build:security
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
build:security [2007/06/26 15:23] 206.197.251.52 |
build:security [2008/02/11 02:52] (current) 4.245.76.22 |
||
|---|---|---|---|
| Line 13: | Line 13: | ||
| * Provide a script to automate certification generation, providing defaults for standard data | * Provide a script to automate certification generation, providing defaults for standard data | ||
| + | ====== SSL ====== | ||
| - | ====== SSL Key Generation ====== | + | //[[postfix|Postfix]], [[imap|Courier IMAP]], and [[apache|Apache]] all use their own SSL certificates in /etc/ssl/ for secure communications and TLS authenication. The configuration files for each application will have to reflect the name of the certificate file. See the documentation for individual applications or existing systems for the naming convention.// |
| - | //Postfix and Apache both use the SSL certificates in /etc/ssl/ for secure communications and TLS authenication. The guide for creating the keys is at openssl.htm (http://www.nomoa.com/bsd/openssl.htm) | + | The guide for creating the keys is at [[http://www.nomoa.com/bsd/openssl.htm|openssl.htm]]. Additional information might be at the [[http://www.openssl.org/|OpenSSL web site]]. |
| - | // | + | |
| - | * Backup /etc/ssl/openssl.cnf to /etc/ssl/openssl.cnf.original and change/add defaults to be specific to SLUUG: | + | ===== SSL Configuration ===== |
| - | * countryName_default = US | + | |
| - | * stateOrProvinceName_default = Missouri | + | |
| - | * localityName_default = St. Louis | + | |
| - | * 0.organizationName_default = St. Louis Unix User's Group | + | |
| - | * emailAddress = postmaster@sluug.org | + | |
| - | * commonName_default = bud.sluug.org | + | |
| - | * Generate the private server key with passphrase. | + | This is done once for the system. |
| + | |||
| + | * Backup ''/etc/ssl/openssl.cnf'' to ''/etc/ssl/openssl.cnf.original'' and change/add defaults in the req_distinguished_name section of openssl.cnf to be specific to SLUUG. The ''commonName_default'' and '' organizationalUnitName_default'' are different for each system. | ||
| + | * ''countryName_default = US'' | ||
| + | * ''stateOrProvinceName_default = Missouri'' | ||
| + | * ''localityName_default = St. Louis'' | ||
| + | * ''0.organizationName_default = St. Louis Unix ''User's Group | ||
| + | * ''emailAddress = postmaster@sluug.org'' | ||
| + | * ''commonName_default = bud.sluug.org'' | ||
| + | * ''organizationalUnitName_default = bud.sluug.org'' | ||
| + | |||
| + | ===== SSL Key Generation - Manual Method ===== | ||
| + | |||
| + | ** This entire section is duplicated below in the [[#ssl_key_generation_-_script_method|SSL Key Generation - Script Method]] section. Do one or the other, not both.** | ||
| + | |||
| + | This is repeated for each application that needs it. | ||
| + | |||
| + | * Generate the private server key with passphrase. Enter anything for the passphrase (4 to 8191 characters), but will have to enter it for the next step that removes it. | ||
| <code rootshell> | <code rootshell> | ||
| - | openssl genrsa -des3 -out /etc/ssl/private/server.key 1024 | + | openssl genrsa -des3 -out /etc/ssl/private/temp.key 1024 |
| </code> | </code> | ||
| * Remove the passphrase (cannot use a passphrase with a server) | * Remove the passphrase (cannot use a passphrase with a server) | ||
| <code rootshell> | <code rootshell> | ||
| - | openssl rsa -in pass.key -out server.key | + | openssl rsa -in /etc/ssl/private/temp.key -out /etc/ssl/private/<name>.key |
| </code> | </code> | ||
| - | * Generate the certificate request with defaults from the modified openssl.cnf. For the "Common Name" enter the servers fqdn e.g. bud.sluug.org | + | * No longer need the temporary key. |
| + | <code rootshell> | ||
| + | rm /etc/ssl/private/temp.key | ||
| + | </code> | ||
| + | * Generate the certificate request with defaults from the modified openssl.cnf. When running the signing request, you will be asked a number of questions about the identification of the organization and system. Since these were already set in openssl.cnf, you should only need to verify the default value and press Carriage Return to take the default for all of them. For example, for the "Common Name" enter the servers fqdn e.g. bud.sluug.org | ||
| <code rootshell> | <code rootshell> | ||
| openssl req -new -key /etc/ssl/private/<name>.key -out /etc/ssl/private/<name>.csr | openssl req -new -key /etc/ssl/private/<name>.key -out /etc/ssl/private/<name>.csr | ||
| </code> | </code> | ||
| - | Self sign the certificate request to produce the certificate. | + | * Self sign the certificate request to produce the certificate. |
| <code rootshell> | <code rootshell> | ||
| openssl x509 -req -days 3650 -in /etc/ssl/private/<name>.csr -signkey /etc/ssl/private/<name>.key -out /etc/ssl/<name>.crt | openssl x509 -req -days 3650 -in /etc/ssl/private/<name>.csr -signkey /etc/ssl/private/<name>.key -out /etc/ssl/<name>.crt | ||
| </code> | </code> | ||
| - | * Next change group so postfix can read it. | + | * Change group and permissions as needed so the application can read it's own certificate. For example, for postfix: |
| <code rootshell> | <code rootshell> | ||
| chown :postfix /etc/ssl/private/postfix.key | chown :postfix /etc/ssl/private/postfix.key | ||
| Line 51: | Line 66: | ||
| </code> | </code> | ||
| - | ===== openssl-gencrt script ===== | + | ===== SSL Key Generation - Script Method ===== |
| - | The above commands are in openssl-gencrt to simplify cert creation: | + | |
| - | * Launch openssl-keygen with the desired Certificate Name as an argument | + | **This entire section is duplicated above in the [[#ssl_key_generation_-_manual_method|SSL Key Generation - Script Method]] section. Do one or the other, not both.** |
| + | This is repeated for each application that needs it. | ||
| + | |||
| + | The above commands are in a script named ''openssl-gencrt'' to simplify certificate creation: | ||
| + | |||
| + | * Copy ''/usr/local/sbin/openssl-gencrt'' from another system if not already done. | ||
| + | |||
| + | * Launch ''openssl-keygen'' with the desired Certificate Name as an argument | ||
| <code rootshell> | <code rootshell> | ||
| - | openssl-gencrt <Certificate Name>e | + | openssl-gencrt <name> |
| </code> | </code> | ||
| * The defaults for SLUUG are provided - a <cr> will accept them; only the common name is required to be entered. | * The defaults for SLUUG are provided - a <cr> will accept them; only the common name is required to be entered. | ||
| * Defaults may be overridden if required | * Defaults may be overridden if required | ||
| - | * NOTE: A passphrase is requifor the key - it is removed in the second step | + | * NOTE: A passphrase is required for the key - it is removed in the second step |
| ===== Defaults ===== | ===== Defaults ===== | ||
| Line 75: | Line 96: | ||
| * Any of the defaults may be overridden at creation time | * Any of the defaults may be overridden at creation time | ||
| - | |||
build/security.1182889385.txt.gz · Last modified: 2007/06/26 15:23 by 206.197.251.52
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
