|
|
| Zeile 25: |
Zeile 25: |
| *[[Postfix/Dovecot ohne LDAP]] | | *[[Postfix/Dovecot ohne LDAP]] |
| *[[Postfix/Dovecot mit LDAP]] | | *[[Postfix/Dovecot mit LDAP]] |
|
| |
| =Erstes Ziel Ldap Anbindung verschlüsselt=
| |
| *apt install ldap-utils
| |
| ;lab34-ca.cer auf den Mailserver kopieren
| |
| ;Zertifikat einbauen unter Linux
| |
| *cp lab34-ca.cer /usr/local/share/ca-certificates/lab34-ca.crt
| |
| *sudo update-ca-certificates
| |
| ;Test ob das Zertifikat, mit eingebauten root-ca zieht
| |
| *openssl s_client -port 636 -host win2022.lab34.linuggs.de
| |
| ;/etc/ldap/ldap.conf anpassen
| |
| BASE dc=lab34,dc=linuggs,dc=de
| |
| URI ldaps://win2022.lab34.linuggs.de
| |
| LDAPDEBUG 1
| |
| TLS_CACERT /etc/ssl/certs/ca-certificates.crt
| |
| =Wir legen auf dem DC einen MailService Nutzer an=
| |
| [[Datei:Mail-lab-1.png]]
| |
| =Test=
| |
| *ldapsearch -LLL -x -H ldaps://win2022.lab34.linuggs.de -D "cn=mailservice,cn=users,dc=lab34,dc=linuggs,dc=de" -w '12345-Xinux' -b DC=lab34,DC=linuggs,DC=de
| |
| [[Datei:Mailuser-ad-1.png]]
| |
|
| |
| [[Datei:Mailuser-ad-2.png]]
| |
|
| |
| =Gruppe Mailuser in der AD anlegen=
| |
| *User die Mails erhalten sollen hinzufügen
| |
|
| |
| =Installation des Mailserverkomponenten=
| |
| *apt install postfix dovecot-core dovecot-imapd libsasl2-modules postfix-ldap dovecot-ldap dovecot-lmtpd
| |
| ;Wir wählen
| |
| Internetsite
| |
| Systemname: mail.lab34.linuggs.de
| |
|
| |
| =Wir besorgen uns ein öffentliches Zertifikat=
| |
| *wget https://xinux.de/downloads/linuggs.de/lab34.linuggs.de.tgz
| |
| *tar -xvzf lab34.linuggs.de.tgz
| |
| *mv fullchain.pem star.lab34.linuggs.de.crt
| |
| *mv privkey.pem star.lab34.linuggs.de.key
| |
| *sudo cp star.lab34.linuggs.de.crt /etc/ssl/certs/
| |
| *sudo cp star.lab34.linuggs.de.key /etc/ssl/private/
| |
| *sudo chmod 600 /etc/ssl/private/star.lab34.linuggs.de.key
| |
|
| |
| =Postfix Konfiguration=
| |
| ==ldapuser ziehen wir von der ADS==
| |
| *vi /etc/postfix/ldap-users.cf
| |
| <pre>
| |
| hosts = win2022.lab34.linuggs.de
| |
| dn = cn=mailservice,cn=users,dc=lab34,dc=linuggs,dc=de
| |
| dnpass = 12345-Xinux
| |
| base = dc=lab34,dc=linuggs,dc=de
| |
| user_filter = (&(objectClass=user)(sAMAccountName=%u)(memberOf=CN=mailuser,CN=Users,DC=lab34,DC=linuggs,DC=de))
| |
| pass_filter = (&(objectClass=user)(sAMAccountName=%u)(memberOf=CN=mailuser,CN=Users,DC=lab34,DC=linuggs,DC=de))
| |
| default_pass_scheme = SSHA
| |
| tls = yes
| |
| tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt
| |
| </pre>
| |
|
| |
| ==/etc/postfix/main.cf==
| |
| smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
| |
| biff = no
| |
| append_dot_mydomain = no
| |
| readme_directory = no
| |
| compatibility_level = 3.6
| |
| '''smtpd_tls_cert_file=/etc/ssl/certs/star.lab34.linuggs.de.crt'''
| |
| '''smtpd_tls_key_file=/etc/ssl/private/star.lab34.linuggs.de.key'''
| |
| '''smtpd_tls_security_level=may'''
| |
| '''smtp_tls_security_level=may'''
| |
| '''smtpd_tls_loglevel = 1'''
| |
| '''smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt'''
| |
| '''smtp_tls_CApath=/etc/ssl/certs'''
| |
| '''smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache'''
| |
| smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
| |
| myhostname = mail.lab34.linuggs.de
| |
| alias_maps = hash:/etc/aliases
| |
| alias_database = hash:/etc/aliases
| |
| myorigin = /etc/mailname
| |
| mydestination = $myhostname, mail.lab34.linuggs.de, mail, localhost.localdomain, localhost
| |
| relayhost =
| |
| mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
| |
| mailbox_size_limit = 0
| |
| recipient_delimiter = +
| |
| inet_interfaces = all
| |
| inet_protocols = all
| |
| ''' # LDAP-basierte Benutzerüberprüfung'''
| |
| ''' virtual_mailbox_domains = lab34.linuggs.de'''
| |
| ''' virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf'''
| |
|
| |
| ''' # Dovecot-Authentifizierung'''
| |
| ''' smtpd_sasl_type = dovecot'''
| |
| ''' smtpd_sasl_path = private/auth'''
| |
| ''' smtpd_sasl_auth_enable = yes'''
| |
| ''' smtpd_sasl_security_options = noanonymous'''
| |
| ''' smtpd_sasl_local_domain = $myhostname'''
| |
| ''' broken_sasl_auth_clients = yes'''
| |
|
| |
| ''' # LMTP-Zustellung an Dovecot'''
| |
| ''' virtual_transport = lmtp:unix:private/dovecot-lmtp'''
| |
| ==/etc/postfix/master.cf==
| |
| ;Dies hier anfügen
| |
| smtps inet n - y - - smtpd
| |
| -o smtpd_tls_wrappermode=yes
| |
| -o smtpd_sasl_auth_enable=yes
| |
| -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
| |
| -o smtpd_tls_security_level=encrypt
| |
| -o smtpd_tls_cert_file=/etc/ssl/certs/star.lab34.linuggs.de.crt
| |
| -o smtpd_tls_key_file=/etc/ssl/private/star.lab34.linuggs.de.key
| |
| -o smtpd_tls_CAfile=/etc/ssl/certs/ca-certificates.crt
| |
|
| |
| ==Check Check==
| |
| postfix check
| |
|
| |
| ==Postfix restart und Tests==
| |
| *systemctl restart postix
| |
| ;Geht TLS?
