Mail的安全
1. 加密认证
1.1sendmail提供的服务
发送 smtps
--Smtp 明文传输
[root@mail ~]# grep smtps /etc/services
smtps 465/tcp # SMTP over SSL (TLS)
[root@mail ~]# sendmail -d0.1 -bv
Version 8.13.8
Compiled with: DNSMAP HESIOD HES_GETMAILHOST LDAPMAP LOG MAP_REGEX
MATCHGECOS MILTER MIME7TO8 MIME8TO7 NAMED_BIND NETINET NETINET6
NETUNIX NEWDB NIS PIPELINING SASLv2 SCANF SOCKETMAP STARTTLS
TCPWRAPPERS USERDB USE_LDAP_INIT
============ SYSTEM IDENTITY (after readcf) ============
(short domain name) $w = mail
(canonical domain name) $j = mail.bj.com
(subdomain name) $m = bj.com
(node name) $k = mail.bj.com
========================================================
Recipient names must be specified
[root@mail ~]#
1.2.做ca认证
#ssl安全传输/tsl标准的安全传输
[root@mail ~]# cd /etc/pki
[root@mail pki]# vim tls/openssl.cnf
45 dir = /etc/pki/CA # Where everything is kept
87 [ policy_match ]
88 countryName = optional
89 stateOrProvinceName = optional
90 organizationName = optional
[root@mail pki]# cd CA/
[root@mail CA]# mkdir certs newcerts crl
[root@mail CA]# touch index.txt serial
[root@mail CA]# echo "01">serial
[root@mail CA]# openssl genrsa 1024 > private/cakey.pem
Generating RSA private key, 1024 bit long modulus
.......................................++++++
...............++++++
e is 65537 (0x10001)
[root@mail CA]# chmod 600 private/*
[root@mail CA]# openssl req -x509 -new -key private/cakey.pem -out cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:HN
Locality Name (eg, city) [Newbury]:ZZ
Organization Name (eg, company) [My Company Ltd]:ZZU
Organizational Unit Name (eg, section) []:sendmail
Common Name (eg, your name or your server's hostname) []:mail.sh.com
Email Address []:
[root@mail CA]# cd /etc/mail
[root@mail mail]# mkdir certs/
[root@mail mail]# cd certs/
[root@mail certs]# openssl genrsa 1024 >sendmail.key
Generating RSA private key, 1024 bit long modulus
...............++++++
.........................................++++++
e is 65537 (0x10001)
[root@mail certs]# openssl req -new -key sendmail.key -out sendmail.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:HN
Locality Name (eg, city) [Newbury]:ZZ
Organization Name (eg, company) [My Company Ltd]:ZZU
Organizational Unit Name (eg, section) []:sendmail
Common Name (eg, your name or your server's hostname) []:mail.sh.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
--签发证书
[root@mail certs]# openssl ca -in sendmail.csr -out sendmail.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Sep 15 22:00:40 2011 GMT
Not After : Sep 14 22:00:40 2012 GMT
Subject:
countryName = CN
stateOrProvinceName = HN
organizationName = ZZU
organizationalUnitName = sendmail
commonName = mail.sh.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
21:9F:4D:91:74:C6:80:EA:B0:38:F4:F2:8D:68:A7:08:4A:15:7F:92
X509v3 Authority Key Identifier:
keyid:CC:F1:AE:5C:1E:96:41:35:AB:3A:E0:69:7C:52:98:D4:35:D9:8F:C2
Certificate is to be certified until Sep 14 22:00:40 2012 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@mail certs]# cp /etc/pki/CA/cacert.pem ./
[root@mail certs]# chmod 600 *
1.3.修改配置文件sendmail.mc
[root@mail CA]# vim /etc/mail/sendmail.mc
--启用认证
39 define(`confAUTH_OPTIONS', `A y')dnl
--信用机制
52 TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
53 define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLA IN')dnl
--启用证书
60 define(`confCACERT_PATH', `/etc/mail/certs')dnl
61 define(`confCACERT', `/etc/mail/certs/cacert.pem')dnl
62 define(`confSERVER_CERT', `/etc/mail/certs/sendmail.crt')dnl
63 define(`confSERVER_KEY', `/etc/mail/certs/sendmail.key')dnl
118 DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA')dnl
136 DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl
[root@mail CA]# service sendmail restart
29-1
29-2
账号的域名要与证书的域名相同，否则不信任。
2.Sasl 简单认证安全层
点到点的机制。
2.1.安装认证
服务名称saslauthd，默认是没有启用的
要测试是否启用了认证
--减少垃圾邮件的攻击
[root@mail ~]# yum list all |grep sasl
This system is not registered with RHN.
