Red Hat Enterprise Linux 5 Administration Unleashed

372CHAPTER 18Setting Up an Email Server with SendmailSendmail can only deliver email to a user’s mail spool in /var/spool/mail/ if the userexists on the system. For each email account, create a user account or configure networkauthentication such as NIS for the system. The directories that contain email such as/var/spool/mail/ and, by default, the Mail/ directory in each user’s home directory ifyou are using IMAP should not be located on an NFS share because the user or group IDof the files can be duplicated on a system mounting the share, granting anyone access tothe email files. Also, it is good practice to only allow the root user to log in to the emailserver for better security. Users should retrieve their email from an email client runningon another system and should have no need to log in to the email server directly.Using SSL EncryptionSendmail can be configured to encrypt email sent and received using SSL (secure socketslayer). First, generate an SSL certificate. You can either create a self-signed certificate orpurchase one from verisign.com or other similar third-party companies.To generate a self-signed certificate, open a terminal and use the su - command tochange to the root user if you are logged in as a non-root user. Change into the/etc/pki/tls/certs/ directory, and execute the make sendmail.pem command. You willbe prompted for information such as the location of the company, company name, andemail address. Listing 18.1 shows this process with the example data provided in bold.LISTING 18.1Generating a Self-Signed SSL Certificateumask 77 ; \PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \/usr/bin/openssl req -utf8 -newkey rsa:1024 -keyout $PEM1 -nodes \-x509 -days 365 -out $PEM2 -set_serial 0 ; \cat $PEM1 > sendmail.pem ; \echo “” >> sendmail.pem ; \cat $PEM2 >> sendmail.pem ; \rm -f $PEM1 $PEM2Generating a 1024 bit RSA private key.......++++++........................++++++writing new private key to ‘/tmp/openssl.y25478’-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter ‘.’, the field will be left blank.-----Country Name (2 letter code) [GB]:USState or Province Name (full name) [Berkshire]:North Carolina