4

A CentOS 7 server with postfix, dovecot, and mailx needs to accommodate mail being sent through port 465 and received through port 25. What specific syntax and files need to be changed in order to accomplish this?

Here are my attempts so far:

1.) I added 465 inet n - - - - smtpd to /etc/postfix/master.cf in the following section:

# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n   -   n   -   -   smtpd
465       inet  n   -   -   -   -   smtpd

2.) I then restarted postfix by typing systemctl stop postfix followed by systemctl start postfix and then systemctl status postfix.

3.) Next, I assigned both port 25 and port 465 in the firewall to the SMTP service. I tested to confirm the firewall was allowing port 465 by typing nc my.SERVER.ip.addr 465 < /dev/null into the devbox terminal, and seeing that it replied by printing 220 mydomain.com ESMTP Postfix. I then tested that the firewall was allowing port 25 to hve SMTP access by sending a test email from a different server and seeing that it was received by this server, obviously through port 25.

4.) I confirmed that the Thunderbird client on my devbox has port 465 set for the outgoing smtp in the [email protected] account from which I am trying to send email out from the server using my devbox's Thunderbird client.

5.) I then typed tcpdump -n -i any tcp port 465 in the server terminal and also typed tcpdump -n -i any tcp port 465 in the devbox terminal.

6.) With all this set up, I tried to use Thunderbird to send a test email from [email protected] to [email protected]. Thunderbird timed out without sending the email, but the following tcpdump was printed on the terminals of both machines.

At the SERVER, this resulted in:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
15:26:40.204817 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.40555: Flags [S.], seq 1955299233, ack 152228482, win 14480, options [mss 1460,sackOK,TS val 1056230222 ecr 5576928,nop,wscale 7], length 0
15:26:40.293442 IP my.DEVBOX.ip.addr.40555 > my.SERVER.ip.addr.urd: Flags [.], ack 1, win 115, options [nop,nop,TS val 5577014 ecr 1056230222], length 0
15:26:40.293926 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.40555: Flags [P.], seq 1:43, ack 1, win 114, options [nop,nop,TS val 1056230312 ecr 5577014], length 42
15:26:40.298215 IP my.DEVBOX.ip.addr.40555 > my.SERVER.ip.addr.urd: Flags [F.], seq 1, ack 1, win 115, options [nop,nop,TS val 5577015 ecr 1056230222], length 0
15:26:40.298521 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.40555: Flags [F.], seq 43, ack 2, win 114, options [nop,nop,TS val 1056230316 ecr 5577015], length 0
15:26:40.384890 IP my.DEVBOX.ip.addr.40555 > my.SERVER.ip.addr.urd: Flags [.], ack 43, win 115, options [nop,nop,TS val 5577104 ecr 1056230312], length 0
15:26:40.389738 IP my.DEVBOX.ip.addr.40555 > my.SERVER.ip.addr.urd: Flags [.], ack 44, win 115, options [nop,nop,TS val 5577113 ecr 1056230316], length 0
15:28:49.598741 IP my.DEVBOX.ip.addr.40557 > my.SERVER.ip.addr.urd: Flags [S], seq 1432245308, win 14600, options [mss 1460,sackOK,TS val 5706324 ecr 0,nop,wscale 7], length 0
15:28:49.598807 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.40557: Flags [S.], seq 706641072, ack 1432245309, win 14480, options [mss 1460,sackOK,TS val 1056359616 ecr 5706324,nop,wscale 7], length 0
15:28:49.685239 IP my.DEVBOX.ip.addr.40557 > my.SERVER.ip.addr.urd: Flags [.], ack 1, win 115, options [nop,nop,TS val 5706409 ecr 1056359616], length 0
15:28:49.685304 IP my.DEVBOX.ip.addr.40557 > my.SERVER.ip.addr.urd: Flags [P.], seq 1:186, ack 1, win 115, options [nop,nop,TS val 5706409 ecr 1056359616], length 185
15:28:49.685328 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.40557: Flags [.], ack 186, win 122, options [nop,nop,TS val 1056359703 ecr 5706409], length 0
15:28:49.700806 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.40557: Flags [P.], seq 1:43, ack 186, win 122, options [nop,nop,TS val 1056359719 ecr 5706409], length 42
15:28:49.783363 IP my.DEVBOX.ip.addr.40557 > my.SERVER.ip.addr.urd: Flags [.], ack 43, win 115, options [nop,nop,TS val 5706510 ecr 1056359719], length 0
15:28:49.783411 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.40557: Flags [P.], seq 43:154, ack 186, win 122, options [nop,nop,TS val 1056359801 ecr 5706510], length 111
15:28:49.868122 IP my.DEVBOX.ip.addr.40557 > my.SERVER.ip.addr.urd: Flags [.], ack 154, win 115, options [nop,nop,TS val 5706592 ecr 1056359801], length 0
15:30:36.430512 IP my.DEVBOX.ip.addr.40557 > my.SERVER.ip.addr.urd: Flags [F.], seq 186, ack 154, win 115, options [nop,nop,TS val 5813157 ecr 1056359801], length 0
15:30:36.430912 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.40557: Flags [F.], seq 154, ack 187, win 122, options [nop,nop,TS val 1056466449 ecr 5813157], length 0
15:30:36.513221 IP my.DEVBOX.ip.addr.40557 > my.SERVER.ip.addr.urd: Flags [.], ack 155, win 115, options [nop,nop,TS val 5813243 ecr 1056466449], length 0
^C
19 packets captured
20 packets received by filter
0 packets dropped by kernel

At the DEVBOX, this resulted in:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
12:32:00.232924 IP my.SERVER.ip.addr.urd > 10.0.0.2.40557: Flags [S.], seq 706641072, ack 1432245309, win 14480, options [mss 1460,sackOK,TS val 1056359616 ecr 5706324,nop,wscale 7], length 0
12:32:00.232992 IP 10.0.0.2.40557 > my.SERVER.ip.addr.urd: Flags [.], ack 1, win 115, options [nop,nop,TS val 5706409 ecr 1056359616], length 0
12:32:00.233212 IP 10.0.0.2.40557 > my.SERVER.ip.addr.urd: Flags [P.], seq 1:186, ack 1, win 115, options [nop,nop,TS val 5706409 ecr 1056359616], length 185
12:32:00.319025 IP my.SERVER.ip.addr.urd > 10.0.0.2.40557: Flags [.], ack 186, win 122, options [nop,nop,TS val 1056359703 ecr 5706409], length 0
12:32:00.334311 IP my.SERVER.ip.addr.urd > 10.0.0.2.40557: Flags [P.], seq 1:43, ack 186, win 122, options [nop,nop,TS val 1056359719 ecr 5706409], length 42
12:32:00.334359 IP 10.0.0.2.40557 > my.SERVER.ip.addr.urd: Flags [.], ack 43, win 115, options [nop,nop,TS val 5706510 ecr 1056359719], length 0
12:32:00.415529 IP my.SERVER.ip.addr.urd > 10.0.0.2.40557: Flags [P.], seq 43:154, ack 186, win 122, options [nop,nop,TS val 1056359801 ecr 5706510], length 111
12:32:00.415586 IP 10.0.0.2.40557 > my.SERVER.ip.addr.urd: Flags [.], ack 154, win 115, options [nop,nop,TS val 5706592 ecr 1056359801], length 0
12:33:46.981077 IP 10.0.0.2.40557 > my.SERVER.ip.addr.urd: Flags [F.], seq 186, ack 154, win 115, options [nop,nop,TS val 5813157 ecr 1056359801], length 0
12:33:47.066884 IP my.SERVER.ip.addr.urd > 10.0.0.2.40557: Flags [F.], seq 154, ack 187, win 122, options [nop,nop,TS val 1056466449 ecr 5813157], length 0
12:33:47.066946 IP 10.0.0.2.40557 > my.SERVER.ip.addr.urd: Flags [.], ack 155, win 115, options [nop,nop,TS val 5813243 ecr 1056466449], length 0
^C
11 packets captured
12 packets received by filter
0 packets dropped by kernel

Note that the first 7 items in the server output showed up from a previous test, though both tcpdump -n -i any tcp port 465 commands (server and devbox) were run at the same time.

Note that typing postconf -n on the server resulted in:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
home_mailbox = Maildir/
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
unknown_local_recipient_reject_code = 550  

Also, typing postconf -M on the server results in:

smtp       inet  n       -       n       -       -       smtpd
465        inet  n       -       -       -       -       smtpd
pickup     unix  n       -       n       60      1       pickup
cleanup    unix  n       -       n       -       0       cleanup
qmgr       unix  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       n       1000?   1       tlsmgr
rewrite    unix  -       -       n       -       -       trivial-rewrite
bounce     unix  -       -       n       -       0       bounce
defer      unix  -       -       n       -       0       bounce
trace      unix  -       -       n       -       0       bounce
verify     unix  -       -       n       -       1       verify
flush      unix  n       -       n       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       1       proxymap
smtp       unix  -       -       n       -       -       smtp
relay      unix  -       -       n       -       -       smtp
showq      unix  n       -       n       -       -       showq
error      unix  -       -       n       -       -       error
retry      unix  -       -       n       -       -       error
discard    unix  -       -       n       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       n       -       -       lmtp
anvil      unix  -       -       n       -       1       anvil
scache     unix  -       -       n       -       1       scache

The contents of /var/log/maillog in that time period were:

Mar  3 15:22:05 mydomain postfix/postfix-script[8565]: starting the Postfix mail system
Mar  3 15:22:05 mydomain postfix/master[8567]: daemon started -- version 2.10.1, configuration /etc/postfix
Mar  3 15:23:40 mydomain postfix/smtpd[8572]: connect from unknown[my.DEVBOX.ip.addr]
Mar  3 15:25:26 mydomain postfix/smtpd[8572]: lost connection after UNKNOWN from unknown[my.DEVBOX.ip.addr]
Mar  3 15:25:26 mydomain postfix/smtpd[8572]: disconnect from unknown[my.DEVBOX.ip.addr]
Mar  3 15:26:40 mydomain postfix/smtpd[8572]: connect from unknown[my.DEVBOX.ip.addr]
Mar  3 15:26:40 mydomain postfix/smtpd[8572]: lost connection after CONNECT from unknown[my.DEVBOX.ip.addr]
Mar  3 15:26:40 mydomain postfix/smtpd[8572]: disconnect from unknown[my.DEVBOX.ip.addr]
Mar  3 15:28:49 mydomain postfix/smtpd[8578]: connect from unknown[my.DEVBOX.ip.addr]
Mar  3 15:30:36 mydomain postfix/smtpd[8578]: lost connection after UNKNOWN from unknown[my.DEVBOX.ip.addr]
Mar  3 15:30:36 mydomain postfix/smtpd[8578]: disconnect from unknown[my.DEVBOX.ip.addr]
Mar  3 15:33:40 mydomain postfix/anvil[8574]: statistics: max connection rate 1/60s for (465:my.DEVBOX.ip.addr) at Mar  3 15:23:40
Mar  3 15:33:40 mydomain postfix/anvil[8574]: statistics: max connection count 1 for (465:my.DEVBOX.ip.addr) at Mar  3 15:23:40
Mar  3 15:33:40 mydomain postfix/anvil[8574]: statistics: max cache size 1 at Mar  3 15:23:40  

The outgoing server settings in Thunderbird are:

Description:           <Not Specified>  
Server Name:           mydomain.com  
Port:                  465
User Name:             me
Authentication Method: Normal Password
Connection Security:   SSL/TLS  

I interpret this to mean that the blockage is in postfix. So what do I change in order to get postfix to allow remote clients to send out through port 465 while still allowing mail to be received from other servers through port 25?


EDIT:


Per the instructions in the link given by @sebix, I tried the following:

In /etc/postfix/main.cf I uncommented the following line:

smtpd_tls_security_level = may

In /etc/postfix/master.cf, I uncommented the following two lines:

-o smtpd_tls_wrappermode=yes 
-o smtpd_sasl_auth_enable=yes

However, when I tried to send a test email, Thunderbird replied with the following error dialog:

Sending of message failed.
The message could not be sent because the connection to SMTP server mydomain.com was  
lost in the middle of the transaction. Try again or contact your network administrator.  

EDIT#2


As per Esa Jokinen's suggestion, I tried the following several commands.

On the DEVBOX, I typed telnet mydomain.com 587 and got the following in reply. Note that the two lines where I added input have # in front of them even though there was no # in the terminal. I added the # for emphasis/clarity:

Trying my.Server.ip.addr...
Connected to mydomain.com.
Escape character is '^]'.
220 mydomain.com ESMTP Postfix
# EHLO mydomain.com
250-mydomain.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
# STARTTLS
454 4.7.0 TLS not available due to local problem

Next, on the SERVER, I typed openssl s_client -host localhost -port 587 -starttls smtp. This resulted in the following output:

CONNECTED(00000003)
140634999289760:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:769:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 244 bytes and written 284 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

On the SERVER, I again typed postconf -n and now currently get the following output:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
home_mailbox = Maildir/
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_cert_file = </etc/pki/dovecot/certs/dovecot.pem
smtpd_tls_key_file = </etc/pki/dovecot/private/dovecot.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
unknown_local_recipient_reject_code = 550

On the SERVER, I again typed postconf -M and got the following in return:

smtp       inet  n       -       n       -       -       smtpd
587        inet  n       -       -       -       -       smtpd
submission inet  n       -       -       -       -       smtpd 
-o smtpd_tls_security_level=encrypt 
-o smtpd_sasl_auth_enable=yes 
-o smtpd_sasl_type=dovecot 
-o smtpd_sasl_path=private/auth 
-o smtpd_sasl_security_options=noanonymous 
-o smtpd_sasl_local_domain=$myhostname 
-o smtpd_client_restrictions=permit_sasl_authenticated,reject 
-o smtpd_sender_login_maps=hash:/etc/postfix/virtual 
-o smtpd_sender_restrictions=reject_sender_login_mismatch 
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
pickup     unix  n       -       n       60      1       pickup
cleanup    unix  n       -       n       -       0       cleanup
qmgr       unix  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       n       1000?   1       tlsmgr
rewrite    unix  -       -       n       -       -       trivial-rewrite
bounce     unix  -       -       n       -       0       bounce
defer      unix  -       -       n       -       0       bounce
trace      unix  -       -       n       -       0       bounce
verify     unix  -       -       n       -       1       verify
flush      unix  n       -       n       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       1       proxymap
smtp       unix  -       -       n       -       -       smtp
relay      unix  -       -       n       -       -       smtp
showq      unix  n       -       n       -       -       showq
error      unix  -       -       n       -       -       error
retry      unix  -       -       n       -       -       error
discard    unix  -       -       n       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       n       -       -       lmtp
anvil      unix  -       -       n       -       1       anvil
scache     unix  -       -       n       -       1       scache

Next, I tried to send an email through the server using the Thunderbird client on the remote devbox. After this test, typing nano /var/log/maillog in the SERVER gives:

Mar  4 11:57:19 mydomain postfix/smtpd[11029]: error: open database /etc/postfix/virtual.db: No such file or directory
Mar  4 11:57:19 mydomain postfix/smtpd[11029]: warning: cannot get RSA certificate from file </etc/pki/dovecot/certs/dovecot.pem: disabling TLS support
Mar  4 11:57:19 mydomain postfix/smtpd[11029]: warning: TLS library problem: 11029:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fope$
Mar  4 11:57:19 mydomain postfix/smtpd[11029]: warning: TLS library problem: 11029:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
Mar  4 11:57:19 mydomain postfix/smtpd[11029]: warning: TLS library problem: 11029:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa$
Mar  4 11:57:19 mydomain postfix/smtpd[11029]: connect from unknown[98.244.12.133]
Mar  4 11:57:20 mydomain postfix/cleanup[11032]: 1FD8680B3BCE: message-id=<[email protected]>
Mar  4 11:57:20 mydomain postfix/qmgr[10139]: 1FD8680B3BCE: from=<[email protected]>, size=873, nrcpt=1 (queue active)
Mar  4 11:57:20 mydomain postfix/smtpd[11029]: disconnect from unknown[98.244.12.133]
Mar  4 11:57:20 mydomain postfix/local[11034]: 1FD8680B3BCE: to=<[email protected]>, orig_to=<postmaster>, relay=local, delay=0.07, delays=0.04/0.01/0/0.0$
Mar  4 11:57:20 mydomain postfix/qmgr[10139]: 1FD8680B3BCE: removed

These readings indicate that the problem is with the certs. Note that I used the certs that are specified in /etc/dovecot/conf.d/10-ssl.conf. I just cut and pasted the urls of the two cert/key files after using nano to confirm that each file existed and contained encryption codes. And also being sure to point the key to the key and point the cert to the cert.

Did I do this correctly?


EDIT#3


I changed the url references of the key files from

smtpd_tls_cert_file = </etc/pki/dovecot/certs/dovecot.pem
smtpd_tls_key_file = </etc/pki/dovecot/private/dovecot.pem

to

smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem
smtpd_tls_key_file = /etc/pki/dovecot/private/dovecot.pem

I also removed the two < symbols in /etc/dovecot/conf.d/10-ssl.conf. (Those two symbols where there before this testing began.) Next, I typed sudo nano to open bpth the cert and key to make sure they were accessible at the given locations, and they were. I then tried to send another email through the server using the Thunderbird client on my devbox. This resulted in a request by Thunderbird for me to add an exception for the unknown certificate. When I accepted the unknown certificate, Thunderbird then gave me a connection timed out dialog box and failed to send the email, while the following was written to /var/log/maillog:

Mar  4 14:08:28 mydomain postfix/postfix-script[11361]: stopping the Postfix mail system
Mar  4 14:08:28 mydomain postfix/master[11293]: terminating on signal 15
Mar  4 14:08:33 mydomain postfix/postfix-script[11444]: starting the Postfix mail system
Mar  4 14:08:33 mydomain postfix/master[11446]: daemon started -- version 2.10.1, configuration /etc/postfix
Mar  4 14:08:44 mydomain postfix/smtpd[11451]: error: open database /etc/postfix/virtual.db: No such file or directory
Mar  4 14:08:44 mydomain postfix/smtpd[11451]: connect from unknown[my.DEVBOX.ip.addr]
Mar  4 14:08:44 mydomain postfix/smtpd[11451]: warning: SASL: Connect to private/auth failed: No such file or directory
Mar  4 14:08:44 mydomain postfix/smtpd[11451]: fatal: no SASL authentication mechanisms
Mar  4 14:08:45 mydomain postfix/master[11446]: warning: process /usr/libexec/postfix/smtpd pid 11451 exit status 1
Mar  4 14:08:45 mydomain postfix/master[11446]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling

NOTE:

Removing the < from </etc/pki/dovecot/certs/dovecot.pem and </etc/pki/dovecot/private/dovecot.pem in /etc/dovecot/conf.d/10-ssl.conf caused the JavaMail imap connection from an app running on the server to stop working. But putting the < back in fixed the problem. This might refer to a linked folder.

4
  • What is the Outgoing SMTP settings of Thunderbird? Authenticated method? Connection Security?
    – masegaloeh
    Mar 3, 2015 at 22:35
  • @masegaloeh I just added that to the end of my OP. Does this help you diagnose the problem?
    – CodeMed
    Mar 3, 2015 at 22:45
  • 1
    Well, you require TLS from client side on port 465, so you probably need to enable it on this port explicitly using -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes. See TLS README: Enabling TLS in the Postfix SMTP server
    – sebix
    Mar 3, 2015 at 23:13
  • @sebix Thank you. Please see the EDIT at the end of my OP documenting results of your suggestion. What else can I try?
    – CodeMed
    Mar 3, 2015 at 23:35

1 Answer 1

1

It seems you are not enabling SSL on the port 465 nor using different settings for your smtp submission server. This means you might have the same settings on port 465 than on port 25. Thunderbird is then trying to establish SMTPS connection but answered in plain text. Submission is a whole different setup from plain SMTP and certainly needs an authentication too.

This on master.cf should enable well secured submission (SMTP with TLS authentication) on port 587:

submission inet n - - - - smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_login_maps=hash:/etc/postfix/virtual
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

Just remove the smtpd_sender_login_maps if not required. The Dovecot specific lines are not exactly Dovecot specific. Instead, Postfix uses Dovecot for SASL authentication, which you really should set up.

For TLS you also need to add these parameters in your main.cf (and perhaps replace the snakeoil with your own certificate path):

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

With these modifications it might also work on SMTPS (465):

smtps inet n - - - - smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
...

I think these might be useful for you to continue with:

http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL

https://www.vultr.com/docs/simple-mailserver-postfix-dovecot-sieve-centos-7

15
  • Thank you. Your four suggestions for using port 465 resulted in: Sending of message failed. The message could not be sent because the connection to SMTP server mydomain.com was lost in the middle of the transaction. Try again or contact your network administrator. Am I missing something? I am going to research your 587 suggestions before making such drastic changes.
    – CodeMed
    Mar 3, 2015 at 23:49
  • I just tried adding the 11 lines to master.cf that you suggested for port 587, then tried to send a test email from my local devbox to mydomain.com, but Thunderbird gave me the following error: Sending of message failed. An error occurred sending mail: Unable to establish a secure link with SMTP server mydomain.com using STARTTLS since it doesn't advertise that feature. Switch off STARTTLS for that server or contact your service provider. How can I resolve this?
    – CodeMed
    Mar 4, 2015 at 0:02
  • Just edited that to my original solution. Is the STARTTLS advertised after these modifications? Mar 4, 2015 at 0:49
  • I added your 5 new lines plus comment to main.cf. I then restarted postfix. I checked that thunderbird is using port 587 with STARTTLS, then I sent another test email, but Thunderbird gave this same error message again: Sending of message failed. An error occurred sending mail: Unable to establish a secure link with SMTP server mydomain.com using STARTTLS since it doesn't advertise that feature. Switch off STARTTLS for that server or contact your service provider. Instead of snakeoil, I used the certs specified in /etc/dovecot/conf.d/10-ssl.conf. What else can I try?
    – CodeMed
    Mar 4, 2015 at 1:23
  • Could you telnet port 587 and after 220 use command EHLO example.com. One of the response lines should be 250-STARTTLS. Then use command STARTTLS to verify whether you get 220 2.0.0 Ready to start TLS. This helps to limit the problem to the server settings. Setting -o smtpd_tls_security_level=encrypt in your master.cf should enable the STARTTLS support and enforce using it. Mar 4, 2015 at 11:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .