Changes

{{Admon/important|Prerequistites|This lab depends on changes made in several previous labs. You must have successfully completed labs 3, 4a, 4b, and 5 6 in order to be able to do this lab.}}

#Let's start with the "sending" SMTP server we have on VM2. Run the following, replacing <u>andrewsmith.orgops</u> with '''<u>your</u> domain name''':

<source lang="bash">mkdir -p /root/postfix-keys /etc/ssl/{private,certs}

openssl genrsa -des3 -out vm2.andrewsmith.orgops.key 2048chmod 600 vm2.andrewsmith.orgops.keyopenssl req -new -key vm2.andrewsmith.orgops.key -out vm2.andrewsmith.orgops.csropenssl x509 -req -days 365 -in vm2.andrewsmith.orgops.csr -signkey vm2.andrewsmith.orgops.key -out vm2.andrewsmith.orgops.crtopenssl rsa -in vm2.andrewsmith.orgops.key -out vm2.andrewsmith.orgops.key.nopassmv vm2.andrewsmith.orgops.key.nopass vm2.andrewsmith.orgops.key

chmod 600 vm2.andrewsmith.orgops.key cakey.pemcp vm2.andrewsmith.orgops.key cakey.pem /etc/ssl/privatecp vm2.andrewsmith.orgops.crt cacert.pem /etc/ssl/certs</source>

smtpd_tls_key_file = /etc/ssl/private/vm2.andrewsmith.orgops.keysmtpd_tls_cert_file = /etc/ssl/certs/vm2.andrewsmith.orgops.crt

#Currently your Thunderbird is set up to use '''vm2.yoursenecaid.orgops''' for an SMTP server, with <u>no</u> security. Change that to use '''STARTTLS''' instead (you can change it under '''account settings --> Outgoing Server''').

<source lang="bash">mkdir /etc/ssl/{private,certs}openssl genrsa -des3 -out vm3.andrewsmith.orgops.key 2048chmod 600 vm3.andrewsmith.orgops.keyopenssl req -new -key vm3.andrewsmith.orgops.key -out vm3.andrewsmith.orgops.csropenssl x509 -req -days 365 -in vm3.andrewsmith.orgops.csr -signkey vm3.andrewsmith.orgops.key -out vm3.andrewsmith.orgops.crtopenssl rsa -in vm3.andrewsmith.orgops.key -out vm3.andrewsmith.orgops.key.nopassmv vm3.andrewsmith.orgops.key.nopass vm3.andrewsmith.orgops.key

chmod 600 vm3.andrewsmith.orgops.key cakey.pemcp vm3.andrewsmith.orgops.key cakey.pem /etc/ssl/privatecp vm3.andrewsmith.orgops.crt cacert.pem /etc/ssl/certs</source>

<source lang="bash">ssl = requiredssl_cert = <path_to_your_crt_filessl_key = <path_to_your_key_file

== INVESTIGATION 2: INSTALL, CONFIGURE &amp; RUN WEBMAIL APPLICATION (Roundcube Mail) TO USE ENCRYPTION ==

In the investigation, we will simply install, configure and run modify the '''roundcube''' webmail applicationto make use of the encrypted connections the email servers provide, and to allow clients to connect to it using an encrypted connection ('''https''').

