Re: kolab3/debian wheezy: Questions regarding ssl setup

On Monday, January 28, 2013 04:57:13 Thomas Spuhler wrote:
> On Wednesday, December 19, 2012 06:00:54 AM Johannes Graumann wrote:
> > Paul Klos <kolab <at> klos2day.nl> writes:
> > > Op Wed, 05 Dec 2012 11:27 +0300
> > > 
> > > Johannes Graumann <johannes_graumann <at> web.de> schreef:
> > > > Hello,
> > > > 
> > > > When configuring a fresh kolab3 install on wheezy,
> > > > I need to issue an explicit "a2enmod ssl &&
> > > > a2ensite default-ssl" to get kolab-webadmin to work.
> > > 
> > > I haven't tried this yet, and it's certainly
> > > something that should work, but AFAIK there is no
> > > explicit need to have ssl working to get into the
> > > kolab-webadmin.
> > 
> > The requirement might be deriving from my lxc and nginx routing setup.
> > 
> > > > In this context I am unclear on where the debian
> > > > setup requires ssl key and certificate.
> > > > 
> > > > http://tinyurl.com/c98ojg5 says here:
> > > > > Certificate: /etc/pki/tls/certs/host.example.org.cert
> > > > > Private
> > > > > Key: /etc/pki/tls/private/host.example.org.key
> > > > 
> > > > but that directory is inexistent in debian.
> > > 
> > > Certificate paths are different on Debian and Red Hat
> > > flavoured distributions. We've run into this before
> > > with cyrus and postfix. Most probably setup-kolab
> > > will have to be patched for Debian to take care of
> > > this. For now, either symlinking or changing the
> > > configuration to look in /etc/ssl/private should
> > > work (as well as straight http, as per my previous
> > > remark).
> > 
> > Do you think the patch appended should/could be pushed into the
> > repository? I went hunting for *.pem etc. in my existing trial
> > installation and came up with
> > the instances the patch attempts to modify towards debianish
> > infrastructure.
> > 
> > Cheers, Joh
> > 
> > diff --git a/pykolab/setup/setup_imap.py b/pykolab/setup/setup_imap.py
> > index c5c400e..4b7564f 100644
> > --- a/pykolab/setup/setup_imap.py
> > +++ b/pykolab/setup/setup_imap.py
> > 
> > @@ -65,14 +65,6 @@ def execute(*args, **kw):
> >              "admins": conf.get('cyrus-imap', 'admin_login'),
> >              "postuser": "shared",
> >          
> >          }
> > 
> > -
> > -    if os.path.isfile('/usr/sbin/make-ssl-cert') and not
> > os.path.isfile('/etc/ssl/private/ssl-cert-snakeoil.key'):
> > -        subprocess.call(['/usr/sbin/make-ssl-cert generate-default-
> > snakeoil'])
> > -
> > -    if os.path.isfile('/etc/ssl/private/ssl-cert-snakeoil.key'):
> > -        imapd_settings['tls_cert_file'] = "/etc/ssl/certs/ssl-cert-
> > snakeoil.pem"
> > -        imapd_settings['tls_ca_file'] =
> > "/etc/ssl/certs/ssl-cert-snakeoil.pem" -
> > imapd_settings['tls_key_file'] = "/etc/ssl/private/ssl-cert-
> > snakeoil.key"
> > 
> >      template_file = None
> > 
> > diff --git a/pykolab/setup/setup_mta.py b/pykolab/setup/setup_mta.py
> > index 40e6555..c02b024 100644
> > --- a/pykolab/setup/setup_mta.py
> > +++ b/pykolab/setup/setup_mta.py
> > @@ -212,15 +212,10 @@ result_attribute = mail
> > 
> >      if os.path.isfile('/etc/pki/tls/certs/make-dummy-cert') and not
> > 
> > os.path.isfile('/etc/pki/tls/private/localhost.pem'):
> >          subprocess.call(['/etc/pki/tls/certs/make-dummy-cert',
> > 
> > '/etc/pki/tls/private/localhost.pem'])
> > -    elif os.path.isfile('/usr/sbin/make-ssl-cert') and not
> > os.path.isfile('/etc/ssl/private/ssl-cert-snakeoil.key'):
> > -        subprocess.call(['/usr/sbin/make-ssl-cert generate-default-
> > snakeoil'])
> > 
> >      if os.path.isfile('/etc/pki/tls/private/localhost.pem'):
> >          postfix_main_settings['smtpd_tls_cert_file'] =
> > 
> > "/etc/pki/tls/private/localhost.pem"
> > 
> >          postfix_main_settings['smtpd_tls_key_file'] =
> > 
> > "/etc/pki/tls/private/localhost.pem"
> > -    elif os.path.isfile('/etc/ssl/private/ssl-cert-snakeoil.key'):
> > -        postfix_main_settings['smtpd_tls_cert_file'] =
> > "/etc/ssl/certs/ssl-cert-snakeoil.pem"
> > -        postfix_main_settings['smtpd_tls_key_file'] =
> > "/etc/ssl/private/ssl-cert-snakeoil.key"
> > 
> >      if not os.path.isfile('/etc/postfix/main.cf'):
> >          if os.path.isfile('/usr/share/postfix/main.cf.debian'):
> An news on this?
No. I do not think Paul had time to check it out yet.

Was wondering the same yesterday, as my trial setup now has issues sending and 
I think I tracked it down to postfix lacking a certificate  ...

Joh

_______________________________________________
Kolab-devel mailing list
[email protected]
https://www.intevation.de/mailman/listinfo/kolab-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAABCgAGBQJRBgtuAAoJEPEE8yDpbiX7lbQP/R4MBwB+ltV1B2npBA9adLGj
Xt4guHdHy8RTQmQ7Z1ARQpysrmzlbDK1aEGn9/GCdg/MWDH5GhZ/JGgSR46XFM6Q
6BPy2uihH/Yt3qG7yuMYNgieWlH4BlSr7bhG1RuCXZqjjlLsTE8TGGP7Ml+qvH5Z
+S6p/kRss/rt7OLPKJ0VjpoYubAhTRkf7Sd0TlYSgoP+1zIO99wLmJP3NPw1MVVy
nSVWAa7PXI0RcFZ58BE14on/ZT3HQRBRTtGwu9hSeqRq1zRQ4huo/Tgcy3EW8W1Y
TzHshE/hhpmrXb7az51yJ5Y5elgqQyFIJT0ppPXn5XJCngyT/yXcLJ6QIgBPVtOF
yOIOENocWkS+KJ1Pu2EwWky4ArtlVC3ePb1jU9mFpq5T6ehW2X9kYJM4ac2tZXfu
QwYEr2lWBcZJi7Kb4O51JuRLaKw0oEi3GLmnqC0XWg3SJgPwr70l9Hy2hx2iJn9Q
0u9T+b+PMNypZpnoFc9fLZoICMD192aYovyy6Nv683O+7OJTWIO0ygc+kCNY7imO
iWJ7DUtILPJYyyTeuV9kGCBa1m0Q2Pm2BHqYJ9VtdQxkQegRizAUsfvUc+TJdR2f
/IwDxC4Nl3L+sDvezfA7RJ3kUcwjfHrFin16uwPKjt9xhqzvqMniNJH4ZRB52zrZ
QPMdG1nLctf+Etzrchkf
=+sfr
-----END PGP SIGNATURE-----