5

Im currently experiencing the following issue with postfix over ssl (smtps)

Apr  7 13:43:55 server88-208-248-147 postfix/smtpd[5777]: connect from xxxxxxxxxxxxxxx[xxx.xxx.xxx.xxx]
Apr  7 13:45:09 server88-208-248-147 postfix/smtpd[5777]: lost connection after UNKNOWN from xxxxxxxxxxxxxxx[xxx.xxx.xxx.xxx]
Apr  7 13:45:09 server88-208-248-147 postfix/smtpd[5777]: disconnect from xxxxxxxxxxxxxxx[xxx.xxx.xxx.xxx]

my main.cf is as follows:

smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes
smtp_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_CAfile = /etc/postfix/caroot.crt
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_loglevel = 1

when accessing smtp and running start tls i get the following:

# telnet xxxxxxxxxxxxxxx 25
Trying xxxxxxxxxxxxxxx...
Connected to xxxxxxxxxxxxxxx .
Escape character is '^]'.
220 xxxxxxxxxxxxxxx ESMTP Postfix
ehlo localhost
250-xxxxxxxxxxxxxxx
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
STARTTLS
220 2.0.0 Ready to start TLS

please help as i'm lost of places to look now.

os is Ubuntu 10.4 and the SSL is a wildcard SSL, imap/pop and apache work flawlessly with the same certificate.

3 Answers 3

1

Have you checked the file permissions for

smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

Are these files being created?

What happens if you temporarily disable those lines?

Also try increasing the log level to 3 or 4.

EDIT: These are additional lines I added to master.cf (postfix 2.5.1):

# TLS stuff
smtps     inet  n       -       y       -       -       smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
submission inet n       -       y       -       -       smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
scache    unix  -       -       n       -       1       scache
discard   unix  -       -       n       -       -       discard
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
retry     unix  -       -       n       -       -       error
proxywrite unix -       -       n       -       1       proxymap
3
  • Hi thanks, When i uncomment this it still does the same, Checking the file permissions on /var/lib/postfix/smtp_scache.db i get the following: 16K -rw------- 1 postfix postfix 16K 2011-04-08 11:00 /var/lib/postfix/smtp_scache.db Any additonal pointers? Apr 8, 2011 at 10:13
  • Have you increased the loglevel? Also, where are your certs from?
    – jamespo
    Apr 9, 2011 at 9:06
  • I tried increasing the log level. And saw the certificate exchange. I couldn't see any obvious errors pop up. The certificate is a wildcard certain from rapidssl and apache/courier appear to use them fine. Also TLS over standard smtp is working perfectly fine using the same certificates Apr 10, 2011 at 16:25
1

This is the way to test STARTTLS with your smtp server:

openssl s_client -starttls smtp -connect yourserver.example.com:587
0

I seem to remember that /etc/postfix/ssl and its contents had to be chown root:0

I have it working and just have:

smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

EHLO me
250-me.fqdn.com
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

2
  • Hi. Not sure you gasped the issue TLS via standard smtp is fine! However smtp over ssl(smtps) is not working. Or just hanging when the initial connection is made. Apr 8, 2011 at 19:52
  • Sorry, I didn't get that. Is there another setting required for SMTPS then ? One that's not present. Apr 9, 2011 at 6:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .