Un petit mémo rapide pour installer signer ses messages (sortant) avec dkim.

Packages nécessaires  (Debian (lenny):

postfix

dkim-filter

dkimproxy

Configuration postfix:

/etc/postfix/main.cf

# conf dkim

milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891

/etc/postfix/master.cf

En début de section:

smtp      inet  n       -       -       -       -       smtpd
-o  content_filter=dksign:[127.0.0.1]:10027

et en fin de section

# declaration du service dksign
dksign unix – - n – 4 smtp
-o smtp_send_xforward_command=yes
-o smtp_discard_ehlo_keywords=8bitmime

127.0.0.1:10028 inet n – n  – 10 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_authorized_xforward_hosts=127.0.0.0/8

Configuration dkim-filter:

# Sign for example.com with key in /etc/mail/dkim.key using
# selector ’2007′ (e.g. 2007._domainkey.example.com)
Domain            example.com
KeyFile                /etc/dkimproxy/example.key
Selector        dkim
Socket                  inet:8891@localhost

dkim-proxy utilise 2 fichiers de config:

dkimproxy_in.conf
# specify what address/port DKIMproxy should listen on
listen    127.0.0.1:10025

# specify what address/port DKIMproxy forwards mail to
relay     127.0.0.1:10024

/etc/dkimproxy/dkimproxy_out.conf
# specify what address/port DKIMproxy should listen on
listen    127.0.0.1:10027

# specify what address/port DKIMproxy forwards mail to
relay     127.0.0.1:10028

# specify what domains DKIMproxy can sign for (comma-separated, no spaces)
# Note that this is set in /etc/init.d/dkimproxy in this Debian package
# unactivate it there if you want to use the config file
domain    example.com

# specify what signatures to add
#signature dkim(c=relaxed)
#signature domainkeys(c=nofws)

# specify location of the private key
keyfile   /etc/dkimproxy/example.com.key

# specify the selector (i.e. the name of the key record put in DNS)
selector  dkim

# génération de la paire de clé rsa

openssl genrsa -out example.com.key 1024
openssl rsa -in example.key -pub out -out example.com_pub.key
# vérification de la clé publique dans les dns
dig  dkim._domainkey.example.com txt