[Workaround.org] Nearly SOLVED: trying to use SSL or TLS for allowing relay (STEP 9)
Kay Wrobel
kwrobel at letterboxes.org
Fri Jan 25 14:20:14 CET 2008
Yannick,
It's interesting you mention The Bat! ! I have to struggle almost
every morning with cleaning up our old email servers queue that
chalk-full with SPAM that's bouncing back to nowhere because the
senders addresses are all faked, and so are the recipients
addresses for our domain. The mail server is a Symantec MailGear
2.0, and it sucks big time as it times out after a while when the
queue is too full.
Anyway, I find a lot of fake emails that have The Bat! as
X-Mailer.
Well, I'm glad you're close to solving your problems. In my case,
I have integrated Postfix with Amavis / ClamAV, so I guess I
can't help you with the Avast issue
Kay
Yannick Campana - SiCTiAM - wrote:
Kay,
I used some of the parameters, especialy those about verbosity and
Decide to try other mail client than outlook express or thunderbird and t
hen
used The Bat!.
Then, The Bat! gave me an really explicit message that help me to solve.
The problem was from my Antivirus: Avast that does not support TLS/SLL
Disabled Avast and alleluia it works great!!!
Something strange: it is impossible to this parameter: smtpd_tls_wrapperm
ode
= yes
don't know why but anyway, it doesn't relay matter.
I really appreciate all the help from this mailing list !
Thanks a lot.
________________________________________
De : [1]workaround-chitchat-bounces at workaround.org
[[2]mailto:workaround-chitchat-bounces at workaround.org] De la part de Kay
Wrobel
Envoyé : jeudi 24 janvier 2008 15:14
À : General talk about the contents of workaround.org;
[3]workaround-chitchat at workaround.org
Objet : Re: [Workaround.org] trying to use SSL or TLS for allowing relay
(STEP 9)
Hi Yannick,
Check out /var/log/syslog or /var/log/mail.log and see if postfix throws
TLS/SSL errors; check out the /home/vmail/dovecot-deliver.log (if you
followed Chris' tutorial). By the way, I followed Chris' tutorial, too, b
ut
also adopted other Howto pages covering this topic (and postfixadmin).
Somewhere in the process, I actually ruined the whole SASL authentication
part. And that brought me back to Chris' tutorial in which he uses doveco
t
not only for delivery to the virtual users, but also for authenticating.
My approach was that I created ONE certificate that's being used by all
services that require SSL on my server. So my dovecot.conf has these
entries:
protocols = imap pop3 imaps pop3s
...
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
...
ssl_cert_file = /etc/ssl/certs-custom/altmail-cert-20071212.pem
ssl_key_file = /etc/ssl/private/altmail-privkey.key
and the postfix' main.cf has these entries:
smtpd_tls_CAfile = /etc/ssl/certs-custom/hawkCA-cert.pem
smtpd_tls_cert_file = /etc/ssl/certs-custom/altmail-cert-20071212.pem
smtpd_tls_key_file = /etc/ssl/private/altmail-privkey.key
smtpd_use_tls = yes
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
...
# Authenticated SMTP via dovecot
# see: [4]http://workaround.org/articles/ispmail-etch/#id28
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_recipient_restrictions =
permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
Also, you may want to check file permissions! On my system, the files
/etc/ssl/private/altmail-privkey.key,
/etc/ssl/certs-custom/altmail-cert-20071212.pem and
/etc/ssl/certs-custom/hawkCA-cert.pem is owned by root:root and has chmod
600 (only root can read/write).
If you see STARTTLS when you do telnet localhost 25 and ehlo localhost, t
hen
TLS should be properly advertised. Maybe open up a second shell and tail
-f
/var/log/syslog before you telnet into the server to see if any errors ar
e
being thrown by postfix.
If you don't see that from the outside world, your firewall is blocking
those headers. We have a WatchGuard Firebox here at work, and it filters
SMTP headers and such. For the outside world to relay with SSL and
authentication, I opened the alternate port 465 and forwarded that port t
o
the mail server on the local network (1:1 NAT). In THAT case, you want to
select SSL in Thunderbird (that's also what I'm using), and you should be
able to telnet localhost 465 as well.
Well, that's all I can think of for the moment. Hope you get it working.
I
also had a rough time setting up our new email server. This was the first
time I got my hands wet with SMTP, POP3 and IMAP, so naturally there were
a
few hurdles. I found that integrating postfixadmin into Chris' solution w
as
a bit intricate as I had to read other Howtos that were less detailed tha
n
Chris'. I can't praise his step-by-step approach enough. Maybe he can exp
and
his ISP tutorial to include postfixadmin (and it's table structure instea
d
of his own tables) as well as Squirrelmail with the postfixadmin plugin,
vacation and finally both on a SSL-enabled Apache2.
Kay Wrobel
On Wed, 23 Jan 2008 01:30:45 +0100, "Yannick Campana - SiCTiAM -"
[5]<y.campana at sictiam.fr> said:
Hello,
Firstly, I'd like to thanks Christoph Haas for this real great tutorial!
I'm having a serious problem: I'm trying to use postfix to allow relaying
with secure connection on my Debian 4 Etch !
I've follow every step line by line .Using username/password with no
secure
connection is working fine but when I try to use TLS, I always receive
the
same message (from thunderbird) stating that I have no STARTTLS in the
response to the ehlo command (confirm that by making it in telnet, no 250
-
STARTTLS like in screenshot of the tutorial).
Im my syslog , I get :
Jan 23 01:15:00 stela postfix/smtpd[3081]: connect from unknown[X.X.X.X]
Jan 23 01:15:00 stela postfix/smtpd[3081]: disconnect from
unknown[X.X.X.X]
Parameters in my main.cf concerning TLS:
# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem
smtpd_tls_key_file = /etc/ssl/private/postfix.pem
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
[...]
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =
permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
I have tried several times in several VMware server and always the same
behavior!
Thanks in advanced for any further help; I'm really going crazy with this
annoying problem.
Y.Campana
NB :If I try to use SSL (always with thunderbird) I get a connection
failed
!!!
_______________________________________________
Workaround-chitchat mailing list
[6]Workaround-chitchat at workaround.org
workaround.org/cgi-bin/mailman/listinfo/workaround-chitchat
References
1. mailto:workaround-chitchat-bounces at workaround.org
2. mailto:workaround-chitchat-bounces at workaround.org
3. mailto:workaround-chitchat at workaround.org
4. http://workaround.org/articles/ispmail-etch/#id28
5. mailto:y.campana at sictiam.fr
6. mailto:Workaround-chitchat at workaround.org
--
Kay Wrobel
kwrobel at letterboxes.org
--
http://www.fastmail.fm - Faster than the air-speed velocity of an
unladen european swallow
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://workaround.org/pipermail/workaround-chitchat/attachments/20080125/d7c3d631/attachment.htm
More information about the Workaround-chitchat
mailing list