Bon voila je galère pas mal. Je voudrais a terme créer un postfix qui n'autorise l'envoi de mail que si le client possède un certificat signer par nos soins.
Voila où j'en suis:
J'ai réussi à mettre en place le TLS+authentification mysql car mes utilisateurs sont stockés dans une bdd.
Je voudrais maintenant mettre en place ce principe de certificat car je ne veux pas que mes utilisateurs utilisent mon serveur SMTP mais celui de leur fai.
J'ai trouvé une solution qui consiste à vérifier le champs from avec un header checker mais le problème c'est qu'à terme je pense que cela sera lourd à gérer.
Mon système utilise Postfix avec dovecot et mysql, le tout sur une debian 4 etch.
Donc voila, dans la configuration de postfix je lui demande de vérifier le certificat SSL du client et la ca ne marche pas....
Voici la configuration de mon postfix:
- Code: Tout sélectionner
smtpd_use_tls = yes
smtpd_tls_CAfile = /etc/postfix/tls/test/demoCA/cacert.pem
smtpd_tls_cert_file = /etc/postfix/tls/test/addonline-cert.pem
smtpd_tls_key_file = /etc/postfix/tls/test/addonline-key.pem
#smtp_use_tls = yes
#smtp_tls_CAfile = /etc/postfix/tls/demoCA/cacert.pem
#smtp_tls_cert_file = /etc/postfix/tls/addonline-cert.pem
#smtp_tls_key_file = /etc/postfix/tls/addonline-key.pem
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_tls_security_level = encrypt
smtpd_tls_ask_ccert = yes
#smtpd_enforce_tls = yes
smtpd_tls_req_ccert = yes
#smtpd_tls_ccert_verifydepth = 2
myhostname = mail.domaine.fr
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost.domaine.fr, localhost
mynetworks = 127.0.0.1/32
#mailbox_size_limit = 1
recipient_delimiter = +
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual_forwardings.cf,mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual_mailbox-domains.cf
#transport_maps = mysql:/etc/postfix/mysql-virtual_transports.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /home/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
virtual_create_maildirsize = yes
virtual_mailbox_extended = yes
virtual_mailbox_limit_override = yes
virtual_maildir_limit_message = "Desole, la boite email de l'utilisateur est pleine, essayez plus tard."
virtual_overquota_bounce = yes
fallback_relay =
maildrop_destination_recipient_limit=1
relay_domains = 127.0.0.1/32
content_filter = smtp-amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappings
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
#smtpd_sasl_path = smtpd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
#smtpd_recipient_restrictions = permit_tls_all_clientcerts
smtpd_sasl_authenticated_header = yes
Maintenant les logs lors de l'echange du TLS:
- Code: Tout sélectionner
Mar 3 12:36:37 mail postfix/smtpd[26721]: connect from unknown[192.168.69.158]
Mar 3 12:36:37 mail postfix/smtpd[26721]: setting up TLS connection from unknown[192.168.69.158]
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:before/accept initialization
Mar 3 12:36:37 mail postfix/smtpd[26721]: read from 0808EDA0 [0809B930] (11 bytes => -1 (0xFFFFFFFF))
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:error in SSLv2/v3 read client hello A
Mar 3 12:36:37 mail postfix/smtpd[26721]: read from 0808EDA0 [0809B930] (11 bytes => 11 (0xB))
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0000 80 4c 01 03 01 00 33 00|00 00 10 .L....3. ...
Mar 3 12:36:37 mail postfix/smtpd[26721]: read from 0808EDA0 [0809B93B] (67 bytes => -1 (0xFFFFFFFF))
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:error in SSLv2/v3 read client hello B
Mar 3 12:36:37 mail postfix/smtpd[26721]: read from 0808EDA0 [0809B93B] (67 bytes => 67 (0x43))
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0000 00 00 04 00 00 05 00 00|0a 01 00 80 07 00 c0 03 ........ ........
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0010 00 80 00 00 09 06 00 40|00 00 64 00 00 62 00 00 .......@ ..d..b..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0020 03 00 00 06 02 00 80 04|00 80 00 00 13 00 00 12 ........ ........
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0030 00 00 63 e0 73 2d 3d 10|39 d7 53 2a 05 d8 3e 76 ..c.s-=. 9.S*..>v
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0040 3d 3a 1e =:.
