Dovecot - Versionsgeschichte

Iceiden: /* Erzeugen des CSR */

2015-10-16T10:49:33Z

Erzeugen des CSR

← Nächstältere Version		Version vom 16. Oktober 2015, 12:49 Uhr
Zeile 8:		Zeile 8:

	<source lang=bash>		<source lang=bash>
	openssl req -new -newkey rsa:2048 -keyout /etc/ssl/private/domain.de.key -out /home/user/csr.txt -nodes		openssl req -new -newkey rsa:2048 -keyout /etc/ssl/private/domain.de.key -out /home/user/csr.txt -nodes -sha256
	</source>		</source>

Iceiden: /* Anpassen der Konfiguration */

2014-11-03T16:06:45Z

Anpassen der Konfiguration

← Nächstältere Version		Version vom 3. November 2014, 18:06 Uhr
Zeile 71:		Zeile 71:

	# SSL ciphers to use		# SSL ciphers to use
	ssl_cipher_list = ALL:!~~MEDIUM~~:!LOW:!~~SSLv3~~:!~~SSLv2~~:!EXP:!aNULL		ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:+HIGH:+MEDIUM

	# SSL crypto device to use, for valid values run "openssl engine"		# SSL crypto device to use, for valid values run "openssl engine"

Iceiden: /* Weiterführende Links */

2014-11-03T15:59:33Z

Weiterführende Links

← Nächstältere Version		Version vom 3. November 2014, 17:59 Uhr
Zeile 78:		Zeile 78:

	= Weiterführende Links =		= Weiterführende Links =
			* Dovecot Dokumentation zu [http://wiki2.dovecot.org/SSL/DovecotConfiguration SSL]
			* SSL Zertifikate für [https://icertificate.eu/de/ssl/anwendungsbereiche/ssl-zertifikate-fuer-mailserver.html Mailserver] bei icertificate

Iceiden: /* Anpassen der Konfiguration */

2014-11-03T15:56:15Z

Anpassen der Konfiguration

← Nächstältere Version		Version vom 3. November 2014, 17:56 Uhr
Zeile 24:		Zeile 24:

	<source lang=bash>		<source lang=bash>
	# SSL/TLS ~~support: yes, no, required~~. ~~<doc/wiki/SSL.txt>~~		# SSL/TLS supportan bzw. abschalten
	ssl = yes		ssl = yes

	# ~~PEM encoded X.509 SSL/TLS certificate and private key. They're opened before~~		#Pfade zum Zertifikat und Privatekey
	~~# dropping root privileges, so keep the key file unreadable by anyone but~~		ssl_cert = </etc/ssl/certs/domain.de.crt
	~~# root. Included doc/mkcert.sh can be used to easily generate self-signed~~		ssl_key = </etc/ssl/private/domain.de.key
	~~# certificate, just make sure to update the domains in dovecot-openssl.cnf~~
	ssl_cert = </etc/ssl/certs/~~www.vsadmin~~.de.crt
	ssl_key = </etc/ssl/private/~~www.vsadmin~~.de.key

	# ~~If key file is password protected~~, ~~give the password here. Alternatively~~
	# ~~give it when starting dovecot with -p parameter~~. ~~Since this file is often~~		#Mit diesem Parameter kann ein Passwort übergeben werden, falls der Privatekey
	# ~~world-readable~~, ~~you may want to place this setting instead to a different~~		# verschluesselt wurde. Da diese Datei oft fuer alle lesbar ist, kann mit
	# root ~~owned 0600 file by using ssl_key_password = <path~~.		# <Pfad_zu_passwort_datei eine Datei angegeben werden, die nur fur root lesbar ist.
	#ssl_key_password =		#ssl_key_password =

Zeile 43:		Zeile 40:
	# ssl_verify_client_cert=yes. The file should contain the CA certificate(s)		# ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
	# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)		# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
	~~ssl_ca = </etc/ssl/certs/COMODO_DV.crt~~

	# ~~Require that CRL check succeeds for client certificates~~.		# Pfad zu den Intermediate Zertifikaten, die das Serverzertifikat
			# signieren.
			ssl_ca = </etc/ssl/certs/INT_CA_chain.crt

			# dieser Parameter verlangt eine erfolgreiche Pruefung von CR Listen fuer Client Zertifikate
	#ssl_require_crl = yes		#ssl_require_crl = yes

	# ~~Request client to send a certificate~~. ~~If you also want to require it, set~~		# Mit diesem Parameter kann bei Clients ein Zertifikat angefordert werden.
	# auth_ssl_require_client_cert=yes ~~in auth section.~~		# Der Parameter auth_ssl_require_client_cert=yes erzwingt eine Verifizierung
			# dieses Zertifikates
	#ssl_verify_client_cert = no		#ssl_verify_client_cert = no

	# ~~Which field from certificate to use for username~~. commonName ~~and~~		# Angabe welches Zertifikatsfeld den Nutzernamen enthalten soll.
	# ~~x500UniqueIdentifier are the usual choices. You'll also need to set~~		# Ueblicher Weise sind dies der commonName und x500UniqueIdentifier
			# Man sollte auch den folgenden Parameter setzen:
	# auth_ssl_username_from_cert=yes.		# auth_ssl_username_from_cert=yes.
	#ssl_cert_username_field = commonName		#ssl_cert_username_field = commonName
Zeile 60:		Zeile 62:
	# intensive operation. The value is in hours, 0 disables regeneration		# intensive operation. The value is in hours, 0 disables regeneration
	# entirely.		# entirely.
			# Wie haeufig die SSL Parameter erzeugt werden sollen. Der Wert fasst Stunden
			# Die Rechenoperation ist verhaeltnismaessig rechenintensiv. 0 schaltet die
			# Regenerierung ab
	#ssl_parameters_regenerate = 168		#ssl_parameters_regenerate = 168

	# SSL ~~protocols to use~~		# Welche SSL Protokolle genutzt werden sollen
	ssl_protocols = !SSLv2		ssl_protocols = !SSLv3 !SSLv2

	# SSL ciphers to use		# SSL ciphers to use
	ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL		ssl_cipher_list = ALL:!MEDIUM:!LOW:!SSLv3:!SSLv2:!EXP:!aNULL

	# SSL crypto device to use, for valid values run "openssl engine"		# SSL crypto device to use, for valid values run "openssl engine"

Iceiden: /* Anpassen der Konfiguration */

2014-11-03T15:33:26Z

Anpassen der Konfiguration

← Nächstältere Version		Version vom 3. November 2014, 17:33 Uhr
Zeile 18:		Zeile 18:

	== Anpassen der Konfiguration ==		== Anpassen der Konfiguration ==

			Je nach Distribution sind die Konfigurationsdateien etwas anders Strukturiert. So werden bei Debian 7.x und Dovecot 2.x die Dateien unterhalb von <nowiki>/etc/dovecot/conf.d</nowiki> in verschiedenen Dateien gepflegt.

			Die Parameter sind jedoch, egal in welcher Datei Sie schlussendlich zu finden sind, die gleichen.

			<source lang=bash>
			# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
			ssl = yes

			# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
			# dropping root privileges, so keep the key file unreadable by anyone but
			# root. Included doc/mkcert.sh can be used to easily generate self-signed
			# certificate, just make sure to update the domains in dovecot-openssl.cnf
			ssl_cert = </etc/ssl/certs/www.vsadmin.de.crt
			ssl_key = </etc/ssl/private/www.vsadmin.de.key

			# If key file is password protected, give the password here. Alternatively
			# give it when starting dovecot with -p parameter. Since this file is often
			# world-readable, you may want to place this setting instead to a different
			# root owned 0600 file by using ssl_key_password = <path.
			#ssl_key_password =

			# PEM encoded trusted certificate authority. Set this only if you intend to use
			# ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
			# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
			ssl_ca = </etc/ssl/certs/COMODO_DV.crt

			# Require that CRL check succeeds for client certificates.
			#ssl_require_crl = yes

			# Request client to send a certificate. If you also want to require it, set
			# auth_ssl_require_client_cert=yes in auth section.
			#ssl_verify_client_cert = no

			# Which field from certificate to use for username. commonName and
			# x500UniqueIdentifier are the usual choices. You'll also need to set
			# auth_ssl_username_from_cert=yes.
			#ssl_cert_username_field = commonName

			# How often to regenerate the SSL parameters file. Generation is quite CPU
			# intensive operation. The value is in hours, 0 disables regeneration
			# entirely.
			#ssl_parameters_regenerate = 168

			# SSL protocols to use
			ssl_protocols = !SSLv2

			# SSL ciphers to use
			ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL

			# SSL crypto device to use, for valid values run "openssl engine"
			#ssl_crypto_device =
			</source>

	= Weiterführende Links =		= Weiterführende Links =

Iceiden: /* Erzeugen des CSR */

2014-11-03T15:30:56Z

Erzeugen des CSR

@@ Zeile 2: / Zeile 2: @@
 == Erzeugen des CSR ==
 == Anpassen der Konfiguration ==
 = Weiterführende Links =

Iceiden: Die Seite wurde neu angelegt: ‚Äû= Einrichtung von SSL für den Dovecot IMAP/POP3 Server = == Erzeugen des CSR == == Anpassen der Konfiguration == = Weiterführende Links =‚Äú

2014-11-03T15:26:30Z

Die Seite wurde neu angelegt: ‚Äû= Einrichtung von SSL für den Dovecot IMAP/POP3 Server = == Erzeugen des CSR == == Anpassen der Konfiguration == = Weiterführende Links =‚Äú

Neue Seite

= Einrichtung von SSL für den Dovecot IMAP/POP3 Server =

== Erzeugen des CSR ==

== Anpassen der Konfiguration ==

= Weiterführende Links =