Exim - Revision history

Vincent: Update certmanage command

2018-05-03T11:29:14Z

Update certmanage command

← Older revision		Revision as of 11:29, 3 May 2018
Line 35:		Line 35:
	{		{
	"domains": ["smtp.example.org"],		"domains": ["smtp.example.org"],
	"reload": [["cp", "--preserve=all", "/etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem", "/etc/exim4/private/"], ["/bin/systemctl", "reload", "exim4.service"]]		"reload": [["cp", "--preserve=all", "/etc/letsencrypt/live/smtp.example.org/fullchain.pem", "/etc/letsencrypt/live/smtp.example.org/privkey.pem", "/etc/exim4/private/"], ["/bin/systemctl", "reload", "exim4.service"]]
	}		}
	</syntaxhighlight>		</syntaxhighlight>

Vincent: Update link

2017-04-05T05:59:14Z

Update link

← Older revision		Revision as of 05:59, 5 April 2017
Line 1:		Line 1:
	== Prerequisite ==		== Prerequisite ==
	This article is part of the [[Emails#Complete\|emails]] series. It is assumed that you already covered [[Dovecot]].		This article is part of the [[Emails/Complete\|emails]] series. It is assumed that you already covered [[Dovecot]].

	This guide also uses the following software:		This guide also uses the following software:

Vincent: Prerequisite

2017-04-02T22:04:39Z

Prerequisite

← Older revision		Revision as of 22:04, 2 April 2017
Line 1:		Line 1:
			== Prerequisite ==
			This article is part of the [[Emails#Complete\|emails]] series. It is assumed that you already covered [[Dovecot]].

			This guide also uses the following software:
			* [[Let’s Encrypt]] or another way to get certificates
			* [[nftables]] as a firewall
			* [[Fail2Ban]]. Optional but recommended for security.

	== Install ==		== Install ==
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">

Vincent: Update certmanage config

2017-04-02T09:56:33Z

Update certmanage config

← Older revision		Revision as of 09:56, 2 April 2017
Line 1:		Line 1:
	== Install ==		== Install ==
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install exim4-daemon-heavy		$ sudo apt install exim4-daemon-heavy
	</syntaxhighlight>Note: The heavy version is needed to use Dovecot as an authentication mechanism.		</syntaxhighlight>Note: The heavy version is needed to use Dovecot as an authentication mechanism.

Line 15:		Line 15:
	==== Create folder ====		==== Create folder ====
	Unlike other programs, Exim doesn't read it's certificate as the root user. So it will be unable to read them from the standard let’sencrypt folder. We will create a folder readable by Exim where we can safely drop certificates later<syntaxhighlight lang="console">		Unlike other programs, Exim doesn't read it's certificate as the root user. So it will be unable to read them from the standard let’sencrypt folder. We will create a folder readable by Exim where we can safely drop certificates later<syntaxhighlight lang="console">
	# mkdir -m 710 /etc/exim4/private		$ sudo mkdir -m 710 /etc/exim4/private
	# chgrp Debian-exim /etc/exim4/private		$ sudo chgrp Debian-exim /etc/exim4/private
	</syntaxhighlight>		</syntaxhighlight>

Line 22:		Line 22:
	# Edit file <code>/etc/nginx/sites-enabled/noweb</code> an add a <code>server_name</code> line for <code>smtp.example.org</code>		# Edit file <code>/etc/nginx/sites-enabled/noweb</code> an add a <code>server_name</code> line for <code>smtp.example.org</code>
	# Activate your new domain in Nginx<syntaxhighlight lang="console">		# Activate your new domain in Nginx<syntaxhighlight lang="console">
	# service ~~nginx reload~~		$ sudo systemctl reload nginx.service
	</syntaxhighlight>		</syntaxhighlight>
	# Edit file <code>/usr/local/sbin/renew_certificates</code> and add the following to the config list<syntaxhighlight lang="~~python~~">		# Edit file <code>/usr/local/sbin/renew_certificates</code> and add the following to the config list<syntaxhighlight lang="json">
	{		{
	'domains': ['smtp.example.org'],		"domains": ["smtp.example.org"],
	'reload': [['cp', '--preserve=all', '/etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem', '/etc/exim4/private/'], [~~'service'~~, 'exim4~~', 'reload'~~]]		"reload": [["cp", "--preserve=all", "/etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem", "/etc/exim4/private/"], ["/bin/systemctl", "reload", "exim4.service"]]
	}		}
	</syntaxhighlight>		</syntaxhighlight>
	# Get Your certificate{{Let’s Encrypt/New Cert Command\|domain = smtp.example.org\|command = cp --preserve=all /etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem /etc/exim4/private/		# Get Your certificate{{Let’s Encrypt/New Cert Command\|domain = smtp.example.org\|command = cp --preserve=all /etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem /etc/exim4/private/
	service ~~exim4 reload~~}}		/bin/systemctl reload exim4.service}}

