Note While all of this down below may be educational, it turns out that my entire problem was not with postfix, but with my ISP. I actually switched ISPs in the time in question, and my new one is intercepting and rewriting unencrypted SMTP traffic in a way that explicitly breaks STARTTLS. I worked around the problem by setting up a TLS-only connection on port 465.
STARTTLS was working with my system earlier today. Without me altering the system in any way, it spontaneously broke. I've now been trying to fix it for a couple of hours, to no success.
When I connect to the server, this is what I get:
savanni@Orolo:~$ telnet apps.savannidgerinel.com 25
Trying 129.121.182.135...
Connected to apps.sasavanni@Orolo:~$ telnet apps.savannidgerinel.com 25
Trying 129.121.182.135...
Connected to apps.savannidgerinel.com.
Escape character is '^]'.
220 ***********************************************
ehlo dude
250-apps.savannidgerinel.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-XXXXXXXA
250-AUTH PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
^]close
telnet> close
Connection closed.
Okay, obviously STARTTLS isn't present in this list. So I've been digging through my configuration files and working through the tutorials again, and that has done me no good at all. Here's my tls-related configuration:
smtp_tls_CAfile = /etc/ssl/certs/savannidgerinel_com_CA.pem
smtp_tls_cert_file = /etc/ssl/certs/apps.savannidgerinel.com.pem
smtp_tls_key_file = /etc/ssl/private/apps.savannidgerinel.com.key.pem
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_CAfile = /etc/ssl/certs/savannidgerinel_com_CA.pem
smtpd_tls_cert_file = /etc/ssl/certs/apps.savannidgerinel.com.pem
smtpd_tls_key_file = /etc/ssl/private/apps.savannidgerinel.com.key.pem
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
tls_random_source = dev:/dev/urandom
All of the certificate files are present, the server private key is present, the server CA is present, and the smtpd_scache.db and smtp_scache.db files are both present. All are accessible to the postfix user. Speaking of which, here are the processes running:
savanni@apps:/var/lib/postfix$ ps aux | grep postfix
root 3525 0.0 0.1 25112 1680 ? Ss 20:19 0:00 /usr/lib/postfix/master
postfix 3526 0.0 0.1 27176 1524 ? S 20:19 0:00 pickup -l -t fifo -u -c -o content_filter= -o receive_override_options=no_header_body_checks
postfix 3527 0.0 0.1 27228 1552 ? S 20:19 0:00 qmgr -l -t fifo -u
postfix 3528 0.0 0.4 46948 4144 ? S 20:19 0:00 smtpd -n smtp -t inet -u -c -o stress= -s 2
postfix 3529 0.0 0.1 27176 1628 ? S 20:19 0:00 proxymap -t unix -u
postfix 3530 0.0 0.3 38212 3176 ? S 20:19 0:00 tlsmgr -l -t unix -u -c
postfix 3531 0.0 0.1 27176 1516 ? S 20:19 0:00 anvil -l -t unix -u -c
postfix 3535 0.0 0.1 27188 1544 ? S 20:20 0:00 trivial-rewrite -n rewrite -t unix -u -c
The log files say absolutely nothing related to TLS except for this:
Nov 6 02:19:45 apps postfix/master[3525]: daemon started -- version 2.9.6, configuration /etc/postfix
Nov 6 02:19:49 apps postfix/smtpd[3528]: initializing the server-side TLS engine
Nov 6 02:19:49 apps postfix/tlsmgr[3530]: open smtpd TLS cache btree:/var/lib/postfix/smtpd_scache
Nov 6 02:19:49 apps postfix/tlsmgr[3530]: tlsmgr_cache_run_event: start TLS smtpd session cache cleanup
Nov 6 02:19:49 apps postfix/smtpd[3528]: connect from unknown[204.16.68.108]
Neither syslog nor mail.err shows any indication of a problem. As far as the whole system is concerned, all is well. But there is no STARTTLS and so I suddenly can't send any email at all.
Help???
from main.cf
For more tls logging: smtp_tls_note_starttls_offer = yes
comment out or remove:
smtp_tls_CAfile = /etc/ssl/certs/savannidgerinel_com_CA.pem
smtp_tls_cert_file = /etc/ssl/certs/apps.savannidgerinel.com.pem
smtp_tls_key_file = /etc/ssl/private/apps.savannidgerinel.com.key.pem
"Do not configure client certificates unless you must present client TLS certificates to one or more servers. Client certificates are not usually needed, and can cause problems in configurations that work well without them. The recommended setting is to let the defaults stand."
Reload config or restart postfix.
I tested your server:
EHLO apps.savannidgerinel.com
250-apps.savannidgerinel.com
250-PIPELINING
250-SIZE 10240000
250-VRFY 250-ETRN
250-STARTTLS
250-AUTH PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
It do offer 250-STARTTLS. So something is intercepting your traffic on port 25 like a proxy. It might be any kind of firewall or advanced router, with such extended functionality that your local computer connects thru. If you have no firewall or advanced router, is it most likely an antispam-policy from your ISP to prevent spam originate from their IP-ranges. In worst case is someone doing a man in the middle attack.
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments