SECURITY 03： 郵件服務TLS/SSL 、 總結和答疑 、 CA數字證書服務
部署CA服務器
郵件加密
網站加密
+++++++++++++++++++++++++++++
部署CA服務器 (54) 機構名稱 tarenaa
ca服務器主機名 catwo.tedu.cn
ip 192.168.4.54
部署CA服務器 (55) 機構名稱 tarena
ca服務器主機名 ca.tedu.cn
ip 192.168.4.55
192.168.4.55
1 、部署證書簽發環境
]# vim /etc/pki/tls/openssl.cnf
40 [ CA_default ]
42 dir = /etc/pki/CA
45 database = $dir/index.txt
50 certificate = $dir/my-ca.crt
51 serial = $dir/serial
55 private_key = $dir/private/my-ca.key
128 [ req_distinguished_name ]
130 countryName_default = CN 國家
135 stateOrProvinceName_default = beijing 省
141 0.organizationName_default = tarena 公司名稱
148 organizationalUnitName_default = ope 部門名稱
84 [ policy_match ] // 匹配策略
85 countryName = match
86 stateOrProvinceName = match
87 organizationName = match
88 organizationalUnitName = optional
90 emailAddress = optional
根據配置文件的設置創建對應的文件
123 echo 01 > /etc/pki/CA/serial
124 cat /etc/pki/CA/serial
125 chmod 600 /etc/pki/CA/serial
118 touch /etc/pki/CA/index.txt
120 cat /etc/pki/CA/index.txt
122 chmod 600 /etc/pki/CA/index.txt
創建私鑰文件
#cd /etc/pki/CA/private
openssl genrsa -des3 2048 > my-ca.key (密碼123456)
#cat my-ca.key
#chmod 600 my-ca.key
創建根證書文件
#cd /etc/pki/CA
[root@host55 CA]# openssl req -new -x509 -key ./private/my-ca.key -days 365 > my-ca.crt
Enter pass phrase for ./private/my-ca.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
Country Name (2 letter code) [CN]:
State or Province Name (full name) [beijing]:
Locality Name (eg, city) [beijing]:
Organization Name (eg, company) [tarena]:
Organizational Unit Name (eg, section) [ope]:
Common Name (eg, your name or your server‘s hostname) []:ca.tedu.cn
Email Address []:[email protected]
[root@host55 CA]#
+++++++++++++++++++++++++++++++++
共享根證書給客戶端 (55)
138 rpm -q httpd || yum -y install httpd
139 mkdir /var/www/html/ca
140 cp /etc/pki/CA/my-ca.crt /var/www/html/ca/
141 chmod +r /var/www/html/ca/my-ca.crt
142 systemctl start httpd
143 systemctl enable httpd
144 setenforce 0
145 systemctl stop firewalld
254客戶端的測試（下載根證書並安裝根證書）
firefox http://192.168.4.55/ca
++++++++++++++++++++++++++++++++++++++++
配置網站加密 HTTPS
#rpm -q httpd || yum -y install httpd
#echo web53 > /var/www/html/test.html
#systemctl start httpd ; systemctl enable httpd
#netstat -utnalp | grep httpd
客戶端訪問254
#vim /etc/hosts
192.168.4.53 www.tedu.cn
:wq
ping -c 2 www.tedu.cn
www.tedu.cn
http://192.168.4.53/test.html
https://192.168.4.53/test.html配置網站服務器 192.168.4.53
1 創建私鑰文件
#cd /etc/pki/tls/private/
#openssl genrsa 2048 > www.key
2 創建證書請求文件
]# openssl req -new -key www.key > /root/www.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:tarena
Organizational Unit Name (eg, section) []:ope