	==== Use Certificate ====		==== Use Certificate ====
Line 58:		Line 58:
	}		}
	</syntaxhighlight>And apply config with<syntaxhighlight lang="console">		</syntaxhighlight>And apply config with<syntaxhighlight lang="console">
	# service ~~dovecot reload~~		$ sudo systemctl restart dovecot.service
	</syntaxhighlight>		</syntaxhighlight>

Line 120:		Line 120:
	}		}
	</syntaxhighlight>Also note that this log file is never rotated. So you will get the same email over and over until you do it manually. It can be done with:<syntaxhighlight lang="console">		</syntaxhighlight>Also note that this log file is never rotated. So you will get the same email over and over until you do it manually. It can be done with:<syntaxhighlight lang="console">
	# logrotate -f /etc/logrotate.d/exim4-paniclog		$ sudo logrotate -f /etc/logrotate.d/exim4-paniclog
	</syntaxhighlight>To have this rotation done automatically (and thus receive the email only once), edit <code>/etc/default/exim4</code><syntaxhighlight lang="shell">		</syntaxhighlight>To have this rotation done automatically (and thus receive the email only once), edit <code>/etc/default/exim4</code><syntaxhighlight lang="shell">
	# Rotate /var/log/exim4/paniclog after email is sent to admin		# Rotate /var/log/exim4/paniclog after email is sent to admin

Vincent: Review TLS ciphers: Add RSA for compatibility & %SERVER_PRECEDENCE for security.

2016-07-30T20:38:34Z

Review TLS ciphers: Add RSA for compatibility & %SERVER_PRECEDENCE for security.

← Older revision		Revision as of 20:38, 30 July 2016
Line 39:		Line 39:
	MAIN_TLS_PRIVATEKEY = /etc/exim4/private/privkey.pem		MAIN_TLS_PRIVATEKEY = /etc/exim4/private/privkey.pem
	# GNUTLS ciphers: https://www.gnutls.org/manual/html_node/Priority-Strings.html		# GNUTLS ciphers: https://www.gnutls.org/manual/html_node/Priority-Strings.html
	tls_require_ciphers = PFS:!ARCFOUR-128:!3DES-CBC:!MD5:!SIGN-RSA-MD5:~~!CURVE~~-~~SECP192R1:!~~CAMELLIA-128-CBC:!CAMELLIA-256-CBC		# test using: gnutls-cli -l --priority PFS:+RSA:...
			tls_require_ciphers = PFS:+RSA:-ARCFOUR-128:-3DES-CBC:-MD5:-SIGN-RSA-MD5:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC:-CURVE-SECP192R1:%SERVER_PRECEDENCE
	</syntaxhighlight>		</syntaxhighlight>

Vincent: Update TLS Config

2016-07-23T21:35:33Z

Update TLS Config

← Older revision		Revision as of 21:35, 23 July 2016
Line 38:		Line 38:
	MAIN_TLS_CERTIFICATE = /etc/exim4/private/fullchain.pem		MAIN_TLS_CERTIFICATE = /etc/exim4/private/fullchain.pem
	MAIN_TLS_PRIVATEKEY = /etc/exim4/private/privkey.pem		MAIN_TLS_PRIVATEKEY = /etc/exim4/private/privkey.pem
	tls_require_ciphers = PFS:!ARCFOUR-128:!3DES-CBC:!MD5:!SIGN-RSA-MD5		# GNUTLS ciphers: https://www.gnutls.org/manual/html_node/Priority-Strings.html
			tls_require_ciphers = PFS:!ARCFOUR-128:!3DES-CBC:!MD5:!SIGN-RSA-MD5:!CURVE-SECP192R1:!CAMELLIA-128-CBC:!CAMELLIA-256-CBC
	</syntaxhighlight>		</syntaxhighlight>

