Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:mail_c6:mta_5 [19.12.2013 21:31. ] – [erster Test] django | centos:mail_c6:mta_5 [22.07.2019 15:08. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| + | ====== SSL/TLS - Postfixverbindungen verschlüsselte Kommunikation ====== | ||
| + | {{: | ||
| + | Dass das Internet systembedingt unsicher ist, hat sich in aller Regel herumgesprochen. | ||
| + | |||
| + | Inwieweit staatliche Stellen den Datenverkehr abhören, protokollieren und abgreifen und zu manipulieren bzw. zensieren versuchen, weiss | ||
| + | - keiner so genau und | ||
| + | - was mit den gewonnen Daten angestellt wird, wird sich niemand öffentlich sagen trauen. | ||
| + | |||
| + | Tja, das war Stand der Dinge vor 2013, denn was bisher in den Bereich der Spekulation fiel, | ||
| + | findet nun Bestätigung durch die Erkenntnisse des Whistleblowers Edward Snowden zu den Projekten PRISM aus den USA und TEMPORA aus England. | ||
| + | {{ : | ||
| + | |||
| + | Was lernen wir aus dieser Tatsache? Unsere Kommunikation ist nach besten Wissen und Gewissen, so zu gestalten, damit andere unsere Daten nicht mitlesen und manipulieren können. Ferner ist sicherzustellen, | ||
| + | |||
| + | Nicht nur auf [[centos: | ||
| + | |||
| + | Mit Hilfe von **PFS**((**P**erfect **F**orward **S**ecrecy)) können wir leicht und einfach sicherstellen, | ||
| + | |||
| + | Perfect Forward Secrecy (PFS) basiert auf der Idee, dass Client und Server ihre Kommunikation über einen zusätzlichen temporären Schlüssel absichern, der wechselt. Da der Verbindungsaufbau so gestrickt ist, daß der Schlüssel selbst gar nicht ausgetauscht werden muß, kann der jeweils benutzte Sitzungsschlüssel selbst auch nicht aufgezeichnet werden. Eine nachträgliche Entschlüsselung einer früher aufgezeichneten Session ist damit nicht mehr möglich. | ||
| + | |||
| + | Die für die Verschlüsselung notwendigen // | ||
| + | |||
| + | |||
| + | |||
| + | ===== OpenSSL ===== | ||
| + | Bei der Standardinstallation unseres Systems wurde in der Regel bereits das Paket **openssl** installiert. Ein kurzer Blick in die RPMdatenbank schafft hierzu Gewissheit. | ||
| + | # yum list openssl | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | Sollte das Paket noch fehlen, installieren wir dies einfach via: | ||
| + | # yum install openssl | ||
| + | Was uns das Paket **// | ||
| + | # rpm -qil openssl | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Install Date: Wed 04 Dec 2013 01:06:18 PM CET Build Host: c6b10.bsys.dev.centos.org | ||
| + | Group : System Environment/ | ||
| + | Size : 4201414 | ||
| + | Signature | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | The OpenSSL toolkit provides support for secure communications between | ||
| + | machines. OpenSSL includes a certificate management tool and shared | ||
| + | libraries which provide various cryptographic algorithms and | ||
| + | protocols. | ||
| + | /etc/pki/CA | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | ==== Cipher-Suites und Diffie-Hellmann ==== | ||
| + | Möchte man in Erfahrung bringen, welche Cipher-Suites((Sammlung von standardisierten kryptographischer Algorithmen)) unser installiertes OpenSSL-Paket mitbringt, können wir wie folgt abfragen((Ausgabe in formatierter Tabelle)). | ||
| + | # openssl ciphers -v | ||
| + | < | ||
| + | ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH | ||
| + | ECDHE-RSA-AES256-SHA384 | ||
| + | ECDHE-ECDSA-AES256-SHA384 | ||
| + | ECDHE-RSA-AES256-SHA | ||
| + | ECDHE-ECDSA-AES256-SHA | ||
| + | DHE-DSS-AES256-GCM-SHA384 | ||
| + | DHE-RSA-AES256-GCM-SHA384 | ||
| + | DHE-RSA-AES256-SHA256 | ||
| + | DHE-DSS-AES256-SHA256 | ||
| + | DHE-RSA-AES256-SHA | ||
| + | DHE-DSS-AES256-SHA | ||
| + | DHE-RSA-CAMELLIA256-SHA | ||
| + | DHE-DSS-CAMELLIA256-SHA | ||
| + | ECDH-RSA-AES256-GCM-SHA384 | ||
| + | ECDH-ECDSA-AES256-GCM-SHA384 | ||
| + | ECDH-RSA-AES256-SHA384 | ||
| + | ECDH-ECDSA-AES256-SHA384 | ||
