[dovecot] Require client certificates for IMAP.

diff --git a/ca/README b/ca/README
index de645f0ddfb9ad13bba3d74fb28d06c6488522bf..3270c050d130960b46b524cf8f01c4b72d8ff7d7 100644 (file)
--- a/ca/README
+++ b/ca/README
@@ -17,6 +17,9 @@ instance of `.crt` [1].
 ```
 $ sudo --preserve-env openssl req -x509 -config ca.cnf -new -days 3650 -sha256 \
     -newkey rsa:4096 -keyout private/ca.key -out ca.pem
+$ sudo --preserve-env openssl ca -gencrl -config ca.cnf -out crlfile
+$ sudo --preserve-env sh -c "cat ca.pem >> ca.crl"
+$ sudo --preserve-env sh -c "cat crlfile >> ca.crl"
 ```
 
 Certificate
@@ -37,11 +40,11 @@ Other output formats are also possible [4]. If generting an email certificate,
 add an extensions [5].
 
 ```
-$ openssl req -config ca.cnf -new -key certs/private/<name>.key \
-    -out certs/<name>.csr -extensions email_cert
-$ openssl x509 -req -days 365 -sha256 -CA ca.pem -CAkey private/ca.key \
-    -next_serial -in certs/<name>.csr -out certs/<name>.crt \
-    -extensions email_cert
+$ sudo --preserve-env openssl req -config ca.cnf -new \
+    -key certs/private/<name>.key -out certs/<name>.csr -extensions email_cert
+$ sudo --preserve-env openssl x509 -req -days 365 -sha256 -CA ca.pem \
+    -CAkey private/ca.key -next_serial -in certs/<name>.csr \
+    -out certs/<name>.crt -extensions email_cert
 ```
 
 Import

diff --git a/dovecot/10-auth.conf b/dovecot/10-auth.conf
index ee3adfd229ad448881d267363c764845fcb87c5b..84294a8d42a8eb3aee55935b491d3873cb31c584 100644 (file)
--- a/dovecot/10-auth.conf
+++ b/dovecot/10-auth.conf
@@ -86,18 +86,18 @@
 #auth_failure_delay = 2 secs
 
 # Require a valid SSL client certificate or the authentication fails.
-#auth_ssl_require_client_cert = no
+auth_ssl_require_client_cert = no
 
 # Take the username from client's SSL certificate, using
 # X509_NAME_get_text_by_NID() which returns the subject's DN's
 # CommonName.
-#auth_ssl_username_from_cert = no
+auth_ssl_username_from_cert = no
 
 # Space separated list of wanted authentication mechanisms:
 #   plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp
 #   gss-spnego
 # NOTE: See also disable_plaintext_auth setting.
-auth_mechanisms = plain
+auth_mechanisms = plain login
 
 ##
 ## Password and user databases

diff --git a/dovecot/10-ssl.conf b/dovecot/10-ssl.conf
index 4dc0566b531e1d7a07c265ea715cd7a51d192570..aa191782fe7263d339e196f791a306034069951e 100644 (file)
--- a/dovecot/10-ssl.conf
+++ b/dovecot/10-ssl.conf
@@ -21,10 +21,10 @@ ssl_key = <${mail_ssl_cert_dir}/privkey.pem
 # PEM encoded trusted certificate authority. Set this only if you intend to use
 # ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
 # followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
-#ssl_ca =
+ssl_ca = <${ca_dir}/ca.crl
 
 # Require that CRL check succeeds for client certificates.
-#ssl_require_crl = yes
+ssl_require_crl = yes
 
 # Directory and/or file for trusted SSL CA certificates. These are used only
 # when Dovecot needs to act as an SSL client (e.g. imapc backend or

diff --git a/dovecot/20-imap.conf b/dovecot/20-imap.conf
index 394accfb50a5f97c349852cc81b1c68f9e92bcb3..176b2be8d5510aab16d22ca8f6d4ae9ca0337f59 100644 (file)
--- a/dovecot/20-imap.conf
+++ b/dovecot/20-imap.conf
@@ -96,4 +96,7 @@ protocol imap {
   # Maximum number of IMAP connections allowed for a user from each IP address.
   # NOTE: The username is compared case-sensitively.
   mail_max_userip_connections = 5
+
+  auth_ssl_require_client_cert = yes
+  ssl_verify_client_cert = yes
 }

diff --git a/dovecot/README b/dovecot/README
index 4cba856c03749cfdc6171786816e5ab68baa21ff..dc0bc80ebf7a52e0a2780385c70e7d85fa4ccfa2 100644 (file)
--- a/dovecot/README
+++ b/dovecot/README
@@ -106,6 +106,12 @@ $ touch /var/log/dovecot.log /var/log/dovecot-info.log
 $ chown vmail:vmail /var/log/{dovecot.log,dovecot-info.log}
 ```
 
+Create mailboxes.
+
+```
+$ doveadm mailbox create -u <user> Trash
+```
+
 Administration
 --------------
 

diff --git a/postfix/main.cf b/postfix/main.cf
index 6d0fa49fafda108e1a4fc1e017bd778754c74138..f1155592ab5e85846b794fb0ca8192a4c912d015 100644 (file)
--- a/postfix/main.cf
+++ b/postfix/main.cf
@@ -38,8 +38,8 @@ disable_vrfy_command = yes
 smtpd_reject_unlisted_sender = yes
 
 # HELO command
-smtpd_helo_restrictions = reject_invalid_helo_hostname,
-  reject_non_fqdn_helo_hostname
+smtpd_helo_restrictions = permit_sasl_authenticated,
+  reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname
 smtpd_helo_required = yes
 
 # Message rewrite