sendmail的数据加密：smtps ：提供ssl<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />

                       tls的服务：starttls通过25端口实现ssl加密

              做smtps加密只是实现一段数据的加密，中继时候不支持 点到点的(主机到主机)

       基于ip的

       端口：465

查看sendmail是否支持starttls

              1、telnet mail.a.com 25

                 ehlo mail.a.com 在开启的情况下会显示starttls表示已经启用

              2、sendmail -d0.1 -bv 查看是否出现STARTTLS ，有表示在sendmail二进制编译过程

                                                 中支持tls功能，并不表示已经启用

配置：

              1、证书 ，做CA认证/etc/pki/CA/cacert.pem

              2、mkdir /etc/mail/certs

              cd /etc/mail/certs

              openssl genrsa 1024 >sendmail_key.pem

              openssl req -new -key sendmail_key.pem -out sendmail_cert.csr

              openssl ca -in sendmail_cert.csr -out sendmail_cert.pem -days 3650

              rm -rf sendmail_cert.csr

              cp /etc/pki/CA/cacert.pem

              chmod 600 ./*

              3、sendmail启用认证

              vim /etc/mail/sendmail.mc

              启用    define(`confCACERT_PATH', `/etc/mail/certs')dnl

                     define(`confCACERT', `/etc/mail/certs/cacert.pem')dnl

                     define(`confSERVER_CERT', `/etc/mail/certs/sendmail_cert.pem')dnl

                     define(`confSERVER_KEY', `/etc/mail/certs/sendmail_key.pem')dnl

              启用      define(`confLOG_LEVEL', `14')dnl启用日志功能

              启用     DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl开启会监听465端口

              vim /etc/mail/access 添加为192.168.0网段做转发

              service sendmail restart

       测试：telnet mail.a.com 25

              ehlo mail.a.com 会有starttls

              可以用outlook测试--创建用户-->属性勾选服务器需要安全的连接ssl--fa邮件

      

 

 

smtps本身并没有认证的功能，需要借助sasl进行认证：

              组件：cyrus-sasl

              进程为saslauthd

              sendmail -d0.1 -bv 会显示SASLv2 表示支持

              sasl配置：

                     service saslauthd restart

                     chkconfig saslauthd on

                     vim /etc/mail/sendmail.mc

                     添加    define(`confAUTH_OPTIONS', `A y')dnl

                            TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

                            define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

                            DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA', M=Ea')dnl

                     vim /usr/lib/sasl2/Sendmail.conf 添加

                       mech_list: login plain 支持的认证机制

              测试：telent mail.a.com 25 会显示login 、plain

                     ehlo mail.a.com

                     auhtlogin 账号要编码base64--->  echo -n 'root@a.com' | openssl base64

                     密码----->      echo -n 'redhat' | openssl base64

                     mail from:root@a.com

                     rcpt to:student@a.com

                     hello

                     .

                     quit

              一般发邮件不要为root用户

              使用outlook测试：工具--账户--属性--服务器勾选我的服务器需要身份认证

                     发邮件 ，可以不用/etc/mail/access里的配置 这时的过程是基于sasl的

 

接受邮件加密：

       dovecot配置---ssl

       pop3---pop3s 端口995<---- grep pop /etc/services

       imap---imaps 端口993<----grep imap /etc/services

              配置：192.168.0.85

                     1、给dovecot发证书

                            mkdir -pv /etc/dovecot/ssl

                            cd /etc/dovecot/ssl

                            openssl genrsa 1024 >dovecot.key

                            openssl req -new -key dovecot.key -out dovecot.csr

                            openssl ca -in dovecot.csr -out dovecot.crt -days 3650

                     2、配置dovecot.conf

                            vim /etc/dovecot.conf

                                 ssl_cert_file = /etc/dovecot/ssl/dovecot.crt

                                 ssl_key_file = /etc/dovecot/ssl/dovecot.key

                                 protocols = imaps

                            service dovevot restart

                            netstat -ntlp | grep 993

                     2、测试：

                            outlook发邮件--账户--

                            收邮件 mutt -f imap://sara@192.168.0.85 或imap://sara@mail.a.com

                            验证加密过程是加密的：抓包wireshark

                            yum install wireshark -y

                            打开110端口 vim /etc/dovecot.conf 在protocol添加pop3协议

                            service dovecot restart

                            netstat -ntlp | grep 110

                            抓包 tshark -ni eth0 "tcp.srcport eq 110 or tcp.dsport eq 110"

                            1、发邮件测试 telnet 192.168.0.85 110 (windows下命令模式)

                                          USER sara

                                          PASS redhat

                                          LIST

                                          RETR 1

                                   可以看到邮件的详细信息 110为明文，加密后就为更为的安全

                            tshark -ni eth0 "tcp.srcport eq 993 or tcp.dsport eq 993"

                             使用加密的账户发邮件 过程是加密的

                            2、模拟加密连接：192.168.0.121

                            openssl s_client -connect 192.168.0.85:993

                            USER sara

                            在192.168.0.85 上查看是加密的看不到信息