| |
| *openssl s_client -connect mail.lab34.linuggs.de:465
| |
| ;Sind die User da?
| |
| *postmap -q "thomas" ldap:/etc/postfix/ldap-users.cf
| |
| thomas@lab34.linuggs.de
| |
| *postmap -q "rudi" ldap:/etc/postfix/ldap-users.cf
| |
| rudi@lab34.linuggs.de
| |
|
| |
| =Konfiguration von Dovecot für IMAPS mit LDAP-Anbindung=
| |
| ==Dovecot SSL-Konfiguration==
| |
| *Öffne die Datei 10-ssl.conf:
| |
| *vi /etc/dovecot/conf.d/10-ssl.conf
| |
| *Füge die Zertifikate ein:
| |
| ssl = yes
| |
| ssl_cert = </etc/ssl/certs/star.lab34.linuggs.de.crt
| |
| ssl_key = </etc/ssl/private/star.lab34.linuggs.de.key
| |
| ssl_min_protocol = TLSv1.2
| |
| ssl_cipher_list = HIGH:!aNULL:!MD5
| |
|
| |
| ==Dovecot Mail-Protokolle konfigurieren==
| |
| *Öffne die Datei 10-master.conf:
| |
| *vi /etc/dovecot/conf.d/10-master.conf
| |
| *Suche den Abschnitt service imap-login und passe ihn an:
| |
| service imap-login {
| |
| inet_listener imap {
| |
| port = 143
| |
| }
| |
| inet_listener imaps {
| |
| port = 993
| |
| ssl = yes
| |
| }
| |
| }
| |
|
| |
| ==Konfiguration des Mailstandortes==
| |
| *Öffne die Datei 10-mail.conf:
| |
| *vi /etc/dovecot/conf.d/10-mail.conf
| |
| *Füge den folgenden Mailstandort ein:
| |
| mail_location = maildir:/var/mail/vhosts/%d/%n
| |
| mail_home = /var/mail/vhosts/%d/%n
| |
| mail_privileged_group = mail
| |
|
| |
| ==LDAP-Verknüpfung in Dovecot einrichten==
| |
| *Öffne die Datei dovecot-ldap.conf.ext:
| |
| *vi /etc/dovecot/dovecot-ldap.conf.ext
| |
| *Füge die LDAP-Konfiguration hinzu:
| |
| hosts = ldaps://win2022.lab34.linuggs.de
| |
| dn = cn=mailservice,cn=users,dc=lab34,dc=linuggs,dc=de
| |
| dnpass = 12345-Xinux
| |
| base = dc=lab34,dc=linuggs,dc=de
| |
| user_filter = (&(objectClass=user)(sAMAccountName=%u)(memberOf=CN=mailuser,CN=Users,DC=lab34,DC=linuggs,DC=de))
| |
| pass_filter = (&(objectClass=user)(sAMAccountName=%u)(memberOf=CN=mailuser,CN=Users,DC=lab34,DC=linuggs,DC=de))
| |
| default_pass_scheme = SSHA
| |
|
| |
| ==Dovecot für die Verwendung von LDAP konfigurieren==
| |
| *Öffne die Datei 10-auth.conf:
| |
| *vi /etc/dovecot/conf.d/10-auth.conf
| |
| *Aktiviere LDAP-Authentifizierung:
| |
| '''!include auth-ldap.conf.ext'''
| |
|
| |
| ==Benutzer- und Passwortdatenbank auf LDAP setzen==
| |
| *Öffne die Datei auth-ldap.conf.ext:
| |
| *vi /etc/dovecot/conf.d/auth-ldap.conf.ext
| |
| *Konfiguriere die LDAP-Backend-Nutzung:
| |
| passdb {
| |
| driver = ldap
| |
| args = /etc/dovecot/dovecot-ldap.conf.ext
| |
| }
| |
|
| |
| userdb {
| |
| driver = ldap
| |
| args = /etc/dovecot/dovecot-ldap.conf.ext
| |
| }
| |
|
| |
| ==Dovecot neu starten==
| |
| *Starte Dovecot neu, um die Änderungen zu übernehmen:
| |
| sudo systemctl restart dovecot
| |
|
| |
| ==Testen==
| |
| *Überprüfe, ob die Benutzer nun über IMAPS authentifiziert werden können:
| |
| openssl s_client -connect mail.lab34.linuggs.de:993 -crlf
| |