Transport Layer Security

TLS Encryption

Mengamankan jalur komunikasi email dengan enkripsi SSL/TLS agar kredensial dan data tidak dapat disadap.

1

Persiapan Sertifikat

Pastikan sertifikat snakeoil bawaan Ubuntu tersedia:

Cek Sertifikat
ls /etc/ssl/certs/ssl-cert-snakeoil.pem
ls /etc/ssl/private/ssl-cert-snakeoil.key
2

Konfigurasi TLS Postfix

A. Wajibkan TLS di master.cf:

sudo nano /etc/postfix/master.cf
submission inet n - y - - smtpd
  -o syslog_name=postfix/submission
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_auth_only=yes
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

B. Set Path di main.cf:

sudo nano /etc/postfix/main.cf
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level = may
3

Konfigurasi TLS Dovecot

A. Aktifkan IMAPS (Port 993):

sudo nano /etc/dovecot/conf.d/10-master.conf
service imap-login {
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}

B. Set Sertifikat (Gunakan tanda <):

sudo nano /etc/dovecot/conf.d/10-ssl.conf
ssl = yes
ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem
ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key
4

Uji Koneksi TLS Manual

Uji SMTP Submission (587):

Terminal
openssl s_client -starttls smtp -connect localhost:587

# Jika sukses, ketik di prompt:
ehlo test
auth login
# Masukkan Base64 User & Pass
# Hasil: 235 2.7.0 Authentication successful

Uji IMAPS (993):

Terminal
openssl s_client -connect localhost:993

# Hasil: Harus muncul banner Dovecot ready.
5

Update Konfigurasi Roundcube

config.inc.php
$config['smtp_host'] = 'tls://mail.nain.local:587';
$config['smtp_auth_type'] = 'LOGIN';
$config['smtp_conn_options'] = [
    'tls' => [
        'verify_peer' => false,
        'verify_peer_name' => false,
        'allow_self_signed' => true,
    ],
];

Status: Enkripsi Aktif

Tanpa TLS, autentikasi sekarang akan ditolak secara otomatis.