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:SSLv3 read client hello A
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:SSLv3 write server hello A
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:SSLv3 write certificate A
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:SSLv3 write certificate request A
Mar 3 12:36:37 mail postfix/smtpd[26721]: write to 0808EDA0 [080A9A58] (1040 bytes => 1040 (0x410))
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0000 16 03 01 00 4a 02 00 00|46 03 01 47 cb e2 c5 fc ....J... F..G....
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0010 f8 07 4a 26 9b 1f f2 a9|66 4d 6b 9a ba e6 45 29 ..J&.... fMk...E)
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0020 8a 07 ae 56 aa 49 c8 f2|2f 46 92 20 4c 7b 6b 1a ...V.I.. /F. L{k.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0030 c4 e4 88 3b 9d 45 a8 82|27 9a 1b 58 ca 50 6e ca ...;.E.. '..X.Pn.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0040 21 a4 f1 ab a0 59 cf bf|7a 6e e4 8a 00 04 00 16 !....Y.. zn......
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0050 03 01 03 20 0b 00 03 1c|00 03 19 00 03 16 30 82 ... .... ......0.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0060 03 12 30 82 02 7b a0 03|02 01 02 02 09 00 ac 63 ..0..{.. .......c
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0070 8e 77 08 a4 84 da 30 0d|06 09 2a 86 48 86 f7 0d .w....0. ..*.H...
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0080 01 01 05 05 00 30 81 93|31 0b 30 09 06 03 55 04 .....0.. 1.0...U.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0090 06 13 02 46 52 31 0f 30|0d 06 03 55 04 08 13 06 ...FR1.0 ...U....
Mar 3 12:36:37 mail postfix/smtpd[26721]: 00a0 46 72 61 6e 63 65 31 0d|30 0b 06 03 55 04 07 13 France1. 0...U...
Mar 3 12:36:37 mail postfix/smtpd[26721]: 00b0 04 4c 79 6f 6e 31 13 30|11 06 03 55 04 0a 13 0a .Lyon1.0 ...U....
Mar 3 12:36:37 mail postfix/smtpd[26721]: 00c0 41 64 64 20 4f 6e 6c 69|6e 65 31 0c 30 0a 06 03 Add Onli ne1.0...
Mar 3 12:36:37 mail postfix/smtpd[26721]: 00d0 55 04 0b 13 03 44 53 49|31 1b 30 19 06 03 55 04 U....DSI 1.0...U.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 00e0 03 13 12 6d 61 69 6c 2e|61 64 64 6f 6e 6c 69 6e ...mail. addonlin
Mar 3 12:36:37 mail postfix/smtpd[26721]: 00f0 65 2e 62 69 7a 31 24 30|22 06 09 2a 86 48 86 f7 e.biz1$0 "..*.H..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0100 0d 01 09 01 16 15 73 75|70 70 6f 72 74 40 61 64 ......su pport@ad
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0110 64 2d 6f 6e 6c 69 6e 65|2e 66 72 30 1e 17 0d 30 d-online .fr0...0
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0120 38 30 33 30 33 31 31 33|31 33 36 5a 17 0d 30 39 80303113 136Z..09
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0130 30 33 30 33 31 31 33 31|33 36 5a 30 81 84 31 0b 03031131 36Z0..1.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0140 30 09 06 03 55 04 06 13|02 46 52 31 0f 30 0d 06 0...U... .FR1.0..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0150 03 55 04 08 13 06 46 72|61 6e 63 65 31 13 30 11 .U....Fr ance1.0.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0160 06 03 55 04 0a 13 0a 41|64 64 20 4f 6e 6c 69 6e ..U....A dd Onlin
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0170 65 31 0c 30 0a 06 03 55|04 0b 13 03 44 53 49 31 e1.0...U ....DSI1
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0180 1b 30 19 06 03 55 04 03|13 12 6d 61 69 6c 2e 61 .0...U.. ..mail.a
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0190 64 64 6f 6e 6c 69 6e 65|2e 62 69 7a 31 24 30 22 ddonline .biz1$0"
Mar 3 12:36:37 mail postfix/smtpd[26721]: 01a0 06 09 2a 86 48 86 f7 0d|01 09 01 16 15 73 75 70 ..*.H... .....sup
Mar 3 12:36:37 mail postfix/smtpd[26721]: 01b0 70 6f 72 74 40 61 64 64|2d 6f 6e 6c 69 6e 65 2e port@add -online.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 01c0 66 72 30 81 9f 30 0d 06|09 2a 86 48 86 f7 0d 01 fr0..0.. .*.H....
