RedHat/CentOS

The .deb packages have been tested on RedHat 7 and CentOS 7.

Note

All commands should be executed as the root user.

SELinux

By default SELinux is enabled on RedHat/CentOS. SELinux prevents certain operations to be executed which are required by CipherMail. For example, a local listening port on port 10026 must be opened by Postfix (this port is used by CipherMail as the Postfix “reinjection” port). SELinux however, by default, does not allow this. Disabling SELinux is recommended if you are not familiar with SELinux.

SELinux can be disabled by editing the file /etc/sysconfig/selinux.

Set SELINUX=disabled and reboot the server.

Configure firewall

RedHat and CentOS by default blocks access to most ports. The firewall should therefore be configured to allow access to the ports used by CipherMail.

The following ports should be remotely accessible: SMTP (25) and 8443 1

1

see Port usage for a list of all used ports.

firewall-cmd --zone=public --add-port=25/tcp --permanent
firewall-cmd --zone=public --add-port=8443/tcp --permanent
firewall-cmd --reload

Tip

If the web GUI should be accessible on the standard https port (443) instead of 8443, add the following additional firewall rules

firewall-cmd --zone=public --add-forward-port=port=443:proto=tcp:toport=8443 --permanent
firewall-cmd --reload

This will redirect all requests for port 443 to port 8443.

Note

This guide assumes that CipherMail will be configured for PostgreSQL. If MySQL/MariaDB or Oracle Database should be used, all PostgreSQL related steps should be skipped.

Install PostgreSQL

yum install postgresql-server

PostgreSQL should be initialized and restarted.

postgresql-setup initdb
systemctl restart postgresql.service

Install required packages

Certain packages need to be installed before installing CipherMail.

yum install redhat-lsb sudo postfix ant mktemp symlinks \
java-1.8.0-openjdk-headless java-1.8.0-openjdk java-1.8.0-openjdk-devel

The CipherMail RPM packages are signed with a PGP key. To validate the signature of the packages, the PGP key https://www.ciphermail.com/downloads/ciphermail-signing-key.asc should be imported into RPM.

rpm --import https://www.ciphermail.com/downloads/ciphermail-signing-key.asc

The signature of the rpm packages can be validated using the following command:

rpm -K <file>

Install CipherMail packages

A full installation of CipherMail requires the CipherMail encryption back-end and the Web GUI front-end.

The following three files are required:

  • djigzo-*.noarch.rpm

  • djigzo-postgres-*.noarch.rpm

  • djigzo-web-*.noarch.rpm

Install back-end packages

yum install djigzo-[0-9]*[0-9].noarch.rpm
yum install djigzo-postgres-[0-9]*[0-9].noarch.rpm

Install Web-GUI package

yum install djigzo-web-[0-9]*[0-9].noarch.rpm

Configure Postfix

Email is first received by Postfix (MTA). Postfix then sends the email to the encryption back-end using an after queue filter. This requires some changes to the Postfix configuration files. CipherMail installs a pre-configured Postfix main and master configuration file which should be copied to the postfix configuration directory.

Warning

The following commands will overwrite all settings in the original postfix config files. If existing Postfix settings should be kept, the required changes to Postfix should be manually applied.

Copy postfix configuration files.

sudo cp /etc/postfix/djigzo-main.cf /etc/postfix/main.cf
sudo cp /etc/postfix/djigzo-master.cf /etc/postfix/master.cf

Update aliases.

Postfix uses /etc/alias as the alias file. Make sure that the alias file is available and up-to-date.

newaliases

Restart Postfix.

systemctl restart postfix.service

The mail logs should be readable by user “djigzo”. We will therefore add a special maillog group.

Note

This can be skipped if you do not want the MTA log to be shown on the MTA page.

groupadd maillog
usermod -a -G maillog djigzo
chown root:maillog /var/log/maillog
chmod g+r /var/log/maillog

Configure logrotate

By default mail logs are rotated with the date appended to the filename. CipherMail however expects the rotated log files to be appended with an increasing number.

A separate rotate rule for maillog should be added by modifying the defalut syslog config.

Note

This can be skipped if you do not want the MTA log to be shown on the MTA page.

vi /etc/logrotate.d/syslog

Remove the existing /var/log/maillog entry and then add the following entry:

/var/log/maillog
{
    nodateext
    compress
    create 640 root maillog
    delaycompress
    sharedscripts
    postrotate
      /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

Install Tomcat

Install the required Tomcat package:

yum install tomcat

Red Hat/CentOS by default installs an older version of Javamail. The newer version of Javamail provided by CipherMail should be added as a new alternative with a higher priority.

alternatives --install /usr/share/java/javamail.jar javamail \
/usr/share/djigzo/lib/mail.jar 20000

The system property djigzo-web.home should reference the location where CipherMail Web GUI is installed. The property will be added to the Tomcat default configuration file. To support importing files containing large number of certificates or keys, Tomcat should be configured with at least 128 MB heap size.

echo "JAVA_OPTS=\"-Ddjigzo-web.home=/usr/share/djigzo-web \
-Ddjigzo.home=/usr/share/djigzo \
-Djava.awt.headless=true -Xmx128M\"" >> /etc/sysconfig/tomcat

To support uploading new TLS certificates for the Web GUI, Tomcat should be allowed to read and write the PKCS#12 file containing the TLS certificate and key.

chown tomcat:djigzo /usr/share/djigzo-web/ssl/sslCertificate.p12

An HTTPS connector should be added to the Tomcat server configuration. If Tomcat is only used by CipherMail, it’s advised to replace the existing Tomcat configuration file (/etc/tomcat/server.xml) with the configuration file provided by CipherMail.

Note

If you want to keep the existing server.xml file, you need to manually add the HTTPS Connector.

cp /usr/share/djigzo-web/conf/tomcat/server.xml /etc/tomcat/

A context should be added to Tomcat to enable the Web admin application.

echo "<Context docBase=\"/usr/share/djigzo-web/djigzo.war\" />" | \
sudo tee /etc/tomcat/Catalina/localhost/ciphermail.xml

If the portal functionality is required, a dedicated portal context should be added to Tomcat.

echo "<Context docBase=\"/usr/share/djigzo-web/djigzo-portal.war\" />" | \
sudo tee /etc/tomcat/Catalina/localhost/web.xml

Tomcat should automatically start at boot:

systemctl enable tomcat.service

Finish

Restart the back-end and front-end services:

systemctl restart djigzo.service
systemctl restart tomcat.service

CipherMail should now be running (wait some time for Tomcat to startup). The login page can be accessed using the following URL:

https://192.168.178.2:8443/ciphermail 2

2

If redirection from 8443 to 443 is enabled or Apache or NGINX is used as a front-end proxy use the standard HTTPS port 443.

Change the IP address to the correct address.

Note

CipherMail comes with a pre-installed TLS certificate which is not by default trusted by your browser. You should therefore manually accept the TLS certificate the first time the page is opened.

Use the following login credentials:

username:

admin

password:

admin

If CipherMail is not running, check the following log files for errors:

CipherMail log:

less /var/log/djigzo.log

Tomcat log:

journalctl -u tomcat.service

Note

The login procedure can take some time after a restart because the Web GUI does some internal initialization after a restart.