How to send mail w/ postfix/TLS (reading works)

ssfrstlstnm · 09-18-2006, 09:47 AM

I am trying to set up postfix to accept mail from an outside connection via TLS and send it to somewhere. TLS currently only works for veiwing mail in my inbox. I am using thunderbird on my work computer and connecting to port 143 on the sever to read mail (TLS works there). To send mail I am connecting to port 25, but TLS does not work. I can only send mail if I use no encryption and unencrypted password. Port 143 forwards to courier and port 25 forwards to postfix. What am I doing wrong? See my postfix/main.cf below:

Code:

# TLS parameters
smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_tls_cert_file=/etc/postfix/ssl/openssl_cert.crt
smtpd_tls_key_file=$smtpd_tls_cert_file
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
smtp_tls_cert_file=/etc/postfix/ssl/openssl_cert.crt
smtp_tls_key_file=$smtp_tls_cert_file
#smtp_tls_CAfile = /etc/postfix/ssl/cacert.pem
#smtp_tls_CApath = /etc/postfix/ssl
smtp_tls_loglevel = 3
smtpd_tls_ask_ccert = yes
smtpd_tls_received_header = yes
smtpd_tls_sesseion_cache_timeout = 3600s
tls_random_source = dev:/dev/random

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = mydomain.net
mydomain = mydomain.net
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $mydomain
mydestination = $mydomain, mail.$mydomain, localhost.localdomain, localhost
relayhost = 
mynetworks = 127.0.0.0/8 192.168.1.0/24
home_mailbox = Maildir/
mailbox_command = procmail -a "$EXTENSION" DEFAULT=$HOME/Maildir/ MAILDIR=$HOME/Maildir
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

# Virtual domains to accept mail for
#virtual_alias_domains = mail.bloomincactus.com
#virtual_alias_maps = hash:/etc/postfix/virtual

Berhanie · 09-18-2006, 03:22 PM

Quote:

To send mail I am connecting to port 25, but TLS does not work

First thing to do is check your logs. It may have something to do with

Code:

smtpd_tls_ask_ccert = yes

Your server is asking the client for a certificate, which is not all that common, and
something for which your client (Thunderbird) needs special configuration.
Perhaps you should comment that line out, and reload postfix. Then, test with

Code:

openssl s_client -connect localhost:25 -starttls smtp

ssfrstlstnm · 09-18-2006, 07:23 PM

I commented out smtpd_tls_ask_ccert part, but it still doesn't work. Here is the output from the command you suggested:

Code:

# openssl s_client -connect localhost:25 -starttls smtp
CONNECTED(00000003)
17395:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:567:

When I try to send something from another PC on my lan, I get this:

Code:

An error occurred sending mail: Unable to connect to SMTP server 192.168.1.100 via STARTTLS since it doesn't offer STARTTLS in EHLO response. Please verify that your Mail/News account settings are correct and try again.

Berhanie · 09-18-2006, 08:42 PM

The error says that the server doesn't even offer STARTTLS, which it should have done because of the 'smtpd_use_tls = yes'.
So, we're still on step 1. Let's try to get as far as offering STARTTLS in the greeting. Here's how the greeting should look when
the server is configured correctly:

Code:

berhanie@host:~$ telnet localhost 25  
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 host.example.com ESMTP Postfix
EHLO localhost
250-host.domain.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

What's in your logs?

ssfrstlstnm · 09-19-2006, 07:47 AM

Indeed, it doesn't offer TLS. Apparently courier works with TLS on port 143 because I can retrieve my mail using IMAP with TLS only specified in Tbird. See the output below along with my current main.cf. I'm not too sure about smtp_tls_CApath. Currently it points to the directory with all of the CA certificates in it (i.e. Thawte, Verisign, etc.). This directory isn't copied to the chroot because I think it is read before going to chroot.

smtpd_tls_cert_file and smtpd_tls_key_file both point to my self signed certificate which is copied to the chroot at postfix startup. I assume this is OK since courier works.

On the router, port 25 is forwarded to "postfix" on the server.

Code:

220 mydomain.com ESMTP Postfix (Debian/GNU)
EHLO localhost
250-mydomain.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

My current /etc/postfix/main.cf

Code:

# TLS parameters
smtpd_security_level = encrypt
smtp_security_level = may
smtpd_tls_cert_file=/etc/postfix/ssl/openssl_cert.crt
smtpd_tls_key_file=$smtpd_tls_cert_file
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
#smtp_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 3
#smtpd_tls_ask_ccert = yes
smtpd_tls_received_header = yes
smtpd_tls_sesseion_cache_timeout = 3600s
tls_random_source = dev:/dev/random

myhostname = mydomain.com
mydomain = mydomain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $mydomain
mydestination = $mydomain, mail.$mydomain, localhost.localdomain, localhost
relayhost = 
mynetworks = 127.0.0.0/8 192.168.1.0/24
home_mailbox = Maildir/
mailbox_command = procmail -a "$EXTENSION" DEFAULT=$HOME/Maildir/ MAILDIR=$HOME/Maildir
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

Berhanie · 09-19-2006, 10:31 AM

The smtp_* setttings don't apply. They take effect when postfix is acting as a client, i.e. when it is delivering mail to another MTA (using smtp). I noticed that your main.cf suddenly switched to postfix-2.3 syntax, so I suppose you've upgraded your postfix installation between posts(?) Is your postfix even compiled with SSL (check makedefs.out to see how it was built)?

