0

I am having a problem since updating from postfix 3.1.12-0 + deb9u1 to 3.4.14-0 + deb10u1 I don't think it comes from the versions but rather from a problem of sequence of the commands sent <> received between MTAs (firewall to reboot ? i have a watchguard xtm-870F...)

Some addresses has been replaced by xxx.xxx.fr, domain1.fr, user, user1 and user2 to anonymize

This is the log send by postfix,as you can see, there is a mismatch between send command (data) and received message (250 recipient user2@xxx.xxx.fr ok)

Unexpected response from mel1.cnaf.fr[195.101.92.41]:25.

Transcript of session follows.

 In:  220-mel1.cnaf.fr ESMTP
 In:  220 Spamming and relaying are prohibited, accesses are logged.
 Out: EHLO relais.xxx.fr
 In:  220 Spamming and relaying are prohibited, accesses are logged.
 Out: MAIL FROM:<user@domain1.fr>
 In:  250-mel1.cnaf.fr
 In:  250-SIZE 10485760
 In:  250 STARTTLS
 Out: RCPT TO:<user1@xxx.xxx.fr>
 In:  250 sender <user1@domain1.fr> ok
 Out: RCPT TO:<user2@xxx.xxx.fr>
 In:  250 recipient <user1@xxx.xxx.fr> ok
 Out: DATA
 In:  250 recipient <user2@xxx.xxx.fr> ok
 Out: RSET
 In:  354  Please end data with <CR><LF>.<CR><LF>
 Out: QUIT

Tried to disable pipelining in postfix : smtpd_discard_ehlo_keywords = pipelining

... but nothing better

In pure telnet, it works. Tried to see something with sniffing packets but nothing more than this mismatch in response.

Thanks in advance for your help / ideas :)

Best regards, Arnaud W.

3
  • Are you MitMing yourself? This looks suspiciously like one of those terrible firewall boxes that should be proper SMTP relays instead of messing with connections. – anx Nov 6 '20 at 17:35
  • Can you do the same session in openssl s_client -tls1_2 -quiet -crlf -connect mel1.cnaf.fr:25? Maybe the reason for the duplicate 220 response becomes more obvious when only looking at a TLS transcript. – anx Nov 6 '20 at 18:02
  • 1
    I connected to that mail server and it is operating correctly. Look for something at your end which may be interfering with your connection. – Michael Hampton Nov 6 '20 at 21:23
1

Thanks all, finally found !

Indeed, there was a problem with our av/netfilter (DrWeb) which break sometimes the protocol. I open a support cas and post informations here because it seems to be a new/unknown bug

Temporary workaround is to set in the AgentCentral

[LinuxFirewall] InspectSmtp = No

Best regards, Arnaud.

1

Here is the complete answer from the support. May help some other DrWeb users :

============== hello, the thing is that maild in filter mode (as milter) and linuxfirewall for inspecting smtp are mutually exclusive.

linuxfirewall can inspect smtp, pop,imap and http, and, optionally, "unwrap" ssl connections (by default it is switched off), that requires additional tuning (creating "trusted" certificates and adding it to clients as trusted to allow this "mitm" ssl inspection)

another thing is that if Dr.Web for Unix mail servers is working under esuite-server's control its configuration must be performed only on es-server's side, and for linuxfirewall's detailed and complete settings there is only ini-file editor (that cancels and override any settings made in component's interface) in Anti-virus Network > xxxx > UNIX > Dr.Web Agent tab Configuration The drweb.ini configuration file

[LinuxFirewall] UnwrapSsl = Yes

and for disabling firewall there must be OutputDivertEnable = No InputDivertEnable = No

or instead of this complicated tuning, if no firewall setup required, there is more convenient and normal way to switch this completely off: Anti-virus Network > xxx > UNIX > SpIDer Gate [v] Enable SpIDer Gate

uncheck|remove [v] from [ ] in Enable SpIDer Gate

if you ssh on this station and check drweb-ctl cfsh linuxfirewall |grep DivertEnable

instead of (example) existing LinuxFirewall.OutputDivertEnable = Yes LinuxFirewall.InputDivertEnable = No LinuxFirewall.ForwardDivertEnable = No

after unchecking [ ] in Enable SpIDer Gate and pressing [save] in es-server web-interface

drweb-ctl cfsh linuxfirewall |grep DivertEnable

will return LinuxFirewall.OutputDivertEnable = No LinuxFirewall.InputDivertEnable = No LinuxFirewall.ForwardDivertEnable = No

meaning that linuxfirewall is off.

==============

So the correct usage in my case is to set it totally off.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.