## 这里介绍两种加密方法:Roundcubemail自带的PGP插件加密和第三方插件Mailvelope加密 ### 一、Roundcubemail自带的PGP插件加密 #### 配置发件人的签名信息  　　 #### 配置PGP密钥对  　　 #### 设置PGP私钥密码  　　 #### 生成了密钥对  　　 #### 设置加密选项  　　 #### 发送公钥给test01   　　 #### test01收到公钥并添加到公钥(test01的密钥对的生成跟前面的test02操作一样)  　　 #### test02\@unotes.co的公钥已经添加成功  　　 #### test01使用test02的公钥加密发送邮件给test02(只有拥有该公钥所对应的私钥的用户才能解密)   　　 #### test01需输入密码，对该邮件进行签名  　　 #### test02收到了test01的加密邮件  #### 如果test02使用了没有私钥的客户端foxmail打开,是看不到加密邮件的真实内容  　　 ### 二、第三方插件Mailvelope加密 浏览器需要安装Mailvelope扩展插件  **firefox:** `https://download.mailvelope.com/releases/latest/mailvelope.firefox.xpi` **chrome:** `https://chrome.google.com/webstore/detail/kajibbejlbohfaggdiogboambcijhkke` 　　 　　 #### 安装扩展完成，之后浏览器上会有个小锁图标 　　 　　 #### 这里测试chrome登录test01的邮箱，火狐登录test02的邮箱 #### 激活当前域名的开启Mailvelope   　　 #### 添加成功后，发送邮件页面会多一个加密图标  　　 #### 导入双方的公私钥 #### chrome的Mailvelope导入test01的私钥以及test02的公钥   　　 #### firefox的Mailvelope导入test02的私钥以及test01的公钥  　　 #### 测试test01给test02发送一份通过Mailvelope加密的邮件  　　 #### test02收到加密的邮件，通过私钥自动解密  　　 #### 如果test02使用了没有私钥的客户端foxmail打开,是看不到加密邮件的真实内容 

### Roundcubemail介绍 　　*RoundCube Webmail是一个基于浏览器，支持多国语言的IMAP客户端，操作界面看起像一个桌面应用程序 　　它提供一个e-mail客户端应该具备的所有功能包括MIME支持,地址薄，文件夹操作，信息搜索和拼写检查。RoundCube Webmail采用PHP+Ajax开发并且需要MySQL数据库来存储数据。 用户界面采用XHTML+CSS2设计。* 　　 ### 安装LAMP 参考[邮件服务器之postfix+dovecot+postfixadmin+TLS](https://ynotes.cn/blog/article_detail/143)中的`LAMP`部分 　　　　　 　　 ### 安装Roundcubemail(1.3.7版本) 下载地址: `https://roundcube.net/` ```bash $ wget https://github.com/roundcube/roundcubemail/releases/download/1.3.7/roundcubemail-1.3.7-complete.tar.gz $ tar -xf roundcubemail-1.3.7-complete.tar.gz -C /var/www/html/ $ cd /var/www/html/ $ mv roundcubemail-1.3.7 webmail ``` ### 浏览器访问`http://roundcube_server_ip/webmail/installer/`   上面提示时区没有配置 ```bash $ vim /etc/php.ini ``` ``` date.timezone = Asia/Shanghai ```        　　 　　 　　 ### 配置插件 ```bash $ vim /var/www/html/webmail/config/config.inc.php ``` ``` $config['smtp_user'] = '%u'; $config['smtp_pass'] = '%p'; $config['product_name'] = 'unotes.co Webmail'; $config['plugins'] = array('attachment_reminder', 'autologon', 'emoticons', 'enigma', 'filesystem_attachments', 'markasjunk', 'newmail_notifier', 'password', 'show_additional_headers', 'userinfo', 'virtuser_file','virtuser_query', 'zipdownload'); $config['password_dovecotpw'] = '/usr/bin/doveadm pw'; $config['password_dovecotpw_method'] = 'CRAM-MD5'; $config['password_dovecotpw_with_method'] = false; $config['password_force_new_user'] = true; $config['password_driver'] = 'sql'; //下面配置postfix库的访问账号 $config['password_db_dsn'] = 'mysql://username:password@localhost/postfix'; ``` 　　 ### 添加automatic_addressbook插件(自动补全已发送过的邮件地址) #### 安装插件 ```bash $ cd /var/www/html/webmail/plugins $ wget https://github.com/sblaisot/automatic_addressbook/archive/master.zip $ tar xvf master.zip $ rm master.zip $ mv automatic_addressbook-master automatic_addressbook $ chown -R apache.apache automatic_addressbook ``` #### 添加插件相关的表 ```bash mysql>use roundcubemail; mysql>source automatic_addressbook/SQL/mysql.initial.sql; ``` #### 修改config配置 ```bash $ vim /var/www/html/webmail/config/config.inc.php ``` ``` $config['plugins'] = array('attachment_reminder', 'autologon', 'emoticons', 'enigma', 'automatic_addressbook', 'filesystem_attachments', 'markasjunk', 'newmail_notifier', 'password', 'show_additional_headers', 'userinfo', 'virtuser_file','virtuser_query', 'zipdownload'); ``` #### 重启服务 ```bash $ /etc/init.d/httpd restart ``` 　　 ### 登录webmail `http://mail.unotes.co/webmail`  　　 ### 配置SSL 增加ssl.conf ```bash /etc/httpd/conf.d/ssl.conf ``` ``` <VirtualHost *:80> ServerName mail.unotes.co RewriteEngine on RewriteCond %{SERVER_PORT} !