postfix-tls-script [plain text]
#!/bin/sh
RSA_BITS=2048 EC_CURVE=secp256r1
case $daemon_directory in
"") echo This script must be run by the postfix command. 1>&2
echo Do not run directly. 1>&2
exit 1;;
esac
umask 022
SHELL=/bin/sh
postconf=$command_directory/postconf
LOGGER="$command_directory/postlog -t $MAIL_LOGTAG/postfix-tls-script"
INFO="$LOGGER -p info"
WARN="$LOGGER -p warn"
ERROR="$LOGGER -p error"
FATAL="$LOGGER -p fatal"
client_settings="
smtp_use_tls
smtp_enforce_tls
smtp_tls_enforce_peername
smtp_tls_security_level
smtp_tls_cert_file
smtp_tls_dcert_file
smtp_tls_eccert_file
"
server_settings="
smtpd_use_tls
smtpd_enforce_tls
smtpd_tls_security_level
smtpd_tls_cert_file
smtpd_tls_dcert_file
smtpd_tls_eccert_file
"
cd $command_directory || {
FATAL="postlog -p fatal -t $MAIL_LOGTAG/postfix-tls-script"
msg="no Postfix command directory '${command_directory}'"
$FATAL "$msg" || { echo "$msg" >&2; sleep 1; }
exit 1
}
check_getopt() {
OPTIND=1
a=
b=
c=
set -- -a 1 -b 2 -c -- -pos
while getopts :a:b:c o
do
case $o in
a) a="${OPTARG}";;
b) b="${OPTARG}";;
c) c=3;;
*) return 1;;
esac
done
shift `expr ${OPTIND} - 1`
if [ "${a}" != "1" -o "${b}" != 2 -o "${c}" != 3 \
-o "${OPTIND}" -ne 7 -o "$1" != "-pos" ]; then
return 1
fi
}
check_getopt || {
$FATAL "/bin/sh does not implement a compatible 'getopts' built-in"
exit 1
}
default_config_directory=`$postconf -dh config_directory`
openssl=`$postconf -c $default_config_directory -xh openssl_path`
"$openssl" version >/dev/null 2>&1 || {
$FATAL "No working openssl(1) command found with 'openssl_path = $openssl'"
exit 1
}
test -n "$config_directory" -a -d "$config_directory" || {
$FATAL no Postfix configuration directory $config_directory!
exit 1
}
$postconf -T compile-version | grep . >/dev/null || {
mail_version=`$postconf -dh mail_version`
$FATAL "Postfix $mail_version is not compiled with TLS support"
exit 1
}
rsa=
ecdsa=
for _algo in `$postconf -T public-key-algorithms | egrep '^(rsa|ecdsa)$'`
do
eval $_algo=$_algo
done
if [ -n "${ecdsa}" ]; then
$openssl ecparam -name secp256r1 >/dev/null 2>&1 || {
cat <<-EOM | $WARN
Postfix supports ECDSA, but the $openssl command does not. Consider
setting the openssl_path parameter to a more capable version of the
command-line utility than $openssl (with PATH=$PATH).
EOM
ecdsa=
}
fi
if [ -n "${rsa}" ]; then
DEFALG=rsa
elif [ -n "${ecdsa}" ]; then
DEFALG=ecdsa
else
mail_version=`$postconf -dh mail_version`
$FATAL "Postfix $mail_version does not support either RSA or ECDSA"
exit 1
fi
if [ -r /dev/stdin ] < /dev/null; then
stdin=/dev/stdin
elif [ -r /dev/fd/0 ] </dev/null; then
stdin=/dev/fd/0
else
$FATAL No /dev/fd/0 or /dev/stdin found
exit 1
fi
hex_sha256() {
$openssl dgst -binary -sha256 | od -An -vtx1 | tr -d ' \012'
}
null256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
tmp=`hex_sha256 </dev/null 2>/dev/null`
if [ "${tmp}" != "${null256}" ]; then
cat <<EOF >&2
Your $openssl does not support the SHA2-256 digest algorithm. To enable
'postfix tls', install an OpenSSL that does. Install its openssl(1) command
at /usr/local/bin/openssl or other suitable location, and set the
'openssl_path' parameter in $default_config_directory/main.cf accordingly.
EOF
$FATAL "No 'postfix tls' support when openssl(1) is obsolete"
exit 1
fi
read_key() {
[ -n "$1" -a -f "$1" ] || return 1
while read cmd key_algo key_param cert_param; do
$openssl $cmd -passin "pass:umask 077" -in "$1" |
grep . && return 0
done 2>/dev/null <<-EOF
rsa rsa smtpd_tls_key_file smtpd_tls_cert_file
ec ecdsa smtpd_tls_eckey_file smtpd_tls_eccert_file
EOF
return 1
}
pubkey_dgst() {
[ -n "$1" -a -f "$1" ] || return 1
for cmd in ec rsa; do
$openssl $cmd -passin "pass:umask 077" -in "$1" -pubout |
$openssl $cmd -pubin -outform DER |
hex_sha256 | egrep -v "${null256}" && return 0
done 2>/dev/null
return 1
}
cert_pubkey_dgst() {
[ -n "$1" -a -f "$1" ] || return 1
for cmd in ec rsa; do
$openssl x509 -pubkey -noout -in "$1" |
$openssl $cmd -pubin -outform DER |
hex_sha256 | egrep -v "${null256}" && return 0
done 2>/dev/null
return 1
}
copy_key() {
_algo=$1; shift
_bits=$1; shift
_fold=$1; shift
_fnew=$1; shift
_umask=`umask`
umask 077
read_key "${_fold}" > "${_fnew}" _ret=$?
umask "${_umask}"
if [ "${_ret}" -ne 0 ]; then
$FATAL "Error copying private key from '${_fold}' to '${_fnew}'"
return 1
fi
if [ "${key_algo}" != "${_algo}" ]; then
$FATAL "Key algorithm '$key_algo' of '${_fold}' is not '${_algo}'"
return 1
fi
}
create_key() {
_algo=$1
_bits=$2
_fnew=$3
_umask=`umask`
case $_algo in
"") $FATAL "Internal error: empty algorithm"; return 1;;
$rsa) set -- "${openssl}" genrsa -out "${_fnew}" "${_bits}";;
$ecdsa) set -- "${openssl}" ecparam -param_enc named_curve -genkey \
-out "${_fnew}" -name "${_bits}";;
*) $FATAL "Internal error: bad algorithm '${_algo}'"
return 1;;
esac
umask 077
_err=`"$@" 2>&1`
_ret=$?
umask "${_umask}"
if [ "${_ret}" -ne 0 ]; then
echo "${_err}" | $WARN
$FATAL "error generating new ${_algo} ${_bits} private key"
return 1
fi
}
create_cert() {
_k=$1; shift
_c=$1; shift
set_fqdn "$1"
if [ $ set -- "$fqdn" "$@"
if [ -r "${_c}" ]; then
$FATAL "New certificate file already exists: ${_c}"
return 1
fi
(
echo "default_md = sha256"
echo "x509_extensions = v3"
echo "prompt = yes"
echo "distinguished_name = dn"
echo "[dn]"
echo "[v3]"
echo "basicConstraints = CA:false"
echo "subjectKeyIdentifier = hash"
echo "extendedKeyUsage = serverAuth, clientAuth"
echo "subjectAltName = @alts"
echo "[alts]"
i=1; for dns in "$@"; do
echo "DNS.$i = $dns"
i=`expr $i + 1`
done
) | $openssl req -x509 -config $stdin -new -key "${_k}" \
-subj "/CN=$fqdn" -days 36525 -out "${_c}" || {
rm -f "${_c}" "${_k}"
$FATAL "error generating self-signed SSL certificate"
return 1
}
}
output_server_csr() {
set_keyfile "$1" || return 1
shift
set_fqdn "$1" || return 1
shift
set -- "$fqdn" "$@"
(
echo "default_md = sha256"
echo "req_extensions = v3"
echo "prompt = yes"
echo "distinguished_name = dn"
echo "[dn]"
echo "[v3]"
echo "subjectKeyIdentifier = hash"
echo "extendedKeyUsage = serverAuth, clientAuth"
echo "subjectAltName = @alts"
echo "[alts]"
i=1; for dns in "$@"; do
echo "DNS.$i = $dns"
i=`expr $i + 1`
done
) | $openssl req -config $stdin -new -key "$keyfile" -subj /
}
info_enable_client() {
cat <<-EOM
*** Non-default SMTP client TLS settings detected, no changes made.
For opportunistic TLS in the Postfix SMTP client, the below settings
are typical:
smtp_tls_security_level = may
smtp_tls_loglevel = 1
EOM
if get_cache_db_type dbtype
then
echo " smtp_tls_session_cache_database = ${dbtype}:\${data_directory}/smtp_scache"
fi
}
info_client_deployed() {
cat <<-EOM
Enabled opportunistic TLS in the Postfix SMTP client.
Run the command:
if you want the new settings to take effect immediately.
