Liunx部署邮件TLS/SSL加密通信服务-创新互联

部署邮件TLS/SSL加密通信服务

一.部署普通邮件服务器

1) 搭建并检测邮件服务的发送服务

        [root@mail ~]# rpm -q postfix

        postfix-2.10.1-6.el7.x86_64

        [root@mail ~]# netstat -pantu | grep :25

        tcp     0    0 127.0.0.1:25       0.0.0.0:*        LISTEN    1822/master

        tcp6    0    0 ::1:25          :::*           LISTEN    1822/master

        [root@mail ~]# ps -C master

         PID TTY      TIME CMD

         1822 ?     00:00:00 master

        [root@mail ~]# vim /etc/postfix/main.cf

        [root@mail ~]# sed -n "113p;116p;419p" /etc/postfix/main.cf

        inet_interfaces = all

        #inet_interfaces = localhost

        home_mailbox = Maildir/

        [root@mail ~]# systemctl restart postfix.service

        [root@mail ~]# useradd jim

        [root@mail ~]# echo 654321 | passwd --stdin jim

        [root@mail ~]# yum -y install telnet

        [root@mail ~]# telnet localhost 25

        Trying ::1...

        Connected to localhost.

        Escape character is '^]'.

        220 mail.com.cn ESMTP Postfix

        helo localhost

        250 mail.com.cn

        mail from:root@localhost

        250 2.1.0 Ok

        rcpt to:jim@localhost

        250 2.1.5 Ok

        data

        354 End data with .

        XXXXX

        XXXX

        XXX

        XX

        X

        .

        250 2.0.0 Ok: queued as BEDA283BDA92

        quit

        221 2.0.0 Bye

        Connection closed by foreign host.

        [root@mail ~]# cat /home/jim/Maildir/new/1515047330.Vfd02I4000083M847601.mail.com.cn

        Return-Path:

        X-Original-To: jim@localhost

        Delivered-To: jim@localhost.com.cn

        Received: from localhost (localhost [IPv6:::1])

        by mail.com.cn (Postfix) with SMTP id BEDA283BDA92

        for ; Thu,  4 Jan 2018 01:28:07 -0500 (EST)

        Message-Id: <20180104062818.BEDA283BDA92@mail.com.cn>

        Date: Thu,  4 Jan 2018 01:28:07 -0500 (EST)

        From: root@localhost.com.cn

        XXXXX

        XXXX

        XXX

        XX

        X

        #可以在发送邮件的时候  抓取发邮件的数据包

        [root@mail ~]# tcpdump -i eth0 -A tcp port 25

2)搭建并检测 邮件服务的收取

        [root@mail ~]# yum -y install dovecot

        [root@mail ~]# rpm -q dovecot

        dovecot-2.2.10-5.el7.x86_64

        [root@mail ~]# vim /etc/dovecot/conf.d/10-mail.conf

        [root@mail ~]# sed -n '24p' /etc/dovecot/conf.d/10-mail.conf

        mail_location = maildir:~/Maildir

        [root@mail ~]# vim /etc/dovecot/conf.d/10-auth.conf

        [root@mail ~]# sed -n '10p' /etc/dovecot/conf.d/10-auth.conf

        disable_plaintext_auth = yes#不禁用明文认证

        [root@mail ~]# systemctl start dovecot

        [root@mail ~]# netstat -pantu | grep :110

        tcp     0    0 0.0.0.0:110       0.0.0.0:*        LISTEN    4924/dovecot

        tcp6    0    0 :::110          :::*           LISTEN    4924/dovecot

        [root@mail ~]# netstat -pantu | grep :143

        tcp     0    0 0.0.0.0:143       0.0.0.0:*        LISTEN    4924/dovecot

        tcp6    0    0 :::143          :::*           LISTEN    4924/dovecot

        [root@mail ~]# telnet localhost 110

        Trying ::1...

        Connected to localhost.

        Escape character is '^]'.

        +OK Dovecot ready.

        USER jim

        +OK

        PASS 654321

        +OK Logged in.

        list

        +OK 1 messages:

        1 423

        .

        retr 1

        +OK 423 octets

        Return-Path:

        X-Original-To: jim@localhost

        Delivered-To: jim@localhost.com.cn

        Received: from localhost (localhost [IPv6:::1])

        by mail.com.cn (Postfix) with SMTP id BEDA283BDA92

        for ; Thu,  4 Jan 2018 01:28:07 -0500 (EST)

        Message-Id: <20180104062818.BEDA283BDA92@mail.com.cn>

        Date: Thu,  4 Jan 2018 01:28:07 -0500 (EST)

        From: root@localhost.com.cn

        XXXXX

        XXXX

        XXX

        XX

        X

        .

        quit

        +OK Logging out.

        Connection closed by foreign host.

        #可以在收取邮件的时候  抓取收邮件的数据包

        [root@mail ~]# tcpdump -A -i lo  tcp port 110

        [root@mail ~]# tcpdump -A -i lo -w /tmp/mail.cap  tcp port 110

        [root@mail ~]# tcpdump -A -r /tmp/mail.cap | grep user

        reading from file /tmp/mail.cap, link-type EN10MB (Ethernet)

        .S...R..user jim                                                                        #这里可以通过抓包 抓取到邮件的用户名和密码  因为当前属于明文传输

        [root@mail ~]# tcpdump -A -r /tmp/mail.cap | grep pass

        reading from file /tmp/mail.cap, link-type EN10MB (Ethernet)

        .S6[.S..pass 654321

二，部署邮件TLS/SSL加密通信服务

1 邮件服务器的配置(192.168.4.2)：

        [root@mail ~]# systemctl restart postfix

        [root@mail ~]# netstat -pantu | grep master

        tcp     0    0 0.0.0.0:25        0.0.0.0:*        LISTEN    5415/master

        tcp6    0    0 :::25          :::*           LISTEN    5415/master

        [root@mail ~]# systemctl restart dovecot

        [root@mail ~]# netstat -pantu | grep dovecot

        tcp     0    0 0.0.0.0:110       0.0.0.0:*        LISTEN    5446/dovecot

        tcp     0    0 0.0.0.0:143       0.0.0.0:*        LISTEN    5446/dovecot

        tcp     0    0 0.0.0.0:993       0.0.0.0:*        LISTEN    5446/dovecot

        tcp     0    0 0.0.0.0:995       0.0.0.0:*        LISTEN    5446/dovecot

        tcp6    0    0 :::110          :::*           LISTEN    5446/dovecot

        tcp6    0    0 :::143          :::*           LISTEN    5446/dovecot

        tcp6    0    0 :::993          :::*           LISTEN    5446/dovecot

        tcp6    0    0 :::995          :::*           LISTEN    5446/dovecot

2 创建私钥文件：生成证书请求文件  mail.key

        [root@mail ~]# cd /etc/pki/tls/private/#默认搜索私钥目录

        [root@mail private]# openssl genrsa 2048 > mail.key#执行生成私钥命令

3 创建证书请求文件mail.csr

        -req 请求

        -new 新文件

        -key 私钥

        [root@mail private]# openssl req -new -key mail.key > ~/mail.csr

        You are about to be asked to enter information that will be incorporated

        into your certificate request.

        What you are about to enter is what is called a Distinguished Name or a DN.

        There are quite a few fields but you can leave some blank

        For some fields there will be a default value,

        If you enter '.', the field will be left blank.

        -----

        Country Name (2 letter code) [XX]:CN#与CA服务器 match 匹配策略 必须一样

        State or Province Name (full name) []:beijing

        Locality Name (eg, city) [Default City]:beijing

        Organization Name (eg, company) [Default Company Ltd]:Xuenqlve

        Organizational Unit Name (eg, section) []:ope

        Common Name (eg, your name or your server's hostname) []:mail#设置为服务域名或者主机名

        Email Address []:Xuenqlve@163.com

        Please enter the following 'extra' attributes

        to be sent with your certificate request

        A challenge password []:

        An optional company name []:

5 上传证书请求文件给CA服务器(192.168.4.1)

        [root@mail ~]# scp ~/mail.csr 192.168.4.1:/tmp

CA服务器的配置(192.168.4.1):

        CA服务器具体配置 https://blog.51cto.com/13558754/2057718

6 审核证书请求文件，并签发数字证书

        [root@CA certs]# openssl ca -in /tmp/mail.csr > mail.crt

        Using configuration from /etc/pki/tls/openssl.cnf

        Enter pass phrase for /etc/pki/CA/private/my-ca.key:

