④Ubuntu - Postfix - Dovecot : SSL/TSL security mail server setting, một phát ăn ngay.

Read Time:3 Minute, 2 Second

Mục lục

Ubuntu 20.04: Mail server.

Cấu hình SSL/TLS cho mail server.

①Dùng Let’s Encrypt để lấy file chứng thực (certification file).

# Install certbot
root@mail:~# apt install certbot

# Kiểm tra xem đã được install chưa
root@mail:~# apt list  --installed  | grep certbot

# Nếu cùng server đang chạy Apache thì phải dừng nó 
# trước khi chạy certbot lấy file chứng thực.
root@mail:~# service apache2 stop

# Tạo file chứng thực
root@mail:~# sudo certbot certonly --standalone -d mail.vidu.com 

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): (Nhập mail tùy ý) 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A # Chấp thuận quy định khi sử dụng service này.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N # Đăng ký mailing list yes or no
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for mail.vidu.com
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/mail.vidu.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/mail.vidu.com/privkey.pem
   Your cert will expire on 2022-03-19. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

# Khởi động lại Apache nếu có.
root@mail:~# sudo service apache2 start

②Cấu hình cho Postfix và Dovecot.

root@mail:~# vi /etc/postfix/main.cf 

# Add vào cuối file.

#smtpd_use_tls = yes
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.vidu.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.vidu.com/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache


root@mail:~# vi /etc/postfix/master.cf 

# Từ dòng 17-20: Xóa comment out

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
#  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
 
# Từ dòng 29-32: Xóa comment out

smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes


root@mail:~# vi /etc/dovecot/conf.d/10-ssl.conf

# Dòng số 6: Sửa thành yes
ssl = yes

# Dòng 12,13: Xóa comment out và set đường dẫn file chứng thực.
ssl_cert = </etc/letsencrypt/live/mail.vidu.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.vidu.com/privkey.pem

# Khởi động lại Postfix và Dovecot
root@mail:~# systemctl restart postfix dovecot