From 9722d50b9b6c5ccd81892a00bdd3023399b004fb Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 5 Dec 2018 15:47:34 +0100 Subject: DKIM: also include the "d=" tag in key filenames, not only the "s=" tag. While the combination of "s=" tag (selector) & "d=" tag signing domain maps to a unique key, the selector alone doesn't necessarily. --- certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7.pub | 9 --------- .../8f00fb94ec6c37aacb48bd43e073f9b7:fripost.org.pub | 9 +++++++++ certs/dkim/9df9cdc7e101629b5003b587945afa70.pub | 9 --------- .../9df9cdc7e101629b5003b587945afa70:x.fripost.org.pub | 9 +++++++++ certs/dkim/README | 7 ++++--- group_vars/all.yml | 2 +- roles/amavis/tasks/main.yml | 10 +++++----- roles/amavis/templates/etc/amavis/conf.d/50-user.j2 | 2 +- roles/common/files/usr/local/bin/genkeypair.sh | 16 ++-------------- 9 files changed, 31 insertions(+), 42 deletions(-) delete mode 100644 certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7.pub create mode 100644 certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7:fripost.org.pub delete mode 100644 certs/dkim/9df9cdc7e101629b5003b587945afa70.pub create mode 100644 certs/dkim/9df9cdc7e101629b5003b587945afa70:x.fripost.org.pub diff --git a/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7.pub b/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7.pub deleted file mode 100644 index ef400f4..0000000 --- a/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7.pub +++ /dev/null @@ -1,9 +0,0 @@ ------BEGIN PUBLIC KEY----- -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApmCWIVZt+L/bJ5+abvdm -Fm6Er/9g6e4WX2HKyeIfC5eDaPbUyHqHSY7xzWNiU+cbBvny8BASkdWsclLdoiuM -J6Yes5VSzkH6j2gp9Uuy7d6p61Jbrizi7/CQzCZfhi5uGKiGtV2g+V/sIuXekm9Q -+Q2eqjj/6hUHGDPTTKEFlgruyaS6y+Kes+sJYjMG62lbTOKL5TjY6z0Gr2AMfglB -Uj9QWD5jm+bH0clE1HZq51mxXQbV2v/7JEHjznR0nSB+jY2EV7g/MXM8DwJCDH4Z -cknoH0NrcJRjuRt8ndufnx4Qh0t7qqWwmGF0jZOcZxHeODfkUlLxQ4SCMVeqV/SS -TwIDAQAB ------END PUBLIC KEY----- diff --git a/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7:fripost.org.pub b/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7:fripost.org.pub new file mode 100644 index 0000000..ef400f4 --- /dev/null +++ b/certs/dkim/8f00fb94ec6c37aacb48bd43e073f9b7:fripost.org.pub @@ -0,0 +1,9 @@ +-----BEGIN PUBLIC KEY----- +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApmCWIVZt+L/bJ5+abvdm +Fm6Er/9g6e4WX2HKyeIfC5eDaPbUyHqHSY7xzWNiU+cbBvny8BASkdWsclLdoiuM +J6Yes5VSzkH6j2gp9Uuy7d6p61Jbrizi7/CQzCZfhi5uGKiGtV2g+V/sIuXekm9Q ++Q2eqjj/6hUHGDPTTKEFlgruyaS6y+Kes+sJYjMG62lbTOKL5TjY6z0Gr2AMfglB +Uj9QWD5jm+bH0clE1HZq51mxXQbV2v/7JEHjznR0nSB+jY2EV7g/MXM8DwJCDH4Z +cknoH0NrcJRjuRt8ndufnx4Qh0t7qqWwmGF0jZOcZxHeODfkUlLxQ4SCMVeqV/SS +TwIDAQAB +-----END PUBLIC KEY----- diff --git a/certs/dkim/9df9cdc7e101629b5003b587945afa70.pub b/certs/dkim/9df9cdc7e101629b5003b587945afa70.pub deleted file mode 100644 index 2574f71..0000000 --- a/certs/dkim/9df9cdc7e101629b5003b587945afa70.pub +++ /dev/null @@ -1,9 +0,0 @@ ------BEGIN PUBLIC KEY----- -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyN6rMmDzZ0MtN6e+T3lS -wny1qs0djjXJMJi5gfCXl9ZW4v5LT098EtpEQsDfY8NY3PvuBTD74Xsvy9jRh71/ -q0iZHHwOffQlP8BVi2uelO9brVBr9nHWvycbEp/PXMVPOSBRuXyrvIYPnWjmaPZc -xT4L3OB5BtZPsGElxAzZMbTDzRr8K0yIY/HtVTXD5JJsKb3GIXiyHY7GCvV6tKeP -eI2L0vJOJ2LLHHX962ykWHAfS12izkfBxGkMVn4AQZIPQ4iGwAPZ9z5DIsz11Riw -+3ysWWdmz2yV8HtoDKfOB4/vyFyWFlyaMkdvblDjgQv0m6bHwvXlxAGSWcZirmEM -pQIDAQAB ------END PUBLIC KEY----- diff --git a/certs/dkim/9df9cdc7e101629b5003b587945afa70:x.fripost.org.pub b/certs/dkim/9df9cdc7e101629b5003b587945afa70:x.fripost.org.pub new file mode 100644 index 0000000..2574f71 --- /dev/null +++ b/certs/dkim/9df9cdc7e101629b5003b587945afa70:x.fripost.org.pub @@ -0,0 +1,9 @@ +-----BEGIN PUBLIC KEY----- +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyN6rMmDzZ0MtN6e+T3lS +wny1qs0djjXJMJi5gfCXl9ZW4v5LT098EtpEQsDfY8NY3PvuBTD74Xsvy9jRh71/ +q0iZHHwOffQlP8BVi2uelO9brVBr9nHWvycbEp/PXMVPOSBRuXyrvIYPnWjmaPZc +xT4L3OB5BtZPsGElxAzZMbTDzRr8K0yIY/HtVTXD5JJsKb3GIXiyHY7GCvV6tKeP +eI2L0vJOJ2LLHHX962ykWHAfS12izkfBxGkMVn4AQZIPQ4iGwAPZ9z5DIsz11Riw ++3ysWWdmz2yV8HtoDKfOB4/vyFyWFlyaMkdvblDjgQv0m6bHwvXlxAGSWcZirmEM +pQIDAQAB +-----END PUBLIC KEY----- diff --git a/certs/dkim/README b/certs/dkim/README index e5addf9..2137a8d 100644 --- a/certs/dkim/README +++ b/certs/dkim/README @@ -1,10 +1,11 @@ -To convert a PEM-encoded public key to a TXT record, run +To convert the PEM-encoded public keys from this directory to TXT +records, run $ SELECTOR="8f00fb94ec6c37aacb48bd43e073f9b7" $ DOMAIN="fripost.org" - $ printf "%s._domainkey%s IN TXT (\n" "$SELECTOR" "${DOMAIN:+.$DOMAIN.}"; \ + $ printf "%s._domainkey.%s IN TXT (\n" "$SELECTOR" "$DOMAIN"; \ { printf "v=DKIM1; k=rsa; t=s; s=email; p="; - sed '/^--.*--$/d' <"./certs/dkim/$SELECTOR.pub" | tr -d '\n'; + openssl pkey -pubin -in "./certs/dkim/$SELECTOR:$DOMAIN.pub" -outform DER | base64 -w0 } | fold -w64 | sed 's/.*/ "&"/; $s/$/ )\n/' Remove the "t=s" tag if subdomaining or third-party signature (hosted diff --git a/group_vars/all.yml b/group_vars/all.yml index f222b56..4fcfc39 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml @@ -53,7 +53,7 @@ dkim_keys: "fripost.org": # domain of the entity signing the message (should be unique accross match keys) d: fripost.org - # selector (should be globally unique and random) + # selector (randomly generated with `xxd -p -l16 1 @@ -66,9 +66,9 @@ - name: Fetch DKIM keys fetch_cmd: cmd="openssl pkey -pubout -outform PEM" - stdin=/etc/amavis/dkim/{{ item }}.pem - dest=certs/dkim/{{ item }}.pub - with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}" + stdin="/etc/amavis/dkim/{{ item.s }}:{{ item.d }}.pem" + dest="certs/dkim/{{ item.s }}:{{ item.d }}.pub" + with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | list }}" tags: - genkey - dkim diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 index f3ff416..a09c366 100644 --- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 +++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 @@ -33,7 +33,7 @@ $enable_dkim_signing = 1; # Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is # safe as we force our domain with the 'd' tag). {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%} -dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}.pem'); +dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem'); {% endfor -%} @dkim_signature_options_bysender_maps = ( {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %} diff --git a/roles/common/files/usr/local/bin/genkeypair.sh b/roles/common/files/usr/local/bin/genkeypair.sh index 01b279a..ad65aef 100755 --- a/roles/common/files/usr/local/bin/genkeypair.sh +++ b/roles/common/files/usr/local/bin/genkeypair.sh @@ -21,6 +21,7 @@ set -ue PATH=/usr/bin:/bin +export PATH # Default values type=rsa @@ -74,18 +75,6 @@ usage() { EOF } -dkiminfo() { - echo "Add the following TXT record to your DNS zone:" - echo "${cn:-$(date +%Y%m%d)}._domainkey\tIN\tTXT ( " - # See https://tools.ietf.org/html/rfc4871#section-3.6.1 - # t=s: the "i=" domain in signature headers MUST NOT be a subdomain of "d=" - # s=email: limit DKIM signing to email - openssl pkey -pubout <"$privkey" | sed '/^--.*--$/d' \ - | { echo -n "v=DKIM1; k=$type; t=s; s=email; p="; tr -d '\n'; } \ - | fold -w 250 \ - | { sed 's/.*/\t"&"/'; echo ' )'; } -} - [ $# -gt 0 ] || { usage; exit 2; } cmd="$1"; shift case "$cmd" in @@ -181,12 +170,11 @@ fi if [ -s "$privkey" -a $force -eq 0 ]; then echo "Error: private key exists: $privkey" >&2 - [ "$cmd" = dkim ] && dkiminfo exit 1 elif [ ! -s "$privkey" -o $force -ge 2 ]; then install --mode="${mode:-0600}" ${owner:+--owner="$owner"} ${group:+--group="$group"} /dev/null "$privkey" || exit 2 openssl $genkey -rand /dev/urandom $genkeyargs >"$privkey" || exit 2 - [ "$cmd" = dkim ] && { dkiminfo; exit; } + [ "$cmd" = dkim ] && exit fi if [ "$cmd" = x509 -a "$pubkey" = "$privkey" ]; then -- cgit v1.2.3