Week 07 - TLS¶

Topic¶

Securing web and email services with TLS certificates. Obtaining certificates from a private Certificate Authority (HashiCorp Vault), enabling HTTPS on all Apache virtual hosts, configuring TLS for Postfix (SMTPS), and enabling IMAPS in Dovecot.

Company Requests¶

Ticket #701: Encrypt Web Traffic

"The security team has discovered that all four of our websites are served over unencrypted HTTP. This is unacceptable - customer data, login credentials, and email content are all visible to anyone intercepting the traffic. Implement HTTPS for all web services: <vm_name>.sysadm.ee, blog.<vm_name>.sysadm.ee, inventory.<vm_name>.sysadm.ee, and mail.<vm_name>.sysadm.ee."

Ticket #702: Encrypt Email Traffic

"The same applies to our email infrastructure. Postfix and Dovecot must support TLS so that authentication credentials and email content are encrypted in transit. Internal-only connections may remain unencrypted for simplicity - this means traffic between Dovecot and Postfix (on the same VM) and between Apache and the inventory backend API do not need TLS."

Scoring Checks¶

• Check 7.1: Port 443 is open and accepts TLS connections.
  • Method: TCP connection with TLS handshake to your VM on port 443.
  • Expected: TLS handshake succeeds.
• Check 7.2: <vm_name>.sysadm.ee answers HTTPS with a valid CA-signed certificate.
  • Method: The scoring server sends an HTTPS request to your VM with --resolve to <vm_name>.sysadm.ee. Certificate is validated against the course CA.
  • Expected: HTTPS response contains your VM's short name, and the certificate is trusted.
• Check 7.3: blog.<vm_name>.sysadm.ee answers HTTPS with WordPress content.
  • Method: HTTPS request with --resolve to blog.<vm_name>.sysadm.ee, validated against the course CA.
  • Expected: HTTPS response contains WordPress indicators (wp-content/, wp-includes/), and the certificate is trusted.
• Check 7.4: mail.<vm_name>.sysadm.ee answers HTTPS with Roundcube.
  • Method: HTTPS request with --resolve to mail.<vm_name>.sysadm.ee, validated against the course CA.
  • Expected: HTTPS response contains Roundcube indicators, and the certificate is trusted.
• Check 7.5: Port 465 (SMTPS) is open and accepts TLS connections.
  • Method: TCP connection with TLS handshake to port 465.
  • Expected: TLS handshake succeeds.
• Check 7.6: Port 993 (IMAPS) is open and accepts TLS connections.
  • Method: TCP connection with TLS handshake to port 993.
  • Expected: TLS handshake succeeds.
• Check 7.7: IMAPS certificate is properly CA-signed.
  • Method: The scoring server connects to port 993 with openssl s_client and checks the Verify return code.
  • Expected: Verify return code is 0 (ok).

Required Documentation¶

Before starting this lab, review the following documentation:

• Concepts: TLS and Certificates
• SOP: Certificate Management
• Technologies: Apache HTTPD
• Technologies: Postfix
• Technologies: Dovecot

Tasks¶

Task 1: Obtain TLS Certificates from Vault¶

Get a certificate and private key from the course Certificate Authority (HashiCorp Vault) for your services.

-----BEGIN CERTIFICATE-----
<base64 data>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<base64 data>
-----END CERTIFICATE-----

Reference: SOP: Certificate Management - Sign a Certificate via Vault, Concepts: TLS and Certificates - Certificate File Formats

Task 2: Enable HTTPS for Web Services¶

Install mod_ssl and configure HTTPS virtual hosts for all four websites.

Reference: SOP: Certificate Management - Install a Certificate in Apache, Concepts: TLS and Certificates - TLS in Apache

Task 3: Enable TLS for Postfix¶

Configure Postfix to support TLS on the SMTPS (465) port.

