0

yesterday I set ssl certificates for our company webpage and webmail client using Let's Encrypt Authority. After the succsses of this procedure I've tried to add the same certificate inside the postfix. Everything was okay and now CheckTLS Confidence get me 100% for TLC, CERT and so on. The only problem is now that the phone gmail app and other email client apps wont connect to smtp.

The error from /var/log/mail.log is

postfix/smtpd[4704]: Anonymous TLS connection established from unknown[151.251.245.71]: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
postfix/smtpd[4704]: warning: SASL authentication failure: Password verification failed
postfix/smtpd[4704]: warning: unknown[151.251.245.71]: SASL PLAIN authentication failed: authentication failure

The main thing that change except adding TLC cert is the MX record. Before was only mail, now is webmail because the domain of the cert was already registered to webmail.mysite.com. I rewrite the MX and A records bouth on the server and control panel inside domain hosting company. As I sayed the cert works and mail is encrypted using tlc cert, but the smpt connection inside the mobile app client failed. Server is Debian 8.11 postfix + cyrus + sasl. Mail accounts are created as linux users and then add to cyradm. So the password is shared between the OS and the mail box.

Spets I done so far to add TLS

  1. In /etc/postfix/main.cf

    smtpd_sasl_type=cyrus
    smtpd_sasl_path=private/auth
    smtpd_use_tls=yes
    smtpd_tls_ask_ccert=yes
    smtp_tls_security_level=may
    smtpd_tls_security_level=may
    smtp_tls_note_starttls_offer=yes
    smtpd_tls_received_header=yes
    myhostname = webmail.mysite.com #before was mail.mysite.com
    destination = mysite.com, webmail, webmail.mysite.com, localhost.localdomain, localhost 
    before was mysite.com, mail, mail.mysite.com localhost.localdomain, localhost    smtpd_tls_cert_file=/etc/letsencrypt/live/webmail.mysite.com/fullchain.pem
    smtpd_tls_key_file=/etc/letsencrypt/live/webmail.mysite.com/privkey.pem
    smtpd_tls_CAfile=/etc/letsencrypt/live/webmail.mysite.com/cert.pem
    
  2. In /etc/postfix/master.cf delete the “#” sign from smtps and the next two columns

  3. In /etc/mailname change mail.mysite.com. to webmail.mysite.com.
  4. Uncommend imaps from /etc/cyrus.conf

Other info that maybe needed to help

cat /etc/postfix/sasl/smtpd.conf 
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

/etc/imapd.conf

allowplaintext: yes
sasl_mech_list: PLAIN LOGIN
sasl_minimum_layer: 1 # before this line was commend
tls_cert_file: /etc/letsencrypt/live/webmail.mysite.com/fullchain.pem 
tls_key_file: /etc/letsencrypt/live/webmail.mysite.com/privkey.pem 
tls_ca_file: /etc/letsencrypt/live/webmail.mysite.com/cert.pem

The thing that I've tried so far also was to stop apache service and try connecting again. I've been thinking that domain name of the web based mail client and MX record are in conflict but no the error still exist. All ports are opened and redirectected correctly - 25, 143, 465, 993 I'm not a system administrator. I've start doing this to learn new stuff and because that's stuffs are interesting to me. So I've know that I don't know a lot of things but there are a lot of informations around the internet, people that can help and think I can handle this with your advices ^_^

Shortly ... the main questions are 1 Is the name of the MX record in conflict with the name of the http website if they are the same - webmail.mysite.com? At this ip/address there is a web-based mail client and a postfix. 2. Can postfix + cyrus + sals + tlc play together ? 3. We have mail boxes with account already working after enable tls for imap/smtp is there any other settings or need of renew all the users passwords.

  • The MX record and HTTP website can share the same name, no problem; just be sure that the MX record points to the name and not an IP address. I have no experience with cyrus, I use dovecot. Note that smtps (port 465) is deprecated, better to use smtp + starttls on the submission port 587. – wurtel Mar 8 at 7:42
  • can i easyly switch between cyrus and dovecot. I've already found some tutorials about tls + dovecot, but the problem is the mailboxes. If i switch somehow will they left or I must create new users and mailbox for everyone. – Vasil Ivanov Mar 8 at 8:10
  • Switching to dovecot is probably not the best solution for you. – wurtel Mar 8 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.