^443$ RewriteRule ^/?(.*)$ https://%{SERVER_NAME}/$1 [L,R] </VirtualHost> ``` ``` LoadModule ssl_module modules/mod_ssl.so Listen 443 SSLPassPhraseDialog builtin SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000) SSLSessionCacheTimeout 300 SSLMutex default SSLRandomSeed startup file:/dev/urandom 256 SSLRandomSeed connect builtin SSLCryptoDevice builtin <VirtualHost _default_:443> DocumentRoot "/var/www/html" ServerName mail.unotes.co SSLEngine on SSLCertificateFile /etc/httpd/conf/ssl/mail.unotes.co.crt SSLCertificateKeyFile /etc/httpd/conf/ssl/mail.unotes.co.key SSLCertificateChainFile /etc/httpd/conf/ssl/ca.crt ErrorLog logs/ssl_error_log TransferLog logs/ssl_access_log LogLevel warn SSLProtocol all -SSLv2 SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES <Files ~ "\.(cgi|shtml|phtml|php3?)$"> SSLOptions +StdEnvVars </Files> <Directory "/var/www/cgi-bin"> SSLOptions +StdEnvVars </Directory> SetEnvIf User-Agent ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 CustomLog logs/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" </VirtualHost> ``` 重定向80->443 ```bash $ vim /etc/httpd/conf/httpd.conf ``` 拷贝证书到/etc/httpd/conf/ssl ```bash $ cp /etc/postfix/ssl/* /etc/httpd/conf/ssl ``` 重启服务 ```bash $ /etc/init.d/httpd restart ``` 访问 `https://mail.unotes.co/webmail/` 

### 邮件服务器(mail.unotes.co)收到 test01\@unotes.co 发送给 test.redhat\@gmail.com 邮件的日志 ```bash $ tail -f /var/log/maillog ``` **`收到客户端x.x.196.255的连接请求`** ```bash Aug 19 05:49:42 mail postfix/smtps/smtpd[10057]: connect from unknown[x.x.196.255] ``` **`用户test01@unotes.co通过sasl认证登录成功`** ```bash Aug 19 05:49:43 mail postfix/smtps/smtpd[10057]: EA8FF222F6: client=unknown[x.x.196.255], sasl_method=LOGIN, sasl_username=test01@unotes.co ``` **`postfix cleanup清理邮件，处理好的邮件，会被传入收件队列(Incoming Queue)`** ```bash Aug 19 05:49:44 mail postfix/cleanup[10064]: EA8FF222F6: message-id=<2018081917494313210561@unotes.co> ``` **`opendkim会检查发送邮件的DKIM签名是否通过`** ```bash Aug 19 05:49:44 mail opendkim[10046]: EA8FF222F6: DKIM-Signature field added (s=default, d=unotes.co) ``` **`qmgr把邮件放入active队列`** ```bash Aug 19 05:49:44 mail postfix/qmgr[7739]: EA8FF222F6: from=<test01@unotes.co>, size=1725, nrcpt=1 (queue active) ``` **`邮件服务器和gmail的smtp发起建立TLS的连接的请求`** ```bash Aug 19 05:49:44 mail postfix/smtp[10065]: setting up TLS connection to gmail-smtp-in.l.google.com[74.125.197.26]:25 ``` **`邮件服务器和gmail的smtp的TLS连接建立成功`** ```bash Aug 19 05:49:44 mail postfix/smtp[10065]: Trusted TLS connection established to gmail-smtp-in.l.google.com[74.125.197.26]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) ``` **`邮件服务器发送邮件给gmail的smtp服务器`** ```bash Aug 19 05:49:45 mail postfix/smtp[10065]: EA8FF222F6: to=<test.redhat@gmail.com>, relay=gmail-smtp-in.l.google.com[74.125.197.26]:25, delay=1.8, delays=0.74/0.03/0.19/0.82, dsn=2.0.0, status=sent (250 2.0.0 OK 1534672190 g10-v6si7304311pfd.86 - gsmtp) ``` **`qmgr把邮件移除`** ```bash Aug 19 05:49:45 mail postfix/qmgr[7739]: EA8FF222F6: removed ``` **`客户端x.x.196.255断开连接`** ```bash Aug 19 05:49:49 mail postfix/smtps/smtpd[10057]: disconnect from unknown[x.x.196.255] ``` ### 