[Workaround.org] trying to use SSL or TLS for allowing relay (STEP 9)

Yannick Campana - SiCTiAM - y.campana at sictiam.fr
Thu Jan 24 16:28:05 CET 2008


Thanks a lot kay for taking the input.
I'll try when back to my office and give you feedback...

________________________________________
De : workaround-chitchat-bounces at workaround.org
[mailto:workaround-chitchat-bounces at workaround.org] De la part de Kay Wrobel
Envoyé : jeudi 24 janvier 2008 15:14
À : General talk about the contents of workaround.org;
workaround-chitchat at workaround.org
Objet : Re: [Workaround.org] trying to use SSL or TLS for allowing relay
(STEP 9)

Hi Yannick,

Check out /var/log/syslog or /var/log/mail.log and see if postfix throws
TLS/SSL errors; check out the /home/vmail/dovecot-deliver.log (if you
followed Chris' tutorial). By the way, I followed Chris' tutorial, too, but
also adopted other Howto pages covering this topic (and postfixadmin).
Somewhere in the process, I actually ruined the whole SASL authentication
part. And that brought me back to Chris' tutorial in which he uses dovecot
not only for delivery to the virtual users, but also for authenticating.


My approach was that I created ONE certificate that's being used by all
services that require SSL on my server. So my dovecot.conf has these
entries:

protocols = imap pop3 imaps pop3s
...
virtual_transport          = dovecot
dovecot_destination_recipient_limit = 1
...
ssl_cert_file = /etc/ssl/certs-custom/altmail-cert-20071212.pem
ssl_key_file = /etc/ssl/private/altmail-privkey.key

and the postfix' main.cf has these entries:
smtpd_tls_CAfile    = /etc/ssl/certs-custom/hawkCA-cert.pem
smtpd_tls_cert_file = /etc/ssl/certs-custom/altmail-cert-20071212.pem
smtpd_tls_key_file  = /etc/ssl/private/altmail-privkey.key
smtpd_use_tls       = yes
smtpd_tls_loglevel  = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
...
# Authenticated SMTP via dovecot
# see: http://workaround.org/articles/ispmail-etch/#id28
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_recipient_restrictions =
permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination

Also, you may want to check file permissions! On my system, the files
/etc/ssl/private/altmail-privkey.key,
/etc/ssl/certs-custom/altmail-cert-20071212.pem and
/etc/ssl/certs-custom/hawkCA-cert.pem is owned by root:root and has chmod
600 (only root can read/write).

If you see STARTTLS when you do telnet localhost 25 and ehlo localhost, then
TLS should be properly advertised. Maybe open up a second shell and tail -f
/var/log/syslog before you telnet into the server to see if any errors are
being thrown by postfix.

If you don't see that from the outside world, your firewall is blocking
those headers. We have a WatchGuard Firebox here at work, and it filters
SMTP headers and such. For the outside world to relay with SSL and
authentication, I opened the alternate port 465 and forwarded that port to
the mail server on the local network (1:1 NAT). In THAT case, you want to
select SSL in Thunderbird (that's also what I'm using), and you should be
able to telnet localhost 465 as well.
Well, that's all I can think of for the moment. Hope you get it working. I
also had a rough time setting up our new email server. This was the first
time I got my hands wet with SMTP, POP3 and IMAP, so naturally there were a
few hurdles. I found that integrating postfixadmin into Chris' solution was
a bit intricate as I had to read other Howtos that were less detailed than
Chris'. I can't praise his step-by-step approach enough. Maybe he can expand
his ISP tutorial to include postfixadmin (and it's table structure instead
of his own tables) as well as Squirrelmail with the postfixadmin plugin,
vacation and finally both on a SSL-enabled Apache2.
Kay Wrobel

On Wed, 23 Jan 2008 01:30:45 +0100, "Yannick Campana - SiCTiAM -"
<y.campana at sictiam.fr> said:
> Hello,
> 
> 
> Firstly, I'd like to thanks Christoph Haas for this real great tutorial! 
> 
> I'm having a serious problem: I'm trying to use postfix to allow relaying
> with secure connection on my Debian 4 Etch !
> 
> I've follow every step line by line .Using username/password with no
> secure
> connection is working fine but when I try to use TLS, I always receive
> the
> same message (from thunderbird) stating that I have no STARTTLS in the
> response to the ehlo command (confirm that by making it in telnet, no 250
> -
> STARTTLS like in screenshot of the tutorial).
> 
> 
> Im my syslog , I get :
> 
> Jan 23 01:15:00 stela postfix/smtpd[3081]: connect from unknown[X.X.X.X]
> Jan 23 01:15:00 stela postfix/smtpd[3081]: disconnect from
> unknown[X.X.X.X]
> 
> 
> Parameters in my main.cf concerning TLS:
> 
> # TLS parameters
> smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem
> smtpd_tls_key_file = /etc/ssl/private/postfix.pem
> smtpd_use_tls = yes
> smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
> smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
> 
> [...]
> smtpd_sasl_type = dovecot
> smtpd_sasl_path = private/auth
> smtpd_sasl_auth_enable = yes
> smtpd_recipient_restrictions =
> permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
> 
> 
> 
> 
> 
> I have tried several times in several VMware server and always the same
> behavior!
> 
> Thanks in advanced for any further help; I'm really going crazy with this
> annoying problem.
> 
> 
> Y.Campana
> 
> 
> 
> NB :If I try to use SSL (always with thunderbird) I get a connection
> failed
> !!!
> 
> 
> 
> _______________________________________________
> Workaround-chitchat mailing list
> Workaround-chitchat at workaround.org
> workaround.org/cgi-bin/mailman/listinfo/workaround-chitchat
-- 
  Kay Wrobel
  kwrobel at letterboxes.org

-- 
http://www.fastmail.fm - One of many happy users:
  http://www.fastmail.fm/docs/quotes.html



More information about the Workaround-chitchat mailing list