Axigen Mailserver

A. Create the certificate PEM file – let’s call it my_domain.pem

Axigen uses a .pem file to store both unecrypted private key and the SSL certificate that might be provided to you in a .crt file.
Please note that the private key file should be available as it was generated and used when you have requested the SSL certificate. If you did not saved it (or have lost it afterwards) your SSL certificate became useless as the private key could not be regenerated.

Private key – let’s say you have save it in my_domain.key and it should contain several text lines like:

Code:

Note: The unencrypted private key could be extract from an encrypted one by using the following command:

Code:

openssl rsa -in my_domain.key.encrypted -out my_domain.key

If the encrypted key is protected by a pass phrase, enter the it when prompted otherwise the decrypt process (as expected) will fail

Cetificate – let’s say you have save it in my_domain.crt and it should contain several text lines like:

Code:

Now you can prepare your my_domain.pem like:

Code:

cat my_domain.key my_domain.crt > ${AXIGEN_WORK_DIR}/my_domain.pem

B. (Optional) create the CA (Certificate Authority) CERT file – let’s call it my_CA.pem
This file should contain all CA certificates (root and intermediate ones) you have received from the certificate issuer

This should be as simple as:

Code:

cat CA_root.crt CA_intermediate1.crt CA_intermediate2.crt > ${AXIGEN_WORK_DIR}/my_CA.pem

C. Axigen Configuration
Assuming that you have saved the mandatory my_domain.pem and the optional my_CA.pem files in the Axigen working directory (and the files could be read by the user used to ran Axigen process), you could now continue to configure the SSL listener(s) with your new certificate:

Connect to WebAdmin and go to Service > Listener > SSL

Certificate file: my_domain.pem
(optional) Certificate authorities file: my_CA.pem
Save configuration

Note: If you like to use the self signed certificate generated by Axigen (at the installation time) you should use axigen_cert.pem file, that it is also stored in the Axigen working directory.

After you finished certificate configuration you could locally test your SSL listener like:

Code:

openssl s_client -connect <listener_ip>:<listener_port>

Source

#!/bin/bash # $1 - log file to be used LOG_AXI="/var/opt/axigen/log/everything.txt" if [ -z "$1" ] then LOG_SEC=/var/opt/axigen/log/secure.txt else LOG_SEC="$1" fi tail --retry --follow=name "$LOG_AXI" | while read l do timestamp=$(date '+%d-%m-%Y %T') case "$l" in *"Authentication error"*|*"could not authenticate user"*|*"error authenticating user"*) sid=$(echo "$l" | awk '{print $6}') if [ -n "$sid" ] then con_ip=$(grep -m 1 $sid "$LOG_AXI" | awk '{print $NF}' | sed 's/\[//g;s/:.*$//g') if [ -n "$con_ip" ] then echo "$timestamp $l from $con_ip" >> "$LOG_SEC" fi fi ;; esac done

Kategori: Axigen Mailserver

Create the certificate PEM file to Axigen Mailserver

Secure AXIGEN against brute-force with Fail2Ban [Linux]