From 67d31ed998b6c0310d5983ac19f3659a3d29f191 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Sat, 21 Jun 2014 22:15:53 +0000 Subject: [PATCH] move the SSL setup into its own bash script since it is used for much more than email now --- management/dns_update.py | 7 +++---- setup/mail.sh | 26 +----------------------- setup/ssl.sh | 43 ++++++++++++++++++++++++++++++++++++++++ setup/start.sh | 1 + 4 files changed, 48 insertions(+), 29 deletions(-) create mode 100755 setup/ssl.sh diff --git a/management/dns_update.py b/management/dns_update.py index d6edc7ce..8e3b135b 100755 --- a/management/dns_update.py +++ b/management/dns_update.py @@ -132,7 +132,7 @@ def build_zone(domain, zonefile, env, with_ns=True): records.append(("ns1", "A", env["PUBLIC_IP"])) records.append(("ns2", "A", env["PUBLIC_IP"])) - # Add a TLSA record for SMTP. + # Add a DANE TLSA record for SMTP. records.append(("_25._tcp", "TLSA", build_tlsa_record(env))) def has_rec(qname, rtype): @@ -179,9 +179,8 @@ def build_zone(domain, zonefile, env, with_ns=True): ######################################################################## def build_tlsa_record(env): - # A TLSA record in DNS specifies that connections on a port, e.g. - # the SMTP port, must use TLS and the certificate must match a - # particular certificate. + # A DANE TLSA record in DNS specifies that connections on a port + # must use TLS and the certificate must match a particular certificate. # # Thanks to http://blog.huque.com/2012/10/dnssec-and-certificates.html # for explaining all of this! diff --git a/setup/mail.sh b/setup/mail.sh index c18379d6..90a50736 100755 --- a/setup/mail.sh +++ b/setup/mail.sh @@ -18,8 +18,7 @@ source /etc/mailinabox.conf # load global vars apt_install \ postfix postgrey postfix-pcre \ - dovecot-core dovecot-imapd dovecot-lmtpd dovecot-sqlite sqlite3 \ - openssl + dovecot-core dovecot-imapd dovecot-lmtpd dovecot-sqlite sqlite3 mkdir -p $STORAGE_ROOT/mail @@ -244,29 +243,6 @@ tools/editconf.py /etc/dovecot/conf.d/10-ssl.conf \ "ssl_cert=<$STORAGE_ROOT/ssl/ssl_certificate.pem" \ "ssl_key=<$STORAGE_ROOT/ssl/ssl_private_key.pem" \ -# SSL CERTIFICATE - -mkdir -p $STORAGE_ROOT/ssl -if [ ! -f $STORAGE_ROOT/ssl/ssl_certificate.pem ]; then - # Generate a new private key if one doesn't already exist. - # Set the umask so the key file is not world-readable. - (umask 077; openssl genrsa -out $STORAGE_ROOT/ssl/ssl_private_key.pem 2048) -fi -if [ ! -f $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr ]; then - # Generate a certificate signing request if one doesn't already exist. - openssl req -new -key $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr \ - -subj "/C=$CSR_COUNTRY/ST=/L=/O=/CN=$PUBLIC_HOSTNAME" -fi -if [ ! -f $STORAGE_ROOT/ssl/ssl_certificate.pem ]; then - # Generate a SSL certificate by self-signing if a SSL certificate doesn't yet exist. - openssl x509 -req -days 365 \ - -in $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr -signkey $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_certificate.pem -fi -echo -echo "Your SSL certificate's fingerpint is:" -openssl x509 -in /home/user-data/ssl/ssl_certificate.pem -noout -fingerprint -echo - # PERMISSIONS / RESTART SERVICES # Ensure configuration files are owned by dovecot and not world readable. diff --git a/setup/ssl.sh b/setup/ssl.sh new file mode 100755 index 00000000..724bf459 --- /dev/null +++ b/setup/ssl.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# +# SSL Certificate +# +# Create a self-signed SSL certificate if one has not yet been created. +# +# The certificate is for PUBLIC_HOSTNAME specifically and is used for: +# +# * IMAP +# * SMTP submission (port 587) and opportunistic TLS (when on the receiving end) +# * the DNSSEC DANE TLSA record for SMTP +# * HTTPS (for PUBLIC_HOSTNAME only) +# +# When other domains besides PUBLIC_HOSTNAME are served over HTTPS, +# we generate a domain-specific self-signed certificate in the management +# daemon (web_update.py) as needed. + +source setup/functions.sh # load our functions +source /etc/mailinabox.conf # load global vars + +apt_install openssl + +mkdir -p $STORAGE_ROOT/ssl +if [ ! -f $STORAGE_ROOT/ssl/ssl_certificate.pem ]; then + # Generate a new private key if one doesn't already exist. + # Set the umask so the key file is not world-readable. + (umask 077; openssl genrsa -out $STORAGE_ROOT/ssl/ssl_private_key.pem 2048) +fi +if [ ! -f $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr ]; then + # Generate a certificate signing request if one doesn't already exist. + openssl req -new -key $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr \ + -subj "/C=$CSR_COUNTRY/ST=/L=/O=/CN=$PUBLIC_HOSTNAME" +fi +if [ ! -f $STORAGE_ROOT/ssl/ssl_certificate.pem ]; then + # Generate a SSL certificate by self-signing if a SSL certificate doesn't yet exist. + openssl x509 -req -days 365 \ + -in $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr -signkey $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_certificate.pem +fi + +echo +echo "Your SSL certificate's fingerpint is:" +openssl x509 -in /home/user-data/ssl/ssl_certificate.pem -noout -fingerprint +echo diff --git a/setup/start.sh b/setup/start.sh index 3c3b36ce..a8d30025 100755 --- a/setup/start.sh +++ b/setup/start.sh @@ -122,6 +122,7 @@ EOF # Start service configuration. . setup/system.sh +. setup/ssl.sh . setup/dns.sh . setup/mail.sh . setup/dkim.sh