*Perform a search on First, we will modify the roundcube application in order webserver to access use the website.encrypted connections the email servers are now providing<ol>*Either Download <li>Modify the roundcube configuration file so that the "zipped tarball" from their website from a direct link or use following parameters reflect the wget command to download directly from a download link (This part may take some effort depending encrypted settings on the Sourceforge website).mail servers:::*Extract the "zipped tarball" and rename the generated directory that contains download source code to: '''webmail$config['smtp_server']'''.::* Use the '''--no-same-owner$config['default_host']''' option when extracting the tar achive to ensure that the files do not keep the original owner (who will not exist on your system).::*Change the ownership of the '''temp$config['default_port']' and '''logs''' directories so they belong to apache.*This service needs to be able to write to several directories (:::'''tempNOTE:''' and '''logs''') that SELinux prevents write access The last <u>two</u> entries above refer to your IMAPS server</li><li>You may wish touse the configuration tool in your Roundcube installer after making those changes. If To do so, you are in a section that has SELinux set will need to add::* '''$config['enforcingenable_installer'] = true;''', run the following commands to let it know that apache should be allowed to write to files in those directoriesyour configuration file.<source lang="bash"/li>semanage fcontext -a -t httpd_log_t '/var/www/html/webmail/temp(/.*)?'semanage fcontext -a -t httpd_log_t '/var/www/html/webmail/logs(/.*)?'restorecon -v -R /var/www/html/webmail</sourceli>::*If your machine does not have the semage commandNext, use yum to install test if the policycoreutilsroundcube webmail application is working by sending and receiving e-python package.*In the directory now named "webmail", there will be a file named '''INSTALL''' which will walk you through the rest of the Roundcube installationmail messages.<br /li><br /ol>Some installation tips to consider:

*Note Now that both of your IMAP and SMTP the webmail application is using an encrypted connection when communicating with the email servers are on different machines (i, it is time to encrypt the client's connection to the web server.e. not on vm1). Therefore, # First you will need to set generate a new certificate for apache on your vm1 machine by issuing the following options for Roundcubecommands:<source>mkdir /etc/ssl/{private,certs}openssl genrsa -des3 -out vm1.andrewsmith.ops.key 2048chmod 600 vm1.andrewsmith.ops.keyopenssl req -new -key vm1.andrewsmith.ops.key -out vm1.andrewsmith.ops.csropenssl x509 -req -days 365 -in vm1.andrewsmith.ops.csr -signkey vm1.andrewsmith.ops.key -out vm1.andrewsmith.ops.crtopenssl rsa -in vm1.andrewsmith.ops.key -out vm1.andrewsmith.ops.key.nopassmv vm1.andrewsmith.ops.key.nopass vm1.andrewsmith.ops.keyopenssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650chmod 600 vm1.andrewsmith.ops.key cakey.pemcp vm1.andrewsmith.ops.key cakey.pem /etc/ssl/privatecp vm1.andrewsmith.ops.crt cacert.pem /etc/ssl/certs</source>

::* '''$config['smtp_server']'''NOTE::* '''$config['default_host']''This process is identical to what you've done for the other two certificates.::* '''$config['default_port']'''#Install the mod_ssl package to allow apache to use ssl.

#Add the following parameters to the apache configuration file:::'''NOTE:''' The last <source>SSLEngine onSSLCertificateFile "<absolute path to the .crt file>"SSLCertificateKeyFile "<uabolute path to the .key file>two"</usource> entries above refer to your IMAP server

*You should be able #restart apache and modify your firewall to allow traffic to test the configuration in port 443.#Open a web-browser on your Roundcube installer after completing Step 3host and try to connect to https://vm1.<yourdomain>.ops/li><li>Try webmail::You should get a security exception similar to test if the roundcube webmail application is working by sending one's you saw with the email, and receiving efor the same reason (the site you are trying to contact has a self-mail messagessigned certificate). Add the exception and login to access your email.::Send an email to ensure everything is functioning properly.*

Follow the instructions for lab 7 8 on moodleblackboard.

===In Class Submission(Murray Saul's Classes only)===

::<span style="color:green;font-size:1.5em;">&#x2713;</span>Download the labcheck7labcheck8.bash checking bash shell script by issuing the command:<br><br>'''wget http://matrix.senecac.on.ca/~peter.callaghan/files/OPS335/labcheck7labcheck8.bash'''<br><br>set execute permission and run the shell script on your '''c7hosthost''' machine.

::<span style="color:green;font-size:1.5em;">&#x2713;</span>Completed Lab7 Lab8 log-book notes.