Re: kolab3/debian wheezy: Questions regarding ssl setup

Paul Klos <kolab <at> klos2day.nl> writes:

> 
> Op Wed, 05 Dec 2012 11:27 +0300
> Johannes Graumann <johannes_graumann <at> web.de> schreef:
> 
> > Hello,
> > 
> > When configuring a fresh kolab3 install on wheezy,
> > I need to issue an explicit "a2enmod ssl &&
> > a2ensite default-ssl" to get kolab-webadmin to work.
> > 
> I haven't tried this yet, and it's certainly
> something that should work, but AFAIK there is no
> explicit need to have ssl working to get into the
> kolab-webadmin.
The requirement might be deriving from my lxc and nginx routing setup.

> > In this context I am unclear on where the debian
> > setup requires ssl key and certificate. 
> > http://tinyurl.com/c98ojg5 says here:
> > > Certificate: /etc/pki/tls/certs/host.example.org.cert
> > > Private
> > > Key: /etc/pki/tls/private/host.example.org.key
> > but that directory is inexistent in debian.
> > 
> Certificate paths are different on Debian and Red Hat
> flavoured distributions. We've run into this before
> with cyrus and postfix. Most probably setup-kolab
> will have to be patched for Debian to take care of
> this. For now, either symlinking or changing the
> configuration to look in /etc/ssl/private should
> work (as well as straight http, as per my previous
> remark).
Do you think the patch appended should/could be pushed into the repository?
I went hunting for *.pem etc. in my existing trial installation and came up 
with
the instances the patch attempts to modify towards debianish infrastructure.

Cheers, Joh

diff --git a/pykolab/setup/setup_imap.py b/pykolab/setup/setup_imap.py
index c5c400e..4b7564f 100644
--- a/pykolab/setup/setup_imap.py
+++ b/pykolab/setup/setup_imap.py
@@ -65,14 +65,6 @@ def execute(*args, **kw):
             "admins": conf.get('cyrus-imap', 'admin_login'),
             "postuser": "shared",
         }
-        
-    if os.path.isfile('/usr/sbin/make-ssl-cert') and not
os.path.isfile('/etc/ssl/private/ssl-cert-snakeoil.key'):
-        subprocess.call(['/usr/sbin/make-ssl-cert generate-default-
snakeoil'])
-
-    if os.path.isfile('/etc/ssl/private/ssl-cert-snakeoil.key'):
-        imapd_settings['tls_cert_file'] = "/etc/ssl/certs/ssl-cert-
snakeoil.pem"
-        imapd_settings['tls_ca_file'] = "/etc/ssl/certs/ssl-cert-snakeoil.pem"
-        imapd_settings['tls_key_file'] = "/etc/ssl/private/ssl-cert-
snakeoil.key"
 
     template_file = None
 
diff --git a/pykolab/setup/setup_mta.py b/pykolab/setup/setup_mta.py
index 40e6555..c02b024 100644
--- a/pykolab/setup/setup_mta.py
+++ b/pykolab/setup/setup_mta.py
@@ -212,15 +212,10 @@ result_attribute = mail
 
     if os.path.isfile('/etc/pki/tls/certs/make-dummy-cert') and not
os.path.isfile('/etc/pki/tls/private/localhost.pem'):
         subprocess.call(['/etc/pki/tls/certs/make-dummy-cert',
'/etc/pki/tls/private/localhost.pem'])
-    elif os.path.isfile('/usr/sbin/make-ssl-cert') and not
os.path.isfile('/etc/ssl/private/ssl-cert-snakeoil.key'):
-        subprocess.call(['/usr/sbin/make-ssl-cert generate-default-
snakeoil'])
 
     if os.path.isfile('/etc/pki/tls/private/localhost.pem'):
         postfix_main_settings['smtpd_tls_cert_file'] =
"/etc/pki/tls/private/localhost.pem"
         postfix_main_settings['smtpd_tls_key_file'] =
"/etc/pki/tls/private/localhost.pem"
-    elif os.path.isfile('/etc/ssl/private/ssl-cert-snakeoil.key'):
-        postfix_main_settings['smtpd_tls_cert_file'] =
"/etc/ssl/certs/ssl-cert-snakeoil.pem"
-        postfix_main_settings['smtpd_tls_key_file'] =
"/etc/ssl/private/ssl-cert-snakeoil.key"
 
     if not os.path.isfile('/etc/postfix/main.cf'):
         if os.path.isfile('/usr/share/postfix/main.cf.debian'):

_______________________________________________
Kolab-devel mailing list
[email protected]
https://www.intevation.de/mailman/listinfo/kolab-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAABCgAGBQJQ0bqHAAoJEPEE8yDpbiX7dCkP/2dmL1RvOgnWYfXx4KYo75C+
rkRm0sNKbqXaGIllwRay8JCwwcmjn7ZhSAFdLyNaxJgycHtThOOEqK7FVX4YSA9J
38DPgoyoI1CNss4hI12+JOaxdWtpuf6hGbFXp9tkLzgKkK53rCwJhWsbeOxRWET6
7s0iO9jvtJlfs0lUn9dEIOHQFi/4reZ+hYLEIECyeYWzUgHJ7lww0t2WBHcmvxoi
CqqzsP51CN+kzq6YR8x2bfSAz8ggIbixRO1lbBenYtg7/lNrqM9bELmkoGDAvaDq
x3qWkt8bARgriwKu5/1y3WmTXhDb812OJpzXNnnT9OPbrrL1lQK0RqSwPffPm1PD
PkmUG8SQkT4FdEqJDXMG901cJlJGjx4M/rVLxmVBrDs5eD4ph+RvREzOo2eDGLVd
OaIc3Ecx81lbaEkeym4I1Q2ZxOzrzyBENbhp4ju4+K3JnP2xuTgQWyVlT59O2DDb
oK1yW7O+8ql4SsKagfBZRSDPueW8xX/YZNpQmXqsR7knqSVwgU3j4s1+FtoXyDDf
bhHfgJHu/V+D5IEf2lbg57gibEYY5IdJhqRzkp0vv6swZIT4uQt4/oCnS6wExmlH
TaqsJbijaaejKXzkeGzO0IRmNqkzbjGWkxPJGDeSKyNfrqYsATPgc8nGwbpeyXKp
rPJ+CoEfbGKSXQN5LaUC
=MUFn
-----END PGP SIGNATURE-----