        Check that the request matches the signature

        Signature ok

        Certificate Details:

            Serial Number: 1 (0x1)

            Validity

              Not Before: Jan  5 04:52:52 2018 GMT

              Not After : Jan  5 04:52:52 2019 GMT

            Subject:

              countryName        = CN

              stateOrProvinceName    = beijing

              organizationName      = Xuenqlve

              organizationalUnitName   = ope

              commonName         = mail

              emailAddress        = Xuenqlve@163.com

            X509v3 extensions:

              X509v3 Basic Constraints:

                CA:FALSE

              Netscape Comment:

                OpenSSL Generated Certificate

              X509v3 Subject Key Identifier:

                1E:C8:F7:FA:7D:F7:9F:7B:00:03:DC:3B:60:CB:A2:8F:C0:16:04:D1

              X509v3 Authority Key Identifier:

                keyid:87:06:18:98:79:53:0E:26:0A:91:2D:B9:93:8A:C3:86:2B:CC:DF:E7

        Certificate is to be certified until Jan  5 04:52:52 2019 GMT (365 days)

        Sign the certificate? [y/n]:y

        1 out of 1 certificate requests certified, commit? [y/n]y

        Write out database with 1 new entries

        Data Base Updated

        注意：审核证书请求文件 报如下的错误时：

        error while loading serial number

        执行如下操作

        [root@CA CA]# echo 01 > serial

        [root@CA certs]# cat ../index.txt

        V190105045252Z01unknown/C=CN/ST=beijing/O=Xuenqlve/OU=ope/CN=mail/emailAddress=Xuenqlve@163.com

        [root@CA certs]# cat ../serial

        02

7 下发证书给邮件服务器(192.168.4.2)

        [root@CA certs]# scp mail.crt 192.168.4.2:/root/

8 配置服务运行时调用私钥文件 数字证书文件

    8.1 配置发邮件服务

        [root@mail ~]# vim /etc/postfix/main.cf

        添加如下配置

        [root@mail ~]# tail -4 /etc/postfix/main.cf

        smtpd_use_tls = yes

        #smtpd_tls_auth_only = yes

        smtpd_tls_key_file = /etc/pki/tls/private/mail.key

        smtpd_tls_cert_file = /etc/pki/tls/certs/mail.crt

        [root@mail ~]# cp /root/mail.crt /etc/pki/tls/certs/

        [root@mail ~]# systemctl restart postfix.service

        [root@mail ~]# netstat -pantu | grep master

        tcp     0    0 0.0.0.0:25        0.0.0.0:*        LISTEN    6461/master

        tcp6    0    0 :::25          :::*           LISTEN    6461/master

    8.2 配置收邮件服务

        [root@mail ~]# vim /etc/dovecot/conf.d/10-ssl.conf

        添加如下配置

        [root@mail ~]# sed -n '14p;15p' /etc/dovecot/conf.d/10-ssl.conf

        ssl_cert =

        ssl_key =

        [root@mail ~]# cp /etc/pki/tls/private/mail.key  /etc/pki/dovecot/private/mail.key

        [root@mail ~]# cp /root/mail.crt /etc/pki/dovecot/certs/mail.crt

        [root@mail ~]# systemctl restart dovecot.service

        [root@mail ~]# netstat -pantu | grep dovecot

        tcp     0    0 0.0.0.0:110       0.0.0.0:*        LISTEN    6517/dovecot

        tcp     0    0 0.0.0.0:143       0.0.0.0:*        LISTEN    6517/dovecot

        tcp     0    0 0.0.0.0:993       0.0.0.0:*        LISTEN    6517/dovecot

        tcp     0    0 0.0.0.0:995       0.0.0.0:*        LISTEN    6517/dovecot

        tcp6    0    0 :::110          :::*           LISTEN    6517/dovecot

        tcp6    0    0 :::143          :::*           LISTEN    6517/dovecot

        tcp6    0    0 :::993          :::*           LISTEN    6517/dovecot

        tcp6    0    0 :::995          :::*           LISTEN    6517/dovecot

三.客户端在软件里设置连接邮件服务器时 是否加密协议

     使用客户端软件时将邮件传输方式设置为ssl

         传输的数据就会进行加密

另外有需要云服务器可以了解下创新互联cdcxhl.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。