Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've just recently installed CentOS 5.5 and Postfix for the first time ever.

I've followed 2 different tutorials which are supposed to enable TLS on the SMTP server. Both of which told me to create a key & cert, edit the config, test the server by connecting via telnet.

Everything looks like it should be working. When I connect with telnet, the server advertises that I can connect with STARTTLS. I have opened the firewall for both ports 25 & 465. SELinux is disabled (not sure if that would have interfered or not).

When I attempt to send an email with STARTTLS enabled in Thunderbird, I am given the following error:

An error occurred sending mail: The mail server sent an incorrect greeting: Cannot connect to SMTP server 192.168.0.9 (192.168.0.9:465), connect error 10061.

After pressing OK, I am greeted with another, less helpful message:

Sending of message failed. The message could not be sent because the connection to SMTP server cinc.centos was lost in the middle of the transaction. Try again or contact your network administrator.

I've Googled and fiddled with the configuration hour the best part of a day now. And I've got absolutely no closer to fixing it. I've tried Googling the error message, or just the error code, and it hasn't found anything helpful.

However.. the SMTP server works perfectly fine without any TLS encryption! So the error definitely is just with encryption, hence why the error message mentions port 465.

In case it helps, I've posted the TLS part of my main.cf:

smtp_tls_note_starttls_offer = yes
smtpd_tls_received_header = yes
smtpd_sasl_local_domain = cinc.centos
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_tls_security_level = may
smtpd_tls_key_file = /etc/pki/tls/private/cinc.centos.key
smtpd_tls_cert_file = /etc/pki/tls/certs/cinc.centos.cert
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache
tls_random_source = dev:/dev/urandom

I am so confused by this whole thing! I'm getting no closer to fixing it on my own... can anybody point me in the right direction?

Thanks a million!!

Ollie Treend

share|improve this question
    
Okay.. I've just tried using SMTP without encryption (which used to work) and now I'm getting the exact same error from Thunderbird as above, mentioning port 465! :/ Looks like I might have broken Postfix! :S –  Ollie Treend Aug 11 '10 at 9:26
    
So... "telnet yourserver 465" works from your client computer, right? –  Janne Pikkarainen Aug 11 '10 at 10:39
    
No.. it's not working. Not even from the server itself... the connection is being refused. Yet the postfix server is running... :S –  Ollie Treend Aug 11 '10 at 11:44
    
run netstat -ntlp so see which addresses postfix is listening to. –  topdog Aug 11 '10 at 14:14
1  
Oh brilliant! I've fixed it! I knew it was going to be something silly... I hadn't enabled TLS/SSL in master.cf This site helped me: abing.gotdns.com/posts/2008/… –  Ollie Treend Aug 13 '10 at 12:12

3 Answers 3

Debug it using openssl.

openssl s_client -host localhost -starttls smtp
share|improve this answer
    
I'm getting: > socket: Connection refused <br/> connect:errno=29 –  Ollie Treend Aug 11 '10 at 11:34
    
if you are not running the command on the server itself, replace localhost with the ip address of the server –  topdog Aug 11 '10 at 14:13
    
@Ollie: You need to also specify the port: openssl s_client -connect localhost:587 -starttls smtp –  grawity Aug 11 '10 at 20:08
    
@grawity - When running that command, I'm told the connection was refused... thus I guess there's nothing running on that port. I tried that same at port 465 - again, nothing. However, when I try it on port 25, I am greeted with a server certificate - and nothing much more. Thunderbird is still complaining about the server sending an incorrect greeting :/ Gah! Why are mailservers so confusing!? –  Ollie Treend Aug 13 '10 at 11:04
    
Good news! If I install Thunderbird on the server & connect to localhost, SMTP & TLS works perfectly!! :D Right.... must be a problem with either the firewall, or maybe the server isn't listening on the right interface.. –  Ollie Treend Aug 13 '10 at 11:41

I had this same problem with Thunderbird connecting to Postfix ( Thunderbird said "The mail server sent an incorrect greeting: 5.7.1"). For me it was solved by changing /etc/postfix/master.cf so that instead of reading:

-o smtpd_client_restrictions=permit_sasl_authenticated,reject

..it read:

-o smtpd_client_restrictions=permit
-o smtpd_sender_restrictions=permit_sasl_authenticated,reject
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

Postfix had been rejecting Thunderbird's connection before it could authenticate.

share|improve this answer

You have to add to the mynetworks entries in the main.cf to allow the IP you are testing from to connect. if you are trying to connect from the localhost the mynetworks = localhostIP should be configured. postfix reload and/or postfix restart and test again.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.