HOWTO: Secure all Kolab Services¶

This HOWTO is based on Centos 6 with some notes for Debian 7.

The configuration on Debian(-based distributions) is similar, but the base path for the certifcates storage is different, and Debian already has a group called ssl-cert to which the user accounts for applications like Cyrus IMAP or Postfix are added by default.

On CentOS, this group is called mail.

Warning

This guide provides general information about how to enable ssl/tls and the majority of your kolab services. This guide is by no means 100% complete nor will it get’s updated everytime ciphers or protocols get deprecated.If you want to know more get deeper knowledge about securing a particular service please consult the corresponding software documentation or other projects that take care about hardening your server.

Example:

https://bettercrypto.org

Prerequisites¶

Prepare your certificates! You’ll need your certificate, your key, the CA and intermediate CA certificates. This tutorial is based on the StartCom SSL CA. Feel free to use any other Certificate Authority to your liking.

In this case the certificate is a wildcard *.example.org certificate, which makes it easier to cover various hostnames (like smtp.example.org, imap.example.org and webmail.example.org).

Copy your personal SSL certificates on your new Kolab server.

On Debian the default location is /etc/ssl/ instead of /etc/pki/tls/.
```
# scp example.org.key kolab.example.org:/etc/pki/tls/private/
# scp example.org.crt kolab.example.org:/etc/pki/tls/certs/
```
On Debian: Make sure the files have the correct permissions: * /etc/ssl/private/example.org.key: owner root, group ssl-cert and mode 0640 * /etc/ssl/certs/example.org.crt: owner root, group root and mode 0666
You should have obtained a CA certificate or CA certificate chain from your SSL certificate issuer.

If you have not, obtain the root and chain certificates from your certification authority. Make sure the source of the certificate is verifiable and trusted.

For example:
```
# wget https://www.startssl.com/certs/ca.pem \
    -O /etc/pki/tls/certs/startcom-ca.pem

# wget https://www.startssl.com/certs/sub.class2.server.ca.pem \
    -O /etc/pki/tls/certs/startcom-sub.class2.server.ca.pem
```

Lets build some bundle files we can use later

# cat /etc/pki/tls/certs/example.org.crt \
      /etc/pki/tls/private/example.org.key \
      /etc/pki/tls/certs/startcom-sub.class2.server.ca.pem \
      /etc/pki/tls/certs/startcom-ca.pem \
      > /etc/pki/tls/private/example.org.bundle.pem

# cat /etc/pki/tls/certs/startcom-ca.pem \
      /etc/pki/tls/certs/startcom-sub.class2.server.ca.pem \
      > /etc/pki/tls/certs/example.org.ca-chain.pem

Add an SSL group. Only members of this group should be able to access your private key, etc.

On Debian the usergroup is not needed.
```
# chmod 640 /etc/pki/tls/private/* \
    /etc/pki/tls/certs/*

# chown root:mail /etc/pki/tls/private/example.org.key
```
Add the CA to system’s CA bundle.

Other applications and scripts that want to communicate via SSL should point to the cabundle in case they want check if your own certificate is trusted.

For RedHat/Centos based systems:
```
# cp /etc/pki/tls/certs/startcom-ca.pem /etc/pki/ca-trust/source/anchors/startcom-ca.pem
# update-ca-trust
```
On Debian based systems you’ve a different location/command, but the rest is the same.
```
# cp /etc/ssl/certs/startcom-ca.pem /usr/local/share/ca-certificates/startcom-ca.crt
# update-ca-certificates
```

Applications¶

Cyrus IMAPD¶

Configure SSL certificates

Cyris 2.5 (Kolab 3.2+):

# sed -r -i \
      -e 's|^tls_server_cert.*|tls_server_cert /etc/pki/tls/certs/example.org.crt|g' \
      -e 's|^tls_server_key.*|tls_server_key /etc/pki/tls/private/example.org.key|g' \
      -e 's|^tls_server_ca_file.*|tls_server_ca_file /etc/pki/tls/certs/example.org.ca-chain.pem|g' \
      /etc/imapd.conf

Cyrus 2.4 (Kolab 3.0 + 3.1):

# sed -r -i \
      -e 's|^tls_cert_file:.*|tls_cert_file: /etc/pki/tls/certs/example.org.crt|g' \
      -e 's|^tls_key_file:.*|tls_key_file: /etc/pki/tls/private/example.org.key|g' \
      -e 's|^tls_ca_file:.*|tls_ca_file: /etc/pki/tls/certs/example.org.ca-chain.pem|g' \
      /etc/imapd.conf

On Debian: Change the paths according to the Debian file structure (replace /etc/pki/tls with /etc/ssl. Make sure that the user cyrus is part of the ssl-certs group.

