[Workaround.org] Nearly SOLVED: trying to use SSL or TLS for allowing relay (STEP 9)

Kay Wrobel kwrobel at letterboxes.org
Fri Jan 25 14:20:14 CET 2008


Yannick,
It's interesting you mention The Bat! ! I have to struggle almost
every morning with cleaning up our old email servers queue that
chalk-full with SPAM that's bouncing back to nowhere because the
senders addresses are all faked, and so are the recipients
addresses for our domain. The mail server is a Symantec MailGear
2.0, and it sucks big time as it times out after a while when the
queue is too full.
Anyway, I find a lot of fake emails that have The Bat! as
X-Mailer.
Well, I'm glad you're close to solving your problems. In my case,
I have integrated Postfix with Amavis / ClamAV, so I guess I
can't help you with the Avast issue
Kay
Yannick Campana - SiCTiAM - wrote:

Kay,

I used some of the parameters, especialy those about verbosity and
Decide to try other mail client than outlook express or thunderbird and t
hen
used The Bat!.

Then, The Bat! gave me an really explicit message that help me to solve.

The problem was from my Antivirus: Avast that does not support TLS/SLL

Disabled Avast and alleluia it works great!!!

Something strange: it is impossible to this parameter: smtpd_tls_wrapperm
ode
= yes

don't know why but anyway, it doesn't relay matter.


I really appreciate all the help from this mailing list !

Thanks a lot.

________________________________________
De : [1]workaround-chitchat-bounces at workaround.org
[[2]mailto:workaround-chitchat-bounces at workaround.org] De la part de Kay
Wrobel
Envoyé : jeudi 24 janvier 2008 15:14
À : General talk about the contents of workaround.org;
[3]workaround-chitchat at workaround.org
Objet : Re: [Workaround.org] trying to use SSL or TLS for allowing relay
(STEP 9)

Hi Yannick,

Check out /var/log/syslog or /var/log/mail.log and see if postfix throws
TLS/SSL errors; check out the /home/vmail/dovecot-deliver.log (if you
followed Chris' tutorial). By the way, I followed Chris' tutorial, too, b
ut
also adopted other Howto pages covering this topic (and postfixadmin).
Somewhere in the process, I actually ruined the whole SASL authentication
part. And that brought me back to Chris' tutorial in which he uses doveco
t
not only for delivery to the virtual users, but also for authenticating.



My approach was that I created ONE certificate that's being used by all
services that require SSL on my server. So my dovecot.conf has these
entries:

protocols = imap pop3 imaps pop3s
...
virtual_transport          = dovecot
dovecot_destination_recipient_limit = 1
...
ssl_cert_file = /etc/ssl/certs-custom/altmail-cert-20071212.pem
ssl_key_file = /etc/ssl/private/altmail-privkey.key

and the postfix' main.cf has these entries:
smtpd_tls_CAfile    = /etc/ssl/certs-custom/hawkCA-cert.pem
smtpd_tls_cert_file = /etc/ssl/certs-custom/altmail-cert-20071212.pem
smtpd_tls_key_file  = /etc/ssl/private/altmail-privkey.key
smtpd_use_tls       = yes
smtpd_tls_loglevel  = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
...
# Authenticated SMTP via dovecot
# see: [4]http://workaround.org/articles/ispmail-etch/#id28
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_recipient_restrictions =
permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination

Also, you may want to check file permissions! On my system, the files
/etc/ssl/private/altmail-privkey.key,
/etc/ssl/certs-custom/altmail-cert-20071212.pem and
/etc/ssl/certs-custom/hawkCA-cert.pem is owned by root:root and has chmod
600 (only root can read/write).

If you see STARTTLS when you do telnet localhost 25 and ehlo localhost, t
hen
TLS should be properly advertised. Maybe open up a second shell and tail
-f
/var/log/syslog before you telnet into the server to see if any errors ar
e
being thrown by postfix.

If you don't see that from the outside world, your firewall is blocking
those headers. We have a WatchGuard Firebox here at work, and it filters
SMTP headers and such. For the outside world to relay with SSL and
authentication, I opened the alternate port 465 and forwarded that port t
o
the mail server on the local network (1:1 NAT). In THAT case, you want to
select SSL in Thunderbird (that's also what I'm using), and you should be
able to telnet localhost 465 as well.
Well, that's all I can think of for the moment. Hope you get it working.
I
also had a rough time setting up our new email server. This was the first
time I got my hands wet with SMTP, POP3 and IMAP, so naturally there were
 a
few hurdles. I found that integrating postfixadmin into Chris' solution w
as
a bit intricate as I had to read other Howtos that were less detailed tha
n
Chris'. I can't praise his step-by-step approach enough. Maybe he can exp
and
his ISP tutorial to include postfixadmin (and it's table structure instea
d
of his own tables) as well as Squirrelmail with the postfixadmin plugin,
vacation and finally both on a SSL-enabled Apache2.
Kay Wrobel

On Wed, 23 Jan 2008 01:30:45 +0100, "Yannick Campana - SiCTiAM -"
[5]<y.campana at sictiam.fr> said:

Hello,


Firstly, I'd like to thanks Christoph Haas for this real great tutorial!

I'm having a serious problem: I'm trying to use postfix to allow relaying
with secure connection on my Debian 4 Etch !

I've follow every step line by line .Using username/password with no
secure
connection is working fine but when I try to use TLS, I always receive
the
same message (from thunderbird) stating that I have no STARTTLS in the
response to the ehlo command (confirm that by making it in telnet, no 250
-
STARTTLS like in screenshot of the tutorial).


Im my syslog , I get :

Jan 23 01:15:00 stela postfix/smtpd[3081]: connect from unknown[X.X.X.X]
Jan 23 01:15:00 stela postfix/smtpd[3081]: disconnect from
unknown[X.X.X.X]


Parameters in my main.cf concerning TLS:

# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem
smtpd_tls_key_file = /etc/ssl/private/postfix.pem
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache

[...]
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =
permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination





I have tried several times in several VMware server and always the same
behavior!

Thanks in advanced for any further help; I'm really going crazy with this
annoying problem.


Y.Campana



NB :If I try to use SSL (always with thunderbird) I get a connection
failed
!!!



_______________________________________________
Workaround-chitchat mailing list
[6]Workaround-chitchat at workaround.org
workaround.org/cgi-bin/mailman/listinfo/workaround-chitchat

References

1. mailto:workaround-chitchat-bounces at workaround.org
2. mailto:workaround-chitchat-bounces at workaround.org
3. mailto:workaround-chitchat at workaround.org
4. http://workaround.org/articles/ispmail-etch/#id28
5. mailto:y.campana at sictiam.fr
6. mailto:Workaround-chitchat at workaround.org
-- 
  Kay Wrobel
  kwrobel at letterboxes.org

-- 
http://www.fastmail.fm - Faster than the air-speed velocity of an
                          unladen european swallow

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://workaround.org/pipermail/workaround-chitchat/attachments/20080125/d7c3d631/attachment.htm 


More information about the Workaround-chitchat mailing list