Mar 3 12:36:37 mail postfix/smtpd[26721]: 01d0 01 01 05 00 03 81 8d 00|30 81 89 02 81 81 00 b1 ........ 0.......
Mar 3 12:36:37 mail postfix/smtpd[26721]: 01e0 6b 3a 93 48 8a a9 65 d3|66 c2 e9 ef 11 c0 3a a9 k:.H..e. f.....:.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 01f0 3c fa 8f 5e ad 94 81 03|b7 6e d0 b7 1c 6b 31 10 <..^.... .n...k1.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0200 30 18 ef e6 fb bf 61 f6|84 88 36 0d af b7 71 a7 0.....a. ..6...q.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0210 e9 de e4 53 69 c2 5c bb|0a 30 0c 12 f6 4e 14 70 ...Si.\. .0...N.p
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0220 f7 3b 2f 7e 41 c0 bc b5|ef 88 b5 e0 87 18 af b2 .;/~A... ........
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0230 1b f0 92 6b 73 39 c3 8c|3f 4a 37 68 7f 9c 5e 8a ...ks9.. ?J7h..^.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0240 23 44 a1 27 b4 cb a9 f6|8c ae 15 83 5b 4b d9 71 #D.'.... ....[K.q
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0250 1a 8e 08 61 5c 1e e7 4f|dc e7 99 67 4e 25 a1 02 ...a\..O ...gN%..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0260 03 01 00 01 a3 7b 30 79|30 09 06 03 55 1d 13 04 .....{0y 0...U...
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0270 02 30 00 30 2c 06 09 60|86 48 01 86 f8 42 01 0d .0.0,..` .H...B..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0280 04 1f 16 1d 4f 70 65 6e|53 53 4c 20 47 65 6e 65 ....Open SSL Gene
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0290 72 61 74 65 64 20 43 65|72 74 69 66 69 63 61 74 rated Ce rtificat
Mar 3 12:36:37 mail postfix/smtpd[26721]: 02a0 65 30 1d 06 03 55 1d 0e|04 16 04 14 c4 8f b2 df e0...U.. ........
Mar 3 12:36:37 mail postfix/smtpd[26721]: 02b0 13 04 ce e0 65 54 40 5f|b5 d8 cd 0f 1c 90 a5 d3 ....eT@_ ........
Mar 3 12:36:37 mail postfix/smtpd[26721]: 02c0 30 1f 06 03 55 1d 23 04|18 30 16 80 14 c4 87 86 0...U.#. .0......
Mar 3 12:36:37 mail postfix/smtpd[26721]: 02d0 88 10 42 ed 24 24 60 ac|94 2e 4d c9 3d a7 18 d8 ..B.$$`. ..M.=...
Mar 3 12:36:37 mail postfix/smtpd[26721]: 02e0 1c 30 0d 06 09 2a 86 48|86 f7 0d 01 01 05 05 00 .0...*.H ........
Mar 3 12:36:37 mail postfix/smtpd[26721]: 02f0 03 81 81 00 53 14 1d 07|41 96 87 a0 e6 a9 1a a2 ....S... A.......
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0300 f4 d9 e3 f7 08 e0 88 57|7c 17 1b f5 8b 0d d2 bf .......W |.......
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0310 c1 eb 3f 13 7f 6d 46 da|f1 c9 45 e2 a9 c0 27 ab ..?..mF. ..E...'.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0320 76 c0 9c 60 6d 32 69 a2|36 1d 0d fd 3c 96 15 fb v..`m2i. 6...<...
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0330 ad 28 93 fe 10 ff 58 fe|ad 69 50 d5 dd 3f 8c ce .(....X. .iP..?..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0340 4c 60 e3 a6 8c a5 e3 f9|f2 3a af d6 44 bf a9 57 L`...... .:..D..W
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0350 fc 17 06 96 19 7b 4a b5|ae d4 04 40 f6 6d 3e d8 .....{J. ...@.m>.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0360 13 a6 a4 05 58 d1 d5 cb|3f fb 16 37 9d 2f 1f 8c ....X... ?..7./..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0370 07 f3 e2 e0 16 03 01 00|97 0d 00 00 8f 03 01 02 ........ ........
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0380 40 00 89 00 87 30 81 84|31 0b 30 09 06 03 55 04 @....0.. 1.0...U.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0390 06 13 02 46 52 31 0f 30|0d 06 03 55 04 08 13 06 ...FR1.0 ...U....
