ThinkPad560(VineLinux)(2001/6/20)
SSL対応
vi /home/httpd/cgi-bin/webmailer/var.pl で下記個所を修正
$home_url = '/';
↓
$home_url = 'http://www.masaji.org/';
« 2001年05月 | メイン | 2001年07月 »
SSL対応
vi /home/httpd/cgi-bin/webmailer/var.pl で下記個所を修正
$home_url = '/';
↓
$home_url = 'http://www.masaji.org/';
OpenSSLインストール
rpm -q openssl
http://www.modssl.orgからmod_ssl-2.8.3-1.3.19.tar.gzを取得
tar zxvf mod_ssl-2.8.3-1.3.19.tar.gz
cd mod_ssl-2.8.3-1.3.19
./configure --with-apxs=/usr/sbin/apxs --with-mm=SYSTEM
make
make install
cd /var/ssl
openssl req -config /var/ssl/openssl.cnf -new -nodes -keyout www.pem -out newreq.pem
Using configuration from /var/ssl/openssl.cnf
Generating a 1024 bit RSA private key
.........++++++
...............................................++++++
writing new private key to 'www.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Kamakura
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Private
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:Yahagi Masaji
Email Address []:yahagi@masaji.org
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
mv www.pem private/
mv openssl.cnf openssl.cnf.org
cp openssl.cnf.org openssl.cnf
vi openssl.cnf で下記個所を修正
dir = /var/ssl/CA # Where everything is kept
mv misc/CA.sh misc/CA.sh.org
cp misc/CA.sh.org misc/CA.sh
vi misc/CA.sh で下記個所を修正
CATOP=/var/ssl/CA
export SSLEAY_CONFIG="-config /var/ssl/openssl.cnf"
misc/CA.sh -newca
CA certificate filename (or enter to create)
Making CA certificate ...
Using configuration from /var/ssl/openssl.cnf
Generating a 1024 bit RSA private key
.++++++
.................................++++++
writing new private key to '/var/ssl/CA/private/./cakey.pem'
Enter PEM pass phrase: <--- パスワードを決めて入力
Verifying password - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Kamakura
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Private
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:Yahagi Masaji
Email Address []:yahagi@masaji.org
misc/CA.sh -sign
Using configuration from /var/ssl/openssl.cnf
Enter PEM pass phrase: <--- misc/CA.sh -newca実行時に入力した値
Check that the request matches the signature
Signature ok
The Subjects Distinguished Name is as follows
countryName :PRINTABLE:'JP'
stateOrProvinceName :PRINTABLE:'Kanagawa'
localityName :PRINTABLE:'Kamakura'
organizationName :PRINTABLE:'Private'
commonName :PRINTABLE:'Yahagi Masaji'
emailAddress :IA5STRING:'yahagi@masaji.org'
Certificate is to be certified until Jun 20 14:46:43 2002 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: md5WithRSAEncryption
Issuer: C=JP, ST=Kanagawa, L=Kamakura, O=Private, CN=Yahagi Masaji/Email=yahagi@masaji.org
Validity
Not Before: Jun 20 14:46:43 2001 GMT
Not After : Jun 20 14:46:43 2002 GMT
Subject: C=JP, ST=Kanagawa, L=Kamakura, O=Private, CN=Yahagi Masaji/Email=yahagi@masaji.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
... 省略 ...
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
... 省略 ...
X509v3 Authority Key Identifier:
keyid: ... 省略 ...
DirName:/C=JP/ST=Kanagawa/L=Kamakura/O=Private/CN=Yahagi Masaji/Email=yahagi@masaji.org
serial:00
Signature Algorithm: md5WithRSAEncryption
... 省略 ...
-----BEGIN CERTIFICATE-----
... 省略 ...
-----END CERTIFICATE-----
Signed certificate is in newcert.pem
mv newcert.pem certs/www.pem
SSL対応
OpenSSLインストール
vi /etc/httpd/conf/httpd.conf で下記個所を追加
Listen 80
Listen 443
LoadModule ssl_module modules/libssl.so
AddModule mod_ssl.c
AddType application/x-x509-ca-cert .pem
AddType application/x-pkcs7-crl .pem
SSLPassPhraseDialog builtin
SSLSessionCache dbm:logs/ssl_scache
SSLSessionCacheTimeout 300
SSLMutex file:logs/ssl_mutex
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
SSLLog logs/ssl_engine_log
SSLLogLevel info
DocumentRoot /home/httpd/html
ErrorLog logs/ssl-error_log
TransferLog logs/ssl-access_log
SSLEngine on
SSLCertificateFile /var/ssl/certs/www.pem
SSLCertificateKeyFile /var/ssl/private/www.pem
SSLVerifyClient none
SSLVerifyDepth 10
/etc/rc.d/init.d/httpd restart
WWWブラウザでhttps接続して確認
プライマリの二重化(Piblic DNS Service)
http://www.granitecanyon.com/cgi-bin/publicdns.cgi/primaryにアクセス
Domain/Zone: masaji.org
Password: *******
Verify: *******
loginボタンをクリック
SOA
Domain: masaji.org
Email: yahagi_m@mua.biglobe.ne.jp
RRs
masaji.org. IN NS ns1.granitecanyon.com.
