 | | | DomainKeys implemenatation overview | DomainKeys implemenatation overview 2005-08-09 - By Opesh Alkara
Back
Hi Group,
I would like to share the knowledge of implementing domainkeys:
The Basic things required is :
Sendmail 8.13 or above
dk-filter-0.3.0
SASL packages
openSSL packages
First of all you untar the sendmail source and add the following line (if
they are not already there) at the end of the file site.config.m4 in the
path sendmail-8.13.4/devtools/Site/site.config.m4:
APPENDDEF(`confENVDEF',`-DSTARTTLS')
APPENDDEF(`confLIBS', `-lssl -lcrypto')
APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib -R/usr/local/ssl/lib')
APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include')
APPENDDEF(`conf_sendmail_ENVDEF', `-DMILTER')
Enter the directory sendmail-8.13.4/libmilter/ and run
#./Build
#./Build install
to install the libmilter.a library required for mail filters options in
sendmail.
Now compile the sendmail source by entering into the root source directory
# cd sendmail-8.13.4/
# ./Build
#./Build install
this will compile and install the sendmail source in the server.
configure the sendmail with the following option in the
sendmail.mc<http://sendmail.mc/>file:
INPUT_MAIL_FILTER(`dk-filter', `S=inet:2500@(protected)')
here dk-filter stands for Domain Key filter and 2500 is the port in which
the dk-filter daemon will listen.
# m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
Now you need to compile dk-milter-0.3.0.tar.gz source. Untar the source and
add the following line (if they are not already there) at the end of the
file site.config.m4 in the path dk-milter-0.3.0/devtools/Site/site.config.m4:
APPENDDEF(`confENVDEF',`-DSTARTTLS')
APPENDDEF(`confLIBS', `-lssl -lcrypto')
APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib -R/usr/local/ssl/lib')
APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include')
APPENDDEF(`conf_sendmail_ENVDEF', `-DMILTER')
Edit the file dk-milter-0.3.0/dk-filter/Makefile.m4 to contain these
options:
##################################################################
include(confBUILDTOOLSDIR`/M4/switch.m4')
define(`confMT', `TRUE')
define(`confREQUIRE_LIBSM', `true')
APPENDDEF(`confLIBS', `-lssl -lcrypto')
dnl Enable and edit these paths as needed:
APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include ')
APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib ')
dnl To use the asynchronous resolver library provided, enable this line:
dnl bldPUSH_SMLIB(`ar')
bldPUSH_SMLIB(`dk')
APPENDDEF(`confINCDIRS', `-I../libdk/ ')
bldPUSH_SMLIB(`sm')
dnl Enable these next line if needed to specify the locations of libmilter.a
dnl and the libmilter include files:
APPENDDEF(`confINCDIRS', `-I/usr/local/sendmail/include')
APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libmilter')
APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsm')
APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsmdb')
APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsmutil')
dnl Enable for IPv6 support:
dnl APPENDDEF(`confENVDEF', `-DNETINET6 ')
dnl Compile time options, especially FFRs:
dnl APPENDDEF(`confENVDEF', `-D_FFR_EXTERNAL_IGNORE_LIST ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_FLUSH_HEADERS ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_MACRO_LIST ')
APPENDDEF(`confENVDEF', `-D_FFR_MULTIPLE_KEYS ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_REPORTINFO ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_REQUIRED_HEADERS ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_SELECT_CANONICALIZATION ')
dnl If you do POP before SMTP:
dnl APPENDDEF(`confENVDEF', `-DPOPAUTH ')
dnl APPENDDEF(`confINCDIRS', `-I/usr/local/BerkeleyDB/include')
dnl APPENDDEF(`confLIBDIRS', `-L/usr/local/BerkeleyDB/lib')
dnl PREPENDDEF(`confLIBS', `-ldb ')
bldPRODUCT_START(`executable', `dk-filter')
define(`bldSOURCES', `dk-filter.c util.c ')
PREPENDDEF(`confLIBS', `-lmilter ')
bldPRODUCT_END
bldPRODUCT_START(`manpage', `dk-filter')
define(`bldSOURCES', `dk-filter.8')
bldPRODUCT_END
bldFINISH
#######################################################
now build the source by command
# ./Build
#./Build install
Generate a public/private key pair for your domain using the command:
#openssl genrsa -out rsa.private 768
#openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM
Move you private key to /usr/share/ssl/private/ with file name *
example.com_key.pem* .
Publish you public key in the DNS server for domain
example.com<http://example.com/>as a TXT record:
mail._domainkey.example.com. 1D IN TXT "g=; k=rsa; t=y;
p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAJUf/A69N7tYPcoursysqYFzBl3
+yzCCUsNQAY6TIcD02OEix1xETOOubJ1Z5i7UrR3E36aEeeHA9tdDu1P
+xvQ6PoQEXeevGWfs61j4lVRQErx4Km+KKcqja6nSgZbflQIDAQAB"
Notice the double quotes that start from *"g=;* and end upto the end of key
i.e. upto *QAB"*
Replace example.com <http://example.com/> by your domain name for which you
want to implement domainkey.
*mail* in the DNS record *mail*._domainkey.example.com. is selector to
select the key. You can place multiple keys in the form of text record and a
selector asociated with each key. While starting the DomainKey Daemon you
need to specify which selector to use while signing the mail for
example.com<http://example.com/>
.
Now restart your DNS service
create a user for Domain Key filter and start dk-filter daemon by the
following command :
dk-filter -l -p inet:2500@(protected) -c nofws -d
example.com<http://example.com/>-D -H -s
/usr/share/ssl/private/example.com_key.pem -S mail -u dkuser -m MTA
Send mail to any Yahoo! ID and check to see whether the
authentication-results header shows result as pass or fail.
Thanks,
Opesh Alkara
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@(protected)?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
Earn $52 per hosting referral at Lunarpages.
|
|
|