As a larger version for setting up Exim4 to use SMTP-AUTH and TLS, here is a guide on how to install based on the Exim4 SMTP Auth with TLS and mailbox access via POP3 or IMAP (both also with TLS) can be established.
Thus supports the following protocols: SMTP, SSMTP with authentication, POP3, pop3s, imap2, IMAPS.
Exim4 as the default mail transport agent (MTA) from debian comes in two versions: light and heavy. The Heavy variant can be extended well for more than just local mail delivery. First of all may have used the light-heavyweight package of Exim4 from the version to be replaced. This is possible at any time without changes to the configuration.
aptitude install exim4-daemon-heavy
Then install some packages to the total for the setup are required.
aptitude install courier-authdaemon courier-imap courier-imap-ssl courier-pop courier-pop-ssl swaks libnet-ssleay-perl ssl-cert
The process of authentication with this setup looks like this: Connection -> exim4 -> Courier -> System (PAM). The users are local users, and thus they stand in resources such as / etc / passwd, / etc / group and / etc / shadow.
So the future users also have a folder structure for e-mail, we create such a set of new user accounts. maildirmake created the structure in / etc / skel.
maildirmake /etc/skel/Maildir
Existing users without folder structure for e-mail can get the folder is added:
maildirmake ~/Maildir
It is recommended that user to sort them into groups. For example, e-mail users, users with valid shell .. the order should be made before one invests a lot of users. This example assumes our group of companies "Solip" for this purpose. All users to have no shell access, but a post office box.
groupadd solip
useradd -g solip -s /bin/false -d /home/demouser demouser
Users can also later still at any point with the command usermod to change.
To the settings of Courier nothing needs to be changed. However, you need a change to the certificate for IMAPS and POP3S:
rm -rf /etc/courier/*.pem
make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/courier/imapd.pem
make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/courier/pop3d.pem
Optionally, if the authentication does not work later, has yet to be made the following change:
chmod 755 /var/run/courier/authdaemon
Now we check whether the services run:
netstat -utal | egrep -e 'pop|imap'
The output should look like this:
tcp6 0 0 [::]:imaps [::]:* LISTEN
tcp6 0 0 [::]:pop3s [::]:* LISTEN
tcp6 0 0 [::]:pop3 [::]:* LISTEN
tcp6 0 0 [::]:imap2 [::]:* LISTEN
Now we check the IMAP server, including an interactive login:
telnet localhost imap2
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready. Copyright 1998-2008 Double Precision, Inc. See COPYING for distribution information.
AB LOGIN "root" "CHANGE"
AB OK LOGIN Ok.
BC SELECT "Inbox"
* FLAGS ($MDNSent NonJunk $Forwarded $label1 $label2 \Draft \Answered \Flagged \Deleted \Seen \Recent)
* OK [PERMANENTFLAGS ($MDNSent NonJunk $Forwarded $label1 $label2 \* \Draft \Answered \Flagged \Deleted \Seen)] Limited
* 190 EXISTS
* 0 RECENT
* OK [UIDVALIDITY 1205133440] Ok
* OK [MYRIGHTS "acdilrsw"] ACL
BC OK [READ-WRITE] Ok
ZZZZ LOGOUT
* BYE Courier-IMAP server shutting down
ZZZZ OK LOGOUT completed
Connection closed by foreign host.
Now to Exim4. We generate an X.509 certificate for encryption. Exim4 has its own tool for this and related passages in the instructions.
bash /usr/share/doc/exim4-base/examples/exim-gencert
These are generated certificate and key in / etc/exim4.
Now the Exim4 configuration for TLS is to be adapted. Therefore we include gem. Documentation, type:
2.1.3. Using Exim Macros to control the configuration" and "2.2.2. Enabling TLS support for Exim as server" from /usr/share/doc/exim4-base/README.Debian.gz, you should create a file with name /etc/exim4/conf.d/main/000_localmacros (split configuration) or /etc/exim4/exim4.conf.localmacros (non-split configuration), and insert lines as following:
#####################################################
### main/03_exim4-config_tlsoptions
#####################################################
MAIN_TLS_ENABLE = true
tls_on_connect_ports = 465
Can also be determined yet at the same place if SMTP-AUTH must be encrypted or not. Standard is also approved in the clear.
auth_advertise_hosts = ${if eq{$tls_cipher}{}{}{*}}
Allows only encrypted connections SMTP-AUTH to use.
Since we would like to us encrypted Exim4 SMTP on port 465 for standard provides, we also edit / etc/default/exim4 as follows:
# options for daemon listening on port 25
SMTPLISTENEROPTIONS='-oX 465:25 -oP /var/run/exim4/exim.pid'
Now have in the section authenticators look at the Exim4 configuration PLAIN and LOGIN as follows. Adjust or replace is possible here.
plain_courier_authdaemon:
driver = plaintext
public_name = PLAIN
server_condition = \
${extract {ADDRESS} \
{${readsocket{/var/run/courier/authdaemon/socket} \
{AUTH ${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n} }} \
{yes} \
fail}
server_set_id = $auth2
.ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
.endif
: login_courier_authdaemon
driver = plaintext
public_name = LOG
server_prompts = Username ::: Password ::
server_condition = \
$ {Extract {ADDRESS} \
{{{$ Socket read / var / run / courier / authdaemon / socket} \
{AUTH $ {strlen: exim \ nlogin \ n AUTH1 $ \ n $ auth2 \ n} \ nexim \ nlogin \ n AUTH1 $ \ n $ auth2 \ n}}} \
{Yes} \
fail}
server_set_id = $ AUTH1
. Ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
server_advertise_condition = $ {if eq {} {} {$ tls_cipher} {*}}
. Endif
If necessary. Exim4 is to configure yet. This may, at any time using dpkg-reconfigure exim4-config can be performed. Key points include:
- Split configuration into small files: No
- System mail name: Same as in certificate and in the System Configuration
- Delivery method for local mail: Maildir format in home directory
Now we check whether the SMTP service running as desired.
netstat -utal | egrep -e 'smtp|ssmtp'
The output should look something like this:
tcp 0 0 *:ssmtp *:* LISTEN
tcp 0 0 *:smtp *:* LISTEN
tcp6 0 0 [::]:ssmtp [::]:* LISTEN
tcp6 0 0 [::]:smtp [::]:* LISTEN
Now you can try one time to send yourself an e-mail and also an external to an address:
echo "test" | mail -s "test" root
echo "test" | mail -s "test" test@domain.de
The Exim4 log / var/log/exim4/mainlog tells you that everything is running properly.
Now we check if TLS is active:
swaks -a -tls -q HELO -s localhost -au root -ap '<>'
And if using TLS authentication is also (please enter password):
swaks -a -tls -q AUTH -s localhost -au root
Now, still using Exim4 /etc/init.d/exim4 restart to restart and check the logs and the function.