Notes: 11月 2015

2015/11/17

SSL導入

使用する証明書

さくらのSSL
* ドメイン認証
* ジオトラストラピッドSSL
* ¥1,500-/year

証明書作成手順

鍵とCSR作成

参考URL
https://www.geotrust.co.jp/support/ssl/csr/apache_openssl_new.html

鍵とCSR作成
# mkdir 20151116-SSL
# cd /root/20151116-SSL
# openssl md5 * > rand.dat
# openssl genrsa -rand rand.dat -des3 2048 > 20151116-www.mylines.org.key
# openssl req -new -key 20151116-www.mylines.org.key -out 20151116-www.mylines.org.csr

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Hiroshima
Locality Name (eg, city) [Default City]:Hiroshima
Organization Name (eg, company) [Default Company Ltd]:XXXXXXX
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:www.mylines.org
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:        
An optional company name []:

# openssl rsa -in 20151116-www.mylines.org.key -out 20151116-www.mylines.org_nonepass.key

さくらのSSLに申し込みする
作成したCSRをさくらのSSLの申し込み途中で貼り付ける
# cat /root/20151116-www.mylines.org.csr

認証ファイルをアップロード

さくらのSSLから認証ファイルをダウンロードしてサーバにアップロード
# mv nm3acaco.htm /var/www/html/wp-www/nw3acaco.htm
アクセスできることを確認
http://www.mylines.org/nw3acaco.htm
サーバ証明書ができるまでapacheの設定をする

Apache + mod_ssl

# yum install mod_ssl
# vi /etc/httpd/conf.d/ssl.conf //以下変更箇所

DocumentRoot "/var/www/html/wp-www"
ServerName www.mylines.org:443
SSLCertificateFile /etc/pki/tls/certs/20151116-www.mylines.org.crt
SSLCertificateKeyFile /etc/pki/tls/private/20151116-www.mylines.org_nonepass.key
SSLCACertificateFile /etc/pki/tls/certs/20151116-ica.crt

サーバ証明書配置

中間証明書ダウンロードと配置
# cp -a 20151116-ica.crt /etc/pki/tls/certs/20151116-ica.crt
# cat /etc/pki/tls/certs/20151116-ica.crt

サーバ証明書ダウンロードと配置
さくらからサーバ証明書作成完了メールが来るのでそれに従ってダウンロード
# cp -a server.crt /etc/pki/tls/certs/20151116-www.mylines.org.crt
秘密鍵配置
# cp -a 20151116-www.mylines.org.key /etc/pki/tls/private/20151116-www.mylines.org_nonepass.key

Apache再起動とweb確認

# service httpd restart
https://www.mylines.org へアクセス
証明書を確認する

2015/11/09

DKIM導入

1.環境

CentOS 6.7 x86_64

2.OpenDkim設定

epelリポジトリ追加

# rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
# rpm --import http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-6

opendkimインストール

# yum install opendkim

公開鍵、秘密鍵作成

# opendkim-genkey -D /etc/opendkim/keys -d mylines.org -s 20151108-key

/etc/opendkim/keys/20151108-key.private //秘密鍵
/etc/opendkim/keys/20151108-key.txt //公開鍵

# chown opendkim. /etc/opendkim/keys/20151108-key.* //所有者変更

ゾーンファイルに公開鍵レコードとADSPレコードを追加

# vi /var/named/chroot/var/named/mylines.org.zone

20151108-key._domainkey.mylines.org. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUbKMp1yzlRGwygs/D5nb5L2Mkui2mvWqiVoETbzttz5XW5+yqwGAigqM9D+PUR7h0vRWrMEMhlOH8FuQJEo9WiDcq6UiZAlbQ4IVaCKiVZi43MfJNNbXFVLAw4mv3A1y0Xvn46QY0FrIvjbOU4JJ2F7FiBzIMY7ER3xFsM35QlwIDAQAB"
_adsp._domainkey.mylines.org. IN TXT "dkim=unknown"

レコード確認

# service named restart
# dig 20151108-key._domainkey.mylines.org txt

;; ANSWER SECTION:
20151108-key._domainkey.mylines.org. 3600 IN TXT "v=DKIM1\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUbKMp1yzlRGwygs/D5nb5L2Mkui2mvWqiVoETbzttz5XW5+yqwGAigqM9D+PUR7h0vRWrMEMhlOH8FuQJEo9WiDcq6UiZAlbQ4IVaCKiVZi43MfJNNbXFVLAw4mv3A1y0Xvn46QY0FrIvjbOU4JJ2F7FiBzIMY7ER3xFsM35QlwIDAQAB"

# dig _adsp._domainkey.mylines.org txt

;; ANSWER SECTION:
_adsp._domainkey.mylines.org. 3600 IN   TXT "dkim=unknown"

OpenDkimのconfファイル変更

# vi /etc/opendkim.conf

Mode    v
　↓
Mode    sv

KeyFile /etc/opendkim/keys/default.private
　↓
#KeyFile /etc/opendkim/keys/default.private

#KeyTable /etc/opendkim/KeyTable
　↓
KeyTable refile:/etc/opendkim/KeyTable

#SigningTable refile:/etc/opendkim/SigningTable
　↓
SigningTable refile:/etc/opendkim/SigningTable

#ExternalIgnoreList refile:/etc/opendkim/TrustedHosts
　↓
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts

#InternalHosts refile:/etc/opendkim/TrustedHosts
　↓
InternalHosts refile:/etc/opendkim/TrustedHosts

# vi /etc/opendkim/KeyTable

#default._domainkey.example.com example.com:default:/etc/opendkim/keys/default.private
20151108-key._domainkey.mylines.org     mylines.org:20151108-key:/etc/opendkim/keys/20151108-key.private

# vi /etc/opendkim/SigningTable

#example.com default._domainkey.example.com
*@mylines.org   20151108-key._domainkey.mylines.org

# vi /etc/opendkim/TrustedHosts

127.0.0.1

OpenDkim スタート&登録

# service opendkim start
# chkconfig opendkim on

3.Postfix設定

# vi /etc/postfix/main.cf //最終行に追加

smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

# service postfix restart //postfix再起動

4.動作確認

Mail@mylines.orgからtest@gmail.com宛にテストメールを送る
メールヘッダ確認

Dkim-Signature：v=1; a=rsa-sha256; c=relaxed/relaxed; d=mylines.org; s=20151108-key; t=1446967794; bh=dYCBGdXYXm7VH/8DhOb6ToDJxu+DlZMIOV3QrmUEzYQ=; h=From:Subject:Date:To:From; b=TdXmM13P/agkXgI+Ne2dHBSxAG1xu7e4dL/5UZl56BiWYA7+eGwF09YlFZCVr5fcN WEAgZIqBIOeu6GpTZTgVkLs0/hpiqVS+ElsRzuUd3g6HJKDYwSQNVHwIXZqddtzc9i IDXa8pK68XOx9pdhg6Sc2mUgYqGjNPjjSkCCT/7s=
Received-Spf：pass (google.com: domain of Mail@mylines.org designates 49.212.197.167 as permitted sender) client-ip=49.212.197.167;
Dkim-Filter：OpenDKIM Filter v2.10.3 mail.mylines.org CE4053E0191
Authentication-Results：mx.google.com; spf=pass (google.com: domain of Mail@mylines.org designates 49.212.197.167 as permitted sender) smtp.mailfrom=Mail@mylines.org; dkim=pass header.i=@mylines.org

test@gmail.comからMail@mylines.org宛にテストメールを送る
# less /var/log/maillog

Nov  8 16:42:34 sakura opendkim[7592]: 9D6733E0191: DKIM verification successful

参考

http://salt.iajapan.org/wpmu/anti_spam/admin/tech/explanation/dkim/
https://blog.apar.jp/linux/856/

SPF導入-Postfix

1.事前準備

以前に途中で設定を投げ出していたので古いモジュールを削除
# cd pypolicyd-spf-1.2
# python setup.py install --record remove.txt
# cat remove.txt |xargs rm -vrf

removed `/usr/lib/python2.6/site-packages/policydspfsupp.py'
removed `/usr/lib/python2.6/site-packages/policydspfuser.py'
removed `/usr/lib/python2.6/site-packages/policydspfsupp.pyc'
removed `/usr/lib/python2.6/site-packages/policydspfuser.pyc'
removed `/usr/bin/policyd-spf'
removed `/usr/share/man/man1/policyd-spf.1'
removed `/usr/share/man/man5/policyd-spf.conf.5'
removed `/etc/python-policyd-spf/policyd-spf.conf'
removed `/usr/share/man/man5/policyd-spf.peruser.5'
removed `/usr/lib/python2.6/site-packages/pypolicyd_spf-1.2-py2.6.egg-info'

2.設定

ダウンロード

pydns-2.3.6.tar
pypolicyd-spf-1.3.2.tar.gz
pyspf-2.0.12.tar.gz

インストール

pydns
# tar xvf pydns-2.3.6.tar
# cd pydns-2.3.6
# python setup.py install
pypolicyd-spf
# tar zxvf pypolicyd-spf-1.3.2.tar.gz
# cd pypolicyd-spf-1.3.2
# python setup.py install
pyspf-2.0.12
# tar zxvf pyspf-2.0.12.tar.gz
# cd pyspf-2.0.12
# python setup.py install

モジュールの動作確認

# python /usr/bin/policyd-spf /etc/python-policyd-spf/policyd-spf.conf
//何も表示されなければOK

設定変更

confファイルをコメント付きファイルに変更
# mv /etc/python-policyd-spf/policyd-spf.conf /etc/python-policyd-spf/policyd-spf.conf.org
# cp pypolicyd-spf-1.3.2/policyd-spf.conf.commented /etc/python-policyd-spf/policyd-spf.conf
SPF判定のみをヘッダに追加するように変更(rejectなし)
# vi /etc/python-policyd-spf/policyd-spf.conf

#HELO_reject = SPF_Not_Pass //comment
HELO_reject = False //add
#Mail_From_reject = Fail //comment
Mail_From_reject = False //add

Postfix設定

master.cf
# vi /etc/postfix/master.cf //最終行に以下を追加

#spf //comment
policyd-spf unix  -      n       n       -       0       spawn
  user=nobody argv=/usr/bin/python /usr/bin/policyd-spf /etc/python-policyd-spf/policyd-spf.conf

mail.cf
# vi /etc/postfix/main.cf //check_policy_service以降を追加する

#smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,check_policy_service unix:private/policyd-spf

再起動
# service postfix restart

3.動作確認

gmailから@mylines.org宛に送ってみる

Received-Spf：Pass (sender SPF authorized) identity=mailfrom; client-ip=209.85.220.48; helo=mail-pa0-f48.google.com; envelope-from=test@gmail.com; receiver=Mail@mylines.org

送信元を詐称して@mylnies.org宛に送ってみる

Received-Spf：Softfail (domain owner discourages use of this host) identity=mailfrom; client-ip=112.78.117.190; helo=sv9.star-plus.netowl.jp; envelope-from=test@gmail.com; receiver=Mail@mylines.org

参考

https://blog.apar.jp/linux/766/
http://news.mynavi.jp/news/2013/03/28/125/

2015/11/08

SPF導入-BIND編

BINDゾーン編集

# vi /var/named/chroot/var/named/mylines.org.zone
@ IN TXT "v=spf1 +ip4:49.212.197.167 -all" //add

テスト

Mail@mylines.org からgmailにメールを送ってヘッダを確認する

Received-Spf：pass (google.com: domain of Mail@mylines.org designates 49.212.197.167 as permitted sender) client-ip=49.212.197.167;
Authentication-Results：mx.google.com; spf=pass (google.com: domain of Mail@mylines.org designates 49.212.197.167 as permitted sender) smtp.mailfrom=Mail@mylines.org

登録: 投稿 (Atom)