EOM
}
info_enable_server() {
cat <<-EOM
*** Non-default SMTP server TLS settings detected, no changes made.
For opportunistic TLS in the Postfix SMTP server, the below settings
are typical:
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
You can use "postfix tls new-server-cert" to create a new certificate.
Or, "postfix tls new-server-key" to also force a new private key.
If you publish DANE TLSA records, see:
https://tools.ietf.org/html/rfc7671#section-8
https://tools.ietf.org/html/rfc7671#section-5.1
https://tools.ietf.org/html/rfc7671#section-5.2
https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-tlsa-records-with-le-certificates/7022
EOM
}
info_created() {
cat <<-EOM
New private key and self-signed certificate created. To deploy run:
EOM
}
info_server_deployed() {
if [ "$3" = "enable" ]; then
echo "Enabled opportunistic TLS in the Postfix SMTP server"
fi
cat <<-EOM
New TLS private key and certificate deployed.
Run the command:
if you want the new settings to take effect immediately.
EOM
}
info_csr() {
cat <<-EOM
To generate a CSR run:
EOM
if [ -z "$3" ]; then
echo "Save the signed certificate chain in $1, and deploy as above."
else
echo "Save the signed certificate chain in $1."
fi
}
info_tlsa() {
if [ -n "$3" ]; then shift $ cat <<-EOM
To generate TLSA records run:
EOM
}
info_dane_dns() {
if [ -n "$3" ]; then
cat <<-EOM
(If you have DANE TLSA RRs, update them as soon as possible to match
the newly deployed keys).
EOM
else
cat <<-EOM
(deploy after updating the DNS and waiting for stale RRs to expire).
EOM
fi
}
set_fqdn() {
if [ -n "$1" ]; then fqdn=$1; return 0; fi
fqdn=`$postconf -xh myhostname` || return 1
case $fqdn in /*) fqdn=`cat "${fqdn}"` || return 1;; esac
}
set_keyfile() {
keyfile=$1
case $keyfile in
rsa) if [ -n "${rsa}" ]; then
keyfile=`$postconf -nxh smtpd_tls_key_file`
else
keyfile=
fi
;;
ecdsa) if [ -n "${ecdsa}" ]; then
keyfile=`$postconf -nxh smtpd_tls_eckey_file`
else
keyfile=
fi
;;
"") : empty ok;;
none) : see below;;
/*) ;;
*) keyfile="${config_directory}/${keyfile}";;
esac
if [ "${keyfile}" = "none" ]; then keyfile= ; fi
}
check_key() {
read_key "$1" >/dev/null && return 0
$FATAL "no private key found in file: $1"
return 1
}
ensure_key() {
_algo=$1; shift
_bits=$1; shift
stamp=`TZ=UTC date +%Y%m%d-%H%M%S`
case $_algo in
"") $FATAL "Internal error: empty algorithm "; return 1;;
$rsa) keyfile="${config_directory}/key-${stamp}.pem"
certfile="${config_directory}/cert-${stamp}.pem";;
$ecdsa) keyfile="${config_directory}/eckey-${stamp}.pem"
certfile="${config_directory}/eccert-${stamp}.pem";;
*) $FATAL "Internal error: bad algorithm '${_algo}'"
return 1;;
esac
if [ -r "${keyfile}" ]; then
$FATAL "New private key file already exists: ${keyfile}"
return 1
fi
if [ -r "${certfile}" ]; then
$FATAL "New certificate file already exists: ${certfile}"
return 1
fi
if [ -n "$1" ]; then
copy_key "${_algo}" "${_bits}" "$1" "${keyfile}" && return 0
else
create_key "${_algo}" "${_bits}" "${keyfile}" && return 0
fi
rm -f "${keyfile}"
return 1
}
init_random_source() {
tls_random_source=$1
if [ -z "${tls_random_source}" ]; then
tls_random_source=`$postconf -xh tls_random_source`
fi
if [ -n "${tls_random_source}" ]; then
return 0
fi
if [ -r /dev/urandom ]
then
tls_random_source=dev:/dev/urandom
else
$FATAL no default TLS random source defined and no /dev/urandom
return 1
fi
}
all_default() {
for var in "$@"
do
val=`$postconf -nh "${var}"`
if [ -n "$val" ]; then return 1; fi
done
return 0
}
get_cache_db_type() {
var=$1; shift
prio=0
ret=1
for _dbtype in `$postconf -m`
do
_prio=0
case $_dbtype in
lmdb) _prio=2;;
btree) _prio=1;;
esac
if [ "$_prio" -gt "$prio" ]
then
eval "$var=\$_dbtype"
prio=$_prio
ret=0
fi
done
return $ret
}
deploy_server_cert() {
certfile=$1; shift
keyfile=$1; shift
deploy=$1; shift
check_key "$keyfile" || return 1
cd=`cert_pubkey_dgst "${certfile}"` || {
$FATAL "error computing certificate public key digest"
return 1
}
kd=`pubkey_dgst "$keyfile"` || {
$FATAL "error computing public key digest"
return 1
}
if [ "$cd" != "$kd" ]; then
$FATAL "Certificate in ${certfile} does not match key in ${keyfile}"
return 1
fi
set -- \
"${key_param} = ${keyfile}" \
"${cert_param} = ${certfile}"
if [ "${deploy}" = "enable" ]; then
set -- "$@" \
"smtpd_tls_security_level = may" \
"smtpd_tls_received_header = yes" \
"smtpd_tls_loglevel = 1"
fi
if [ -n "${tls_random_source}" ]; then
set -- "$@" "tls_random_source = ${tls_random_source}"
fi
$postconf -e "$@" || return 1
}
new_server_cert() {
algo=$1; shift
bits=$1; shift
oldkey=$1; shift
deploy=$1; shift
ensure_key "$algo" "$bits" "${oldkey}" || return 1
create_cert "${keyfile}" "${certfile}" "$@" || return 1
if [ -n "${deploy}" ]; then
deploy_server_cert "${certfile}" "${keyfile}" "${deploy}" || return 1
fi
(
if [ -z "${deploy}" ]; then
info_created "${certfile}" "${keyfile}" "${deploy}"
else
info_server_deployed "${certfile}" "${keyfile}" "${deploy}"
fi
info_csr "${certfile}" "${keyfile}" "${deploy}"
info_tlsa "${certfile}" "${keyfile}" "${deploy}"
if [ -z "${oldkey}" ]; then
info_dane_dns "${certfile}" "${keyfile}" "${deploy}"
fi
) | $INFO
}
enable_client() {
if all_default ${client_settings}
then
set -- \
"smtp_tls_security_level = may" \
"smtp_tls_loglevel = 1"
if get_cache_db_type dbtype
then
set -- "$@" \
"smtp_tls_session_cache_database = ${dbtype}:${data_directory}/smtp_scache"
fi
if [ -n "${tls_random_source}" ]; then
set -- "$@" "tls_random_source = ${tls_random_source}"
fi
$postconf -e "$@" || return 1
info_client_deployed
else
info_enable_client
fi | $INFO
}
enable_server() {
algo=$1; shift
bits=$1; shift
if all_default ${server_settings}
then
new_server_cert "${algo}" "${bits}" "" "enable" "$@" || return 1
else
info_enable_server | $INFO
fi
}
output_server_tlsa() {
hostname=$1
check_key "$2" || return 1
data=`pubkey_dgst "$2"` || return 1
if [ -z "$data" ]
then
$FATAL error computing SHA2-256 SPKI digest of "$key"
return 1
fi
echo "_25._tcp.$hostname. IN TLSA 3 1 1 $data"
}
case $1 in
enable-client)
cmd=$1; shift; OPTIND=1
rand=
while getopts :r: _opt
do
case $_opt in
r) rand="${OPTARG}";;
*) $FATAL "usage: postfix tls $cmd [-r devrandom]"
exit 1;;
esac
done
if [ $ $FATAL "usage: postfix tls $cmd [-r devrandom]"
exit 1
fi
shift `expr $OPTIND - 1`
init_random_source "${rand}" || exit 1
enable_client || exit 1
;;
enable-server)
cmd=$1; shift; OPTIND=1
algo=$DEFALG
bits=
rand=
while getopts :a:b:r: _opt
do
case $_opt in
a) algo="${OPTARG}";;
b) bits="${OPTARG}";;
r) rand="${OPTARG}";;
*) $FATAL "usage: postfix tls $cmd [-a algorithm] [-b bits ] [-r devrandom] [hostname ...]"
exit 1;;
esac
done
shift `expr $OPTIND - 1`
case $algo in
"") $FATAL "Internal error: empty algorithm "; return 1;;
$rsa) : ${bits:=${RSA_BITS}};;
$ecdsa) : ${bits:=${EC_CURVE}};;
*) $FATAL "Unsupported private key algorithm: $algo"
exit 1;;
esac
init_random_source "${rand}" || exit 1
enable_server "${algo}" "${bits}" "$@" || exit 1
;;
new-server-key)
cmd=$1; shift; OPTIND=1
algo=$DEFALG
while getopts :a:b: _opt
do
case $_opt in
a) algo="${OPTARG}";;
b) bits="${OPTARG}";;
*) $FATAL "usage: postfix tls $cmd [-a algorithm] [-b bits ] [hostname ...]"
