Hi Group, I would like to share the knowledge of implementing domainkeys: The Basic things required is : Sendmail 8.13 or above dk-filter-0.3.0 SASL packages openSSL packages First of all you untar the sendmail source and add the following line (if they are not already there) at the end of the file site.config.m4 in the path sendmail-8.13.4/devtools/Site/site.config.m4: APPENDDEF(`confENVDEF',`-DSTARTTLS') APPENDDEF(`confLIBS', `-lssl -lcrypto') APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib -R/usr/local/ssl/lib') APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include') APPENDDEF(`conf_sendmail_ENVDEF', `-DMILTER') Enter the directory sendmail-8.13.4/libmilter/ and run #./Build #./Build install to install the libmilter.a library required for mail filters options in sendmail. Now compile the sendmail source by entering into the root source directory # cd sendmail-8.13.4/ # ./Build #./Build install this will compile and install the sendmail source in the server. configure the sendmail with the following option in the sendmail.mc<http://sendmail.mc/>file: INPUT_MAIL_FILTER(`dk-filter', `S=inet:2500@localhost') here dk-filter stands for Domain Key filter and 2500 is the port in which the dk-filter daemon will listen. # m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf Now you need to compile dk-milter-0.3.0.tar.gz source. Untar the source and add the following line (if they are not already there) at the end of the file site.config.m4 in the path dk-milter-0.3.0/devtools/Site/site.config.m4: APPENDDEF(`confENVDEF',`-DSTARTTLS') APPENDDEF(`confLIBS', `-lssl -lcrypto') APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib -R/usr/local/ssl/lib') APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include') APPENDDEF(`conf_sendmail_ENVDEF', `-DMILTER') Edit the file dk-milter-0.3.0/dk-filter/Makefile.m4 to contain these options: ################################################################## include(confBUILDTOOLSDIR`/M4/switch.m4') define(`confMT', `TRUE') define(`confREQUIRE_LIBSM', `true') APPENDDEF(`confLIBS', `-lssl -lcrypto') dnl Enable and edit these paths as needed: APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include ') APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib ') dnl To use the asynchronous resolver library provided, enable this line: dnl bldPUSH_SMLIB(`ar') bldPUSH_SMLIB(`dk') APPENDDEF(`confINCDIRS', `-I../libdk/ ') bldPUSH_SMLIB(`sm') dnl Enable these next line if needed to specify the locations of libmilter.a dnl and the libmilter include files: APPENDDEF(`confINCDIRS', `-I/usr/local/sendmail/include') APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libmilter') APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsm') APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsmdb') APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsmutil') dnl Enable for IPv6 support: dnl APPENDDEF(`confENVDEF', `-DNETINET6 ') dnl Compile time options, especially FFRs: dnl APPENDDEF(`confENVDEF', `-D_FFR_EXTERNAL_IGNORE_LIST ') dnl APPENDDEF(`confENVDEF', `-D_FFR_FLUSH_HEADERS ') dnl APPENDDEF(`confENVDEF', `-D_FFR_MACRO_LIST ') APPENDDEF(`confENVDEF', `-D_FFR_MULTIPLE_KEYS ') dnl APPENDDEF(`confENVDEF', `-D_FFR_REPORTINFO ') dnl APPENDDEF(`confENVDEF', `-D_FFR_REQUIRED_HEADERS ') dnl APPENDDEF(`confENVDEF', `-D_FFR_SELECT_CANONICALIZATION ') dnl If you do POP before SMTP: dnl APPENDDEF(`confENVDEF', `-DPOPAUTH ') dnl APPENDDEF(`confINCDIRS', `-I/usr/local/BerkeleyDB/include') dnl APPENDDEF(`confLIBDIRS', `-L/usr/local/BerkeleyDB/lib') dnl PREPENDDEF(`confLIBS', `-ldb ') bldPRODUCT_START(`executable', `dk-filter') define(`bldSOURCES', `dk-filter.c util.c ') PREPENDDEF(`confLIBS', `-lmilter ') bldPRODUCT_END bldPRODUCT_START(`manpage', `dk-filter') define(`bldSOURCES', `dk-filter.8') bldPRODUCT_END bldFINISH ####################################################### now build the source by command # ./Build #./Build install Generate a public/private key pair for your domain using the command: #openssl genrsa -out rsa.private 768 #openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM Move you private key to /usr/share/ssl/private/ with file name * example.com_key.pem* . Publish you public key in the DNS server for domain example.com<http://example.com/>as a TXT record: mail._domainkey.example.com. 1D IN TXT "g=; k=rsa; t=y; p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAJUf/A69N7tYPcoursysqYFzBl3+yzCCUsNQAY6TIcD02OEix1xETOOubJ1Z5i7UrR3E36aEeeHA9tdDu1P+xvQ6PoQEXeevGWfs61j4lVRQErx4Km+KKcqja6nSgZbflQIDAQAB" Notice the double quotes that start from *"g=;* and end upto the end of key i.e. upto *QAB"* Replace example.com <http://example.com/> by your domain name for which you want to implement domainkey. *mail* in the DNS record *mail*._domainkey.example.com. is selector to select the key. You can place multiple keys in the form of text record and a selector asociated with each key. While starting the DomainKey Daemon you need to specify which selector to use while signing the mail for example.com<http://example.com/> . Now restart your DNS service create a user for Domain Key filter and start dk-filter daemon by the following command : dk-filter -l -p inet:2500@localhost -c nofws -d example.com<http://example.com/>-D -H -s /usr/share/ssl/private/example.com_key.pem -S mail -u dkuser -m MTA Send mail to any Yahoo! ID and check to see whether the authentication-results header shows result as pass or fail. Thanks, Opesh Alkara -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subjecthttps://www.redhat.com/mailman/listinfo/redhat-list