Reference: SOP: Certificate Management - Install a Certificate in Postfix/Dovecot, Concepts: TLS and Certificates - TLS in Postfix

Task 4: Enable TLS for Dovecot¶

Configure Dovecot to serve IMAP over TLS (IMAPS) on port 993.

Reference: SOP: Certificate Management - Install a Certificate in Postfix/Dovecot, Concepts: TLS and Certificates - TLS in Dovecot

Ansible Tips¶

This section covers tips for automating the tasks in this lab with Ansible. You are not required to automate everything this week, but starting early will save you time later.

Requesting Certificates from Vault with Ansible¶

Install the community.hashi_vault Ansible collection:

ansible-galaxy collection install community.hashi_vault

Use the vault_pki_generate_certificate module to issue certificates automatically:

- name: Request a certificate from HashiCorp Vault PKI
  community.hashi_vault.vault_pki_generate_certificate:
    url: "https://vault.sysadm.ee"
    auth_method: "ldap"
    username: "{{ vault_ldap_username }}"
    password: "{{ vault_ldap_password }}"
    engine_mount_point: "pki"
    role_name: "sysadm.ee"
    common_name: "*.{{ hostname }}.sysadm.ee"
    alt_names: "{{ hostname }}.sysadm.ee"
  register: vault_pki_response
  delegate_to: localhost
  become: false

Key points about this task:

• delegate_to: localhost - the Vault API call runs from your local machine, not the remote VM.
• become: false - no root privileges needed for the API call.
• register: vault_pki_response - saves the response (certificate, key, chain) in a variable.

Protecting Credentials¶

Option 1: Interactive prompt (simplest)

Add vars_prompt to your playbook to ask for credentials at runtime:

- hosts: all
  vars_prompt:
    - name: vault_ldap_username
      prompt: "Enter your university username"
      private: false
    - name: vault_ldap_password
      prompt: "Enter your university password"
      private: true

Option 2: Ansible Vault (more robust)

Encrypt sensitive variables with Ansible Vault (note: this is a different product from HashiCorp Vault):

ansible-vault encrypt_string --prompt

This prompts you for an encryption password and a variable name (e.g., vault_ldap_password), then outputs an encrypted blob you can put in a variable file. Run your playbook with --ask-vault-pass to decrypt at runtime.

Store the encrypted variable file separately and add it to .gitignore - even encrypted secrets should not be in version control.

Writing Certificate Files to the VM¶

Use the response from the Vault module to write certificate files:

- name: Write certificate files
  ansible.builtin.copy:
    content: "{{ item.content }}"
    dest: "{{ item.path }}"
    mode: "{{ item.mode }}"
  with_items:
    - { path: '/etc/pki/tls/certs/server.crt', content: "{{ vault_pki_response.data.certificate }}", mode: '0644' }
    - { path: '/etc/pki/tls/certs/ca-chain.crt', content: "{{ vault_pki_response.data.ca_chain | join('\n') }}", mode: '0644' }
    - { path: '/etc/pki/tls/private/server.key', content: "{{ vault_pki_response.data.private_key }}", mode: '0600' }
  notify:
    - restart httpd
    - restart postfix
    - restart dovecot

Handlers¶

Define handlers to restart services only when certificate files change:

# roles/tls/handlers/main.yml
- name: restart httpd
  systemd:
    name: httpd
    state: restarted

- name: restart postfix
  systemd:
    name: postfix
    state: restarted

- name: restart dovecot
  systemd:
    name: dovecot
    state: restarted

Tags¶

Use tags to run only TLS-related tasks:

- { role: tls, tags: tls }

Run only the TLS role: ansible-playbook --tags=tls playbook.yml

Useful Modules¶

• community.hashi_vault.vault_pki_generate_certificate - request certificates from Vault
• copy - write certificate/key content to files
• template - deploy TLS-enabled virtual host configurations
• firewalld - open ports (443, 465, 993)
• systemd - restart services after config changes
• file - set ownership and permissions on certificate files