exit 1;;
esac
done
shift `expr $OPTIND - 1`
case $algo in
"") $FATAL "Internal error: empty algorithm "; return 1;;
$rsa) : ${bits:=${RSA_BITS}};;
$ecdsa) : ${bits:=${EC_CURVE}};;
*) $FATAL "Unsupported public key algorithm: $algo"
exit 1;;
esac
new_server_cert "${algo}" "${bits}" "" "" "$@" || exit 1
;;
new-server-cert)
cmd=$1; shift; OPTIND=1
algo=$DEFALG
while getopts :a:b: _opt
do
case $_opt in
a) algo="${OPTARG}";;
b) bits="${OPTARG}";;
*) $FATAL "usage: postfix tls $cmd [-a algorithm] [-b bits ] [hostname ...]"
exit 1;;
esac
done
shift `expr $OPTIND - 1`
case $algo in
"") $FATAL "Invalid empty key algorithm"; exit 1;;
$rsa) : ${bits:=${RSA_BITS}};;
$ecdsa) : ${bits:=${EC_CURVE}};;
*) $FATAL "Unsupported private key algorithm: $algo"
exit 1;;
esac
set_keyfile "${algo}"
if [ -n "${keyfile}" -a ! -f "${keyfile}" ]; then
echo "Key file: ${keyfile} not found, creating new keys" | $WARN
keyfile=
fi
new_server_cert "${algo}" "${bits}" "${keyfile}" "" "$@" || exit 1
;;
deploy-server-cert)
if [ $ $FATAL "usage: postfix tls $1 certfile keyfile"
exit 1
fi
shift
case "${1}" in
/*) certfile="${1}" ;;
*) certfile="${config_directory}/${1}" ;;
esac
case "${2}" in
/*) keyfile="${2}" ;;
*) keyfile="${config_directory}/${2}" ;;
esac
deploy_server_cert "${certfile}" "${keyfile}" || exit 1
info_server_deployed "${certfile}" "${keyfile}" "deploy" | $INFO
;;
output-server-csr)
cmd=$1; shift; OPTIND=1
k=
while getopts :k: _opt
do
case $_opt in
k) k="${OPTARG}";;
*) $FATAL "usage: postfix tls $cmd [-k keyfile] [hostname ...]"
exit 1;;
esac
done
shift `expr $OPTIND - 1`
if [ -n "${k}" ]; then
set_keyfile "${k}"
else
for _algo in $rsa $ecdsa
do
set_keyfile "${_algo}"
if [ -n "${keyfile}" ]; then
break
fi
done
fi
if [ -z "${keyfile}" -o ! -r "${keyfile}" ]; then
$FATAL "No usable keyfile specified or configured"
exit 1
fi
if [ $ set_fqdn
set -- "$fqdn"
fi
output_server_csr "$keyfile" "$@" || exit 1
;;
output-server-tlsa)
cmd=$1; shift; OPTIND=1
hostname=
while getopts :h: _opt
do
case $_opt in
h) hostname="${OPTARG}";;
*) $FATAL "usage: postfix tls $cmd [-h hostname] [keyfile ...]"
exit 1;;
esac
done
set_fqdn "${hostname}"
shift `expr $OPTIND - 1`
if [ $
found=
for _k in "$@"
do
set_keyfile "${_k}"
if [ -z "${keyfile}" ]; then continue; fi
echo "; ${keyfile}"
output_server_tlsa "${fqdn}" "${keyfile}" || exit 1
found=1
done
if [ -z "${found}" ]; then
$FATAL "No usable keyfiles specified or configured"
exit 1
fi
;;
all-default-client)
cmd=$1; shift; OPTIND=1
if [ $ $FATAL "usage: postfix tls $cmd"
exit 1
fi
all_default ${client_settings} || exit 1
;;
all-default-server)
cmd=$1; shift; OPTIND=1
if [ $ $FATAL "usage: postfix tls $cmd"
exit 1
fi
all_default ${server_settings} || exit 1
;;
*)
$ERROR "unknown tls command: '$1'"
$FATAL "usage: postfix tls enable-client (or enable-server, new-server-key, new-server-cert, deploy-server-cert, output-server-csr, output-server-tlsa, all-default-client, all-default-server)"
exit 1
;;
esac