Scalix Forums

I am running Scalix 11.1 on SUSE Linux Enterprise Server 10 SP1 i568 running in a XEN domU on a SLES 10 SP1 x86_64 box.
I search many time to find the answers on secure connections from Evolution to the Scalix server but could not really find one.
So here are my steps, there is probably a better way but this works and it is easy.

Backup your /etc/sysconfig/, /etc/sendmail, /etc/mail/ files and directories.

To get secure IMAP and/or POP3 was easy. Install stunnel and run
/usr/bin/openssl req -new -x509 -days 365 -nodes -config /usr/share/doc/packages/stunnel/stunnel.cnf -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem
This will build a simple certificate to use.
You need to edit the /etc/stunnel/stunnel.conf file to look something like this
#
[pop3s]
accept = 995
connect = 110

[imaps]
accept = 993
connect = 143

[ssmtp]
accept = 465
connect = 25
#
Then you need to make sure stunnel starts with the server after a reboot.
chkconfig stunnel on

Now for secure SMTP to work I had to edit several files to include SASL AUTH support.
This are the following steps.

*Create Certs: to configure CAcerts in /etc/mail/certs

First do this:
openssl genrsa -des3 -rand /etc/hosts -out MYServer.key.pem.encrypted 1024
passphrase (some phrase you can remember typed here)

chmod 600 MYServer.key.pem.encrypted

openssl req -new -key MYServer.key.pem.encrypted -out MYServer.cert.req

It will ask for (Each separately(Country,State,City,Company,Username,useremail@xxxxxxxxxxxxxxx)

openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out CA.cert.pem -days 3650
(it will ask for your pass phrase here.....)
openssl rsa -in MYServer.key.pem.encrypted -out smtpd.key.unencrypted

mv -f smtpd.key.unencrypted MYServer.key.pem

openssl x509 -req -days 3650 -in MYServer.cert.req -signkey MYServer.key.pem.encrypted -out MYServer.cert.pem

chmod 600 *


I needed to add several lines in the sysconfig/sendmail file...search for the following lines since I will not add the commented # info.
vi /etc/sysconfig/sendmail
(Now I had to add a smart mailer)
SENDMAIL_SMARTHOST="smart.host.org"

SMTP_AUTH_MECHANISMS="gssapi,digest-md5,cram-md5,plain,login,otp"

SMTP_AUTH_SERVER="gssapi,digest-md5,cram-md5,plain,login,otp"

STARTTLS="server"

For me I decided it was easier to let SUSE do its thing, then edit after.
So I edited the files to let SuSEconfig configure sendmail for me
vi /etc/sysconfig/mail
# If you don't want to let SuSEconfig generate your configuration file, set this to no

MAIL_CREATE_CONFIG="yes"

Then run SuSEconfig
This will create the /etc/sendmail.cf and the /etc/mail/submit.cf files
When I ran SuSEconfig it created a /etc/sendmail.cf.SuSEconfig and a /etc/mail/submit.cf.SuSEconfig since I edited my files by hand the first time.

I then did a diff on the files to see what had changed
diff submit.cf submit.cf.SuSEconfig
diff sendmail.cf sendmail.cf.SuSEconfig

Once I felt good about the changes I just copied the .SuSEconfig files over the current ones. *remember we backed them up, right ?

For me, I had to doubled check that my smartmail host was there.
so
grep DS /etc/sendmail.cf
grep DS /etc/mail/submit.cf
look for DSsmart.host.org or whatever yours is.

Then restart the services
rcstunnel restart
rcsendmail restart


That is all I did and it works great. Now I just open ports 465, 993 and 995 and 443 on my Astaro firewall and I have secured my Scalix environment.

Hope this helps