| + | ECDH-RSA-AES256-SHA | ||
| + | ECDH-ECDSA-AES256-SHA | ||
| + | AES256-GCM-SHA384 | ||
| + | AES256-SHA256 | ||
| + | AES256-SHA | ||
| + | CAMELLIA256-SHA | ||
| + | PSK-AES256-CBC-SHA | ||
| + | ECDHE-RSA-DES-CBC3-SHA | ||
| + | ECDHE-ECDSA-DES-CBC3-SHA | ||
| + | EDH-RSA-DES-CBC3-SHA | ||
| + | EDH-DSS-DES-CBC3-SHA | ||
| + | ECDH-RSA-DES-CBC3-SHA | ||
| + | ECDH-ECDSA-DES-CBC3-SHA | ||
| + | DES-CBC3-SHA | ||
| + | PSK-3DES-EDE-CBC-SHA | ||
| + | KRB5-DES-CBC3-SHA | ||
| + | KRB5-DES-CBC3-MD5 | ||
| + | ECDHE-RSA-AES128-GCM-SHA256 | ||
| + | ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH | ||
| + | ECDHE-RSA-AES128-SHA256 | ||
| + | ECDHE-ECDSA-AES128-SHA256 | ||
| + | ECDHE-RSA-AES128-SHA | ||
| + | ECDHE-ECDSA-AES128-SHA | ||
| + | DHE-DSS-AES128-GCM-SHA256 | ||
| + | DHE-RSA-AES128-GCM-SHA256 | ||
| + | DHE-RSA-AES128-SHA256 | ||
| + | DHE-DSS-AES128-SHA256 | ||
| + | DHE-RSA-AES128-SHA | ||
| + | DHE-DSS-AES128-SHA | ||
| + | DHE-RSA-SEED-SHA | ||
| + | DHE-DSS-SEED-SHA | ||
| + | DHE-RSA-CAMELLIA128-SHA | ||
| + | DHE-DSS-CAMELLIA128-SHA | ||
| + | ECDH-RSA-AES128-GCM-SHA256 | ||
| + | ECDH-ECDSA-AES128-GCM-SHA256 | ||
| + | ECDH-RSA-AES128-SHA256 | ||
| + | ECDH-ECDSA-AES128-SHA256 | ||
| + | ECDH-RSA-AES128-SHA | ||
| + | ECDH-ECDSA-AES128-SHA | ||
| + | AES128-GCM-SHA256 | ||
| + | AES128-SHA256 | ||
| + | AES128-SHA | ||
| + | SEED-SHA | ||
| + | CAMELLIA128-SHA | ||
| + | IDEA-CBC-SHA | ||
| + | PSK-AES128-CBC-SHA | ||
| + | KRB5-IDEA-CBC-SHA | ||
| + | KRB5-IDEA-CBC-MD5 | ||
| + | ECDHE-RSA-RC4-SHA | ||
| + | ECDHE-ECDSA-RC4-SHA | ||
| + | ECDH-RSA-RC4-SHA | ||
| + | ECDH-ECDSA-RC4-SHA | ||
| + | RC4-SHA | ||
| + | RC4-MD5 | ||
| + | PSK-RC4-SHA | ||
| + | KRB5-RC4-SHA | ||
| + | KRB5-RC4-MD5 | ||
| + | EDH-RSA-DES-CBC-SHA | ||
| + | EDH-DSS-DES-CBC-SHA | ||
| + | DES-CBC-SHA | ||
| + | KRB5-DES-CBC-SHA | ||
| + | KRB5-DES-CBC-MD5 | ||
| + | EXP-EDH-RSA-DES-CBC-SHA | ||
| + | EXP-EDH-DSS-DES-CBC-SHA | ||
| + | EXP-DES-CBC-SHA | ||
| + | EXP-RC2-CBC-MD5 | ||
| + | EXP-KRB5-RC2-CBC-SHA | ||
| + | EXP-KRB5-DES-CBC-SHA | ||
| + | EXP-KRB5-RC2-CBC-MD5 | ||
| + | EXP-KRB5-DES-CBC-MD5 | ||
| + | EXP-RC4-MD5 | ||
| + | EXP-KRB5-RC4-SHA | ||
| + | EXP-KRB5-RC4-MD5 | ||
| + | </ | ||
| + | Wir haben also mit der aktuellen Version von OpenSSL, den für //**Perfect Forward Secrecy**// benötigten kryptographischen Algorithmus **DH**((**D**iffie **H**ellmann)) sowie den weiterentwickelten **ECDH**((**E**lliptic **C**urve **D**iffie **H**ellmann)). | ||
| + | |||
| + | Bei der [[centos: | ||
| + | |||
| + | # openssl dhparam -out / | ||
| + | < | ||
| + | This is going to take a long time | ||
| + | ...+.................+.+..................+.............+............................+.......+.................................+......................++.........................+..........................................+.....................+......+.......................+....+................+.................+...............................................+...........+...............+.........+.........................................+.....+.....+..................+..........+.......+..........+...............+....................++*++*++*++*++*++*</ | ||
| + | |||
| + | # openssl dhparam -out / | ||
| + | < | ||
| + | This is going to take a long time | ||
| + | ...........+..............................................................+.................+........................................................................................................................................................................................................................+...................................................................+..................................................................+...........................+....................................................................................................................+........+.................+.................................................................................................+...........+...................+.......................................................................................................+++...................................+....+................................................+.....................................+...............+.....+.............................+.+.........................+.........................+....................................+...................................................................................+..................+............+...............................+.........................................................................................+..............+.................................+.............+................................................................+.....+..............+.........+.............+..............................................+..............+................................++*++*++* | ||
| + | </ | ||
| + | |||
| + | |||
| + | ===== Zertifikatserstellung ===== | ||
| + | Für die Verschlüsselung unserer Kommunikation nutzen wir ein selbstsigniertes Zertifikat. Hierzu benötigen wir: | ||
| + | - unseren //Private Key//, den wir hüten wie unseren Augapfel | ||
| + | - unseren //Public Key//, den wir von einer CA((Certification Authority)) signieren, in unserem Falle unsere eigene CA, und | ||
| + | - den //Public Key// der unterschreibenden CA, um deren Unterschrift zu prüfen. | ||
| + | Dem Paket //openssl// liegt zwar ein Bash-Script bei, mit dessen Hilfe die nachfolgenden Installationsschritte automatisiert ablaufen sollen, aber zum besseren Verständnis, | ||
| + | # cat / | ||
| + | <code bash / | ||
| + | #!/bin/sh | ||
| + | # | ||
| + | # CA - wrapper around ca to make it easier to use ... basically ca requires | ||
| + | # some setup stuff to be done before you can use it and this makes | ||
| + | # things easier between now and when Eric is convinced to fix it :-) | ||
| + | # | ||
| + | # CA -newca ... will setup the right stuff | ||
| + | # CA -newreq ... will generate a certificate request | ||
| + | # CA -sign ... will sign the generated request and output | ||
| + | # | ||
| + | # At the end of that grab newreq.pem and newcert.pem (one has the key | ||
| + | # and the other the certificate) and cat them together and that is what | ||
| + | # you want/need ... I'll make even this a little cleaner later. | ||
| + | # | ||
| + | # | ||
| + | # 12-Jan-96 tjh Added more things ... including CA -signcert which | ||
| + | # converts a certificate to a request and then signs it. | ||
| + | # 10-Jan-96 eay Fixed a few more bugs and added the SSLEAY_CONFIG | ||
| + | # environment variable so this can be driven from | ||
| + | # a script. | ||
| + | # 25-Jul-96 eay Cleaned up filenames some more. | ||
| + | # 11-Jun-96 eay Fixed a few filename missmatches. | ||
| + | # 03-May-96 eay Modified to use ' | ||
| + | # 18-Apr-96 tjh Original hacking | ||
| + | # | ||
| + | # Tim Hudson | ||
| + | # tjh@cryptsoft.com | ||
| + | # | ||
| + | |||
| + | # default openssl.cnf file has setup as per the following | ||
| + | # demoCA ... where everything is stored | ||
| + | cp_pem() { | ||
| + | infile=$1 | ||
| + | outfile=$2 | ||
| + | bound=$3 | ||
| + | flag=0 | ||
| + | exec < | ||
| + | while read line; do | ||
| + | if [ $flag -eq 1 ]; then | ||
| + | echo $line|grep " | ||
| + | if [ $? -eq 0 ] ; then | ||
| + | echo $line >> | ||
| + | break | ||
| + | else | ||
| + | echo $line >> | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | echo $line|grep " | ||
| + | if [ $? -eq 0 ]; then | ||
| + | echo $line > | ||
| + | flag=1 | ||
| + | fi | ||
| + | done | ||
| + | } | ||
| + | |||
| + | usage() { | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | if [ -z " | ||
| + | |||
| + | if [ -z " | ||
| + | CADAYS=" | ||
| + | REQ=" | ||
| + | CA=" | ||
| + | VERIFY=" | ||
| + | X509=" | ||
| + | PKCS12=" | ||
| + | |||
| + | if [ -z " | ||
| + | CAKEY=./ | ||
| + | CAREQ=./ | ||
| + | CACERT=./ | ||
| + | |||
| + | RET=0 | ||
| + | |||
| + | while [ " | ||
| + | case $1 in | ||
| + | -\? | ||
| + | usage | ||
| + | exit 0 | ||
| + | ;; | ||
| + | -newcert) | ||
| + | # create a certificate | ||
| + | $REQ -new -x509 -keyout newkey.pem -out newcert.pem $DAYS | ||
| + | RET=$? | ||
| + | echo " | ||
| + | ;; | ||
| + | -newreq) | ||
| + | # create a certificate request | ||
| + | $REQ -new -keyout newkey.pem -out newreq.pem $DAYS | ||
| + | RET=$? | ||
| + | echo " | ||
| + | ;; | ||
| + | -newreq-nodes) | ||
| + | # create a certificate request | ||
| + | $REQ -new -nodes -keyout newreq.pem -out newreq.pem $DAYS | ||
| + | RET=$? | ||
| + | echo " | ||
| + | ;; | ||
| + | -newca) | ||
| + | # if explicitly asked for or it doesn' | ||
| + | # structure that Eric likes to manage things | ||
| + | NEW=" | ||
| + | if [ " | ||
| + | # create the directory hierarchy | ||
| + | mkdir -p ${CATOP} | ||
| + | mkdir -p ${CATOP}/ | ||
| + | mkdir -p ${CATOP}/ | ||
| + | mkdir -p ${CATOP}/ | ||
| + | mkdir -p ${CATOP}/ | ||
| + | touch ${CATOP}/ | ||
| + | fi | ||
| + | if [ ! -f ${CATOP}/ | ||
| + | echo "CA certificate filename (or enter to create)" | ||
| + | read FILE | ||
| + | |||
| + | # ask user for existing CA certificate | ||
| + | if [ " | ||
| + | cp_pem $FILE ${CATOP}/ | ||
| + | cp_pem $FILE ${CATOP}/ | ||
| + | RET=$? | ||
| + | if [ ! -f " | ||
| + | $X509 -in ${CATOP}/ | ||
| + | -out ${CATOP}/ | ||
| + | fi | ||
| + | else | ||
| + | echo " | ||
| + | $REQ -new -keyout ${CATOP}/ | ||
| + | -out ${CATOP}/ | ||
| + | $CA -create_serial -out ${CATOP}/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | RET=$? | ||
| + | fi | ||
| + | fi | ||
| + | ;; | ||
| + | -xsign) | ||
| + | $CA -policy policy_anything -infiles newreq.pem | ||
| + | RET=$? | ||
| + | ;; | ||
| + | -pkcs12) | ||
| + | if [ -z " | ||
| + | CNAME=" | ||
| + | else | ||
| + | CNAME=" | ||
| + | fi | ||
| + | $PKCS12 -in newcert.pem -inkey newreq.pem -certfile ${CATOP}/ | ||
| + | -out newcert.p12 -export -name " | ||
| + | RET=$? | ||
| + | exit $RET | ||
| + | ;; | ||
| + | -sign|-signreq) | ||
| + | $CA -policy policy_anything -out newcert.pem -infiles newreq.pem | ||
| + | RET=$? | ||
| + | cat newcert.pem | ||
| + | echo " | ||
| + | ;; | ||
| + | -signCA) | ||
| + | $CA -policy policy_anything -out newcert.pem -extensions v3_ca -infiles newreq.pem | ||
| + | RET=$? | ||
| + | echo " | ||
| + | ;; | ||
| + | -signcert) | ||
| + | echo "Cert passphrase will be requested twice - bug?" | ||
| + | $X509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem | ||
| + | $CA -policy policy_anything -out newcert.pem -infiles tmp.pem | ||
| + | RET=$? | ||
| + | cat newcert.pem | ||
| + | echo " | ||
| + | ;; | ||
| + | -verify) | ||
| + | shift | ||
| + | if [ -z " | ||
| + | $VERIFY -CAfile $CATOP/ | ||
| + | RET=$? | ||
| + | else | ||
| + | for j | ||
| + | do | ||
| + | $VERIFY -CAfile $CATOP/ | ||
| + | if [ $? != 0 ]; then | ||
| + | RET=$? | ||
| + | fi | ||
| + | done | ||
| + | fi | ||
| + | exit $RET | ||
| + | ;; | ||
| + | *) | ||
| + | echo " | ||
| + | usage | ||
| + | exit 1 | ||
| + | ;; | ||
| + | esac | ||
| + | shift | ||
| + | done | ||
| + | exit $RET | ||
| + | </ | ||
| + | ==== Dateien anlegen ==== | ||
| + | Als erstes legen wir die noch fehlenden Dateien an. | ||
| + | # echo " | ||
| + | |||
| + | # touch / | ||
| + | |||
| + | Somit befindet sich in unserem Pfad **/ | ||
| + | # ll /etc/pki/CA | ||
| + | < | ||
| + | drwxr-xr-x. 2 root root 4096 May 29 19:20 certs | ||
| + | drwxr-xr-x. 2 root root 4096 May 29 19:20 crl | ||
| + | -rw-r--r-- | ||
| + | drwxr-xr-x. 2 root root 4096 May 29 19:20 newcerts | ||
| + | drwx------. 2 root root 4096 May 29 19:20 private | ||
| + | -rw-r--r-- | ||
| + | </ | ||
| + | ==== Erstellen unserer eigenen CA ==== | ||
| + | Die Gültigkeit setzen wir mit 25 Jahren bewusst sehr hoch an. Nach dem Ablauf der Gültigkeit der CA werden nämlich auch alle damit signierten Serverzertifikate ungültig! Bei der nun folgenden Generierung unserer CA wird automatisch ein Schlüssel (//private key//), mit einer Länge von 2048 Bit, erzeugt und in der Datei **// | ||
| + | |||
| + | Zur Sicherheit schützen wir den //private key// unserer CA mit einer Passphrase! Denn wer den geheimen Schlüssel der CA hat/kennt, könnte damit beliebige Serverzertifikate signieren. Daher legen wir dieses Keyfile nicht im Klartext auf der Festplatte ab, sondern mit einer Passphrase verschlüsselt. Diese Passphrase benötigen wir immer dann, wenn wir mit unser eigenen CA neue Zertifikate ausstellen wollen. Im nachfolgenden Dialog akzetieren wir die Vorgaben in eckigen Klammern, geben unsere individuellen Daten an, oder quittieren ein //leeres Feld// mittels eines **Punktes** **.**. Beim Feld Common Name (CN) geben wir den Domain-Namen unserer Zertifizierungsstelle ein. | ||
| + | |||
| + | Diese Daten werden dem Client angezeigt, sobald dieser aufgefordert wird, das Zertifikat zu akzeptieren oder abzulehnen. | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | # openssl req -new -x509 -newkey rsa:2048 -keyout cakey.pem -out cacert.pem -days 9125 | ||
| + | < | ||
| + | ..............+++ | ||
| + | ..................................................+++ | ||
| + | writing new private key to ' | ||
| + | Enter PEM pass phrase: des-woas-blos-I-und-sundst-koana | ||
| + | Verifying - Enter PEM pass phrase: des-woas-blos-I-und-sundst-koana | ||
| + | ----- | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [GB]:DE | ||
| + | State or Province Name (full name) [Berkshire]: | ||
| + | Locality Name (eg, city) [Newbury]: | ||
| + | Organization Name (eg, company) [My Company Ltd]:Nausch | ||
| + | Organizational Unit Name (eg, section) []: | ||
| + | Common Name (eg, your name or your server' | ||
| + | Email Address []: | ||
| + | Als Ergebnis erhalten wir zwei Dateien: | ||
| + | * **cakey.pem** den //private key// unserer //CA// und | ||
| + | * **cacert.pem** das CA-Certifikat unserer //CA//. | ||
| + | |||
| + | # ll *.pem | ||
| + | |||
| + | | ||
| + | | ||
| + | Vorsichtshalber ändern wir die Rechte so, dass die Schlüsseldateien nur für root lesbar sind: | ||
| + | # chmod 400 *.pem | ||
| + | Bei Bedarf kann man mit **openssl rsa -in < | ||
| + | # openssl rsa -in cakey.pem -noout -text | ||
| + | < | ||
| + | Private-Key: | ||
| + | modulus: | ||
| + | 00: | ||
| + | 68: | ||
| + | a3: | ||
| + | a1: | ||
| + | 24: | ||
| + | 54: | ||
| + | 68: | ||
| + | 58: | ||
| + | 25: | ||
| + | 24: | ||
| + | 54: | ||
| + | | ||
| + | Will man die Passphrase eines Schlüssels entfernen, geht man wie folgt vor: | ||
| + | # openssl rsa < | ||
| + | |||
| + | Enter pass phrase: des-woas-blos-I-und-sundst-koana | ||
| + | | ||
| + | ==== Schlüssel für das Serverzertifikat erzeugen ==== | ||
| + | Nachdem wir nun unsere eigene CA erstellt haben, machen wir uns daran, endlich für unseren Server ein Zertifikat herausgeben. Hierzu erzeugen wir als erstes einen 2048 Bit langen RSA Schlüssel, den wir mit AES 256 verschlüsselt auf der Platte abgelegt lassen. Da OpenSSL keine leere Passphrase zulässt braucht die Passphrase diesmal nicht sonderlich geheim sein, da wir diese im Anschluss ohnehin sofort wieder entfernen werden: | ||
| + | # openssl genrsa -out serverkey.pem -aes256 2048 -days 7300 | ||
| + | < | ||
| + | ......+++ | ||
| + | ......................................+++ | ||
| + | e is 65537 (0x10001) | ||
| + | Enter pass phrase for serverkey.pem: | ||
| + | Verifying - Enter pass phrase for serverkey.pem: | ||
| + | |||
| + | Wie schon erwähnt entfernen wir die Passphrase nun wieder, damit unser Postfix-Server, | ||
| + | # openssl rsa < | ||
| + | Wie schon zuvor schützen wir auch hier den Serverschlüssel über die Dateirechte, | ||
| + | # mv serverkey_2.pem serverkey.pem | ||
| + | # chmod 400 serverkey.pem | ||
| + | ==== Certificate Signing Request erzeugen ==== | ||
| + | Im folgenden Schritt zu unserem eigenen Zertifikat erzeugen wir einen **CSR**((Certificate Signing Request)), den wir dann in einem weiteren Schritt von unserer eigenen CA signieren lassen werden. <WRAP round alert> **__Wichtig__**: | ||
| + | # openssl req -new -key serverkey.pem -out csr.pem -nodes | ||
| + | < | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [GB]:DE | ||
| + | State or Province Name (full name) [Berkshire]: | ||
| + | Locality Name (eg, city) [Newbury]: | ||
| + | Organization Name (eg, company) [My Company Ltd]:Nausch | ||
| + | Organizational Unit Name (eg, section) []: | ||
| + | Common Name (eg, your name or your server' | ||
| + | Email Address []: | ||
| + | |||
| + | Please enter the following ' | ||
| + | to be sent with your certificate request | ||
| + | A challenge password []: | ||
| + | An optional company name []: | ||
| + | </ | ||
| + | ==== Serverzertifikat signieren ==== | ||
| + | Bevor wir nun unser eigenes Zertifikat signieren können, passen wir in der OpenSSL-Konfigurationsdatei die Laufzeit an, da wir diese nicht auf der Komandozeile übergeben können. | ||
| + | # vim / | ||
| + | <code bash> | ||
| + | ... | ||
| + | #################################################################### | ||
| + | [ ca ] | ||
| + | default_ca | ||
| + | |||
| + | #################################################################### | ||
| + | [ CA_default ] | ||
| + | |||
| + | dir = / | ||
| + | certs = $dir/ | ||
| + | crl_dir | ||
| + | database | ||
| + | # | ||
| + | # several ctificates with same subject. | ||
| + | new_certs_dir | ||
| + | |||
| + | certificate | ||
| + | serial | ||
| + | crlnumber | ||
| + | # must be commented out to leave a V1 CRL | ||
| + | crl = $dir/ | ||
| + | private_key | ||
| + | RANDFILE | ||
| + | |||
| + | x509_extensions = usr_cert | ||
| + | |||
| + | # Comment out the following two lines for the " | ||
| + | # (and highly broken) format. | ||
| + | name_opt | ||
| + | cert_opt | ||
| + | |||
| + | # Extension copying option: use with caution. | ||
| + | # copy_extensions = copy | ||
| + | |||
| + | # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs | ||
| + | # so this is commented out by default to leave a V1 CRL. | ||
| + | # crlnumber must also be commented out to leave a V1 CRL. | ||
| + | # crl_extensions | ||
| + | |||
| + | default_days | ||
| + | default_crl_days= 30 # how long before next CRL | ||
| + | default_md | ||
| + | preserve | ||
| + | |||
| + | ...</ | ||
| + | Außerdem verschieben wir den privaten Schlüssel unserer CA nach **/ | ||
| + | # mv / | ||
| + | Kommen wir zum krönenden Abschluss - wir signieren nun das Server-Zertifikat durch unsere CA: | ||
| + | # openssl ca -in csr.pem -notext -out servercert.pem | ||
| + | < | ||
| + | Enter pass phrase for / | ||
| + | Check that the request matches the signature | ||
| + | Signature ok | ||
| + | Certificate Details: | ||
| + | Serial Number: 0 (0x0) | ||
| + | Validity | ||
| + | Not Before: Mar 26 21:59:14 2009 GMT | ||
| + | Not After : Mar 21 21:59:14 2029 GMT | ||
| + | Subject: | ||
| + | countryName | ||
| + | stateOrProvinceName | ||
| + | organizationName | ||
| + | organizationalUnitName | ||
| + | commonName | ||
| + | emailAddress | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:FALSE | ||
| + | Netscape Comment: | ||
| + | OpenSSL Generated Certificate | ||
| + | X509v3 Subject Key Identifier: | ||
| + | E7: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | |||
| + | Certificate is to be certified until Mar 21 21:59:14 2029 GMT (7300 days) | ||
| + | Sign the certificate? | ||
| + | |||
| + | |||
| + | 1 out of 1 certificate requests certified, commit? [y/n]y | ||
| + | Write out database with 1 new entries | ||
| + | Data Base Updated | ||
| + | </ | ||
| + | ==== Schlüsseldateien ablegen ==== | ||
| + | Für unsere Postfix-Installation legen wir uns am besten einen eigenen Unterordner unter **/ | ||
| + | # mkdir / | ||
| + | Anschließend legen wir dort die drei benötigten Dateien ab: | ||
| + | - unseren // | ||
| + | - unseren // | ||
| + | - das // | ||
| + | und schützen diese Dateien mit den Dateirechten **400**: | ||
| + | # mv / | ||
| + | # mv / | ||
| + | # cp / | ||
| + | # chmod 400 / | ||
| + | ===== Postfix Konfigurieren ===== | ||
| + | ==== SSL/TLS für den Mailempfang ==== | ||
| + | Für den verschlüsselten Empfangsmodus erweitern wir unsere Postfix-Konfigurationsdatei wie folgt: | ||
| + | # | ||
| + | # SSL/TLS - Schutz durch verschlüsselte Verbindungen | ||
| + | # eingetragen am 24.03.09 | ||
| + | # | ||
| + | # Pfade zu den Keys für den Mailempfang | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | # Aktiviert STARTTLS für den Mailempfang | ||
| + | | ||
| + | |||
| + | ==== SSL/TLS für den Mailversand ==== | ||
| + | Ähnlich trivial gestaltet sich die Geschichte für den Mailversand: | ||
| + | # Aktiviert STARTTLS für den Mailversand | ||
| + | | ||
| + | |||
| + | ==== Perfect Forward Secrecy ==== | ||
| + | Unsere bereits [[centos: | ||
| + | |||
| + | < | ||
| + | smtpd_tls_dh1024_param_file = / | ||
| + | smtpd_tls_dh512_param_file = / | ||
| + | # | ||
| + | # Aktivierung des " | ||
| + | smtpd_tls_eecdh_grade = ultra | ||
| + | # | ||
| + | # Setzen des präferierten standardisierten kryptographischen Algorithmus' | ||
| + | tls_preempt_cipherlist = yes | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== SSL/TLS - Logging im Maillog ==== | ||
| + | Für die Dokumentation der Verschlüsselung tragen wir in der **main.cf** noch folgende Zeilen nach: | ||
| + | # Logged in den Received-Zeilen | ||
| + | | ||
| + | | ||
| + | | ||
| + | Abschließend starten wir nun unseren Postfix einmal durch, damit unsere Änderungen aktiv werden. | ||
| + | # service postfix restart | ||
| + | ===== Postfix Verbindungstest ===== | ||
| + | ==== erster Test ==== | ||
| + | Als erstes kontrollieren wir, ob unser MX nun **// | ||
| + | < | ||
| + | Trying 217.91.103.190... | ||
| + | Connected to mx1.nausch.org (217.91.103.190). | ||
| + | Escape character is ' | ||
| + | 220 mx1.nausch.org ESMTP Postfix | ||
| + | EHLO test | ||
| + | 250-mx01.nausch.org | ||
| + | 250-PIPELINING | ||
| + | 250-SIZE 52428800 | ||
| + | 250-ETRN | ||
| + | 250-STARTTLS | ||
| + | 250-AUTH PLAIN LOGIN DIGEST-MD5 | ||
| + | 250-AUTH=PLAIN LOGIN DIGEST-MD5 | ||
| + | 250-ENHANCEDSTATUSCODES | ||
| + | 250-8BITMIME | ||
| + | 250 DSN | ||
| + | QUIT | ||
| + | 221 2.0.0 Bye | ||
| + | Connection closed by foreign host. | ||
| + | </ | ||
| + | ==== zweiter Verbindungstest ==== | ||
| + | Als nächstes verbinden wir uns unter Einbeziehung von OpenSSL mit unserem Mailserver via telnet auf Port 25: | ||
| + | $ openssl s_client -starttls smtp -connect mx01.nausch.org: | ||
| + | < | ||
| + | depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA | ||
| + | verify return:1 | ||
| + | depth=1 C = US, O = " | ||
| + | verify return:1 | ||
| + | depth=0 serialNumber = 2trISjzDJTPJcm3fBbxM-aRvSFL9RMfj, | ||
| + | verify return:1 | ||
| + | --- | ||
| + | Certificate chain | ||
| + | 0 s:/ | ||
| + | | ||
| + | 1 s:/ | ||
| + | | ||
| + | 2 s:/ | ||
| + | | ||
| + | --- | ||
| + | Server certificate | ||
| + | -----BEGIN CERTIFICATE----- | ||
| + | MIIFKjCCBBKgAwIBAgIDDFfLMA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT | ||
| + | MRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEUMBIGA1UEAxMLUmFwaWRTU0wgQ0Ew | ||
| + | HhcNMTMwNTMwMTYzNDM3WhcNMTYwNjAxMTEzNzI5WjCBuzEpMCcGA1UEBRMgMnRy | ||
| + | SVNqekRKVFBKY20zZkJieE0tYVJ2U0ZMOVJNZmoxEzARBgNVBAsTCkdUNDk0NDc5 | ||
| + | NTExMTAvBgNVBAsTKFNlZSB3d3cucmFwaWRzc2wuY29tL3Jlc291cmNlcy9jcHMg | ||
| + | KGMpMTMxLzAtBgNVBAsTJkRvbWFpbiBDb250cm9sIFZhbGlkYXRlZCAtIFJhcGlk | ||
| + | U1NMKFIpMRUwEwYDVQQDDAwqLm5hdXNjaC5vcmcwggEiMA0GCSqGSIb3DQEBAQUA | ||
| + | A4IBDwAwggEKAoIBAQCs1+zIxqVHU5Jpf3S0MYleIQAJZoIYwxFcS4IoIFULxpPi | ||
| + | KOTXHH1XSZRDk7OVAPGKVt9VzE0CNcWKiiS4eyWCAVOb4wf778yGG1FhKVAb2EFh | ||
| + | 99SJdzfN0Iqte44N01IjqVNNurV+lu74GoPP0/ | ||
| + | vYYSxbggsD+eNLtsjSzI7Etnnr0IUfoOG5i0HEN297pzMfEckDu/ | ||
| + | l8BPd5/ | ||
| + | DuH3fa87nBo/ | ||
| + | HSMEGDAWgBRraT1qGEJK3Y8CZTn9NSSGeJEWMDAOBgNVHQ8BAf8EBAMCBaAwHQYD | ||
| + | VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCMGA1UdEQQcMBqCDCoubmF1c2No | ||
| + | Lm9yZ4IKbmF1c2NoLm9yZzBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vcmFwaWRz | ||
| + | c2wtY3JsLmdlb3RydXN0LmNvbS9jcmxzL3JhcGlkc3NsLmNybDAdBgNVHQ4EFgQU | ||
| + | UBbZzOI29235UZ6jDjt2csIGeD8wDAYDVR0TAQH/ | ||
| + | MGowLQYIKwYBBQUHMAGGIWh0dHA6Ly9yYXBpZHNzbC1vY3NwLmdlb3RydXN0LmNv | ||
| + | bTA5BggrBgEFBQcwAoYtaHR0cDovL3JhcGlkc3NsLWFpYS5nZW90cnVzdC5jb20v | ||
| + | cmFwaWRzc2wuY3J0MEwGA1UdIARFMEMwQQYKYIZIAYb4RQEHNjAzMDEGCCsGAQUF | ||
| + | BwIBFiVodHRwOi8vd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvY3BzMA0GCSqG | ||
| + | SIb3DQEBBQUAA4IBAQCvDzskGubI84Y33jxleOMOJpJaFbXI1jNlvxzKLfut1qm9 | ||
| + | / | ||
| + | 3Ev7yPGmm6BGop46a1aF/ | ||
| + | RmUf7u8Y8LKDG4h/ | ||
| + | rrOZDFwuuEHGFWQo8Cjm6FpQrj7+gJ+8UI4I17wE5x3KBX9f1jOQiScyHNpq+3+p | ||
| + | Aexjfd4miyGq0cP+4qELK85mwU3kHpbhaD9H9o7B | ||
| + | -----END CERTIFICATE----- | ||
| + | subject=/ | ||
| + | issuer=/ | ||
| + | --- | ||
| + | No client certificate CA names sent | ||
| + | --- | ||
| + | SSL handshake has read 4277 bytes and written 490 bytes | ||
| + | --- | ||
| + | New, TLSv1/ | ||
| + | Server public key is 2048 bit | ||
| + | Secure Renegotiation IS supported | ||
| + | Compression: | ||
| + | Expansion: NONE | ||
| + | SSL-Session: | ||
| + | Protocol | ||
| + | Cipher | ||
| + | Session-ID: C876A758E505A5CF08071FD93648FDE2EA2D327D08B792C2FDDE16E0725AF164 | ||
| + | Session-ID-ctx: | ||
| + | Master-Key: B0CBC53B75E0795B52A903AF8BF6BD723B452BD312E64FF7102009049151EBF878239E5CE9B5FABA49DE3F6638F9018E | ||
| + | Key-Arg | ||
| + | Krb5 Principal: None | ||
| + | PSK identity: None | ||
| + | PSK identity hint: None | ||
| + | TLS session ticket lifetime hint: 3600 (seconds) | ||
| + | TLS session ticket: | ||
| + | 0000 - 77 d0 1c ae d7 dd c2 c8-46 b4 c0 28 7b 4d e3 06 | ||
| + | 0010 - 77 04 74 9e e5 e9 78 53-a9 0c 36 95 09 0f d8 97 | ||
| + | 0020 - 6c 4e 17 05 38 5d 9f 1c-16 85 80 05 01 7c fe 19 | ||
| + | 0030 - ba 76 8d 7d 99 cc f2 e5-ee f3 94 a2 47 23 3e 03 | ||
| + | 0040 - de 7f 3a 21 e7 f6 8e 36-d6 10 14 2b 5e 41 94 4b | ||
| + | 0050 - 3e 31 e4 5b 69 19 0b 51-47 fd 42 8f e1 8e 6a 45 > | ||
| + | 0060 - c5 a6 6e ac b9 d5 e3 a3-d0 f8 45 10 cc 1b 2b 16 | ||
| + | 0070 - c4 a0 5e 21 c6 7a ec f2-6d 8a 2b 20 12 4b 63 d5 | ||
| + | 0080 - 95 5c 68 82 f7 29 36 16-19 de 8b 65 11 b2 94 78 | ||
| + | 0090 - ff a6 db 80 b9 08 1e 5f-b2 64 d8 29 3d c8 db 68 | ||
| + | |||
| + | Start Time: 1387489519 | ||
| + | Timeout | ||
| + | Verify return code: 0 (ok) | ||
| + | --- | ||
| + | 250 DSN | ||
| + | quit | ||
| + | 221 2.0.0 Bye | ||
| + | closed | ||
| + | </ | ||
| + | |||
| + | Im obigen Beispiel sehen wir, dass: | ||
| + | * **Protokoll**: | ||
| + | * **Cipher** | ||
| + | verwendet wurden. | ||
| + | |||
| + | Die Verbindung wurde uns im Maillog entsprechend positiv quittiert: | ||
| + | < | ||
| + | Jun 15 22:46:21 vml000080 postfix/ | ||
| + | Jun 15 22:46:21 vml000080 postfix/ | ||
| + | Jun 15 22:46:22 vml000080 postfix/ | ||
| + | </ | ||
| + | |||
| + | ==== eMail-Verkehr ==== | ||
| + | Der verschlüsselte Transportweg wird in der Headerzeilen einer eMail entsprechend vermerkt: | ||
| + | < | ||
| + | by mx1.nausch.org (Postfix) with ESMTP for < | ||
| + | Auch im **Maillog** wird die gesicherte Kommunikation protokolliert: | ||
| + | < | ||
| + | Mar 26 23:40:40 nss postfix/ | ||
| + | Mar 26 23:40:52 nss postfix/ | ||
| + | |||
| + | ====== Links ====== | ||
| + | * **[[centos: | ||
| + | * **[[wiki: | ||
| + | * **[[http:// | ||
| + | |||