アーカイブ カテゴリー: サーバ管理

Ubuntu（10.04）の postfix（2.7.0）に STLS／STARTTLSを導入する手順。
※ Ubuntuのバージョンは「cat /etc/lsb-release」で取得できる。
　 postfixのバージョンは「/usr/sbin/postconf | grep mail_version」で取得。

1. postfixのSASLは設定済み（とする）

   $ sudo nano /etc/postfix/main.cf

   # SMTP-Auth setting
   smtpd_sasl_auth_enable = yes
   smtpd_sasl_type = dovecot
   smtpd_sasl_path = private/auth-dovecot
   smtpd_sasl_authenticated_header = yes
   smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
   broken_sasl_auth_clients = yes
   

2. dovecot側のSASLも同様（設定済みとする）

   $ sudo nano /etc/dovecot/dovecot.conf

     socket listen {
       client {
         path = /var/spool/postfix/private/auth-dovecot
         mode = 0660
         user = postfix
         group = postfix
       }
     }
   

3. TLS の設定。認証局を作成してくれるスクリプトの保存先を demoCAから postfixCAへ変更。

   $ cd /usr/lib/ssl/misc
   $ sudo nano CA.pl
   

   #$CATOP="./demoCA";
   $CATOP="./postfixCA";
   

   $ sudo nano /usr/lib/ssl/openssl.cnf
   

   #dir            = ./demoCA              # Where everything is kept
   dir             = ./postfixCA           # Where everything is kept
   

4. private keyを作る。（一部伏字）

   $ sudo ./CA.pl -newca

   CA certificate filename (or enter to create)    # 空Enterキー
   
   Making CA certificate ...
   Generating a 1024 bit RSA private key
   ............................++++++
   .........................++++++
   writing new private key to './postfixCA/private/cakey.pem'
   Enter PEM pass phrase:                    # パスワードを入れる
   Verifying - Enter PEM pass phrase:    # もう1回パスワード
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [AU]:JP
   State or Province Name (full name) [Some-State]:Kanagawa-ken
   Locality Name (eg, city) []:Yokosuka-shi
   Organization Name (eg, company) [Internet Widgits Pty Ltd]:Satake Studio,LPC.
   Organizational Unit Name (eg, section) []:
   Common Name (eg, YOUR name) []:Mamoru Satake
   Email Address []:mam@x-xx.jp
   
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []:                   # 入れなくてよい
   An optional company name []:
   Using configuration from /usr/lib/ssl/openssl.cnf
   Enter pass phrase for ./postfixCA/private/cakey.pem:   # パスワードを入れる
   Check that the request matches the signature
   Signature ok
   Certificate Details:
           Serial Number:
               xx:ee:33:xx:6b:xx:59:xx
           Validity
               Not Before: Jul 11 21:43:17 2011 GMT
               Not After : Jul 10 21:43:17 2014 GMT
           Subject:
               countryName               = JP
               stateOrProvinceName       = Kanagawa-ken
               organizationName          = Satake Studio,LPC.
               commonName                = Mamoru Satake
               emailAddress              = mam@x-xx.jp
           X509v3 extensions:
               X509v3 Subject Key Identifier:
                   xx:20:xx:93:xx:86:xx:55:xx:9C:xx:6F:xx:2C:xx:C7:xx:E3:xx:15
               X509v3 Authority Key Identifier:
                   keyid:xx:20:xx:93:xx:86:xx:55:xx:9C:xx:6F:xx:2C:xx:C7:xx:E3:xx:15
                   DirName:/C=JP/ST=Kanagawa-ken/O=Satake Studio,LPC./CN=Mamoru Satake/emailAddress=mam@x-xx.jp
                   serial:xx:EE:xx:AE:xx:F8:xx:F1
   
               X509v3 Basic Constraints:
                   CA:TRUE
   Certificate is to be certified until Jul 10 21:43:17 2014 GMT (1095 days)
   
   Write out database with 1 new entries
   Data Base Updated
   

5. もう1回 private keyを作る。（なんでだ？）

   $ cd postfixCA/
   $ sudo openssl req -new -nodes -keyout postfix-key.pem -out postfix-req.pem -days 365
   

   Generating a 1024 bit RSA private key
   ..........++++++
   ..............++++++
   writing new private key to 'postfix-key.pem'
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [AU]:JP
   State or Province Name (full name) [Some-State]:Kanagawa-ken
   Locality Name (eg, city) []:Yokosuka-shi
   Organization Name (eg, company) [Internet Widgits Pty Ltd]:Satake Studio,LPC.
   Organizational Unit Name (eg, section) []:
   Common Name (eg, YOUR name) []:Mamoru Satake
   Email Address []:mam@x-xx.jp
   
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []:
   An optional company name []:
   

6. CSR に認証局の証明書で署名。

   $ sudo sh -c "echo '00' > serial"
   $ cd /usr/lib/ssl/misc
   $ sudo rm postfixCA/index.txt*   # 「TXT_DB error number 2」エラー対策
   $ sudo touch postfixCA/index.txt
   $ sudo openssl ca -out postfix-cert.pem -infiles postfixCA/postfix-req.pem
   

   Using configuration from /usr/lib/ssl/openssl.cnf
   Enter pass phrase for ./postfixCA/private/cakey.pem:          # パスワードを入れる
   Check that the request matches the signature
   Signature ok
   Certificate Details:
           Serial Number: 0 (0x0)
           Validity
               Not Before: Jul 12 00:02:50 2011 GMT
               Not After : Jul 11 00:02:50 2012 GMT
           Subject:
               countryName               = JP
               stateOrProvinceName       = Kanagawa-ken
               organizationName          = Satake Studio,LPC.
               commonName                = Mamoru Satake
               emailAddress              = mam@x-xx.jp
           X509v3 extensions:
               X509v3 Basic Constraints:
                   CA:FALSE
               Netscape Comment:
                   OpenSSL Generated Certificate
               X509v3 Subject Key Identifier:
                   xx:E3:xx:32:xx:D4:xx:EF:xx:2A:xx:35:xx:4C:xx:DC:xx:AD:xx:D5
               X509v3 Authority Key Identifier:
                   keyid:xx:B2:xx:88:xx:4E:xx:B4:xx:73:xx:DF:xx:5A:xx:72:xx:55:xx:33
   
   Certificate is to be certified until Jul 11 00:02:50 2012 GMT (365 days)
   Sign the certificate? [y/n]:y
   
   
   1 out of 1 certificate requests certified, commit? [y/n]y
   Write out database with 1 new entries
   Data Base Updated
   

7. ファイルの配置＆postfixリスタート

   $ sudo cp postfix-cert.pem /etc/ssl/certs/
   $ sudo cp postfixCA/postfix-key.pem /etc/ssl/private/
   $ sudo  chmod 644 /etc/ssl/certs/postfix-cert.pem
   $ sudo  chmod 400 /etc/ssl/private/postfix-key.pem
   $ sudo service postfix restart
   

    * Stopping Postfix Mail Transport Agent postfix
      ...done.
    * Starting Postfix Mail Transport Agent postfix
      ...done.
   

8. これでOK（のはず）