Why doesn't Postfix announce AUTH during EHLO?

Question

I have setup postfix and dovecot, I can even receive e-mails and pick them up remotely using Thunderbird client connecting via IMAP

However, I can not send out using the Smtp server, when I telnet locally to my server using telnet mail.mydomain.com 25 and then perform ehlo mail.mydomain.com there is no 250-auth line - is this the problem and how do I fix it ?

I have smtpd_sasl_auth_enable = yes in main.cf

Answer 1

smtpd_tls_auth_only = yes

Needed to change this to

smtpd_tls_auth_only = no

Answer 2

Is the out put of postconf smtpd_tls_auth_only smtpd_tls_auth_only = yes?
If so, need to use starttls before authenticating.
Could disable setting to allow for unencrypted authentication (not advised).

Can debug with starttls using:
openssl s_client -connect $YOUR_SMTP_SERVER:25 -starttls smtp -CApath $PATH_TO_CA_DIR

Answer 3

This is kind of stretch, but have you verified that it's listening on TCP 25 with lsof?

Answer 4

If your smtpd_tls_auth_only is set to yes:

# postconf smtpd_tls_auth_only
smtpd_tls_auth_only = yes

Then, you have had your smtpd_tls_security_level set to encrypt.

# postconf smtpd_tls_security_level
smtpd_tls_security_level = encrypt

This resulted in setting your port 25 to never offer STARTTLS and perfectly explains why the following test TLS exercise shows no encryption offered:

# openssl s_client -connect $YOUR_SMTP_SERVER:25 -starttls smtp -CApath /etc/ssl/certs
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 230 bytes and written 334 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

You could still have your Port 25 that only offers that encrypt option (of which you've set it to), but then you would have drastically altered the nature of port 25 that the rest of the Internet could interoperate with.

This means your server could never be useable in wilderness of the Internet.

To fix that, you must set the following in /etc/postfix/main.cf:

# smtpd_tls_security_level (empty)
#   The  SMTP TLS security level for the Postfix SMTP server; when a
#   non-empty value is specified, this overrides the obsolete param-
#   eters smtpd_use_tls and smtpd_enforce_tls.
#   Specify one of the following security levels:
#
#     none
#         TLS will not be used. 
#     may
#         Opportunistic TLS: announce STARTTLS support 
#         to remote SMTP clients, but do not require that 
#         clients use TLS encryption. 
#     encrypt
#         Mandatory TLS encryption: announce STARTTLS 
#         support to remote SMTP clients, and require 
#         that clients use TLS encryption. According to 
#         RFC 2487 this MUST NOT be applied in case of 
#         a publicly-referenced SMTP server. Instead, 
#         this option should be used only on dedicated
#          servers. 
#     
#     Note 1: the "fingerprint", "verify" and "secure" levels 
#     are not supported here. The Postfix SMTP server logs a 
#     warning and uses "encrypt" instead. To verify remote 
#     SMTP client certificates, see TLS_README for a 
#     discussion of the smtpd_tls_ask_ccert, 
#     smtpd_tls_req_ccert, and permit_tls_clientcerts 
#     features.
#     
#     Note 2: The parameter setting 
#     "smtpd_tls_security_level = encrypt" implies 
#     "smtpd_tls_auth_only = yes".
#     
#     Note 3: when invoked via "sendmail -bs", Postfix will 
#     never offer STARTTLS due to insufficient privileges to 
#     access the server private key. This is intended behavior.
smtpd_tls_security_level = may

In short, encrypt setting is only used practically for certain mail relay and mail bastion host within your private network. Change it to may.