/usr/sfw/bin/openssland the configuration file
/etc/sfw/openssl/openssl.cnfare provided by the
SUNWopenssl-commandsand
SUNWopensslrpackages respectively, which are included in the End User (and greater) package meta-clusters. So if your system is installed with the Core (or lesser) package meta-cluster, you will need to install these two packages.
1# cd /etc/mail 2# mkdir -p certs/CA 3# cd certs/CA 4# mkdir certs crl newcerts private 5# echo "01" > serial 6# cp /dev/null index.txt 7# cp /etc/sfw/openssl/openssl.cnf .Note that the above source path is for Solaris 10; if anyone happens to be doing the same on say, Mac OS X, the source path is
/System/Library/OpenSSL/openssl.cnf; FreeBSD 4.11 puts the file in
/etc/ssl/openssl.cnf.
8# vi openssl.cnfSet values: I changed the
dirvalue from
/etc/sfw/opensslto
/etc/mail/certs/CAand the
stateOrProvinceName_defaultvalue from
Some-Stateto
California; the former was important but the latter was not.)
9# openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -c onfig openssl.cnfNotes on how to answer the questions: for
Organization Name, I answer
Sun Microsystems, for
Organizational Unit Name, I answer
Solaris, for
Common Name, I answer with the fully-qualified host-name (FQHN) of the machine in question (see
check-hostname(1M)for help on this), and for
10# openssl req -nodes -new -x509 -keyout newreq.pem -out newreq.pem -days 365 - config openssl.cnf(The certificate and private key are in the file
newreq.pem.) To sign the new certificate with the certificate authority:
11# openssl x509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem 12# openssl ca -config openssl.cnf -policy policy_anything -days 365 -out newcer t.pem -infiles tmp.pem 13# rm -f tmp.pem(The file
newcert.pemcontains the signed certificate;
newreq.pemstill contains the unsigned certificate and private key.)
Note that commands 9, 10 and 12 have a
-days 365 argument, which
specifies how long until the certificate expires. There does not appear to
be a reliable way to extend certificates, and going back to every machine and
reapplying this process a year later is a major pain, as I found out the hard
way. So the second time thru, I calculated how many days it would be until January 18, 2038, and
used that value.
sendmail.cfabout the certificates. (Note that this section was derived from another page written by Claus Aßmann, also of Sendmail.) Add:to your
.mcfile and rebuild your
sendmail.cffile and install it in
/etc/mail.
#
/etc/mail/certs/CAcert.pem(or whatever file
sendmail.cf's
CACertFileoption points to on that host) and copy it to
/etc/mail/certs/host.domain.cert.pemon your host (where host.domain is the other host's FQHN), and repeat step 5, except using
C=host.domain.cert.pem.
STARTTLSdefined and linked with both
libssland
libcrypto, and the Received: header shows e.g.:
Received: from jurassic.eng.sun.com ([IPv6:2002:8192:56bb:9259::8192:5932]) by opal.eng.sun.com (8.13.4+Sun/8.13.4) with ESMTP id j2TNUB8i242496 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for <jbeck@opal.eng.sun.com>; Tue, 29 Mar 2005 15:30:11 -0800 (PST ) Received: from opal.eng.sun.com (opal.SFBay.Sun.COM [129.146.89.54]) by jurassic.eng.sun.com (8.13.4+Sun/8.13.4) with ESMTP id j2TNU7cl571102 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for <jbeck@jurassic.eng.sun.com>; Tue, 29 Mar 2005 15:30:07 -0800 (PST)where the
verify=OKis the key part (see Claus' STARTTLS page for an explanation of what the various
verify=values correspond to).:
/etc/ssh/sshd_configand
/.ssh/authorized_keysto allow root from the old box to ssh to the new without being prompted for a password (not sure if this step was needed or not)
%.):
#include <libtecla.h>
#define MAX_LINE_LEN 1024 #define MAX_CMD_HIST 1024
static GetLine *gl; /* The gl_get_line() resource object */
main():
if ((gl = new_GetLine(MAX_LINE_LEN, MAX_CMD_HIST)) == NULL) exit(Z_ERR);Note that
Z_ERRis a constant with the value of 1, but the important thing for the general case is that it is some non-zero value..
main():
(void) del_GetLine(gl);
$CFDIR/READMEfor background and all sorts of details on these, where
$CFDIRis one of:
/etc/mail/cfon Solaris 10
/usr/lib/mailon Solaris 7, 8 or 9.
Overall, spam getting thru my personal domain's mail server to my users (including myself, my wife, my siblings, our mom, etc.) has dropped about 90% since I started using these techniques, despite the ever-increasing spam trends on the rest of the Internet..