1,234
edits
Changes
→Encrypting Email Connections
We're going to secure the two connections that we left to be in plain text previously. Unfortunately encrypting things is rarely a straighforward process. Fortunately we have a whole week to spend on it.
== Generating a Self-signed Certificate ==
Normally (in production) you need to pay a certificate authority to issue a certificate for you. That's essentially a signed public key that will tell strangers on the internet your server is really yours (the certificate authority says so). There's an obvious problem with the previous statement but that's mostly how public key encryption works on the internet today.
We'll be generating our own, mostly in order to avoid paying for the certificate. We won't have too much time to get into the details of what all the following commands do. They are from [https://www.e-rave.nl/create-a-self-signed-ssl-key-for-postfix this blog post]. If you don't understand what he's talking about on that page but would like to understand - I'll again recommend the book Crypto by Steven Levy for reading outside this course.
=== Postfix + TLS ===
Let's start with the "sending" SMTP server we have on VM2. Run the following, replacing andrewsmith.org with your own domain name:
<source lang="bash">openssl genrsa -des3 -out andrewsmith.org.key 2048
chmod 600 andrewsmith.org.key
openssl req -new -key andrewsmith.org.key -out andrewsmith.org.csr
openssl x509 -req -days 365 -in andrewsmith.org.csr -signkey andrewsmith.org.key -out andrewsmith.org.crt
openssl rsa -in andrewsmith.org.key -out andrewsmith.org.key.nopass
mv andrewsmith.org.key.nopass andrewsmith.org.key
openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650
chmod 600 andrewsmith.org.key cakey.pem
cp andrewsmith.org.key cakey.pem /etc/ssl/private/
cp andrewsmith.org.crt cacert.pem /etc/ssl/certs/</source>
Those commands will create a certificate, a certificate signing request, a certificate authority, and a sign your certificate with your certificate authority. Same as in the real world except there you would contact a real CA, here you're making up your own.