sendmail邮件服务器认证、SSL配置示例
1. SMTP Authentication / Cyrus-SASL Configuration
1.1 Install CYLUS-SASL
1.2 Configure CYLUS-SASL to support SMTP Authentication
1.2.1 Configure /etc/mail/sendmail.mc to support SMTP authentication:
Uncomment this:
TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', ` GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
...
DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA,M=Ea')dnl
1.2.2 New /usr/lib/sasl2Sendmail.conf:
[root@host sasl2]# vi /usr/lib/sasl2/Sendmail.conf
pwcheck_method:saslauthd
1.3 Restart SASL and Check installation
Start SASL with pam:
[root@host sbin]# service saslauthd stop
Stopping saslauthd: [ OK ]
[root@host sbin]# saslauthd -a shadow pam
Test installation:
[root@host sasl2]# cat /usr/lib/sasl2/Sendmail.conf
pwcheck_method:saslauthd
[root@host sasl2]# service saslauthd restart
Stopping saslauthd: [ OK ]
Starting saslauthd: [ OK ]
[root@host sasl2]# telnet mail.host.com 25
Trying 10.56.233.59...
Connected to mail.host.com (192.168.1.5).
Escape character is '^]'.
220 host.com ESMTP Sendmail 8.13.8/8.13.8; Wed, 17 Mar 2010 23:12:20 +0800
ehlo localhost
250-host.com Hello host [192.168.1.5], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH LOGIN PLAIN
250-DELIVERBY
250 HELP
quit
221 2.0.0 host.com closing connection
Connection closed by foreign host.
[root@host sasl2]# sendmail -d0.1 -bv root | grep SASL
NETUNIX NEWDB NIS PIPELINING SASLv2 SCANF SOCKETMAP STARTTLS
2. Configuration for SSl
2.1 vi /etc/pki/dovecot/dovecot-openssl.cnf
[root@host mail]# vi /etc/pki/dovecot/dovecot-openssl.cnf
[ req ]
default_bits = 1024
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type
prompt = no
[ req_dn ]
# country (2 letter code)
#C=FI
# State or Province Name (full name)
#ST=
# Locality Name (eg. city)
#L= Helsinki
# Organization (eg. company)
#O=Dovecot
# Organizational Unit Name (eg. section)
OU=IMAP server
# Common Name (*.example.com is also possible)
CN=mail.host.com
# E-mail contact
[ cert_type ]
nsCertType = serve
r
2.2 Create new dovecot.pem
[root@host dovecot]# rm /etc/pki/dovecot/certs/dovecot.pem
[root@host dovecot]# rm /etc/pki/dovecot/private/dovecot.pem
[root@host dovecot]# cd /usr/share/doc/dovecot-1.0.7/examples
[root@host examples]# ./mkcert.sh
Generating a 1024 bit RSA private key
........................................++++++
.............++++++
writing new private key to '/etc/pki/dovecot/private/dovecot.pem'
-----
subject= /OU=IMAP server/CN=imap.example.com/[email protected]
SHA1 Fingerprint=5C:DB:2E:7B:A8:A0:4B:B9:43:88:C7:D9:26:AB:70:EF:FA:2C:2D:53
2.3 vi /etc/dovecot.conf
[root@host examples]# vi /etc/dovecot.conf
…
# Disable SSL/TLS support.
ssl_disable = no
…
ssl_cert_file = /etc/pki/dovecot/certs/dovecot.pem
ssl_key_file = /etc/pki/dovecot/private/dovecot.pem
…
2.4 Make sendmail.pem
[root@host mail]# cd /etc/pki/tls/certs
[root@host certs]# make sendmail.pem
umask 77 ; \
PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
/usr/bin/openssl req -utf8 -newkey rsa:1024 -keyout $PEM1 -nodes -x509 - days 365 -out $PEM2 -set_serial 0 ; \
cat $PEM1 > sendmail.pem ; \
echo "" >> sendmail.pem ; \
cat $PEM2 >> sendmail.pem ; \
rm -f $PEM1 $PEM2
Generating a 1024 bit RSA private key
.........++++++
..........++++++
writing new private key to '/tmp/openssl.xC2939'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]: sichuan
Locality Name (eg, city) [Newbury]: chengdu
Organization Name (eg, company) [My Company Ltd]:nokia
Organizational Unit Name (eg, section) []:nbg
Common Name (eg, your name or your server's hostname) []:mail.host.com
Email Address []:[email protected]
[root@host certs]# ls
ca-bundle.crt localhost.crt make-dummy-cert Makefile sendmail.pem
2.5 Configure /etc/mail/sendmail.mc
[root@host certs]# vi /etc/mail/sendmail.mc
...
define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl
define(`confSERVER_CERT', `/etc/pki/tls/certs/sendmail.pem')dnl
define(`confSERVER_KEY', `/etc/pki/tls/certs/sendmail.pem')dnl
...
DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl
...
[root@host certs]# m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
2.6 Restart dovecot and sendmail
[root@host mail]# service dovecot restart
Stopping Dovecot Imap: [ OK ]
Starting Dovecot Imap: [ OK ]
[root@host mail]# service sendmail restart
Shutting down sm-client: [ OK ]
Shutting down sendmail: [ OK ]
Starting sendmail: [ OK ]
Starting sm-client: [ OK ]
2.7 Check installation
Sendmail SSL on port 465; POP3 SSL on 995; IMAP SSL on 993.
[root@host mail]# netstat -an |grep 465
tcp 0 0 0.0.0.0:465 0.0.0.0:* LIST EN
[root@host mail]# netstat -an |grep 995
tcp 0 0 :::995 :::* LIST EN
[root@host mail]# netstat -an |grep 993
tcp 0 0 :::993 :::* LIST EN
unix 3 [ ] STREAM CONNECTED 55559934 /tmp/orbit-root/linc- 2466-0-5b1fb2745ff54
unix 3 [ ] STREAM CONNECTED 55559933
unix 3 [ ] STREAM CONNECTED 55559932 /tmp/orbit-root/linc- 1846-0-c008ce5556ba
unix 3 [ ] STREAM CONNECTED 55559931
unix 3 [ ] STREAM CONNECTED 55556993