Common Name (eg, your name or your server‘s hostname) []:www.tedu.cn
Email Address []:[email protected]
Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@host53 private]#
[root@host53 private]# cat /root/www.csr
3 提交證書請求文件給CA服務器
#scp /root/www.csr 192.168.4.55:/tmp/
配置CA服務器192.168.4.55
1 審核證書請求文件並簽發數字證書文件
#ls /tmp/www.csr
#cd /etc/pki/CA/certs
#openssl ca -in /tmp/www.csr > www.crt
2 下發數字證書文件給網站服務器
#scp www.crt 192.168.4.53:/tmp/
3 在 網站服務器 配置 網站服務在運行時，調用私鑰文件和數字證書文件，然後重啟網站服務
yum -y install mod_ssl
]# vim /etc/httpd/conf.d/ssl.conf
100 SSLCertificateFile /etc/pki/tls/certs/www.crt
107 SSLCertificateKeyFile /etc/pki/tls/private/www.key
:wq
cp /tmp/www.crt /etc/pki/tls/certs/
[root@host53 ~]# ls /etc/pki/tls/private/
localhost.key www.key
#systemctl restart httpd
#netstat -utnalp | grep httpd
[root@host53 ~]# netstat -utnalp | grep httpd
tcp6 0 0 :::80 ::: LISTEN 26098/httpd
tcp6 0 0 :::443 ::: LISTEN 26098/httpd
4客戶端驗證配置192.168.4.254
++++++++++++++++++++++++++++
在主機52 做郵件服務器
能夠發郵件（運行postfix服務）
#yum -y install postfix
#systemctl start postfix ; systemctl enable postfix
#netstat -utnalp | grep :25
#ps -C master
vim /etc/postfix/main.cf
113 inet_interfaces = all
116 #inet_interfaces = localhost
419 home_mailbox = Maildir/
:wq
#systemctl restart postfix
添加本地郵箱賬號 並測試能否發送郵件
useradd jerry ;echo 123456 | passwd --stdin jerry
useradd lili ;echo 123456 | passwd --stdin lili
jerry@localhost lili@localhost
123456 123456
郵件服務器 192.168.4.52
發件人 lili@localhost
收件人 jerry@localhost
客戶端51 測試能否發送郵件
rpm -q telnet || yum -y install telnet
#which telnet
telnet 192.168.4.52 25 //連接郵件服務器
helo pc51 //客戶定義主機名
mail from:lili@localhost //發件人
rcpt to:jerry@localhost //收件人
data //寫郵件內容
郵件內容
. //提交郵件
quit //斷開連接
+++++++++++++++++++++++++++++++++++++++
52 查看郵件是否被投遞到用戶的郵箱裏？
#cd /home
#ls
#cat jerry/Maildir/new/1517275339.Vfd02I4000084M202939.host52
52 能夠收郵件(運行dovecot服務)
yum -y install dovecot
#rpm -q dovecot
#rpm -qc dovecot
#cd /etc/dovecot/
#ls
#vim conf.d/10-mail.conf
24 mail_location = maildir:~/Maildir
:wq
#vim conf.d/10-auth.conf
10 disable_plaintext_auth = no
:wq
[root@host52 conf.d]# systemctl start dovecot
[root@host52 conf.d]# systemctl enable dovecot
[root@host52 conf.d]# netstat -utnalp | grep :110
[root@host52 conf.d]# netstat -utnalp | grep :143
[root@host52 conf.d]# ps -C dovecot
測試能否收郵件
52：
#which telnet
#yum -y install telnet
#telnet localhost 110 //連接本機收郵件的服務
user jerry //收件人用戶名
pass 123456 //郵箱密碼
list //列出郵件
retr 1 //查看第1封郵件的內容
quit //斷開連接
配置郵件加密
配置郵件服務器 192.168.4.52
1 創建私鑰文件
2 創建證書請求文件
3 提交證書請求文件給CA
配置CA服務器192.168.4.55
1 審核證書請求文件並簽發
2 下發數字證書文件給郵件服務器
3 在郵件服務器 配置 郵件服務在運行時，調用私鑰文件和數字證書文件，然後重啟郵件服務
4客戶端驗證配置192.168.4.254
SECURITY 03： 郵件服務TLS/SSL 、 總結和答疑 、 CA數字證書服務