Bonus:

You can get bonus points to disable weak ciphers like so:

# Cyrus 2.5 (imapd.conf)
tls_ciphers: EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

# Cyrus 2.4 (imapd.conf)
tls_ciphers_list: EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

Restart and verify

# service cyrus-imapd restart
# sslscan --no-failed localhost:993
# openssl s_client -showcerts -connect localhost:993

Postfix¶

Configure SSL certificates

# postconf -e smtpd_tls_key_file=/etc/pki/tls/private/example.org.key
# postconf -e smtpd_tls_cert_file=/etc/pki/tls/certs/example.org.crt
# postconf -e smtpd_tls_CAfile=/etc/pki/tls/certs/example.org.ca-chain.pem
# postconf -e smtp_tls_mandatory_protocols='!SSLv2,!SSLv3'
# postconf -e smtp_tls_protocols='!SSLv2,!SSLv3'
# postconf -e smtpd_tls_mandatory_protocols='!SSLv2,!SSLv3'
# postconf -e smtpd_tls_protocols='!SSLv2,!SSLv3'
# postconf -e smtpd_tls_mandatory_ciphers=high
# postconf -e smtpd_tls_eecdh_grade=ultra
# postconf -e tls_preempt_cipherlist=yes
# postconf -e tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

On Debian: Change the paths according to the Debian file structure (replace /etc/pki/tls with /etc/ssl. Make sure that the user postfix is part of the ssl-certs group.

Restart

# service postfix restart
# sslscan --starttls --no-failed localhost:587

Apache2¶

Apache offers 2 modules that provide SSL support.

The wildly used mod_ssl and mod_nss. Since mod_nss was already installed and loaded through some dependency I’ll cover this.

mod_ssl¶

This is the prefered way and it’s easier to work with.

Install mod_ssl
```
# yum install mod_ssl
```

Set your ssl certificates

# sed -i -e 's/^SSLCertificateFile.*/SSLCertificateFile /etc/pki/tls/certs/example.org.crt/' /etc/httpd/conf.d/ssl.conf
# sed -i -e 's/^SSLCertificateKeyFile.*/SSLCertificateKeyFile /etc/pki/tls/private/example.org.key/' /etc/httpd/conf.d/ssl.conf
# sed -i -e 's/^#?SSLCertificateChainFile.*/SSLCertificateChainFile /etc/pki/tls/certs/example.org.ca-chain.pem/' /etc/httpd/conf.d/ssl.conf

Fine tune your ssl/tls ciphers and protocols

# sed -i -e 's/^SSLProtocol.*/SSLProtocol All -SSLv2 -SSLv3/' /etc/httpd/conf.d/ssl.conf
# sed -i -e "s/^SSLProtocol/SSLHonorCipherOrder on\nSSLProtocol/" /etc/httpd/conf.d/ssl.conf
# sed -i -e 's/^SSLCipherSuite.*/SSLCipherSuite "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA"/' /etc/httpd/conf.d/ssl.conf

Create a vhost for http (:80) to redirect everything to https

# cat >> /etc/httpd/conf/httpd.conf << EOF

<VirtualHost _default_:80>
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>
EOF

Restart and verify

# service httpd restart
# openssl s_client -showcerts -connect localhost:443

mod_nss¶

This is an alternative to mod_ssl.

Import your CA into NSS Cert Database for Apache

# certutil -d /etc/httpd/alias -A  -t "CT,," \
    -n "StartCom Certification Authority" \
    -i /etc/pki/tls/certs/startcom-ca.pem

Convert and import your personal certificate into NSS DB

# openssl pkcs12 -export \
    -in /etc/pki/tls/certs/example.org.crt \
    -inkey /etc/pki/tls/private/example.org.key \
    -out /tmp/example.p12 -name Server-Cert -passout pass:foo

# echo "foo" > /tmp/foo
# pk12util -i /tmp/example.p12 -d /etc/httpd/alias -w /tmp/foo -k /dev/null
# rm /tmp/foo
# rm /tmp/example.p12

You should now be able to see all the imported certificates

# certutil -L -d /etc/httpd/alias
# certutil -V -u V -d /etc/httpd/alias -n "Server-Cert"

Move mod_nss from port 8443 to 443 and configure the certificate that mod_nss should use.

# sed -i -e 's/8443/443/' /etc/httpd/conf.d/nss.conf
# sed -i -e 's/NSSNickname.*/NSSNickname Server-Cert/' \
    /etc/httpd/conf.d/nss.conf

Create a vhost for http (:80) to redirect everything to https

# cat >> /etc/httpd/conf/httpd.conf << EOF

<VirtualHost _default_:80>
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>
EOF

Restart and verify

# service httpd restart
# openssl s_client -showcerts -connect localhost:443

389 Directory Server¶

Note

Unless you want to make your LDAP Service available to other services on other servers you can safely skip this section. There’s no need to enable SSL/TLS if you only use LDAP on localhost.

