[memo] postfix + dovecotでSMTP AUTH & IMAPなメールサーバを立ち上げるがあまり正しくないので修正版。
emerge -C ssmtp
emerge -pv postfix dovecot
echo "mmail-mta/postfix -mysql sasl" >> /etc/portage/package.use
echo "dev-libs/cyrus-sasl -mysql -java -gdbm -crypt" >> /etc/portage/package.use
emerge postfix dovecot
mkdir /etc/certs
chmod 700 /etc/certs
cd /etc/certs
cp /etc/ssl/misc/CA.pl .
perl ./CA.pl -newca
CA certificate filename (or enter to create)
(ENTER)
Making CA certificate ...
Generating a 1024 bit RSA private key
..................................++++++
.......................++++++
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase:(パスフレーズを入力)
Verifying - Enter PEM pass phrase:(同じパスフレーズをもう一度入力)
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Yokohama
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Private
Organizational Unit Name (eg, section) []:Private
Common Name (eg, YOUR name) []:nobu666.fam.cx
Email Address []:root@nobu666.fam.cx
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:(ENTER)
An optional company name []:(ENTER)
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
(略)
Certificate is to be certified until Oct 28 06:15:58 2009 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
Please enter the following ‘extra’ attributes to be sent with your certificate request A challenge password []:(ENTER) An optional company name []:(ENTER) Request is in newreq.pem, private key is in newkey.pem
<h4>リクエストファイルからX.509サーバ証明書の作成と署名</h4>
```bash
perl ./CA.pl -sign
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
ce:db:05:2a:6a:dc:75:17
Validity
Not Before: Oct 29 06:51:11 2006 GMT
Not After : Oct 29 06:51:11 2007 GMT
Subject:
countryName = JP
stateOrProvinceName = Kanagawa
localityName = Yokohama
organizationName = nobu666.fam.cx
organizationalUnitName = Admin
commonName = nobu666.fam.cx
emailAddress = root@nobu666.fam.cx
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
7B:0E:46:62:02:FB:B6:A6:05:DC:DE:75:2E:2D:5A:29:5D:31:79:F8
X509v3 Authority Key Identifier:
keyid:A7:51:EC:0A:BD:B6:70:68:A5:01:ED:8E:76:1F:FE:0C:4D:B2:A0:19
Certificate is to be certified until Oct 29 06:51:11 2007 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem
openssl x509 -in newcert.pem -out server.crt
queue_directory = /var/spool/postfix command_directory = /usr/sbin daemon_directory = /usr/lib/postfix mail_owner = postfix myhostname = nobu666.fam.cx mydomain = nobu666.fam.cx myorigin = $mydomain inet_interfaces = all mydestination = $myhostname, localhost.$mydomain, $mydomain, mail.$mydomain, localhost unknown_local_recipient_reject_code = 550 mynetworks_style = subnet mynetworks = 192.168.0.0/24, 127.0.0.0/8 relay_domains = $mydestination alias_maps = hash:/etc/mail/aliases alias_database = hash:/etc/mail/aliases home_mailbox = .Maildir/
header_checks = regexp:/etc/postfix/header_checks smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) mydestination = $myhostname, localhost.$mydomain, $myhostname.$mydomain, mail.$mydomain, localhost debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin xxgdb $daemon_directory/$process_name $process_id & sleep 5 sendmail_path = /usr/sbin/sendmail mailq_path = /usr/bin/mailq setgid_group = postdrop html_directory = /usr/share/doc/postfix-2.2.10/html manpage_directory = /usr/share/man sample_directory = /etc/postfix readme_directory = /usr/share/doc/postfix-2.2.10/readme smtpd_use_tls = yes smtpd_tls_loglevel = 1 smtpd_tls_cert_file = /etc/ssl/postfix/server.crt smtpd_tls_key_file = /etc/ssl/postfix/server.key smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_scache smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtp_sasl_security_options = noanonymous allow_mail_to_commands = alias,forward,include message_size_limit = 1024000 smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, permit_auth_destination, reject
vi /etc/postfix/master.cf
submission inet n - n - - smtpd -o smtpd_etrn_restrictions=reject -o smtpd_client_restrictions=permit_sasl_authenticated,reject
<h4>saslの設定</h4>
```bash
vi /etc/sasl2/smtpd.conf
pwcheck_method: saslauthd
mkdir /var/state/saslauthd
chmod 700 /var/state/saslauthd
chown postfix /var/state/saslauthd
protocols = pop3 imap ssl_disable = no ssl_cert_file = /etc/ssl/postfix/server.crt ssl_key_file = /etc/ssl/postfix/server.key default_mail_env = maildir:%h/.Maildir
chmod 755 /var/run/dovecot chmod 750 /var/run/dovecot/login
あとはデフォルトのまま。
<h4>クライアントの設定</h4>
まずはオレオレ認証局の証明書をクライアントに入れる必要がある（やらなくてもいいが警告が出るので…）。別にどうやってクライアントに渡してもOK。FTPとかSCPとかで適当に。メーラによって操作が違うがThunderbirdの場合は、ツール→オプション→プライバシー→セキュリティ→証明書を表示→認証局証明書→インポートと進んで、cacert.derを選択すればOK。あとはIMAPでアカウントを作って、受信は143番ポートでTLSを使うようにし、送信は587番ポートで同じくTLSを使うように設定する。送信テストするとユーザ名とパスワードが聞かれるので「パスワード無しで送信できないこと」「間違ったパスワードを入れて送信できないこと」「正しいパスワードを入れて送信できること」の3つを確認して終了。