Home / user-267552

cs378's questions

Martin Hope
cs378
Asked: 2017-02-03 14:51:46 +0800 CST
  • 10

I need help setting up the CertBot for LetsEncrypt

I am running on CentOS 7 with Python 2.7

When I run certbot I get the following error:

[root@li86-193 frappe-bench]#certbot certonly --manual

Traceback (most recent call last):
  File "/usr/bin/certbot", line 7, in <module>
    from certbot.main import main
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 21, in <module>
    from certbot import client
  File "/usr/lib/python2.7/site-packages/certbot/client.py", line 10, in <module>
    from acme import client as acme_client
  File "/usr/lib/python2.7/site-packages/acme/client.py", line 31, in <module>
    requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()
  File "/usr/lib/python2.7/site-packages/requests/packages/urllib3/contrib/pyopenssl.py", line 112, in inject_into_urllib3
    _validate_dependencies_met()
  File "/usr/lib/python2.7/site-packages/requests/packages/urllib3/contrib/pyopenssl.py", line 147, in _validate_dependencies_met
    raise ImportError("'pyOpenSSL' module missing required functionality. "
ImportError: 'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.

[root@li86-193 frappe-bench]# pip show certbot
Name: certbot
Version: 0.11.1
Summary: ACME client
Home-page: https://github.com/letsencrypt/letsencrypt
Author: Certbot Project
Author-email: [email protected]
License: Apache License 2.0
Location: /usr/lib/python2.7/site-packages
Requires: ConfigArgParse, configobj, zope.component, pytz, setuptools, cryptography, zope.interface, pyrfc3339, mock, parsedatetime, six, acme, PyOpenSSL

[root@li86-193 frappe-bench]# pip show pyopenssl
Name: pyOpenSSL
Version: 16.2.0
Summary: Python wrapper module around the OpenSSL library
Home-page: https://pyopenssl.readthedocs.io/
Author: Hynek Schlawack
Author-email: [email protected]
License: Apache License, Version 2.0
Location: /usr/lib/python2.7/site-packages
Requires: six, cryptography

Please help out

Thank you

centos7 certbot
Martin Hope
cs378
Asked: 2016-02-20 11:07:37 +0800 CST
  • 1

I am having a lot of trouble setting up the Postfix to do STARTTLS. It seems that I could successfully send outgoing mail using Thunderbird. However, I can't seem to get the Postman SMTP for Wordpress to work with STARTTLS and PLAIN AUTH.

I configured my firewall to only open port 25:

    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request state NEW,RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:memcache
REJECT     tcp  --  anywhere             anywhere             tcp dpts:netbios-ns:netbios-ssn reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere             udp dpts:netbios-ns:netbios-ssn reject-with icmp-port-unreachable
LOG        all  --  anywhere             anywhere             LOG level warning
DROP       all  --  anywhere             anywhere

main.cf:

    #http://www.postfix.org/TLS_README.html#server_tls
myhostname = host.com
myorigin = /home/mail
mydomain = host..com
mydestination = $myhostname, localhost, localhost.$mydomain, localhost.localdomain
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
alias_maps = hash:/home/etc/postfix/aliases
alias_database = hash:/home/etc/postfix/aliases
smtpd_use_tls=yes
smtp_use_tls=yes
smtpd_tls_received_header = yes
smtpd_tls_auth_only = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_tls_cert_file=/home/keys/postfix/certs/certificate-self.crt
smtpd_tls_key_file=/home/keys/postfix/private/private-key.key
smtpd_tls_CAfile = /home/keys/postfix/certs/cacert.pem
smtpd_tls_security_level=may
smtp_tls_security_level=may
smtpd_tls_protocols = !SSLv2, !SSLv3, TLSv1
smtpd_tls_exclude_ciphers = aNULL, LOW, EXP, MEDIUM, ADH, AECDH, MD5, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, eNULL
smtpd_tls_loglevel = 4
tls_preempt_cipherlist      = yes
smtpd_tls_mandatory_ciphers = high
smtpd_tls_ciphers           = high
smtp_tls_mandatory_ciphers  = $smtpd_tls_mandatory_ciphers
smtp_tls_ciphers            = $smtpd_tls_ciphers
lmtp_tls_mandatory_ciphers  = $smtpd_tls_mandatory_ciphers
lmtp_tls_ciphers            = $smtpd_tls_ciphers
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject
smtpd_sasl_security_options = noanonymous
milter_protocol = 2
milter_default_action = accept
smtpd_milters = inet:localhost:12301
non_smtpd_milters = inet:localhost:12301

master.cf:

smtp      inet  n       -       n       -       -       smtpd -v
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_wrappermode=no
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth

dovecot.conf:

disable_plaintext_auth = no
mail_privileged_group = mail
mail_location = maildir:/home/mail
userdb {
  driver = passwd
}

passdb {
  driver = pam
}

protocols = imap

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
        user=postfix
        group=postfix
  }
 }
ssl=required
ssl_cert = </home/keys/postfix/certs/certificate-self.crt
ssl_key = </home/keys/postfix/private/private-key.key

maillog:

host..com[74.2.3.193]: 220 2.0.0 Ready to start TLS
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: setting up TLS connection from host..com[74.2.3.193]
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: host..com[74.2.3.193]: TLS cipher list "aNULL:-aNULL:ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH:!aNULL:!LOW:!EXP:!MEDIUM:!ADH:!AECDH:!MD5:!DSS:!ECDSA:!CAMELLIA128:!3DES:!CAMELLIA256:!RSA+AES:!eNULL"
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: send attr request = seed
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: send attr size = 32
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: private/tlsmgr: wanted attribute: status
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: input attribute name: status
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: input attribute value: 0
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: private/tlsmgr: wanted attribute: seed
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: input attribute name: seed
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: input attribute value: dgCi5kk5Jn2+7TS3B8+s9oB3mfQL426CwogdB8AWoxE=
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: private/tlsmgr: wanted attribute: (list terminator)
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: input attribute name: (end)
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: SSL_accept:before/accept initialization
Feb 19 13:44:58 li86-193 postfix/smtpd[16864]: read from 56442DA22B30 [56442DA28110] (11 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Feb 19 13:45:01 li86-193 postfix/smtpd[16864]: read from 56442DA22B30 [56442DA28110] (11 bytes => 11 (0xB))
Feb 19 13:45:01 li86-193 postfix/smtpd[16864]: 0000 65 68 6c 6f 20 6c 6f 63|61 6c 68                 ehlo loc alh
Feb 19 13:45:01 li86-193 postfix/smtpd[16864]: SSL_accept:error in SSLv2/v3 read client hello A
Feb 19 13:45:01 li86-193 postfix/smtpd[16864]: SSL_accept error from host..com[74.2.3.193]: -1
Feb 19 13:45:01 li86-193 postfix/smtpd[16864]: warning: TLS library problem: 16864:error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:647:

telnet host.com 25:

ehlo localhost
250-host.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
starttls
220 2.0.0 Ready to start TLS
ehlo localhost
Connection closed by foreign host.

I could openssl to port 25 with -starttls fine.

I have been reading and reading and its not going anywhere. Please help me find my error. Your help is greatly appreciated.

postfix
Martin Hope
cs378
Asked: 2015-01-29 16:03:49 +0800 CST
  • 0

I am setting up a shopping cart website however I am having issues with sharing PHP Sessions between HTTPS and HTTP.

My secure address: https://secure.domain.com My regular address: http://domain.com

I had read some pages here on serverfault and concluded a solution myself. I would like to know if my solution is secure and practical.

My solution: 1: On new session, save PHP Session ID, User IP, and ID (randomly generated 6 digit number and saved to clients computer as cookie) to database 2. When client goes into HTTPS page. The page checks the database for matching ID and IP address for the PHP Session ID.

If you have a better solution, please share

thank you

php