LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General > LinuxAnswers Discussion
User Name
Password
LinuxAnswers Discussion This forum is to discuss articles posted to LinuxAnswers.

Notices

Reply
 
Search this Thread
Old 09-21-2003, 09:25 PM   #1
DavidPhillips
Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,154

Rep: Reputation: 56
Post DISCUSSION: HOWTO Setup a Secure Relaying Email Server


This thread is to discuss the article titled: HOWTO Setup a Secure Relaying Email Server
 
Old 10-02-2003, 12:35 PM   #2
lenlutz
Member
 
Registered: May 2003
Location: philadelhpia pa
Posts: 92

Rep: Reputation: 15
i followed this, as closely as i was able, but, had a few problems:

when i ran /bin/netstat -tp
i got nothing like what was shown

when i ran /usr/sbin/stunnel /etc/stunnel/myserver.conf
i got

Either -r, -l (or -L) option must be used

Try 'stunnel -h' for more information.

ive been really tryiing to get this to work...
using redhat 8.0

any help, is greatly apprciated... im not a newbie to unix, and
not all that new to linux, though i sure am haing some mail problems....
 
Old 10-05-2003, 11:41 AM   #3
DavidPhillips
Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,154

Original Poster
Rep: Reputation: 56
what do you get when running netstat on the server?

The -t is a filter to show only tcp, -p displays the pid of the program with the connection.

you could try netstat -lp
Code:
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name   
tcp        0      0 *:imaps                 *:*                     LISTEN      1117/xinetd


stunnel needs the -r or -l as used on the server to tell it how to connect. The config file contains the needed information. Be sure that the config file is correct and that the user running stunnel can access it.

I run stunnel as root

Code:
ls -l /etc/stunnel
total 4
-rw-------    1 root     root         278 Oct  5 11:14 www.conf
Code:
cat /etc/stunnel/www.conf

client = yes
debug = debug
cert = /usr/share/ssl/private/www.pem
[pop3s]
accept = localhost:110
connect = mail.dcphillips.net:995
[imaps]
accept = localhost:143
delay = yes
connect = mail.dcphillips.net:993
[smtps]
accept = localhost:25
connect =mail.dcphillips.net:465

your logs should tell you if stunnel has a problem starting, check /var/log/messages for more info on the problem.



Last edited by DavidPhillips; 10-05-2003 at 09:28 PM.
 
Old 10-27-2003, 08:21 PM   #4
linuxnube
Member
 
Registered: Oct 2003
Location: US
Distribution: Fedora C1 & C2
Posts: 81

Rep: Reputation: 15
As for the windows client goes, how does this work with antivirus software that is also intercepting mail sent from the client on localhost, in order to scan outgoing mail for viruses?

-KS
 
Old 10-27-2003, 09:22 PM   #5
DavidPhillips
Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,154

Original Poster
Rep: Reputation: 56
No problem as far as I have tested.

I have "Norton AV 2002" set to scan email, I also have it set to display a progress indicator when I send mail. The progress screen comes up and shows the scan as expected.


I would expect other scanners to work as expected also.
 
Old 11-04-2003, 02:13 PM   #6
linuxnube
Member
 
Registered: Oct 2003
Location: US
Distribution: Fedora C1 & C2
Posts: 81

Rep: Reputation: 15

Last edited by linuxnube; 11-04-2003 at 02:54 PM.
 
Old 11-04-2003, 04:08 PM   #7
DavidPhillips
Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,154

Original Poster
Rep: Reputation: 56
yes linuxnube it will work. the .dll files for openssl are found at stunnel.org in the download area, that's all you need on the client unless you intend to create certificates on the client. Then you would need to install openssl.

Last edited by DavidPhillips; 05-31-2004 at 10:43 AM.
 
Old 12-15-2003, 01:37 PM   #8
romel
Member
 
Registered: Sep 2003
Location: Bangladesh
Distribution: Debian
Posts: 102

Rep: Reputation: 15
Can I setup "exim 4" mail server at "debian gnu linux 3.0" by following these instructions....I want to setp a secure mail server at debian and also a scanner for it's incoming and outgoing email....
 
Old 12-15-2003, 06:02 PM   #9
DavidPhillips
Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,154

Original Poster
Rep: Reputation: 56
This document covers setting up a secure tunnel to transfer mail over. You can use it to secure any mailserver you wish.

It does not cover mailserver installation or configuration.
 
Old 12-16-2003, 02:12 PM   #10
romel
Member
 
Registered: Sep 2003
Location: Bangladesh
Distribution: Debian
Posts: 102

Rep: Reputation: 15
thanks...Now I understand...
 
Old 01-01-2004, 01:22 PM   #11
J_Szucs
Senior Member
 
Registered: Nov 2001
Location: Budapest, Hungary
Distribution: SuSE 6.4-11.3, Dsl linux, FreeBSD 4.3-6.2, Mandrake 8.2, Redhat, UHU, Debian Etch
Posts: 1,126

Rep: Reputation: 58
According to the Article, one should setup stunnel and ssl on the client, too, to connect to e.g. a secure smtp server.

Fortunately, it is not so. I tested the setup and found that the mail client of Mozilla 1.5 can perfecly use the smtps server even if you do not have stunnel on the client! In my case I had a https server with client-server authentication using stunnel on the server, and, based on that setup, it took me not more than a minute to setup the new, smtps service.

Stunnel and Mozilla rock!

Thanks for the tip!

Last edited by J_Szucs; 01-01-2004 at 01:23 PM.
 
Old 01-01-2004, 03:02 PM   #12
DavidPhillips
Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,154

Original Poster
Rep: Reputation: 56
Yes, that's true if your client supports it directly you can input the server instead of localhost. It does sound like your not using client certificate auth on the server if this works without using the client certificate. That's the difference.

Also not all clients will support it, so If yours does not you can do it with stunnel and ssl. If it does the choice is yours to decide.

Last edited by DavidPhillips; 05-31-2004 at 10:46 AM.
 
Old 04-02-2004, 02:37 AM   #13
DavidPhillips
Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,154

Original Poster
Rep: Reputation: 56
As a side note..

Normal smtp mailserver setup was not covered here, but be sure your port 25 is open on your firewall for incoming email.

 
Old 04-09-2004, 05:28 PM   #14
kenoichi
LQ Newbie
 
Registered: Apr 2004
Posts: 11

Rep: Reputation: 0
what affero button?
 
Old 04-09-2004, 06:07 PM   #15
DavidPhillips
Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,154

Original Poster
Rep: Reputation: 56
The one that says ( * affero ) on it!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
DISCUSSION: DHCP Server Howto SiegeX LinuxAnswers Discussion 30 12-10-2006 09:40 PM
Email Server for remote users, can it be secure? javiergt Linux - Software 2 02-04-2005 09:44 AM
Secure Mail Server Setup djkene70 Linux - Networking 3 10-14-2003 01:29 PM
relaying to email server depaul Linux - Software 3 07-18-2003 02:12 PM
Secure Web Server HowTo from SuSE mcleodnine Linux - Security 0 08-02-2001 09:41 PM


All times are GMT -5. The time now is 09:11 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration