summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2018-12-05 15:47:34 +0100
committerGuilhem Moulin <guilhem@fripost.org>2018-12-05 16:24:12 +0100
commit9722d50b9b6c5ccd81892a00bdd3023399b004fb (patch)
tree10ff7840e4c924d51217a122ac5f4a7bcb56a476
parentc21b92d9b79a80a27607618666b56fbc5cd26ac8 (diff)
DKIM: also include the "d=" tag in key filenames, not only the "s=" tag.
While the combination of "s=" tag (selector) & "d=" tag signing domain maps to a unique key, the selector alone doesn't necessarily.
-rw-r--r--certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7:fripost.org.pub (renamed from certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7.pub)0
-rw-r--r--certs/dkim/9df9cdc7e101629b5003b587945afa70:x.fripost.org.pub (renamed from certs/dkim/9df9cdc7e101629b5003b587945afa70.pub)0
-rw-r--r--certs/dkim/README7
-rw-r--r--group_vars/all.yml2
-rw-r--r--roles/amavis/tasks/main.yml10
-rw-r--r--roles/amavis/templates/etc/amavis/conf.d/50-user.j22
-rwxr-xr-xroles/common/files/usr/local/bin/genkeypair.sh16
7 files changed, 13 insertions, 24 deletions
diff --git a/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7.pub b/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7:fripost.org.pub
index ef400f4..ef400f4 100644
--- a/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7.pub
+++ b/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7:fripost.org.pub
diff --git a/certs/dkim/9df9cdc7e101629b5003b587945afa70.pub b/certs/dkim/9df9cdc7e101629b5003b587945afa70:x.fripost.org.pub
index 2574f71..2574f71 100644
--- a/certs/dkim/9df9cdc7e101629b5003b587945afa70.pub
+++ b/certs/dkim/9df9cdc7e101629b5003b587945afa70:x.fripost.org.pub
diff --git a/certs/dkim/README b/certs/dkim/README
index e5addf9..2137a8d 100644
--- a/certs/dkim/README
+++ b/certs/dkim/README
@@ -1,10 +1,11 @@
-To convert a PEM-encoded public key to a TXT record, run
+To convert the PEM-encoded public keys from this directory to TXT
+records, run
$ SELECTOR="8f00fb94ec6c37aacb48bd43e073f9b7"
$ DOMAIN="fripost.org"
- $ printf "%s._domainkey%s IN TXT (\n" "$SELECTOR" "${DOMAIN:+.$DOMAIN.}"; \
+ $ printf "%s._domainkey.%s IN TXT (\n" "$SELECTOR" "$DOMAIN"; \
{ printf "v=DKIM1; k=rsa; t=s; s=email; p=";
- sed '/^--.*--$/d' <"./certs/dkim/$SELECTOR.pub" | tr -d '\n';
+ openssl pkey -pubin -in "./certs/dkim/$SELECTOR:$DOMAIN.pub" -outform DER | base64 -w0
} | fold -w64 | sed 's/.*/ "&"/; $s/$/ )\n/'
Remove the "t=s" tag if subdomaining or third-party signature (hosted
diff --git a/group_vars/all.yml b/group_vars/all.yml
index f222b56..4fcfc39 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -53,7 +53,7 @@ dkim_keys:
"fripost.org":
# domain of the entity signing the message (should be unique accross match keys)
d: fripost.org
- # selector (should be globally unique and random)
+ # selector (randomly generated with `xxd -p -l16 </dev/urandom`)
s: 8f00fb94ec6c37aacb48bd43e073f9b7
"~": # catch-all, for our virtual domains
d: x.fripost.org
diff --git a/roles/amavis/tasks/main.yml b/roles/amavis/tasks/main.yml
index 92a0e81..3036c52 100644
--- a/roles/amavis/tasks/main.yml
+++ b/roles/amavis/tasks/main.yml
@@ -52,8 +52,8 @@
- dkim
- name: Generate a private key for DKIM signing
- command: genkeypair.sh dkim --privkey=/etc/amavis/dkim/{{ item }}.pem -t rsa -b 2048
- with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
+ command: genkeypair.sh dkim --privkey="/etc/amavis/dkim/{{ item.s }}:{{ item.d }}.pem" -t rsa -b 2048
+ with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | list }}"
register: dkim
changed_when: dkim.rc == 0
failed_when: dkim.rc > 1
@@ -66,9 +66,9 @@
- name: Fetch DKIM keys
fetch_cmd: cmd="openssl pkey -pubout -outform PEM"
- stdin=/etc/amavis/dkim/{{ item }}.pem
- dest=certs/dkim/{{ item }}.pub
- with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
+ stdin="/etc/amavis/dkim/{{ item.s }}:{{ item.d }}.pem"
+ dest="certs/dkim/{{ item.s }}:{{ item.d }}.pub"
+ with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | list }}"
tags:
- genkey
- dkim
diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
index f3ff416..a09c366 100644
--- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
+++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
@@ -33,7 +33,7 @@ $enable_dkim_signing = 1;
# Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is
# safe as we force our domain with the 'd' tag).
{% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%}
-dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}.pem');
+dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem');
{% endfor -%}
@dkim_signature_options_bysender_maps = (
{% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %}
diff --git a/roles/common/files/usr/local/bin/genkeypair.sh b/roles/common/files/usr/local/bin/genkeypair.sh
index 01b279a..ad65aef 100755
--- a/roles/common/files/usr/local/bin/genkeypair.sh
+++ b/roles/common/files/usr/local/bin/genkeypair.sh
@@ -21,6 +21,7 @@
set -ue
PATH=/usr/bin:/bin
+export PATH
# Default values
type=rsa
@@ -74,18 +75,6 @@ usage() {
EOF
}
-dkiminfo() {
- echo "Add the following TXT record to your DNS zone:"
- echo "${cn:-$(date +%Y%m%d)}._domainkey\tIN\tTXT ( "
- # See https://tools.ietf.org/html/rfc4871#section-3.6.1
- # t=s: the "i=" domain in signature headers MUST NOT be a subdomain of "d="
- # s=email: limit DKIM signing to email
- openssl pkey -pubout <"$privkey" | sed '/^--.*--$/d' \
- | { echo -n "v=DKIM1; k=$type; t=s; s=email; p="; tr -d '\n'; } \
- | fold -w 250 \
- | { sed 's/.*/\t"&"/'; echo ' )'; }
-}
-
[ $# -gt 0 ] || { usage; exit 2; }
cmd="$1"; shift
case "$cmd" in
@@ -181,12 +170,11 @@ fi
if [ -s "$privkey" -a $force -eq 0 ]; then
echo "Error: private key exists: $privkey" >&2
- [ "$cmd" = dkim ] && dkiminfo
exit 1
elif [ ! -s "$privkey" -o $force -ge 2 ]; then
install --mode="${mode:-0600}" ${owner:+--owner="$owner"} ${group:+--group="$group"} /dev/null "$privkey" || exit 2
openssl $genkey -rand /dev/urandom $genkeyargs >"$privkey" || exit 2
- [ "$cmd" = dkim ] && { dkiminfo; exit; }
+ [ "$cmd" = dkim ] && exit
fi
if [ "$cmd" = x509 -a "$pubkey" = "$privkey" ]; then