#!/bin/sh
# Author: Christoph Galuschka <christoph.galuschka@chello.at>
t_Log "Running $0 - Postfix plain SASL test."
t_Log "Installing prerequisits"
t_InstallPackage openssl
#creating backups of changed files
cp -a /etc/postfix/main.cf /etc/postfix/main.cf_testing
if [ $centos_ver = 5 ]
then
cp -a /etc/dovecot.conf /etc/dovecot.conf_testing
else
cp -a /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf_testing
fi
#creating certificates
TESTDIR='/var/tmp/openssl-test'
mkdir $TESTDIR
t_Log "creating private key"
if [ $centos_ver = 6 ]
then
openssl genpkey -algorithm rsa -out $TESTDIR/server.key.secure -pkeyopt rsa_keygen_bits:2048 > /dev/null 2>&1
else
openssl genrsa -passout pass:centos -des3 -rand file1:file2:file3:file4:file5 -out $TESTDIR/server.key.secure 2048 > /dev/null 2>&1
fi
if [ $? == 1 ]
then t_Log "Creation of private key failed."
ret_val=1
exit
fi
#create default answer file
cat > $TESTDIR/openssl_answers<<EOF
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
string_mask = nombstr
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = UK
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = somestate
localityName = Locality Name (eg, city)
localityName_default = somecity
0.organizationName = Organization Name (eg, company)
0.organizationName_default = CentOS-Project
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = CentOS
EOF
t_Log "creating server key"
if [ $centos_ver = 6 ]
then
openssl rsa -in $TESTDIR/server.key.secure -out $TESTDIR/server.key > /dev/null 2>&1
else
openssl rsa -passin pass:centos -in $TESTDIR/server.key.secure -out $TESTDIR/server.key > /dev/null 2>&1
fi
if [ $? == 1 ]
then t_Log "Creation of server key failed."
ret_val=1
exit
fi
openssl req -batch -config $TESTDIR/openssl_answers -new -key $TESTDIR/server.key -out $TESTDIR/server.csr > /dev/null 2>&1
if [ $? == 1 ]
then t_Log "Creation of CSR failed."
ret_val=1
exit
fi
t_Log "creating server certificate"
openssl x509 -req -days 3600 -in $TESTDIR/server.csr -signkey $TESTDIR/server.key -out $TESTDIR/server.crt > /dev/null 2>&1
if [ $? == 1 ]
then t_Log "Creation of CRT failed."
ret_val=1
exit
fi
#copy files to destinations
cp -a $TESTDIR/server.crt /etc/pki/tls/certs/
cp -a $TESTDIR/server.key /etc/pki/tls/private/
#adding parameters to postfix
cat >> /etc/postfix/main.cf <<EOF
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_tls_security_level = may
smtpd_tls_key_file = /etc/pki/tls/private/mail.example.com.key
smtpd_tls_cert_file = /etc/pki/tls/certs/mail.example.com.cert
# smtpd_tls_CAfile = /etc/pki/tls/root.crt
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache
tls_random_source = dev:/dev/urandom
smtpd_tls_auth_only = yes
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination
EOF
#adding parameters to dovecot
if [ $centos_ver = 5 ]
then
cat > /etc/dovecot.conf <<EOF
protocol imap {
}
protocol pop3 {
}
protocol lda {
postmaster_address = postmaster@example.com
}
auth default {
mechanisms = plain
passdb pam {
}
userdb passwd {
}
user = root
socket listen {
client {
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}
}
}
dict {
}
plugin {
}
EOF
else
cat >> /etc/dovecot/dovecot.conf <<EOF
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}
EOF
fi
#restarting services
t_ServiceControl postfix restart
t_ServiceControl dovecot restart
#Running test
t_Log "Testing if postfix accepts connections and offers STARTTLS"
echo "ehlo test" | nc -w 3 127.0.0.1 25 | grep -q 'STARTTLS'
ret_val=$?
# restoring changed files
mv -f /etc/postfix/main.cf_testing /etc/postfix/main.cf
if [ $centos_ver = 5 ]
then
mv -f /etc/dovecot.conf_testing /etc/dovecot.conf
else
mv -f /etc/dovecot/dovecot.conf_testing /etc/dovecot/dovecot.conf
fi
rm -rf $TESTDIR/server.*
rm -rf /etc/pki/tls/certs/server.crt
rm -rf /etc/pki/tls/private/server.key
t_CheckExitStatus $ret_val