Anti-Virus Anti-Spam system construction (IV.)

4. TLS support

By modifying the/USR/LIB/SSL/MISC/CA.PLL script implementation, the following changes are compared between ca1.pl and unmodified ca.pl:

ca.pl
---ca1.pl
***************
59,69 * * * *
} elsif (/^-newcert$/) {
# Create a Certificate
! System ("$REQ-new-x509-keyout newreq.pem-out newreq.pem $DAYS");
$RET =$?;
Print "certificate (and private key) is in newreq.pem\n"
} elsif (/^-newreq$/) {
# Create a certificate request
! System ("$REQ-new-keyout newreq.pem-out newreq.pem $DAYS");
$RET =$?;
Print "Request (and private key) is in newreq.pem\n";
} elsif (/^-newca$/) {
---59,69----
} elsif (/^-newcert$/) {
# Create a Certificate
! System ("$REQ-new-x509-nodes-keyout newreq.pem-out newreq.pem $DAYS");
$RET =$?;
Print "certificate (and private key) is in newreq.pem\n"
} elsif (/^-newreq$/) {
# Create a certificate request
! System ("$REQ-new-nodes-keyout newreq.pem-out newreq.pem $DAYS");
$RET =$?;
Print "Request (and private key) is in newreq.pem\n";
} elsif (/^-newca$/) {

You can now use the modified ca1.pl to issue the certificate:

# Cd/usr/local/ssl/misc
#./CA1.PL-NEWCA
#./ca1.pl-newreq
#./ca1.pl-sign
# CP Democa/cacert.pem/etc/postfix/cacert.pem
# CP Newcert.pem/etc/postfix/cert.pem
# CP Newreq.pem/etc/postfix/key.pem

Modify MAIN.CF, add:

Smtpd_tls_cert_file =/etc/postfix/cert.pem
Smtpd_tls_key_file =/etc/postfix/privkey.pem
Smtpd_use_tls = yes
Tls_random_source = Dev:/dev/urandom
Tls_daemon_random_source = Dev:/dev/urandom

You can see 250-starttls when you start Postfix.

Many mail clients support TLS is not very good, it is recommended to use Stunnel to implement the appropriate SMTP and POP3 encryption.

# Apt-get Install Stunnel

Certificate:

# OpenSSL req-new-x509-days 365-nodes-config/etc/ssl/openssl.cnf-out stunnel.pem-keyout Stunnel.pem
# OpenSSL Gendh >> Stunnel.pem

Service side:
# stunnel-d 60025-r 25-s nobody-g nogroup
# stunnel-d 60110-r 110-s nobody-g nogroup

If you use parameters such as-n POP3, you can only use the mail client to receive the letter.

Client:
Build a stunnel.conf file:

Client = yes

[POP3]
Accept = 127.0.0.1:110
Connect = 192.168.7.144:60110

[SMTP]
Accept = 127.0.0.1:25
Connect = 192.168.7.144:60025

Then start Stunnel.exe, in the mail client's SMTP and POP3 servers are filled 127.0.0.1, so from your mail server to the data transmission let Stunnel to you encrypted.

5, testing users

# mkdir-p/home/vmail/test.org/san/
# Chown-r Nobody.nogroup/home/vmail
# Chmod-r 700/home/vmail

Mysql> use Postfix
Mysql> INSERT INTO transport set domain= ' test.org ', destination= '
Virtual: ';
Mysql> INSERT into users set email= ' san@test.org ', clear= ' test ', name= ', uid= ' 65534 ', gid= ' 65534 ',
Homedir= ' Home/vmail ', maildir= ' test.org/san/';

Then you can use the client to send and receive mail, remember the user name is an email address.