Mar 3 12:36:37 mail postfix/smtpd[26721]: 03a0 46 72 61 6e 63 65 31 13|30 11 06 03 55 04 0a 13 France1. 0...U...
Mar 3 12:36:37 mail postfix/smtpd[26721]: 03b0 0a 41 64 64 20 4f 6e 6c|69 6e 65 31 0c 30 0a 06 .Add Onl ine1.0..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 03c0 03 55 04 0b 13 03 44 53|49 31 1b 30 19 06 03 55 .U....DS I1.0...U
Mar 3 12:36:37 mail postfix/smtpd[26721]: 03d0 04 03 13 12 6d 61 69 6c|2e 61 64 64 6f 6e 6c 69 ....mail .addonli
Mar 3 12:36:37 mail postfix/smtpd[26721]: 03e0 6e 65 2e 62 69 7a 31 24|30 22 06 09 2a 86 48 86 ne.biz1$ 0"..*.H.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 03f0 f7 0d 01 09 01 16 15 73|75 70 70 6f 72 74 40 61 .......s upport@a
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0400 64 64 2d 6f 6e 6c 69 6e|65 2e 66 72 0e dd-onlin e.fr.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 040d - <SPACES/NULLS>
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:SSLv3 flush data
Mar 3 12:36:37 mail postfix/smtpd[26721]: read from 0808EDA0 [0809B930] (5 bytes => -1 (0xFFFFFFFF))
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:error in SSLv3 read client certificate A
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:error in SSLv3 read client certificate A
Mar 3 12:36:37 mail postfix/smtpd[26721]: read from 0808EDA0 [0809B930] (5 bytes => 5 (0x5))
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0000 16 03 01 00 8d .....
Mar 3 12:36:37 mail postfix/smtpd[26721]: read from 0808EDA0 [0809B935] (141 bytes => -1 (0xFFFFFFFF))
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:error in SSLv3 read client certificate A
Mar 3 12:36:37 mail postfix/smtpd[26721]: read from 0808EDA0 [0809B935] (141 bytes => 141 (0x8D)
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0000 0b 00 00 03 00 00 00 10|00 00 82 00 80 69 1b bb ........ .....i..
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0010 b3 dd 6d 78 e8 90 3c b8|46 70 7c 35 8d 00 f8 35 ..mx..<. Fp|5...5
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0020 fa 83 b0 cb 43 a9 79 98|02 e5 36 38 75 22 24 84 ....C.y. ..68u"$.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0030 aa 2a 5f 65 d3 b5 7c 13|da 1b 89 d8 82 ff 19 4f .*_e..|. .......O
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0040 0d 50 94 77 05 3b c9 61|29 df 68 a4 a5 d8 38 ea .P.w.;.a ).h...8.
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0050 d1 8e d1 0b 85 53 ee 2e|b5 3f 51 8f 45 9d 5f 40 .....S.. .?Q.E._@
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0060 e6 97 3f 52 aa bc 5a a2|2e 43 57 9c 61 f9 f6 ad ..?R..Z. .CW.a...
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0070 21 5d 75 08 72 20 11 9c|62 dd 64 eb fd 81 43 51 !]u.r .. b.d...CQ
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0080 4b 41 64 45 5e 03 55 63|08 35 df e0 7c KAdE^.Uc .5..|
Mar 3 12:36:37 mail postfix/smtpd[26721]: write to 0808EDA0 [080A9A58] (7 bytes => 7 (0x7))
Mar 3 12:36:37 mail postfix/smtpd[26721]: 0000 15 03 01 00 02 02 28 ......(
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL3 alert write:fatal:handshake failure
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept:error in SSLv3 read client certificate B
Mar 3 12:36:37 mail postfix/smtpd[26721]: SSL_accept error from unknown[192.168.69.158]: -1
Mar 3 12:36:37 mail postfix/smtpd[26721]: warning: TLS library problem: 26721:error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate:s3_srvr.c:2455:
Mar 3 12:36:37 mail postfix/smtpd[26721]: lost connection after CONNECT from unknown[192.168.69.158]
En sachant que 69.158 c'est l'ip de mon client...
Je suis un peu perdu si quelqu'un sait me dire où cela pêche... Pour ce qui est des générations de clefs et de certificats ssl j'ai suivi ces deux sites: http://www.pcinpact.com/forum/index.php?showtopic=87786 et http://www.grandville.net/pmwiki.php/Op ... DeCommande
Merci d'avance à ceux qui se donneront la peine de m'aider
