Ubuntu（10.04）の postfix（2.7.0）に STLS／STARTTLSを導入する手順。
※ Ubuntuのバージョンは「cat /etc/lsb-release」で取得できる。
postfixのバージョンは「/usr/sbin/postconf | grep mail_version」で取得。
- postfixのSASLは設定済み（とする）
$ sudo nano /etc/postfix/main.cf
# SMTP-Auth setting
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth-dovecot
smtpd_sasl_authenticated_header = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
broken_sasl_auth_clients = yes
- dovecot側のSASLも同様（設定済みとする）
$ sudo nano /etc/dovecot/dovecot.conf
socket listen {
client {
path = /var/spool/postfix/private/auth-dovecot
mode = 0660
user = postfix
group = postfix
}
}
- TLS の設定。認証局を作成してくれるスクリプトの保存先を demoCAから postfixCAへ変更。
$ cd /usr/lib/ssl/misc
$ sudo nano CA.pl
#$CATOP="./demoCA";
$CATOP="./postfixCA";
$ sudo nano /usr/lib/ssl/openssl.cnf
#dir = ./demoCA # Where everything is kept
dir = ./postfixCA # Where everything is kept
- private keyを作る。（一部伏字）
$ sudo ./CA.pl -newca
CA certificate filename (or enter to create) # 空Enterキー
Making CA certificate ...
Generating a 1024 bit RSA private key
............................++++++
.........................++++++
writing new private key to './postfixCA/private/cakey.pem'
Enter PEM pass phrase: # パスワードを入れる
Verifying - Enter PEM pass phrase: # もう1回パスワード
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa-ken
Locality Name (eg, city) []:Yokosuka-shi
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Satake Studio,LPC.
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:Mamoru Satake
Email Address []:mam@x-xx.jp
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: # 入れなくてよい
An optional company name []:
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./postfixCA/private/cakey.pem: # パスワードを入れる
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
xx:ee:33:xx:6b:xx:59:xx
Validity
Not Before: Jul 11 21:43:17 2011 GMT
Not After : Jul 10 21:43:17 2014 GMT
Subject:
countryName = JP
stateOrProvinceName = Kanagawa-ken
organizationName = Satake Studio,LPC.
commonName = Mamoru Satake
emailAddress = mam@x-xx.jp
X509v3 extensions:
X509v3 Subject Key Identifier:
xx:20:xx:93:xx:86:xx:55:xx:9C:xx:6F:xx:2C:xx:C7:xx:E3:xx:15
X509v3 Authority Key Identifier:
keyid:xx:20:xx:93:xx:86:xx:55:xx:9C:xx:6F:xx:2C:xx:C7:xx:E3:xx:15
DirName:/C=JP/ST=Kanagawa-ken/O=Satake Studio,LPC./CN=Mamoru Satake/emailAddress=mam@x-xx.jp
serial:xx:EE:xx:AE:xx:F8:xx:F1
X509v3 Basic Constraints:
CA:TRUE
Certificate is to be certified until Jul 10 21:43:17 2014 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
- もう1回 private keyを作る。（なんでだ？）
$ cd postfixCA/
$ sudo openssl req -new -nodes -keyout postfix-key.pem -out postfix-req.pem -days 365
Generating a 1024 bit RSA private key
..........++++++
..............++++++
writing new private key to 'postfix-key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa-ken
Locality Name (eg, city) []:Yokosuka-shi
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Satake Studio,LPC.
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:Mamoru Satake
Email Address []:mam@x-xx.jp
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
- CSR に認証局の証明書で署名。
$ sudo sh -c "echo '00' > serial"
$ cd /usr/lib/ssl/misc
$ sudo rm postfixCA/index.txt* # 「TXT_DB error number 2」エラー対策
$ sudo touch postfixCA/index.txt
$ sudo openssl ca -out postfix-cert.pem -infiles postfixCA/postfix-req.pem
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./postfixCA/private/cakey.pem: # パスワードを入れる
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Jul 12 00:02:50 2011 GMT
Not After : Jul 11 00:02:50 2012 GMT
Subject:
countryName = JP
stateOrProvinceName = Kanagawa-ken
organizationName = Satake Studio,LPC.
commonName = Mamoru Satake
emailAddress = mam@x-xx.jp
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
xx:E3:xx:32:xx:D4:xx:EF:xx:2A:xx:35:xx:4C:xx:DC:xx:AD:xx:D5
X509v3 Authority Key Identifier:
keyid:xx:B2:xx:88:xx:4E:xx:B4:xx:73:xx:DF:xx:5A:xx:72:xx:55:xx:33
Certificate is to be certified until Jul 11 00:02:50 2012 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
- ファイルの配置＆postfixリスタート
$ sudo cp postfix-cert.pem /etc/ssl/certs/
$ sudo cp postfixCA/postfix-key.pem /etc/ssl/private/
$ sudo chmod 644 /etc/ssl/certs/postfix-cert.pem
$ sudo chmod 400 /etc/ssl/private/postfix-key.pem
$ sudo service postfix restart
* Stopping Postfix Mail Transport Agent postfix
...done.
* Starting Postfix Mail Transport Agent postfix
...done.
- これでOK（のはず）
