部署邮件TLS/SSL加密通信服务
一.部署普通邮件服务器
1) 搭建并检测邮件服务的发送服务
[root@mail ~]# rpm -q postfix
postfix-2.10.1-6.el7.x86_64
[root@mail ~]# netstat -pantu | grep :25
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1822/master
tcp6 0 0 ::1:25 :::* LISTEN 1822/master
[root@mail ~]# ps -C master
PID TTY TIME CMD
1822 ? 00:00:00 master
[root@mail ~]# vim /etc/postfix/main.cf
[root@mail ~]# sed -n "113p;116p;419p" /etc/postfix/main.cf
inet_interfaces = all
#inet_interfaces = localhost
home_mailbox = Maildir/
[root@mail ~]# systemctl restart postfix.service
[root@mail ~]# useradd jim
[root@mail ~]# echo 654321 | passwd --stdin jim
[root@mail ~]# yum -y install telnet
[root@mail ~]# telnet localhost 25
Trying ::1...
Connected to localhost.
Escape character is '^]'.
220 mail.com.cn ESMTP Postfix
helo localhost
250 mail.com.cn
mail from:root@localhost
250 2.1.0 Ok
rcpt to:jim@localhost
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
XXXXX
XXXX
XXX
XX
X
.
250 2.0.0 Ok: queued as BEDA283BDA92
quit
221 2.0.0 Bye
Connection closed by foreign host.
[root@mail ~]# cat /home/jim/Maildir/new/1515047330.Vfd02I4000083M847601.mail.com.cn
Return-Path: <root@localhost.com.cn>
X-Original-To: jim@localhost
Delivered-To: jim@localhost.com.cn
Received: from localhost (localhost [IPv6:::1])
by mail.com.cn (Postfix) with SMTP id BEDA283BDA92
for <jim@localhost>; Thu, 4 Jan 2018 01:28:07 -0500 (EST)
Message-Id: <20180104062818.BEDA283BDA92@mail.com.cn>
Date: Thu, 4 Jan 2018 01:28:07 -0500 (EST)
From: root@localhost.com.cn
XXXXX
XXXX
XXX
XX
X
#可以在发送邮件的时候 抓取发邮件的数据包
[root@mail ~]# tcpdump -i eth0 -A tcp port 25
2)搭建并检测 邮件服务的收取
[root@mail ~]# yum -y install dovecot
[root@mail ~]# rpm -q dovecot
dovecot-2.2.10-5.el7.x86_64
[root@mail ~]# vim /etc/dovecot/conf.d/10-mail.conf
[root@mail ~]# sed -n '24p' /etc/dovecot/conf.d/10-mail.conf
mail_location = maildir:~/Maildir
[root@mail ~]# vim /etc/dovecot/conf.d/10-auth.conf
[root@mail ~]# sed -n '10p' /etc/dovecot/conf.d/10-auth.conf
disable_plaintext_auth = yes#不禁用明文认证
[root@mail ~]# systemctl start dovecot
[root@mail ~]# netstat -pantu | grep :110
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 4924/dovecot
tcp6 0 0 :::110 :::* LISTEN 4924/dovecot
[root@mail ~]# netstat -pantu | grep :143
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 4924/dovecot
tcp6 0 0 :::143 :::* LISTEN 4924/dovecot
[root@mail ~]# telnet localhost 110
Trying ::1...
Connected to localhost.
Escape character is '^]'.
+OK Dovecot ready.
USER jim
+OK
PASS 654321
+OK Logged in.
list
+OK 1 messages:
1 423
.
retr 1
+OK 423 octets
Return-Path: <root@localhost.com.cn>
X-Original-To: jim@localhost
Delivered-To: jim@localhost.com.cn
Received: from localhost (localhost [IPv6:::1])
by mail.com.cn (Postfix) with SMTP id BEDA283BDA92
for <jim@localhost>; Thu, 4 Jan 2018 01:28:07 -0500 (EST)
Message-Id: <20180104062818.BEDA283BDA92@mail.com.cn>
Date: Thu, 4 Jan 2018 01:28:07 -0500 (EST)
From: root@localhost.com.cn
XXXXX
XXXX
XXX
XX
X
.
quit
+OK Logging out.
Connection closed by foreign host.
#可以在收取邮件的时候 抓取收邮件的数据包
[root@mail ~]# tcpdump -A -i lo tcp port 110
[root@mail ~]# tcpdump -A -i lo -w /tmp/mail.cap tcp port 110
[root@mail ~]# tcpdump -A -r /tmp/mail.cap | grep user
reading from file /tmp/mail.cap, link-type EN10MB (Ethernet)
.S...R..user jim #这里可以通过抓包 抓取到邮件的用户名和密码 因为当前属于明文传输
[root@mail ~]# tcpdump -A -r /tmp/mail.cap | grep pass
reading from file /tmp/mail.cap, link-type EN10MB (Ethernet)
.S6[.S..pass 654321
二，部署邮件TLS/SSL加密通信服务
1 邮件服务器的配置(192.168.4.2)：
[root@mail ~]# systemctl restart postfix
[root@mail ~]# netstat -pantu | grep master
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 5415/master
tcp6 0 0 :::25 :::* LISTEN 5415/master
[root@mail ~]# systemctl restart dovecot
[root@mail ~]# netstat -pantu | grep dovecot
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 5446/dovecot
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 5446/dovecot
tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 5446/dovecot
tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 5446/dovecot
tcp6 0 0 :::110 :::* LISTEN 5446/dovecot
tcp6 0 0 :::143 :::* LISTEN 5446/dovecot
tcp6 0 0 :::993 :::* LISTEN 5446/dovecot
tcp6 0 0 :::995 :::* LISTEN 5446/dovecot
2 创建私钥文件：生成证书请求文件 mail.key
[root@mail ~]# cd /etc/pki/tls/private/#默认搜索私钥目录
[root@mail private]# openssl genrsa 2048 > mail.key#执行生成私钥命令
3 创建证书请求文件mail.csr
-req 请求
-new 新文件
-key 私钥
[root@mail private]# openssl req -new -key mail.key > ~/mail.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN#与CA服务器 match 匹配策略 必须一样
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:Xuenqlve
Organizational Unit Name (eg, section) []:ope
Common Name (eg, your name or your server's hostname) []:mail#设置为服务域名或者主机名
Email Address []:Xuenqlve@163.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
5 上传证书请求文件给CA服务器(192.168.4.1)
[root@mail ~]# scp ~/mail.csr 192.168.4.1:/tmp
CA服务器的配置(192.168.4.1):
CA服务器具体配置 https://blog.51cto.com/13558754/2057718
6 审核证书请求文件，并签发数字证书
[root@CA certs]# openssl ca -in /tmp/mail.csr > mail.crt
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/my-ca.key:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jan 5 04:52:52 2018 GMT
Not After : Jan 5 04:52:52 2019 GMT
Subject:
countryName = CN
stateOrProvinceName = beijing
organizationName = Xuenqlve
organizationalUnitName = ope
commonName = mail
emailAddress = Xuenqlve@163.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
1E:C8:F7:FA:7D:F7:9F:7B:00:03:DC:3B:60:CB:A2:8F:C0:16:04:D1
X509v3 Authority Key Identifier:
keyid:87:06:18:98:79:53:0E:26:0A:91:2D:B9:93:8A:C3:86:2B:CC:DF:E7
Certificate is to be certified until Jan 5 04:52:52 2019 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
注意：审核证书请求文件 报如下的错误时：
error while loading serial number
执行如下操作
[root@CA CA]# echo 01 > serial
[root@CA certs]# cat ../index.txt
V190105045252Z01unknown/C=CN/ST=beijing/O=Xuenqlve/OU=ope/CN=mail/emailAddress=Xuenqlve@163.com
[root@CA certs]# cat ../serial
02
7 下发证书给邮件服务器(192.168.4.2)
[root@CA certs]# scp mail.crt 192.168.4.2:/root/
8 配置服务运行时调用私钥文件 数字证书文件
8.1 配置发邮件服务
[root@mail ~]# vim /etc/postfix/main.cf
添加如下配置
[root@mail ~]# tail -4 /etc/postfix/main.cf
smtpd_use_tls = yes
#smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/pki/tls/private/mail.key
smtpd_tls_cert_file = /etc/pki/tls/certs/mail.crt
[root@mail ~]# cp /root/mail.crt /etc/pki/tls/certs/
[root@mail ~]# systemctl restart postfix.service
[root@mail ~]# netstat -pantu | grep master
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 6461/master
tcp6 0 0 :::25 :::* LISTEN 6461/master
8.2 配置收邮件服务
[root@mail ~]# vim /etc/dovecot/conf.d/10-ssl.conf
添加如下配置
[root@mail ~]# sed -n '14p;15p' /etc/dovecot/conf.d/10-ssl.conf
ssl_cert = </etc/pki/dovecot/certs/mail.crt
ssl_key = </etc/pki/dovecot/private/mail.key
[root@mail ~]# cp /etc/pki/tls/private/mail.key /etc/pki/dovecot/private/mail.key
[root@mail ~]# cp /root/mail.crt /etc/pki/dovecot/certs/mail.crt
[root@mail ~]# systemctl restart dovecot.service
[root@mail ~]# netstat -pantu | grep dovecot
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 6517/dovecot
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 6517/dovecot
tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 6517/dovecot
tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 6517/dovecot
tcp6 0 0 :::110 :::* LISTEN 6517/dovecot
tcp6 0 0 :::143 :::* LISTEN 6517/dovecot
tcp6 0 0 :::993 :::* LISTEN 6517/dovecot
tcp6 0 0 :::995 :::* LISTEN 6517/dovecot
三.客户端在软件里设置连接邮件服务器时 是否加密协议
使用客户端软件时将邮件传输方式设置为ssl
传输的数据就会进行加密
来源：oschina
链接：https://my.oschina.net/u/4368242/blog/4873289