Installation of Cryptshare Mail Gateway

This page describes the installation and configuration of the core component of Cryptshare for NTA 7516, the Cryptshare Mail Gateway.

Preparation

Make sure that the system on which Cryptshare Mail Gateway will be installed (hereafter referred to as the server) fulfils all requirements specified in System Requirements, in particular storage encryption and name-server configuration.

If it has not already been done, install the sudo package and add the user who will perform the installation to the sudo group:

su -
apt install sudo -y
usermod -aG sudo <username>
exit

Replace <username> with the actual username.

Log out and log in again.

Installation Steps

Provision the Certificates (only for Let’s Encrypt! certificates)

The setup program detects Let’s Encrypt certificates created with Certbot. More precisely, it detects certificate files stored in subdirectories of /etc/letsencrypt/live and performs all required server-TLS setup.

If you use Certbot, make sure the certificates have been created and are up to date.

If you use other certificates without Certbot, configure TLS later as described under Server TLS.

Start the Setup Program

Copy the installation package file to your home directory.

Extract the installation package:

tar -xzf cmg-setup-<version>.tar.gz

<version> is the product version.

Elevate your privileges to root:

sudo su

Change to the extracted directory and start the setup program:

cd cmg-setup
./setup.sh

Setup Questions

Will you be using Microsoft 365 to send emails through the Cryptshare Mail Gateway?

Choose yes if emails are routed from Exchange Online in Microsoft 365 (M365) to the Cryptshare Mail Gateway for further delivery. The setup configures the gateway to retrieve mail-server IP addresses from a Microsoft web service and permit relaying only for those hosts. Incoming messages from those hosts are also checked for a header containing your tenant ID.

Choose no if you use a stand-alone Microsoft Exchange Server outside Microsoft 365 or another mail-server product.

Please enter the Tenant ID for your Microsoft 365 tenant

This question is shown only for M365 installations. The tenant ID is required to ensure that only messages from your tenant are processed by the Cryptshare Mail Gateway. You can find it on the Azure Active Directory Overview page.

Would you like to enable Header Authentication?

Answer according to whether header-based authentication should be activated for messages processed by the gateway.

Additional Configuration Steps

Server TLS

Complete the server-TLS configuration when certificates were not provisioned automatically through Certbot.

Client TLS

Configure the client TLS certificate required for authenticated SMTP communication with organizations that require client-certificate authentication.

DKIM Keys

Configure the DKIM keys used to sign outgoing messages.

Nameserver Configuration

Complete the required name-server configuration for the Cryptshare Mail Gateway.

Complete the Installation

Start the cmg-filter Service

After completing the required configuration, start the cmg-filter service to finish the installation.