邮件服务器(mail.unotes.co)收到 test.redhat\@gmail.com 发送给 test01\@unotes.co 邮件的日志 **`gmail客户端请求连接邮件服务器`** ```bash Aug 19 06:09:14 mail postfix/smtpd[10077]: connect from mail-wr1-f42.google.com[209.85.221.42] ``` **`postgrey灰名单校验通过，客户端在whitelist中`** ```bash Aug 19 06:09:15 mail postgrey[9433]: action=pass, reason=client whitelist, client_name=mail-wr1-f42.google.com, client_address=209.85.221.42, sender=test.redhat@gmail.com, recipient=test01@unotes.co Aug 19 06:09:15 mail postgrey[9433]: cleaning up old logs... Aug 19 06:09:15 mail postgrey[9433]: cleaning up old entries... Aug 19 06:09:15 mail postgrey[9433]: cleaning main database finished. before: 4, after: 4 Aug 19 06:09:15 mail postgrey[9433]: cleaning clients database finished. before: 4, after: 4 ``` **`postfix cleanup清理邮件`** ```bash Aug 19 06:09:15 mail postfix/smtpd[10077]: 974C6222F6: client=mail-wr1-f42.google.com[209.85.221.42] Aug 19 06:09:15 mail postfix/cleanup[10083]: 974C6222F6: message-id=<CAOmnsz0oWbDCvGsjo3Q2sLoyCWeFPqsyZFdin1thTvC2NmWA5w@mail.gmail.com> ``` **`opendkim检查客户端的smtp服务器的DKIM签名成功`** ```bash Aug 19 06:09:15 mail opendkim[10046]: 974C6222F6: mail-wr1-f42.google.com [209.85.221.42] not internal Aug 19 06:09:15 mail opendkim[10046]: 974C6222F6: not authenticated Aug 19 06:09:15 mail opendkim[10046]: 974C6222F6: DKIM verification successful ``` **`qmgr把邮件放入active队列`** ```bash Aug 19 06:09:15 mail postfix/qmgr[7739]: 974C6222F6: from=<test.redhat@gmail.com>, size=9907, nrcpt=1 (queue active) Aug 19 06:09:16 mail postfix/smtpd[10077]: disconnect from mail-wr1-f42.google.com[209.85.221.42] Aug 19 06:09:16 mail postfix/smtpd[10088]: connect from unknown[127.0.0.1] Aug 19 06:09:17 mail postfix/smtpd[10088]: 01373222F7: client=unknown[127.0.0.1] Aug 19 06:09:17 mail postfix/cleanup[10083]: 01373222F7: message-id=<CAOmnsz0oWbDCvGsjo3Q2sLoyCWeFPqsyZFdin1thTvC2NmWA5w@mail.gmail.com> ``` **`opendkim检查客户端的发件人的DKIM签名不匹配(正常,因为我们没有把test.redhat@gmail.com添加到/etc/opendkim/SigningTable)，smtp服务器的DKIM签名成功`** ```bash Aug 19 06:09:17 mail opendkim[10046]: 01373222F7: no signing table match for 'test.redhat@gmail.com' Aug 19 06:09:17 mail opendkim[10046]: 01373222F7: DKIM verification successful ``` **`qmgr再次把邮件放入active队列`** ```bash Aug 19 06:09:17 mail postfix/qmgr[7739]: 01373222F7: from=<test.redhat@gmail.com>, size=10498, nrcpt=1 (queue active) ``` **`amavis检测通过`** ```bash Aug 19 06:09:17 mail amavis[9854]: (09854-01) Passed CLEAN {RelayedInbound}, [209.85.221.42] [209.85.221.42] <test.redhat@gmail.com> -> <test01@codemax.cn>, Message-ID: <CAOmnsz0oWbDCvGsjo3Q2sLoyCWeFPqsyZFdin1thTvC2NmWA5w@mail.gmail.com>, mail_id: rLrGCzYXUKtd, Hits: -0.099, size: 10066, queued_as: 01373222F7, dkim_sd=20161025:gmail.com, 1077 ms ``` **`smtp把邮件发送给amavis`** ```bash Aug 19 06:09:17 mail postfix/smtp[10084]: 974C6222F6: to=<test01@codemax.cn>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.5, delays=0.42/0.04/0.02/1.1, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 01373222F7) ``` **`qmgr把邮件移除`** ```bash Aug 19 06:09:17 mail postfix/qmgr[7739]: 974C6222F6: removed ``` **`把邮件中继给dovecot`** ```bash Aug 19 06:09:17 mail postfix/pipe[10090]: 01373222F7: to=<test01@codemax.cn>, relay=dovecot, delay=0.32, delays=0.06/0.01/0/0.25, dsn=2.0.0, status=sent (delivered via dovecot service) ``` **`qmgr把邮件移除`** ```bash Aug 19 06:09:17 mail postfix/qmgr[7739]: 01373222F7: removed ```