How to add CA certificate to NSS Certificate DB

If you have created a Certificate Authority (see here), you probably want get rid of warnings the consumers shows to your users, e.g. email clients while accessing the mailbox. Here are few simple steps to add your local Certificate Authority to to NSS Certificate DB:

1. Copy CA certificate to known certificates:

   cp cacert.pem /etc/ssl/certs
   chmod go+r /etc/ssl/certs/cacert.pem
   

2. Let install a tools to manage NSS Certificate DB:

   apt-get install libnss3-tools
   

3. The default location of NSSDB is in $HOME/.pki/nssdb. If you do not have one yet issue the following command to create (see more baout certutil here):

   mkdir -p .pki/nssdb ; certutil -N -d sql:.pki/nssdb
   

4. Add CA certificate:

   certutil -d sql:.pki/nssdb -A -t "CT,c,c" -n DEV.LOCAL \
   -i /etc/ssl/certs/cacert.pem
   

Evolution email client

Nothing specific need to be done. It uses .pki/nssdb by default

Firefox/Iceweasel web browser

The idea here is to point existing nssdb files to one in .pki/nssdb:

cd .mozilla/firefox/your-profile/
rm cert9.db key4.db
ln -s ~/.pki/nssdb/key4.db .
ln -s ~/.pki/nssdb/cert9.db .

Thunderbird email client

Things you need to do are exactly the same as for firefox, with the only exception to change default directory to .thunderbird/your-profile instead.

Final Note

At this point you should be fine to see SSL content (web, mail, etc) without a security warning since your CA is trusted. Consider copy nss db to /etc/skel, so the new users will get it working automatically:

cp -r .pki /etc/skel

The first time a new user logging, the nssdb will be copied from skel directory and as result the user will get valid CA certificate. Read more here.

Dovecot IMAP Server

The Internet Message Access Protocol (IMAP) is one of the two most prevalent Internet standard protocols for e-mail retrieval. Dovecot is an open source IMAP.

• IMAP host FQDN: mail1.dev.local, ip: 192.168.10.11, DNS alias: mail.dev.local
• Mailbox type: Maildir
• Mail location: /var/mail/<user>
• Communication: Only secure, TLS/SSL

Basic Installation

Here are few simple steps to configure: Let install dovecot:

apt-get -y install dovecot-imapd

Dovecot V1.x Configuration

Ensure imaps in the following configuration (file /etc/dovecot/dovecot.conf):

protocols = imap imaps
mail_location = maildir:/var/mail/%u

Dovecot V2.0 Configuration

Setup mail location (file /etc/dovecot/conf.d/10-mail.conf)

mail_location = maildir:/var/mail/%u

SSL

1. Create SSL certificate (see here). While answering questions make sure the following (this is the name the clients will access your IMAP server):

   Common Name (eg, YOUR name) []:mail.dev.local
   

   There are two important files we created here: newreq.pem and newcert.pem. Rename those files:

   mv newreq.pem mail-key.pem
   mv newcert.pem mail-cert.pem
   

2. Copy these files:

   cp mail-cert.pem /etc/ssl/certs
   cp mail-key.pem /etc/ssl/private
   

3. Dovecot V1.x Configuration

   Let dovecot know about our certificates (file /etc/dovecot/dovecot.conf):

   ssl_cert_file = /etc/ssl/certs/mail-cert.pem
   ssl_key_file = /etc/ssl/private/mail-key.pem
   

   Dovecot V2.0 Configuration

   Let dovecot know about our certificates (file /etc/dovecot/conf.d/10-ssl.conf):

   ssl_cert = </etc/ssl/certs/mail-cert.pem
   ssl_key = </etc/ssl/private/mail-key.pem
   

4. Restart dovecot:

   /etc/init.d/dovecot restart
   

You should be able access the mail via IMAP TLS/SSL now. See here how to get rid of warning message about the SSL certificate signature by mail clients, e.g. Evolution, etc.

Troubleshooting: namespace missing

While upgrading to dovecot v2.1.7 I noticed the following error:

mail1 dovecot: imap(xxx): Error: user xxx: Initialization failed: 
namespace configuration error: inbox=yes namespace missing
mail1 dovecot: imap(xxx): Error: Invalid user settings. Refer to 
server log for more information.

You need define inbox namespace and explicitly set the `inbox` attribute (file /etc/dovecot/conf.d/10-mail.conf)

namespace inbox {
    inbox = yes
}

Restart dovecot and that fix it.

Configure exim4 internet site; mail is sent and received directly using SMTP

This option of exim4 let you configure SMTP server for your domain.

• SMTP host FQDN: mail1.dev.local, ip: 192.168.10.11
• Domain: dev.local, serves emails like user1@dev.local
• Delivery mode: Maildir
• Mail location: /var/mail/<user>

Here are few simple steps to configure:

Email Available Updates for Debian

Before you proceed below please check:

• Simple apt daily update script, see here.
• Configure exim4 to send messages by smarthost, no local mail, see here.

We are going enhance daily update script by ability to send a list of new updates to mail.

#!/bin/sh

mailto=debian-updates@dev.local

# Download only; package files are only retrieved, not 
# unpacked or installed.
apt-get -dqq update
apt-get -dyqq upgrade

has_upgrades=$(apt-get -s upgrade | grep ^Inst)
if [ "$has_upgrades" ] ; then
    echo "$has_upgrades" | mail -s \
    "Updates for $(hostname) on $(date +%Y-%m-%d)" \
    $mailto
fi

Alternatively consider using apticron, read more here.

Configure exim4 to send messages by smarthost, no local mail

This option of exim4 configuration is suitable for a client system which is not responsible for a local e-mail domain. All locally generated e-mail is sent to the smarthost.

• Smarthost FQDN: mail.dev.local
• Client: deby01.dev.local

Here are few simple steps to configure:

1. The easiest way is to reconfigure exim4-config package:

   dpkg-reconfigure exim4-config
   

2. General type of mail configuration:
      mail sent by smarthost; no local mail
   System mail name:
      deby01.dev.local
   IP-addresses to listen on for incoming SMTP connections:
      127.0.0.1
   Other destinations for which mail is accepted:
      deby01.dev.local
   Visible domain name for local users:
      deby01.dev.local
   IP address or host name of the outgoing smarthost:
      mail.dev.local
   Keep number of DNS-queries minimal (Dial-on-Demand)?
      No
   Split configuration into small files?
      No
   

Let verify it is working:

echo "test message" | mail -s "test" user1@dev.local

... exim4 log (file /var/log/exim4/mainlog):

1PmoNq-0001or-55 <= root@deby01.dev.local H=deby01.dev.local (localhost) [192.168.XX.XXX] P=esmtps X=TLS1.0:RSA_AES_256_CBC_SHA1:32 S=715 id=E1PmoNq-0001f6-08@localhost
1PmoNq-0001or-55 => user1  R=local_user T=maildir_home
1PmoNq-0001or-55 Completed

At this point user1 should be able to receive your test message.