masaji.org. IN NS ns2.granitecanyon.com.
masaji.org. IN NS yahagi.masaji.org.
masaji.org. IN RP yahagi_m.mua.biglobe.ne.jp. Yahagi.Masaji.masaji.org.
Yahagi.Masaji.masaji.org. IN TXT "Yahagi Masaji"
localhost.masaji.org. IN A 127.0.0.1
yahagi.masaji.org. IN A 202.212.35.44
biglobe.masaji.org. IN A 202.247.106.83
www.masaji.org. IN CNAME yahagi.masaji.org.
masaji.org. IN MX 5 yahagi.masaji.org.
masaji.org. IN MX 10 biglobe.masaji.org.
sendボタンをクリック
直ぐに受信したメール(Agreement to Public DNS terms of use for masaji.org)をsoa@granitecanyon.comに返信
数時間から十数時間後に(DNS updates COMPLETE)を受信し、24時間以内に反映
dig @ns1.granitecanyon.com masaji.org mx
vi /var/named/masaji.org
/etc/rc.d/init.d/named restart
dig masaji.org mx
tail -100 /var/log/messages
printer設定
http://192.168.1.250:901 に root で接続
lpを選択し[プリンタ選択]をクリック
[設定変更]をクリック
特になにも変更せず
Windowsマシンでプリンタの追加を実行
Windowsマシンでテストページを印刷
設定
startx
printtool &
フィルターなし、/dev/lp0で追加
APOP設定
/usr/sbin/useradd pop
/usr/sbin/popauth -init
設定
mv /etc/X11/XF86Config /etc/X11/XF86Config.org
vi /etc/X11/XF86Config
インターネット情報とオリジナル(TrueType対応)のXF86Configを参照して作成
startx
インストール
VinePlusからnetatalk-1.4b2+asun2.1.3-7vl5.src.rpmを取得
rpm -ivh netatalk-1.4b2+asun2.1.3-7vl5.src.rpm
rpm --rebuild netatalk-1.4b2+asun2.1.3-7vl5.src.rpm
rpm -ivh /usr/src/redhat/RPMS/i386/netatalk-1.4b2+asun2.1.3-7vl5.i386.rpm
以下のメッセージが表示されるが無視
warning: The DDP services appear to be present in /etc/services.
warning: Please check them against services.atalk in the documentation.
netatalk-devel-1.4b2+asun2.1.3-7vl5.i386.rpmも作成されるがインストールせず
旧サーバと違い以下の作業は不要
/etc/conf.modules に alias net-pf-5 appletalk を追加
/etc/rc.d/init.d/atalk のstart/stopのifconfigに promisc/-promiscを追加
/etc/rc.d/init.d/atalk start
Macの電源をON
/usr/sbin/nbplkup でMacが表示されることを確認
Macのセレクタでtp560に接続できることを確認
アップグレード
From:およびTo:が複数行の時に"\"が付加される不具合(AL-Mailで発生)対策
VineSpeedからpostfix-0.0.20010228pl03-0vl1.src.rpmを取得
rpm -ivh postfix-0.0.20010228pl03-0vl1.src.rpm
rpm --rebuild postfix-0.0.20010228pl03-0vl1.src.rpm
rpm -Uvh /usr/src/redhat/RPMS/i386/postfix-0.0.20010228pl03-0vl1.i386.rpm
"警告: /etc/postfix/main.cf は /etc/postfix/main.cf.rpmnew として作成されます"が表示されるが無視
AL-MailでFrom: yahagi@comm.sei.co.jp (矢作 雅司) のメールを送信し、
受信メールで"矢作\ 雅司"になっていないことを確認
セキュリティ設定
vi /etc/named.conf
/etc/rc.d/init.d/named restart
nslookup masaji.org 127.0.0.1
nslookup masaji.org 192.168.1.250
nslookup masaji.org seigate.sei.co.jp
設定
旧サーバから/home/httpd/cgi-bin/webmailerディレクトリ以下をコピー(属性込み)
設定
mv /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.org
旧サーバから/etc/httpd/conf/httpd.confをコピー
/etc/rc.d/init.d/httpd restart
mv /home/httpd/html/index.html /home/httpd/html/index.html.org
旧サーバから/home/httpd/html/index.htmlをコピー
cp /home/httpd/html/manual/configuring.html.ja.jis /home/httpd/html/manual/configuring.html
cp /home/httpd/html/manual/custom-error.html.ja.jis /home/httpd/html/manual/custom-error.html
cp /home/httpd/html/manual/handler.html.ja.jis /home/httpd/html/manual/handler.html
cp /home/httpd/html/manual/index.html.ja.jis /home/httpd/html/manual/index.html
cp /home/httpd/html/manual/install.html.ja.jis /home/httpd/html/manual/install.html
cp /home/httpd/html/manual/new_features_1_3.html.ja.jis /home/httpd/html/manual/new_features_1_3.html
cp /home/httpd/html/manual/server-wide.html.ja.jis /home/httpd/html/manual/server-wide.html
設定
mv /etc/smb.conf /etc/smb.conf.org
cp /etc/smb.conf.org /etc/smb.conf
vi /etc/smb.conf
coding system = euc
client code page = 932
workgroup = WORKGROUP
↓
coding system = cap
client code page = 932
workgroup = YAHAGI
/etc/rc.d/init.d/smb start
/sbin/chkconfig --level 2345 smb on
ユーザパスワード設定
Windowsから共有確認
設定
mv /etc/inetd.conf /etc/inetd.conf.org
cp /etc/inetd.conf.org /etc/inetd.conf
vi /etc/inetd.conf
#ftp stream tcp nowait root /usr/sbin/tcpd in.proftpd
↓
ftp stream tcp nowait root /usr/sbin/tcpd in.proftpd
mv /etc/proftpd.conf /etc/proftpd.conf.org
cp /etc/proftpd.conf.org /etc/proftpd.conf
vi /etc/proftpd.conf
ServerType standalone
↓
ServerType inetd
ISDNルータのNATe拡張設定(port20-21を168.192.1.250に設定)
ftp localhost (接続許可)
ftp yahagi.masaji.org (接続不許可&警告Mail受信)
設定
ISDNルータのNATe拡張設定(port80,443を168.192.1.250に設定)
設定
mv /etc/hosts.deny /etc/hosts.deny.org
cp /etc/hosts.deny.org /etc/hosts.deny
vi /etc/hosts.deny
mv /etc/hosts.allow /etc/hosts.allow.org
cp /etc/hosts.allow.org /etc/hosts.allow
vi /etc/hosts.allow
設定
ISDNルータのNATe拡張設定(port110を168.192.1.250に設定)
不要サービス停止
/sbin/chkconfig --level 2345 usbmgr off
/sbin/chkconfig --level 2345 canna off
/sbin/chkconfig --level 2345 FreeWnn off
設定
mv /etc/postfix/main.cf /etc/postfix.main.cf.org
cp /etc/postfix/main.cf.org /etc/postfix/main.cf
vi /etc/postfix/main.cf
/etc/rc.d/init.d/postfix start
/sbin/chkconfig postfix on
tp560から送信テスト
・yahagiへ
・yahagi@masaji.orgへ
・yahagi@local.masaji.orgへ
・yahagi@st0044.nas911.n-yokohama.nttpc.ne.jpへ
・yahagi@comm.sei.co.jpへ
tp560への受信テスト(他マシンから)
・yahagi@masaji.orgへ
・yahagi@local.masaji.orgへ
・yahagi@st0044.nas911.n-yokohama.nttpc.ne.jpへ
tp560のリレーテスト(他マシンから)
・yahagi@comm.sei.co.jpへ
旧サーバのユーザを追加
ISDNルータのNATe拡張設定(port25を168.192.1.250に設定)
tp560への受信テスト(他マシンから)
・yahagi@comm.sei.co.jpへ(yahagi@masaji.orgへforwardしている)
vi /etc/aliasesでroot: yahagiを追加
newaliases
mail root
bind設定
mv /etc/named.conf /etc/named.conf.org
vi /etc/named.conf
vi /var/named/masaji.org
vi /var/named/local.masaji.org
vi /var/named/192.168.1
mv /etc/resolv.conf /etc/resolv.conf.org
vi /etc/resolv.conf
/etc/rc.d/init.d/named start
/sbin/chkconfig --level 2345 named on
ISDNルータのNATe拡張設定(port53を168.192.1.250に設定)
dig yahagi.masaji.org
tail -100 /var/log/messages