3

I'd like to know what my local postfix says to the Amazon SES smtpd after the STARTTLS. In plain text, so I can understand it. Amazon SES requires TLS, so I can't temporarily turn it off.

I currently log both legs of the traffic with this trick:

mkfifo proxypipe
cat proxypipe | nc -l 11111 | tee -a inflow | nc email-smtp.us-east-1.amazonaws.com smtp | tee -a outflow 1>proxypipe

and then I have postfix talk to localhost:11111 instead of email-smtp.us-east-1.amazonaws.com:25. This produces a nice transcript, as long as they are talking in clear text. As soon as STARTTLS shows up, everything turns gibberish of course.

Is there some trick I can route this through openssl, or post-process using openssl or something like that, to figure out what exactly they said to each other? Googling has not produced any answer.

Improve this question
2
  • What exactly are you trying to "understand"? If you're in the dark about what exactly goes on in an SMTP session there are entire books and websites dedicated to the SMTP protocol. What's going on after STARTTLS is identical, except it's been encrypted...
    – voretaq7
    Aug 21, 2012 at 21:33
  • Does SES require TLS? If not, disable opportunistic TLS on your postfix server, do your debugging of the plaintext conversation, then turn it back on again.
    – SmallClanger
    Aug 21, 2012 at 21:45

2 Answers 2

Reset to default
9

Don't bother with sniffing the network connection; as @voretaq7 explained, you can't. Instead, have postfix log the connection by adding the IP address of the remote SMTP server to debug_peer_list.

And if that doesn't get you enough detail to understand what's going on, you can set smtp_tls_loglevel 4 to get a complete dump of everything that went over the wire.

Once you're done, be sure to change your configuration back. You don't want to leave debugging on for any longer than absolutely necessary.

Improve this answer
4
  • Ooh, that's a handy (if somewhat disgusting) trick. Can Postfix get down to "show me everything sent/received over the wire" granularity with that?
    – voretaq7
    Aug 21, 2012 at 21:50
  • 2
    No, but the disgusting trick I just edited in will do that. :)
    – Michael Hampton
    Aug 21, 2012 at 21:53
  • I am suitably disgusted. (Though it's less of a horror than qmail, where you basically put tee in the path between the thing that knows how to speak SMTP and the thing that knows how to speak SSL/TCP/IP)
    – voretaq7
    Aug 21, 2012 at 21:56
  • This is the kind of trick I was looking for! Thank you.
    – Johannes Ernst
    Aug 21, 2012 at 22:54
5

Allow me to rephrase your question:

I want to stick something in the middle of an TLS-encrypted connection that shows me the cleartext that's being sent.

. . . Well it wouldn't be very secure now, would it? I mean the whole point of TLS is to prevent exactly what you're trying to do! -- So no, what you're asking for is NOT possible, nor is it anywhere near the level of logging any sane admin would want.
All you want to know is who you connected to (the remote system), what you told them (mail from A to B), and what they said (OK, Deferred, Rejected).

If you really want to eavesdrop on the TLS connection you have to fool your server into connecting to a proxy that presents a fake SSL certificate (for which you have the key), the proxy can then decrypt the data (and log it), and then re-encrypt it to forward along to Amazon's real servers.
You could rig up such a beast with OpenSSL's s_client and s_server subsystems, but implementation of such a beast is left as an exercise for the reader.

Improve this answer
2
  • Let me respectfully disagree with you. Wireshark, for example, is great at listening to encrypted HTTP traffic. Of course, you need to have access to key material, so, as you point out, security is not compromised against an attacker. But for debugging, this feature is very valuable. I'm essentially asking for the same feature for smtp/tls, which -- as I understand it -- Wireshark does not support.
    – Johannes Ernst
    Aug 21, 2012 at 22:53
  • 3
    @JohannesErnst Apples and Velociraptors my friend - If you have access to the key reading any encrypted communication is trivial. It is a core assumption of cryptography that the attacker (you) will not have access to the key (which is the case here unless you've compromised Amazon and aren't telling us). Without the key (or the NSA's cryptanalysis division) you cannot observe the cleartext on the wire - you have to rely on one half or the other being able to log the communication for you.
    – voretaq7
    Aug 22, 2012 at 3:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .