Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Elastix server box that I want to send email notifications of voice mails from. I'd like to send them through our company email (hosted by shared web host provider Bluehost). I have followed instructions on how to use Postfix as a relay server. Emails don't go out tho. I get the following in the logs (slightly obfuscated):

Sep 27 16:31:51 TD1000 postfix/smtp[9757]: 1B2C357117: to=<me@mycompany.com>, relay=boxNNN.bluehost.com[a.b.c.d]:465, delay=5241, delays=5076/0.03/165/0, dsn=4.4.2, status=deferred (lost connection with boxNNN.bluehost.com[a.b.c.d] while receiving the initial server greeting)

Various places suggest that it might be a blacklisting issue. However, it seems like that would be an issue for my outlook running on my PC also. What I am trying to do is get the postfix to act like Outlook, and send through Bluehost, using SSL. (my outlook settings: boxNNN.bluehost.com:465, SSL, authentication required)

When I up the debugging level, I get the following message:

dns_query: boxNNN.bluehost.com (MX): Host found but no data record of requested type

But since the ultimate message is no response, and it finds an IP address for the server, I don't the DNS issues are the problem.

postconf -n reveals:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debug_peer_level = 5
debug_peer_list = boxNNN.bluehost.com
html_directory = no
inet_interfaces = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = cenginc-office.local
myhostname = td1000.my-office.local
mynetworks = /etc/postfix/network_table
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.5.6/README_FILES
relayhost = boxNNN.bluehost.com:465
sample_directory = /usr/share/doc/postfix-2.5.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_connect_timeout = 300
smtp_enforce_tls = yes
smtp_helo_name = my-phone-system
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
smtp_sasl_type = cyrus
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_domains =
virtual_transport = lmtp:unix:/var/lib/imap/socket/lmtp

(we are using Postifix 2.3.3 according to the Elastix UI, so I'm not sure why the samples say 2.5.6)

When I telnet to the bluehost box and port, the connection remains open for a short time, and then closes, I think because I'm not coming in as SSL.

I used this site (among others) for the configuration, but I don't see what I'm missing. https://www.zulius.com/how-to/set-up-postfix-with-a-remote-smtp-relay-host/

Any ideas on what I'm doing wrong? My theory is that postfix isn't doing something that bluehost expects in the initial connection, but I have no idea what. Thanks for your help.

share|improve this question
    
Try testing connection with openssl s_client -connect boxNNN.bluehost.com:465. –  kworr Oct 1 '13 at 4:39
1  
I don't see any place in your configuration where you tell postfix to use ssl while connecting to boxNNN.bluehost.com:465. Does it try to connect without ssl? –  Eric DANNIELOU Oct 1 '13 at 8:00
    
@befreeandgood: I'm not sure how to tell it to use SSL, then. I thought that's what the smtp_sasl_auth_enable was. But now that I look into it a little more, I'm not sure that it is. –  MrPhilTX Oct 1 '13 at 15:59
    
@kworr: I was able to connect, get a banner and a response to an EHLO command. Sounds like I need to get postfix to actually use SSL –  MrPhilTX Oct 1 '13 at 16:00
    
eglug.org/book/export/html/1923 showed tunneling the relay through stunnel, which seems to work, but now I've got names all mumbled up. Bounces cuz it is sending asterix@td1000.my-office.local as a sender or reply-to. I'm connecting to the bluehost box, but not sending the correct account names, etc. –  MrPhilTX Oct 1 '13 at 18:39
show 3 more comments

2 Answers

When destination domain has no MX records SMTP server should try delivering mail to any of domain A records. For example.net this would be any address of example.net.

If the connection to encrypted port fails you need to consult postfix manual about smtp_tls_security_level parameter. You can find there a lengthy explanation but I think in most cases you just need to add to your config:

smtp_tls_security_level=may
share|improve this answer
    
Well, I guess that part is working as intended then. :-) Thanks! –  MrPhilTX Oct 1 '13 at 15:51
add comment

I'm not sure if this is where I should put this, but here is how I got it working.

So, kworr and befreeandgood put me on the right track. The smtp_sasl_* doesn't do anything with SSL, just with authentication.

I followed a combination of the instructions from the following links: This one got me close http://www.eglug.org/book/export/html/1923 but left out a few things to set. This one http://tech.surveypoint.com/blog/relay-mail-with-postfix-and-stunnel/ added inet_interfaces = loopback_only.

Those options got me to some problems with the mail server rejecting various header names, like "from" and "reply-to". I fixed those via some instructions that I found via googling, (but I'm not allowed to post those links as I have exceeded my link quota already).

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
html_directory = no
inet_interfaces = loopback-only
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = my-office.local
myhostname = td1000.my-office.local
mynetworks = /etc/postfix/network_table
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.5.6/README_FILES
relayhost = 127.0.0.1:5001
sample_directory = /usr/share/doc/postfix-2.5.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_connect_timeout = 60
smtp_generic_maps = hash:/etc/postfix/generic
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
smtp_sasl_type = cyrus
smtp_use_tls = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 2
smtpd_tls_received_header = no
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_domains =
virtual_transport = lmtp:unix:/var/lib/imap/socket/lmtp

So the smtp_generic_maps was used to rename the various addresses that came up to some address that actually exists. I had to do that for two different names, that I found by looking in the /var/log/maillog file.

So, the summary to connect to Bluehost:

  • Enable smtp_sasl authentication
  • Use stunnel to create an SSL tunnel
  • Use smtp_generic_maps to map the non-existent usernames that asterisk is using.
  • Dinking around with the mydomain and such might get you around the generic maps requirement. I also saw someone reference $myorigin as a potential work around.
share|improve this answer
    
Have you tried setting up postfix without stunnel first? If so, why did it fail? –  Eric DANNIELOU Oct 2 '13 at 9:49
    
Yes. It failed with the original question: status=deferred then lost connection with boxNNN.bluehost.com[a.b.c.d] while receiving the initial server greeting. How does one tell postfix to use SSL? My google-fu only found the tunneling suggestions. Thanks for following up. –  MrPhilTX Oct 2 '13 at 23:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.