RHN support will be disabled.
cyrus-sasl.i386 2.1.22-4 installed
cyrus-sasl-devel.i386 2.1.22-4 installed
cyrus-sasl-lib.i386 2.1.22-4 installed
cyrus-sasl-plain.i386 2.1.22-4 installed
[root@mail ~]# chkconfig saslauthd on
[root@mail ~]# chkconfig --list |grep sasl
saslauthd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@mail certs]# service saslauthd start
#vim /etc/mail/sendmail.mc
--Mta增加强制认证
118 DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA,M=Ea')dnl
2.2.描述认证方法
[root@mail lib]# cd /usr/lib/sasl2
[root@mail sasl2]# vim Sendmail.conf
pwcheck_method:saslauthd
mech_list:login plain –可以不加，描述的验证机制。
[root@mail sasl2]# service sendmail restart
2.3生成用户信息的密文
--base64编码得到密文，-n 去除换行
[root@mail certs]# echo -n "user5@sh.com"|openssl base64
dXNlcjVAc2guY29t
[root@mail certs]# echo -n "123"|openssl base64
MTIz
2.4 测试认证
[root@mail sasl2]# telnet mail.sh.com 25
Trying 192.168.101.71...
Connected to mail.sh.com (192.168.101.71).
Escape character is '^]'.
220 mail.sh.com ESMTP Sendmail 8.13.8/8.13.8; Fri, 16 Sep 2011 06:39:13 +0800
helo mail.sh.com
250 mail.sh.com Hello mail.sh.com [192.168.101.71], pleased to meet you
ehlo mail.sh.com
250-mail.sh.com Hello mail.sh.com [192.168.101.71], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-AUTH LOGIN PLAIN –在开启sasl前是没有的，验证可以防止非法或不存在的用户发邮件。
250-STARTTLS
250-DELIVERBY
250 HELP
auth login dXNlcjVAc2guY29t
334 UGFzc3dvcmQ6
MTIz
235 2.0.0 OK Authenticated
mail from:user5@mail.sh.com
250 2.1.0 user5@mail.sh.com... Sender ok
rcpt to :user6@mail.sh.com
250 2.1.5 user6@mail.sh.com... Recipient ok
data
354 Enter mail, end with "." on a line by itself
subject hh
hello user6.
250 2.0.0 p8FMdDZN008247 Message accepted for delivery
quit
221 2.0.0 mail.sh.com closing connection
Connection closed by foreign host.
2.5 对方测试接收文件
[root@mail sasl2]# su - user6
[user6@mail ~]$ mail
Mail version 8.1 6/6/93. Type ? for help.
"/var/spool/mail/user6": 2 messages 1 new
1 MAILER-DAEMON@mail.s Thu Sep 15 19:09 13/542 "DON'T DELETE THIS MES"
>N 2 user5@mail.sh.com Fri Sep 16 06:46 13/423
& 2
Message 2:
From user5@mail.sh.com Fri Sep 16 06:46:21 2011
Date: Fri, 16 Sep 2011 06:45:54 +0800
From: user5@mail.sh.com
subject hh
hello user6.
&
3.抓包工具
[root@mail ~]# yum list all |grep shark
This system is not registered with RHN.
RHN support will be disabled.
wireshark.i386 1.0.3-4.el5_2 rehl-server
wireshark-gnome.i386 1.0.3-4.el5_2 rehl-server
[root@mail ~]# yum install wireshark
4.实现imaps pop3s接收
4.1生成dovecot的证书文件
[root@mail sasl2]# cd /usr/lib/sasl2
[root@mail sasl2]# mkdir -pv /etc/dovecot/certs
mkdir: created directory `/etc/dovecot'
mkdir: created directory `/etc/dovecot/certs'
[root@mail sasl2]# cd /etc/dovecot/certs/
--导出钥匙
[root@mail certs]# openssl genrsa 1024 >dovecot.key
Generating RSA private key, 1024 bit long modulus
...................................++++++
...............................++++++
e is 65537 (0x10001)
--输出证书请求文件
[root@mail certs]# openssl req -new -key dovecot.key -out dovecot.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:HN
Locality Name (eg, city) [Newbury]:ZZ
Organization Name (eg, company) [My Company Ltd]:ZZU
Organizational Unit Name (eg, section) []:sendmail
Common Name (eg, your name or your server's hostname) []:imap.sh.com
--域名要与账号发送接收的相同
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
4.2-颁发证书
[root@mail certs]# openssl ca -in dovecot.csr -out dovecot.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 2 (0x2)
Validity
Not Before: Sep 15 23:01:08 2011 GMT
Not After : Sep 14 23:01:08 2012 GMT
Subject:
countryName = CN
stateOrProvinceName = HN
organizationName = ZZU
organizationalUnitName = sendmail
commonName = mail.sh.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
BB:2C:B9:99:11:D1:E5:85:53:7F:8E:FE:E4:FC:C2:35:95:2E:08:87
X509v3 Authority Key Identifier:
keyid:CC:F1:AE:5C:1E:96:41:35:AB:3A:E0:69:7C:52:98:D4:35:D9:8F:C2
Certificate is to be certified until Sep 14 23:01:08 2012 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
4.3 编辑dovecot配置文件
[root@mail certs]# vim /etc/dovecot.conf
protocols = imap imaps pop3 pop3s
--接收证书服务器的文件
92 ssl_cert_file = /etc/dovecot/certs/dovecot.crt
93 ssl_key_file = /etc/dovecot/certs/dovecot.key
[root@mail certs]# chmod 600 *
[root@mail certs]# service dovecot restart
[root@mail certs]# netstat -tulpn |grep dov
4.4添加imap的记录
[root@mail ~]# vim /var/named/chroot/var/named/sh.com.db
$TTL 86400
@ IN SOA ns.sh.com. root.126.com (
44 ; serial (d. adams)
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
@ IN NS ns.sh.com.
ns IN A 192.168.101.71
mail IN A 192.168.101.71
pop3 IN CNAME mail
smtp IN CNAME mail
imap IN CNAME mail
@ IN MX 10 mail
[root@mail ~]# rndc reload
server reload successful
[root@mail ~]# dig imap.sh.com
4．5开启抓包功能
--明文抓包结果
[root@mail certs]# tshark -ni eth0 -R "tcp.srcport eq 110 or tcp.dstport eq 110"Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
302.590811 192.168.101.213 -> 192.168.101.71 TCP 1101 > 110 [SYN] Seq=0 Win=65535 Len=0 MSS=1460
302.590888 192.168.101.71 -> 192.168.101.213 TCP 110 > 1101 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460
302.591092 192.168.101.213 -> 192.168.101.71 TCP 1101 > 110 [ACK] Seq=1 Ack=1 Win=65535 Len=0
302.591257 192.168.101.71 -> 192.168.101.213 POP Response: +OK Dovecot ready.
302.591718 192.168.101.213 -> 192.168.101.71 POP Request: USER user6
302.591753 192.168.101.71 -> 192.168.101.213 TCP 110 > 1101 [ACK] Seq=21 Ack=13 Win=5840 Len=0
302.591877 192.168.101.71 -> 192.168.101.213 POP Response: +OK
302.592048 192.168.101.213 -> 192.168.101.71 POP Request: PASS 123
302.600894 192.168.101.71 -> 192.168.101.213 POP Response: +OK Logged in.
302.601742 192.168.101.213 -> 192.168.101.71 POP Request: STAT
302.642575 192.168.101.71 -> 192.168.101.213 TCP 110 > 1101 [ACK] Seq=42 Ack=29 Win=5840 Len=0
302.648145 192.168.101.71 -> 192.168.101.213 POP Response: +OK 0 0
302.648920 192.168.101.213 -> 192.168.101.71 POP Request: QUIT
302.648973 192.168.101.71 -> 192.168.101.213 TCP 110 > 1101 [ACK] Seq=51 Ack=35 Win=5840 Len=0
302.649177 192.168.101.71 -> 192.168.101.213 POP Response: +OK Logging out.
--配置imaps后抓包结果
服务器身份验证可以是任意一种，登陆方式是在用户首次使用是要输入用户名和密码
29-3
29-4
[root@mail ~]# tshark -ni eth0 -R "tcp.srcport eq 993 or tcp.dstport eq 993"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
4.471940 192.168.101.213 -> 192.168.101.71 TLSv1 Application Data
4.471943 192.168.101.213 -> 192.168.101.71 TCP 1147 > 993 [FIN, ACK] Seq=41 Ack=1 Win=64377 Len=0
4.473771 192.168.101.71 -> 192.168.101.213 TCP 993 > 1147 [FIN, ACK] Seq=1 Ack=42 Win=6432 Len=0
4.480719 192.168.101.213 -> 192.168.101.71 TCP 1147 > 993 [ACK] Seq=42 Ack=2 Win=64377 Len=0
48.113729 192.168.101.213 -> 192.168.101.71 TCP 1149 > 993 [SYN] Seq=0 Win=65535 Len=0 MSS=1460
48.113810 192.168.101.71 -> 192.168.101.213 TCP 993 > 1149 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460
48.113889 192.168.101.213 -> 192.168.101.71 TCP 1149 > 993 [ACK] Seq=1 Ack=1 Win=65535 Len=0
48.114100 192.168.101.213 -> 192.168.101.71 SSL Client Hello
48.114119 192.168.101.71 -> 192.168.101.213 TCP 993 > 1149 [ACK] Seq=1 Ack=103 Win=5840 Len=0
48.116103 192.168.101.71 -> 192.168.101.213 TLSv1 Server Hello, Certificate, Server Hello Done
48.116845 192.168.101.213 -> 192.168.101.71 TLSv1 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
48.118198 192.168.101.71 -> 192.168.101.213 TLSv1 Change Cipher Spec, Encrypted Handshake Message
48.319185 192.168.101.71 -> 192.168.101.213 TLSv1 [TCP Retransmission] Change Cipher Spec, Encrypted Handshake Message
48.319447 192.168.101.213 -> 192.168.101.71 TCP 1149 > 993 [ACK] Seq=285 Ack=823 Win=64713 Len=0
48.319469 192.168.101.71 -> 192.168.101.213 TLSv1 Application Data
48.320517 192.168.101.213 -> 192.168.101.71 TLSv1 Application Data
48.320690 192.168.101.71 -> 192.168.101.213 TLSv1 Application Data
48.321276 192.168.101.213 -> 192.168.101.71 TLSv1 Application Data
48.329138 192.168.101.71 -> 192.168.101.213 TLSv1 Application Data
48.330432 192.168.101.213 -> 192.168.101.71 TLSv1 Application Data
48.330753 192.168.101.71 -> 192.168.101.213 TLSv1 Application Data
48.331100 192.168.101.213 -> 192.168.101.71 TLSv1 Application Data
48.331247 192.168.101.71 -> 192.168.101.213 TLSv1 Application Data
48.331472 192.168.101.213 -> 192.168.101.71 TLSv1 Application Data
48.332986 192.168.101.71 -> 192.168.101.213 TLSv1 Application Data
48.333306 192.168.101.213 -> 192.168.101.71 TLSv1 Application Data