Vincent: Paniclog handling

2016-07-04T22:32:46Z

Paniclog handling

@@ Line 109: / Line 109: @@
 === DKIM ===
 [[Exim/DKIM]]
 == Fail2Ban ==

Vincent: DKIM

2016-06-09T21:17:51Z

DKIM

← Older revision		Revision as of 21:17, 9 June 2016
Line 104:		Line 104:
	</syntaxhighlight>		</syntaxhighlight>

	== Firewall ==		=== Firewall ===
	{{nftables/config\|category = Exim\|tcp_port_in = 25, 587\|udp_port_in = \|tcp_port_out =25 \|udp_port_out = \|user_out = }}		{{nftables/config\|category = Exim\|tcp_port_in = 25, 587\|udp_port_in = \|tcp_port_out =25 \|udp_port_out = \|user_out = }}

			=== DKIM ===
			[[Exim/DKIM]]

	== Fail2Ban ==		== Fail2Ban ==

Vincent: /* Authentication */ Dovecot configuration

2016-06-09T21:01:16Z

Authentication: Dovecot configuration

@@ Line 42: / Line 42: @@
 === Authentication ===
 Create file <code>/etc/exim4/conf.d/auth/15_dovecot</code><syntaxhighlight lang="properties">
 dovecot_login:

Vincent: Rename certs folder

2016-06-06T07:04:12Z

Rename certs folder

← Older revision		Revision as of 07:04, 6 June 2016
Line 15:		Line 15:
	==== Create folder ====		==== Create folder ====
	Unlike other programs, Exim doesn't read it's certificate as the root user. So it will be unable to read them from the standard let’sencrypt folder. We will create a folder readable by Exim where we can safely drop certificates later<syntaxhighlight lang="console">		Unlike other programs, Exim doesn't read it's certificate as the root user. So it will be unable to read them from the standard let’sencrypt folder. We will create a folder readable by Exim where we can safely drop certificates later<syntaxhighlight lang="console">
	# mkdir -m 710 /etc/exim4/~~certs~~		# mkdir -m 710 /etc/exim4/private
	# chgrp Debian-exim /etc/exim4/~~certs~~		# chgrp Debian-exim /etc/exim4/private
	</syntaxhighlight>		</syntaxhighlight>

Line 27:		Line 27:
	{		{
	'domains': ['smtp.example.org'],		'domains': ['smtp.example.org'],
	'reload': [['cp', '--preserve=all', '/etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem', '/etc/exim4/~~certs~~/'], ['service', 'exim4', 'reload']]		'reload': [['cp', '--preserve=all', '/etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem', '/etc/exim4/private/'], ['service', 'exim4', 'reload']]
	}		}
	</syntaxhighlight>		</syntaxhighlight>
	# Get Your certificate{{Let’s Encrypt/New Cert Command\|domain = smtp.example.org\|command = cp --preserve=all /etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem /etc/exim4/~~certs~~/		# Get Your certificate{{Let’s Encrypt/New Cert Command\|domain = smtp.example.org\|command = cp --preserve=all /etc/letsencrypt/live/smtp.example.org/{fullchain,privkey}.pem /etc/exim4/private/
	service exim4 reload}}		service exim4 reload}}

Line 36:		Line 36:
	Edit <code>/etc/exim4/conf.d/main/00_local_settings</code> and add the following lines<syntaxhighlight lang="properties">		Edit <code>/etc/exim4/conf.d/main/00_local_settings</code> and add the following lines<syntaxhighlight lang="properties">
	MAIN_TLS_ENABLE = true		MAIN_TLS_ENABLE = true
	MAIN_TLS_CERTIFICATE = /etc/exim4/~~certs~~/fullchain.pem		MAIN_TLS_CERTIFICATE = /etc/exim4/private/fullchain.pem
	MAIN_TLS_PRIVATEKEY = /etc/exim4/~~certs~~/privkey.pem		MAIN_TLS_PRIVATEKEY = /etc/exim4/private/privkey.pem
	tls_require_ciphers = PFS:!ARCFOUR-128:!3DES-CBC:!MD5:!SIGN-RSA-MD5		tls_require_ciphers = PFS:!ARCFOUR-128:!3DES-CBC:!MD5:!SIGN-RSA-MD5
	</syntaxhighlight>		</syntaxhighlight>