Postfix Dovecot SSL/TLS STARTTLS: smtp authentication fails

Discussion:

(too old to reply)

Dominique Ramaekers

2016-06-12 09:09:26 UTC

Hi,

I'm setting up a mail server using Ubuntu 16.04 LTS, Postfix 3.1.0 and Dovecot 2.2.22

Logging in to imap with SSL/TLS works great.

I just can't seem to setup the smtp correctly. I know you can find a lot of information about using Dovecot SASL with Postfix. But let's say I'm no longer seeing the wood for the trees... Help will be greatly appreciated!

On first glance it looks good:

***@cloudserver1:/etc/postfix# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
220 cloudserver1.crowdcloud.be ESMTP Postfix (Ubuntu)
ehlo localhost
250-cloudserver1.crowdcloud.be
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

To test, I've setup thunderbird to send mail on port 25 using STARTTLS and 'normal pasword'. If I send a mail, the progress bar keeps on working. If I press 'cancel', I just get a message that thunderbird fails sending the message. (Duh...)

I don't see anything special in the mail log.

My configuration:

***@cloudserver1:~# cat /etc/postfix/main.cf.clean
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
append_dot_mydomain = no
readme_directory = no
smtpd_tls_cert_file = /etc/letsencrypt/live/crowdcloud.be/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/crowdcloud.be/privkey.pem
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = cloudserver1.crowdcloud.be
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, crowdcloud.be, cloudserver1.crowdcloud.be, localhost.crowdcloud.be, localhost, mail.crowdcloud.be
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 10.111.0.0/32 37.252.124.0/32
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_authenticated_header = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname is volgende regel zo wel nodig???
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/dovecot.conf -m "${EXTENSION}"
smtp_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_auth_only = no
tls_random_source = dev:/dev/urandom
smtpd_tls_security_level = may
smtpd_tls_loglevel = 4
smtp_tls_note_starttls_offer = yes
smtpd_tls_session_cache_timeout = 3600s

***@cloudserver1:~# cat /etc/postfix/master.cf.clean
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
smtp inet n - y - - smtpd
submission inet n - y - - smtpd
pickup unix n - y 60 1 pickup
cleanup unix n - y - 0 cleanup
qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 bounce
trace unix - - y - 0 bounce
verify unix - - y - 1 verify
flush unix n - y 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - y - - smtp
relay unix - - y - - smtp
showq unix n - y - - showq
error unix - - y - - error
retry unix - - y - - error
discard unix - - y - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - y - - lmtp
anvil unix - - y - 1 anvil
scache unix - - y - 1 scache
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}

In /etc/dovecot/conf.d/10-master.conf I've got
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user = postfix
group = postfix
}

And in /etc/dovecot/conf.d/10-mail.conf I've got
ssl = yes
ssl_cert = </etc/letsencrypt/live/crowdcloud.be/fullchain.pem
ssl_key = </etc/letsencrypt/live/crowdcloud.be/privkey.pem

Greetings and thanks in advance,

Dominique.

d***@gmail.com

2016-06-12 11:22:55 UTC

Permalink

Hi

Enable debug mode of the postfix smtpd deamon by adding the "-v" option in master.cf :
Replace :
smtp inet n - y - - smtpd
by
smtp inet n - y - - smtpd -v
+ restart postfix

And send the full logfile if you need help.

Regards

Victor

Post by Dominique Ramaekers
Hi,
I'm setting up a mail server using Ubuntu 16.04 LTS, Postfix 3.1.0 and Dovecot 2.2.22
Logging in to imap with SSL/TLS works great.
I just can't seem to setup the smtp correctly. I know you can find a lot of information about using Dovecot SASL with Postfix. But let's say I'm no longer seeing the wood for the trees... Help will be greatly appreciated!
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
220 cloudserver1.crowdcloud.be ESMTP Postfix (Ubuntu)
ehlo localhost
250-cloudserver1.crowdcloud.be
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
To test, I've setup thunderbird to send mail on port 25 using STARTTLS and 'normal pasword'. If I send a mail, the progress bar keeps on working. If I press 'cancel', I just get a message that thunderbird fails sending the message. (Duh...)
I don't see anything special in the mail log.
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
append_dot_mydomain = no
readme_directory = no
smtpd_tls_cert_file = /etc/letsencrypt/live/crowdcloud.be/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/crowdcloud.be/privkey.pem
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = cloudserver1.crowdcloud.be
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, crowdcloud.be, cloudserver1.crowdcloud.be, localhost.crowdcloud.be, localhost, mail.crowdcloud.be
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 10.111.0.0/32 37.252.124.0/32
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_authenticated_header = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname is volgende regel zo wel nodig???
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/dovecot.conf -m "${EXTENSION}"
smtp_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_auth_only = no
tls_random_source = dev:/dev/urandom
smtpd_tls_security_level = may
smtpd_tls_loglevel = 4
smtp_tls_note_starttls_offer = yes
smtpd_tls_session_cache_timeout = 3600s
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
smtp inet n - y - - smtpd
submission inet n - y - - smtpd
pickup unix n - y 60 1 pickup
cleanup unix n - y - 0 cleanup
qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 bounce
trace unix - - y - 0 bounce
verify unix - - y - 1 verify
flush unix n - y 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - y - - smtp
relay unix - - y - - smtp
showq unix n - y - - showq
error unix - - y - - error
retry unix - - y - - error
discard unix - - y - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - y - - lmtp
anvil unix - - y - 1 anvil
scache unix - - y - 1 scache
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
In /etc/dovecot/conf.d/10-master.conf I've got
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user = postfix
group = postfix
}
And in /etc/dovecot/conf.d/10-mail.conf I've got
ssl = yes
ssl_cert = </etc/letsencrypt/live/crowdcloud.be/fullchain.pem
ssl_key = </etc/letsencrypt/live/crowdcloud.be/privkey.pem
Greetings and thanks in advance,
Dominique.

Dominique Ramaekers

2016-06-12 12:43:28 UTC

Permalink

Ok, thanks. When I did that, I noticed that there was nothing happening in the log. Where I got the info that STARTTLS could work on port 25, I don't remember. I put Thunderbird back on 587, and it worked... Exept, for now it seems my server is greylisted. I'll look in to that later...

Now I tried the same for SSL/TLS with normal password on port 465. Again, there is nothing coming on the server log... But also Thunderbird immediately reports the smtp server isn't accessible. So I think SSL/TLS protocol isn't enabled. I've checked, port 465 is open...

What settings are different from STARTTLS?

d***@gmail.com

2016-06-15 05:47:56 UTC

Permalink

Hi

SSL/TLS is SMTP over TLS over TCP on port 465 and often 587.
STARTTLS is an ESMTP option of SMTP over TCP on port 25.

Both have the same option/need in main.cf but in master.cf you must open the port 465 (or 587) by adding a ligne (with the ssl option at the end).

Regards

Victor