If you’ve more question please refer the the documentation of the 389 directory server.

http://directory.fedoraproject.org/docs/389ds/howto/howto-ssl.html

Enable SSL/TLS

First you must import your PEM File into the certutil certificate store (identical to Apache with mod_nss)

# certutil -d /etc/dirsrv/slapd-$(hostname -s)/ -A  -t "CT,," \
    -n "StartCom Certification Authority" \
    -i /etc/pki/tls/certs/startcom-ca.pem

# openssl pkcs12 -export \
    -in /etc/pki/tls/certs/example.org.crt \
    -inkey /etc/pki/tls/private/example.org.key \
    -out /tmp/example.p12 -name Server-Cert -passout pass:foo

# echo "foo" > /tmp/foo
# pk12util -i /tmp/example.p12 -d /etc/dirsrv/slapd-$(hostname -s)/ \
    -w /tmp/foo -k /dev/null
# rm /tmp/foo
# rm /tmp/example.p12

Enable SSL Support

Since all the configuration for 389ds is being done live, changing and adding SSL support will require some LDAP commands to modify the server configuration.

# passwd=$(grep ^bind_pw /etc/kolab/kolab.conf | cut -d '=' -f2- | sed -e 's/\s*//g')
# ldapmodify -x -h localhost -p 389 \
    -D "cn=Directory Manager" -w "${passwd}" << EOF
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL2
nsSSL2: off
-
replace: nsSSL3
nsSSL3: off
-
replace: nsTLS1
nsTLS1: on
-
replace: nsSSLClientAuth
nsSSLClientAuth: allowed

dn: cn=config
changetype: modify
add: nsslapd-security
nsslapd-security: on
-
replace: nsslapd-ssl-check-hostname
nsslapd-ssl-check-hostname: off
-
replace: nsslapd-secureport
nsslapd-secureport: 636

dn: cn=RSA,cn=encryption,cn=config
changetype: add
objectclass: top
objectclass: nsEncryptionModule
cn: RSA
nsSSLPersonalitySSL: Server-Cert
nsSSLToken: internal (software)
nsSSLActivation: on
EOF

Next, restart the LDAP service:

# service dirsrv restart
# openssl s_client -connect localhost:636

You can test if your LDAP over SSL is configured correctly via the openssl s_client -connect localhost:636 command, or just making a query using ldapsearch:

Test non-SSL connection

# ldapsearch -x -H ldap://kolab.example.org \
    -b "cn=kolab,cn=config" -D "cn=Directory Manager" \
    -w "${passwd}"

Test SSL connection

# ldapsearch -x -H ldaps://kolab.example.org \
    -b "cn=kolab,cn=config" -D "cn=Directory Manager" \
    -w "${passwd}"

Kolab Components¶

kolab-cli¶

With the HTTP Service configured to force SSL communication you must add/update your kolab-cli API url.

# sed -r -i \
      -e '/api_url/d' \
      -e "s#\[kolab_wap\]#[kolab_wap]\napi_url = https://kolab.example.org/kolab-webadmin/api#g" \
      /etc/kolab/kolab.conf

Roundcube/Plugins¶

Set correct SSL parameters for HTTP_Request2. This will ensure the kolab_files plugin and Chwala can talk over HTTPS.

Change freebusy API url in the libkolab plugin configuration:

# sed -i -e 's/http:/https:/' /etc/roundcubemail/libkolab.inc.php

Change Chwala API url in the kolab_files plugin configuration:

# sed -i -e 's/http:/https:/' /etc/roundcubemail/kolab_files.inc.php

Lets remove the php-close tag line as a quick hack to make it easier for us to extend the /etc/roundcubemail/config.inc.php:
```
# sed -i -e '/^?>/d' /etc/roundcubemail/config.inc.php
```

Tell the webclient the SSL iRony URLs for CalDAV and CardDAV:

# cat >> /etc/roundcubemail/config.inc.php << EOF
# caldav/webdav
\$config['calendar_caldav_url']             = "https://%h/iRony/calendars/%u/%i";
\$config['kolab_addressbook_carddav_url']   = 'https://%h/iRony/addressbooks/%u/%i';
EOF

Additionaly, you can redirect all http traffic to https:

# cat >> /etc/roundcubemail/config.inc.php << EOF
# Force https redirect for http requests
\$config['force_https'] = true;
EOF

Optional: Switch to verified ssl connections

This will enable the ssl-verification for internal api calls between kolab php components (like roundcube <> chwala). If you care about this you’re free to do so, but don’t forget the parts of python/kolab.conf as well.

Usually these calls are internal (on localhost) and therefore don’t really need to to trust the ssl endpoint.
1. Remove old-style SSL configuration parameters
```
# sed -i -e '/kolab_ssl/d' /etc/roundcubemail/libkolab.inc.php
```
2. Enable SSL verification against our extended CA bundle.
```
# cat >> /etc/roundcubemail/config.inc.php << EOF
\$config['kolab_http_request'] = array(
        'ssl_verify_peer'       => true,
        'ssl_verify_host'       => true,
        'ssl_cafile'            => '/etc/pki/tls/certs/ca-bundle.crt'
);
EOF
```

HOWTO: Secure all Kolab Services¶

Prerequisites¶

Applications¶

Cyrus IMAPD¶

Postfix¶

Apache2¶

mod_ssl¶

mod_nss¶

389 Directory Server¶

Kolab Components¶

kolab-cli¶

Roundcube/Plugins¶

Table of Contents

Previous topic

Next topic

This Page