According to the tls_readme, the smtpd_tls_CAfile and smtp_tls_CAfile are "opened (with root privileges) before Postfix enters the optional chroot jail and so need not be accessible from inside the chroot jail." It's rather the *_tls_CApath that you have to be careful with. You may not need the *_tls_CAfile and *_tls_CApath settings unless you really do want to verify certificates. Furthermore, you realise that 'smtpd_security_level = encrypt' will cause postfix not accept mail unless the client uses STARTTLS -- this is ok for testing, but otherwise remote clients which cannot use tls will not be able to submit mail.

This is my tls stanza in main.cf:

Code:

# tls
#
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtpd_tls_cert_file = /usr/local/etc/postfix/cert.pem
smtpd_tls_auth_only = yes
smtpd_tls_session_cache_database =
  btree:/usr/local/etc/postfix/smtpd_tls_scache

I'm not running chrooted. The 'smtpd_tls_auth_only' is for SMTPAUTH, so you can ignore it. Also, always check your logs.

ssfrstlstnm · 09-19-2006, 12:49 PM

I am 90% sure that my postfix has support for tls. I am using a binary package from the debian repo. It is postfix-2.3 and is labelled as a replacement for postfix-tls (2.1), so I assume the new version has tls built in. Either it doesn't or there is some problem with my cert. I am going to mess around a bit more with it. Thanks for your help. This config file is actually starting to make sense!

Berhanie · 09-19-2006, 01:15 PM

I think that even if there's a problem with the certificate, postfix would still announce STARTTLS. I'd be interested to know the
cause when you finally solve the problem. Good luck.

ssfrstlstnm · 09-19-2006, 06:53 PM

OK, I got it to offer TLS now. Not sure how I did it. Unfortunately I can only send mail from within my local network (192.168.1.0/24). I am guessing it could be that maybe my isp is blocking port 25? I was unable to telnet from my work computer (at a university). Might also be something to do with authentication? I had tried to set up sasl at one time, but commented it out because I was trying to simplify things to make it work. Maybe time to give it a go again. Here is my full main.cf. It's a mess I know.

Code:

# SASL parameters
#smtpd_sasl_auth_enable = yes
#smtpd_sasl_local_domain = stephen.homeip.net
#smtpd_restriction_classes = restrictive, permissive
#restrictive = reject_unknown_sender reject_unknown_client_hostname
#permissive = permit
#smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject
smtpd_recipient_restrictions = permit_mynetworks reject_unauth_destination
#relay_recipient_maps = hash:/etc/postfix/relay_recipients
#smtpd_sasl_security_options = noanonymous
#smtpd_sasl_authenticated_header = yes
#broken_sasl_auth_clients = yes

# SASL client parameters
#smtp_sasl_auth_enable = yes
#smtp_sasl_password_maps = hash:/etc/sasldb2
#smtp_sasl_type = cyrus
#smtp_sasl_security_options =

# TLS parameters
smtpd_use_tls = yes
smtp_use_tls = yes
smtpd_tls_cert_file=/etc/postfix/ssl/smtpd.pem
smtpd_tls_key_file=$smtpd_tls_cert_file
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
#smtp_tls_cert_file=/etc/postfix/ssl/openssl_cert.crt
#smtp_tls_key_file=$smtp_tls_cert_file
#smtp_tls_CAfile = /etc/postfix/ssl/openssl_cert.crt
#smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 3
#smtpd_tls_ask_ccert = yes
#smtpd_tls_received_header = yes
#smtpd_tls_sesseion_cache_timeout = 3600s
tls_random_source = dev:/dev/random

myhostname = stephen.homeip.net
mydomain = stephen.homeip.net
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $mydomain
mydestination = $mydomain, mail.$mydomain, localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8 128.210.184.0/24 192.168.1.0/24 66.249.82.0/24
home_mailbox = Maildir/
mailbox_command = procmail -a "$EXTENSION" DEFAULT=$HOME/Maildir/ MAILDIR=$HOME/Maildir
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

Berhanie · 09-19-2006, 08:55 PM

Quote:

Might also be something to do with authentication?

No. You should be able to see the greeting. It's probably either your router not port forwarding or your ISP blocking the port.

ssfrstlstnm · 09-20-2006, 07:41 AM

Hmmm, but I can recieve mail from the outside. Is incoming mail on port 25?

Berhanie · 09-20-2006, 11:04 AM

If you can receive mail from the outside, then nothing's blocked and you should be able to telnet to
port 25, the 'incoming' mail port of your server. Since you are unsuccessful, Is it possible you're
using the wrong IP address? Clients that deliver mail to you use your domain's MX record in DNS. Use
that IP address when you telnet.

I think I understand what you are trying to do: you want to allow some remote clients to relay mail through
your server (by default only clients in $mynetworks are allowed to do so). Authentication will come in handy,
then.