5

Im currently experiencing the following issue with postfix over ssl (smtps)

Apr  7 13:43:55 server88-208-248-147 postfix/smtpd[5777]: connect from xxxxxxxxxxxxxxx[xxx.xxx.xxx.xxx]
Apr  7 13:45:09 server88-208-248-147 postfix/smtpd[5777]: lost connection after UNKNOWN from xxxxxxxxxxxxxxx[xxx.xxx.xxx.xxx]
Apr  7 13:45:09 server88-208-248-147 postfix/smtpd[5777]: disconnect from xxxxxxxxxxxxxxx[xxx.xxx.xxx.xxx]

my main.cf is as follows:

smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes
smtp_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_CAfile = /etc/postfix/caroot.crt
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_loglevel = 1

when accessing smtp and running start tls i get the following:

# telnet xxxxxxxxxxxxxxx 25
Trying xxxxxxxxxxxxxxx...
Connected to xxxxxxxxxxxxxxx .
Escape character is '^]'.
220 xxxxxxxxxxxxxxx ESMTP Postfix
ehlo localhost
250-xxxxxxxxxxxxxxx
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
STARTTLS
220 2.0.0 Ready to start TLS

please help as i'm lost of places to look now.

os is Ubuntu 10.4 and the SSL is a wildcard SSL, imap/pop and apache work flawlessly with the same certificate.

Improve this question

3 Answers 3

Reset to default
1

Have you checked the file permissions for

smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

Are these files being created?

What happens if you temporarily disable those lines?

Also try increasing the log level to 3 or 4.

EDIT: These are additional lines I added to master.cf (postfix 2.5.1):

# TLS stuff
smtps     inet  n       -       y       -       -       smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
submission inet n       -       y       -       -       smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
scache    unix  -       -       n       -       1       scache
discard   unix  -       -       n       -       -       discard
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
retry     unix  -       -       n       -       -       error
proxywrite unix -       -       n       -       1       proxymap
Improve this answer
3
  • Hi thanks, When i uncomment this it still does the same, Checking the file permissions on /var/lib/postfix/smtp_scache.db i get the following: 16K -rw------- 1 postfix postfix 16K 2011-04-08 11:00 /var/lib/postfix/smtp_scache.db Any additonal pointers?
    – davidcollom
    Apr 8, 2011 at 10:13
  • Have you increased the loglevel? Also, where are your certs from?
    – jamespo
    Apr 9, 2011 at 9:06
  • I tried increasing the log level. And saw the certificate exchange. I couldn't see any obvious errors pop up. The certificate is a wildcard certain from rapidssl and apache/courier appear to use them fine. Also TLS over standard smtp is working perfectly fine using the same certificates
    – davidcollom
    Apr 10, 2011 at 16:25
1

This is the way to test STARTTLS with your smtp server:

openssl s_client -starttls smtp -connect yourserver.example.com:587
Improve this answer
0

I seem to remember that /etc/postfix/ssl and its contents had to be chown root:0

I have it working and just have:

smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

EHLO me
250-me.fqdn.com
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Improve this answer
2
  • Hi. Not sure you gasped the issue TLS via standard smtp is fine! However smtp over ssl(smtps) is not working. Or just hanging when the initial connection is made.
    – davidcollom
    Apr 8, 2011 at 19:52
  • Sorry, I didn't get that. Is there another setting required for SMTPS then ? One that's not present.
    – Jonathan Ross
    Apr 9, 2011 at 6:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .