diff options
| author | jmg <jmg@FreeBSD.org> | 2013-10-19 18:51:06 +0000 |
|---|---|---|
| committer | jmg <jmg@FreeBSD.org> | 2013-10-19 18:51:06 +0000 |
| commit | a25e3add85ff606c3740e4c8346bc9cb1c13f7e3 (patch) | |
| tree | 9c5fa17e375961b2b89a7f29f6cd354d8d559f12 /etc/sendmail | |
| parent | 1a884d59cfcf6f1850742e793acfc113bbc33838 (diff) | |
| download | FreeBSD-src-a25e3add85ff606c3740e4c8346bc9cb1c13f7e3.zip FreeBSD-src-a25e3add85ff606c3740e4c8346bc9cb1c13f7e3.tar.gz | |
Enable the automatic creation of a certificate (if one does not exists)
and enable the usage by sendmail if sendmail is enabled. Include and
document knobs to disable this feature and also set the Common Name of
the certificate created.
As the certificate is signed w/ a discarded key, it only helps prevent
Eve, but not Malory from knowing the contents of the emails.
This means that new installs (and people that use the updated freebsd.mc
file) will automaticly have STARTTLS enabled allowing incoming email to
be encrypted in most cases.
Reviewed by: gshapiro
MFC after: 3 days
Security: Yes, please.
Diffstat (limited to 'etc/sendmail')
| -rw-r--r-- | etc/sendmail/freebsd.mc | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/etc/sendmail/freebsd.mc b/etc/sendmail/freebsd.mc index 6d75636..7ab7386 100644 --- a/etc/sendmail/freebsd.mc +++ b/etc/sendmail/freebsd.mc @@ -42,6 +42,11 @@ divert(-1) # /usr/share/sendmail/cf/README or # /usr/src/contrib/sendmail/cf/README # +# +# NOTE: If you enable RunAsUser, make sure that you adjust the permissions +# and owner of the SSL certificates and keys in /etc/mail/certs to be usable +# by that user. +# divert(0) VERSIONID(`$FreeBSD$') @@ -54,6 +59,16 @@ FEATURE(local_lmtp) FEATURE(mailertable, `hash -o /etc/mail/mailertable') FEATURE(virtusertable, `hash -o /etc/mail/virtusertable') +dnl Enable STARTTLS for receiving email. +define(`CERT_DIR', `/etc/mail/certs')dnl +define(`confSERVER_CERT', `CERT_DIR/host.cert')dnl +define(`confSERVER_KEY', `CERT_DIR/host.key')dnl +define(`confCLIENT_CERT', `CERT_DIR/host.cert')dnl +define(`confCLIENT_KEY', `CERT_DIR/host.key')dnl +define(`confCACERT', `CERT_DIR/cacert.pem')dnl +define(`confCACERT_PATH', `CERT_DIR')dnl +define(`confDH_PARAMETERS', `CERT_DIR/dh.param')dnl + dnl Uncomment to allow relaying based on your MX records. dnl NOTE: This can allow sites to use your server as a backup MX without dnl your permission. |
