Martin Waschbuesch wrote:
Hi Eric,
Thanks for the help!
Am 03.11.2009 um 11:19 schrieb Eric Shubert:
Martin Waschbuesch wrote:
Hi all,
I successfully installed the qmailtoaster and am very happy so far.
Now, I have a few questions that I need some help with. So if anyone
knows how to do this or can point me to good documentation I would
really appreciate the help.
I have installed a SSL certificate and got it working for apache,
courier and qmail. Now, is it possible to enforce use of encryption
for IMAP, POP3 and SMTP for everyone not on localhost - e.g. it would
be silly to have horde/imp (installed on same server) to use STMP or
IMAP over ssl, but everyone not working on webmail should have to.
For IMAP and POP3, simply stop the services. For SMTP, it's not that
simple, and I don't know off hand.
On my old toaster, I would have stopped the services doing something
like this:
cd /service
svc -d pop3
svc -d imap4
etc.
On this toaster, only dnscache resides in /service? (perhaps something
that can be consolidated in an updated release?) The other services seem
to be in /var/qmail/supervise, but running the svc command did not stop
the services?
Just cd to /var/qmail/supervise before running the svc commands.
At any rate, I would rather make them not come up at boot up, reboot and
have them 'gone' this way instead... :-)
How would I go about that? Just remove the folders from
/var/qmail/supervise?
Yep.
It is not all that essential as I figured I would also remove the
iptables rules for those two to prevent people from accessing them, but
to save resources...
I agree.
Also, how would I go about enforcing the management webpages
(qcontrol et al) and the webmail (I use horde instead of squirrel) to
only use https? right now I can access them in both ways and I would
like any attempt to access those sites without encryption to jump to
https://xyz instead.
This is done using apache's rewrite module. First, be sure it's loaded:
/etc/httpd/conf/httpd.conf:
LoadModule rewrite_module modules/mod_rewrite.so
Then add the rewrite instructions to the appropriate conf files, e.g.:
/etc/httpd/conf/squirrelmail.conf:
RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*/webmail.*)$ https://%{SERVER_NAME}$1 [L,R]
<Directory /usr/share/squirrelmail>
Options None
Order allow,deny
allow from all
SSLRequireSSL
</Directory>
Did the job alright! :-) Thanks!
I would like everyone of my roaming users to always use the
submission port 587 (and ssl). Can that be enforced, too?
Not that I'm aware of. While spamdyke does TLS and authentication, it
doesn't appear to have an option to require TLS when authenticating.
I've just posted a request for this feature on the spamdyke list.
We'll see what Sam (the author) has to say about it.
There may be some other way I'm not aware of. Jake would probably know
for sure.
Hm, I guess I can live with that. But if any option comes up - that
would be cool! Perhaps I could rewrite the smtp-ssl/run file to work on
port 587 instead of 465 as suggested in wiki and have it taken care of
that way?
Though, I do believe that that, too, only means I could have
authentication + encryption, but authentication would be enough.
I wouldn't mess with that. smtp-ssl (port 465) is deprecated. Besides,
TLS on port 25 and 587 works fine. There's just no way to enforce it
(that I'm aware of). Adding smtp-ssl (it's not in the stock toaster)
won't solve that problem, and I don't see that it buys you anything.
Thanks a lot for the help!
Sure. Now it's your turn Martin. Will you please update the wiki with
all of this when you're done? I'd like to see a new page under
Configuration/Security that ties all of this stuff together. Are you
up for it?
As to the wiki, I think I can do that once I figured it all out. :-)
Great!
Thanks a lot,
Martin
--
-Eric 'shubes'
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
