构建反病毒反垃圾邮件系统(四)

80酷酷网    80kuku.com

  4、TLS支持

  通过修改/usr/lib/ssl/misc/CA.pll脚本实现,以下修改后CA1.pl和未修改CA.pl之间的对比:

  *** CA.pl
  --- CA1.pl
  ***************
  *** 59,69 ****
  } elsif (/^-newcert$/) {
  # create a certificate
  ! system ("$REQ -new -x509 -keyout newreq.pem -out newreq.pem $DAYS");
  $RET=$?;
  print "Certificate (and private key) is in newreq.pem\n"
  } elsif (/^-newreq$/) {
  # create a certificate request
  ! system ("$REQ -new -keyout newreq.pem -out newreq.pem $DAYS");
  $RET=$?;
  print "Request (and private key) is in newreq.pem\n";
  } elsif (/^-newca$/) {
  --- 59,69 ----
  } elsif (/^-newcert$/) {
  # create a certificate
  ! system ("$REQ -new -x509 -nodes -keyout newreq.pem -out newreq.pem $DAYS");
  $RET=$?;
  print "Certificate (and private key) is in newreq.pem\n"
  } elsif (/^-newreq$/) {
  # create a certificate request
  ! system ("$REQ -new -nodes -keyout newreq.pem -out newreq.pem $DAYS");
  $RET=$?;
  print "Request (and private key) is in newreq.pem\n";
  } elsif (/^-newca$/) {

  现在就可以使用修改的CA1.pl来签发证书:

  # cd /usr/local/ssl/misc
  # ./CA1.pl -newca
  # ./CA1.pl -newreq
  # ./CA1.pl -sign
  # cp demoCA/cacert.pem /etc/postfix/CAcert.pem
  # cp newcert.pem /etc/postfix/cert.pem
  # cp newreq.pem /etc/postfix/key.pem

  修改main.cf,添加:

  smtpd_tls_cert_file = /etc/postfix/cert.pem
  smtpd_tls_key_file = /etc/postfix/privkey.pem
  smtpd_use_tls = yes
  tls_random_source = dev:/dev/urandom
  tls_daemon_random_source = dev:/dev/urandom

  重起postfix后就可以看到250-STARTTLS

  很多邮件客户端对TLS的支持并不是非常好,建议使用stunnel来实现相应的smtp和pop3加密。

  # apt-get install stunnel

  证书:

  # openssl req -new -x509 -days 365 -nodes -config /etc/ssl/openssl.cnf -out stunnel.pem -keyout stunnel.pem
  # openssl gendh 512 >> stunnel.pem

  服务端:
  # stunnel -d 60025 -r 25 -s nobody -g nogroup
  # stunnel -d 60110 -r 110 -s nobody -g nogroup

  如果使用-n pop3等参数就只能用邮件客户端收信。

  客户端:
  建一个stunnel.conf文件:

  client = yes

  [pop3]
  accept = 127.0.0.1:110
  connect = 192.168.7.144:60110

  [smtp]
  accept = 127.0.0.1:25
  connect = 192.168.7.144:60025

  然后启动stunnel.exe,在邮件客户端的smtp和pop3的服务器都填127.0.0.1就可以了,这样从你到邮件服务器端的数据传输就让stunnel给你加密了。

  5、测试用户

  # mkdir -p /home/vmail/test.org/san/
  # chown -R nobody.nogroup /home/vmail
  # chmod -R 700 /home/vmail

  mysql> use postfix
  mysql> insert into transport set domain='test.org', destination='
virtual:';
  mysql> insert into users set email='santest.org',clear='test',name='',uid='65534',gid='65534',
homedir='home/vmail',maildir='test.org/san/';

  然后就可以使用客户端收发邮件,记得用户名是email地址。



分享到
  • 微信分享
  • 新浪微博
  • QQ好友
  • QQ空间
点击: