Enable mail encryption in postfix outgoing mails for gmail.

-
~~~ Enable mail encryption in postfix outgoing mails for gmail~~~~~

####First make a temporary directory, assuming you are signed on as root user cd /root

mkdir temp
cd /temp

####Next, generate a private key for the server.
openssl genrsa -des3 -out mail.domain.tld.key 2048
####Now it's time to create the certificate request.
openssl req -new -key mail.domain.tld.key -out mail.domain.tld.csr

####Now it's time to create the self-signed key. It will also ask for the randomly generated password.

openssl x509 -req -days 365 -in mail.domain.tld.csr -signkey mail.domain.tld.key -out mail.domain.tld.crt

####Now we need to remove the password from the private certificate so that there is no need to enter in a password when you restart postfix. You will need to enter in the randomly generated password.

openssl rsa -in mail.domain.tld.key -out mail.domain.tld.key.nopass

####The command below will overwrite the old key with the new key (without password).

mv mail.domain.tld.key.nopass mail.domain.tld.key


####Now it's time to make yourself the "trusted certificate authority".

openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650

####Make directories for the certificates and give proper chmod permissions.

mkdir -p /etc/ssl/private/
mkdir -p /etc/ssl/certs/
chmod 600 mail.domain.tld.key
chmod 600 cakey.pem
cp mail.domain.tld.key /etc/ssl/private/
cp mail.domain.tld.crt /etc/ssl/certs/
cp cakey.pem /etc/ssl/private/
cp cacert.pem /etc/ssl/certs/

####edit your /etc/postfix/main.cf file to include the following if it is not there already:

nano -w /etc/postfix/main.cf

smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_key_file = /etc/ssl/private/mail.domain.tld.key
smtpd_tls_cert_file = /etc/ssl/certs/mail.domain.tld.crt
tls_random_source = dev:/dev/urandom

####myhostname - DOMAIN NAME MUST MATCH YOUR CERTIFICATE'S "COMMON" NAME!

myhostname = yourDomainName.com

####save main.cf, then restart postfix

service postfix restart

####The below commands will copy your cacert.pem file to /usr/share/pki/ca-trust-source/anchors/

cd /etc/ssl/certs/
cp cacert.pem /usr/share/pki/ca-trust-source/anchors/
update-ca-trust

####Assign postfix permissions to the cacert.pem file. Cacert.pem = certificate authority (public, not private).

chown postfix:postfix cacert.pem

####Finally, modify postfix so that outgoing emails are TLS enabled so that emails are encrypted.

nano -w /etc/postfix/main.cf

smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_CAfile = /etc/ssl/certs/cacert.pem

systemctl restart postfix

~~~~~~~Setup DKIM ~~~~~~

install epel repo

yum install epel-release

yum install opendkim -y

MYDOMAIN=example.com
mkdir -p /etc/opendkim/keys/$MYDOMAIN
cd /etc/opendkim/keys/$MYDOMAIN
opendkim-genkey -r -d $MYDOMAIN

chown -R opendkim:opendkim /etc/opendkim
chmod go-rw /etc/opendkim/keys

vim /etc/opendkim.conf

Mode     sv
Socket   inet:8891@localhost
Domain   example.com
#KeyFile        /etc/opendkim/keys/default.private  ### comment this line
KeyTable        /etc/opendkim/KeyTable
SigningTable   refile:/etc/opendkim/SigningTable
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts   refile:/etc/opendkim/TrustedHosts

edit the domain keys lists setting file /etc/opendkim/KeyTable and add following entry.

default._domainkey.example.com example.com:default:/etc/opendkim/keys/example.com/default.private

edit /etc/opendkim/SigningTable file and update following entry.

*@example.com default._domainkey.example.com

And edit /etc/opendkim/TrustedHosts file and update following entry.

mail.example.com
example.com

Now edit POSTFIX configuration file /etc/postfix/main.cf and add following values at the end of file

smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

finally start DKIM service using following command

service opendkim start

Now there is a file generated with dns records ..
/etc/opendkim/keys/example.com/default.txt
open above and add dns dkiam txt records in your dns

Comments

Post a Comment

Popular posts from this blog

Running web ssh client on port 443 /80 with nginx as reverse proxy

-
Package used         : shellinabox , nginx Repository used        : epel-release Linux distro used    : Centos 7.6 nginx reverse proxy server ip : 192.168.1.65 shellinabox web ssh server ip : 192.168.1.111 login to web ssh server first install epel-repo # yum install epel-release -y install shellinabox package # yum -y install shellinabox start and enable shellinaboxd service # systemctl enable shellinaboxd && systemctl start shellinaboxd By default shellinaboxd service starts with ssl port 4200 for us to run this in a reverse proxy environment need to make this as insecure hence the encryption will be done by nginx to end user. edit file /etc/sysconfig/shellinabox  like bellow- USER=shellinabox GROUP=shellinabox CERTDIR=/var/lib/shellinabox PORT=4200 OPTS="--disable-ssl-menu -s /:LOGIN" OPTS="-t -s /:SSH:192.168.1.111" save file exit and restart service # systemctl restart shellinaboxd Now open firewall for listening port 4200 from nginx proxy server only #
Read more

Running cockpit behind nginx reverse proxy with nginx ssl and cockpit non ssl

-
Domain for web access to cockpit : cockpit.mylab.local cockpit server ip : 192.168.1.61 nginx server ip   : 192.168.1.65 Linux distro using is Centos 7.6 Login to cockpit server Create a file [root@repo ~]# vim /etc/cockpit/cockpit.conf content will be like [WebService] Origins = https://cockpit.mylab.local wss://cockpit.mylab.local ProtocolHeader = X-Forwarded-Proto AllowUnencrypted = true save and restart cockpit # systemctl restart cockpit now  login to your nginx webserver and install nginx # yum install nginx -y create a new file vim /etc/nginx/conf.d/cockpit.conf paste content as bellow server {     listen         80;     listen         443 ssl http2;     server_name    cockpit.mylab.local;     ssl_certificate /etc/ssl/certs/cockpit-selfsigned.crt;     ssl_certificate_key  /etc/ssl/private/cockpit-selfsigned.key;     location / {         proxy_pass http://192.168.1.61:9090;         proxy_set_header Host $host;         proxy_http_version 1.1;
Read more

Setup VOD streaming server with nginx using RTMP on Ubuntu 18.04

-
Install required packages for source code nginx build # apt-get install -y build-essential ca-certificates wget curl libpcre3 libpcre3-dev autoconf unzip automake libtool tar git libssl-dev zlib1g-dev uuid-dev lsb-release vim htop sysstat ufw fail2ban makepasswd libgd-dev libgeoip-dev -y create a directory # mkdir /usr/local/src/nginx/ # cd /usr/local/src/nginx/ download and extract nginx tar # wget -qO- http://nginx.org/download/nginx-1.14.2.tar.gz | tar zxf - clone nginx rtmp module # git clone https://github.com/arut/nginx-rtmp-module Download other modules - PCRE version 8.42 # wget https://ftp.pcre.org/pub/pcre/pcre-8.42.tar.gz && tar xzvf pcre-8.42.tar.gz - zlib version 1.2.11 # wget https://www.zlib.net/zlib-1.2.11.tar.gz && tar xzvf zlib-1.2.11.tar.gz - OpenSSL version 1.1.0h # wget https://www.openssl.org/source/openssl-1.1.0h.tar.gz && tar xzvf openssl-1.1.0h.tar.gz # cd nginx-1.14.2/ configure  nginx with modules and options # ./configure --add-modu
Read more