Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Note While all of this down below may be educational, it turns out that my entire problem was not with postfix, but with my ISP. I actually switched ISPs in the time in question, and my new one is intercepting and rewriting unencrypted SMTP traffic in a way that explicitly breaks STARTTLS. I worked around the problem by setting up a TLS-only connection on port 465.


STARTTLS was working with my system earlier today. Without me altering the system in any way, it spontaneously broke. I've now been trying to fix it for a couple of hours, to no success.

When I connect to the server, this is what I get:

savanni@Orolo:~$ telnet apps.savannidgerinel.com 25
Trying 129.121.182.135...
Connected to apps.sasavanni@Orolo:~$ telnet apps.savannidgerinel.com 25
Trying 129.121.182.135...
Connected to apps.savannidgerinel.com.
Escape character is '^]'.
220 ***********************************************
ehlo dude
250-apps.savannidgerinel.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-XXXXXXXA
250-AUTH PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
^]close

telnet> close
Connection closed.

Okay, obviously STARTTLS isn't present in this list. So I've been digging through my configuration files and working through the tutorials again, and that has done me no good at all. Here's my tls-related configuration:

smtp_tls_CAfile = /etc/ssl/certs/savannidgerinel_com_CA.pem
smtp_tls_cert_file = /etc/ssl/certs/apps.savannidgerinel.com.pem
smtp_tls_key_file = /etc/ssl/private/apps.savannidgerinel.com.key.pem
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_tls_CAfile = /etc/ssl/certs/savannidgerinel_com_CA.pem
smtpd_tls_cert_file = /etc/ssl/certs/apps.savannidgerinel.com.pem
smtpd_tls_key_file = /etc/ssl/private/apps.savannidgerinel.com.key.pem
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

tls_random_source = dev:/dev/urandom

All of the certificate files are present, the server private key is present, the server CA is present, and the smtpd_scache.db and smtp_scache.db files are both present. All are accessible to the postfix user. Speaking of which, here are the processes running:

savanni@apps:/var/lib/postfix$ ps aux | grep postfix
root      3525  0.0  0.1  25112  1680 ?        Ss   20:19   0:00 /usr/lib/postfix/master
postfix   3526  0.0  0.1  27176  1524 ?        S    20:19   0:00 pickup -l -t fifo -u -c -o content_filter= -o receive_override_options=no_header_body_checks
postfix   3527  0.0  0.1  27228  1552 ?        S    20:19   0:00 qmgr -l -t fifo -u
postfix   3528  0.0  0.4  46948  4144 ?        S    20:19   0:00 smtpd -n smtp -t inet -u -c -o stress= -s 2
postfix   3529  0.0  0.1  27176  1628 ?        S    20:19   0:00 proxymap -t unix -u
postfix   3530  0.0  0.3  38212  3176 ?        S    20:19   0:00 tlsmgr -l -t unix -u -c
postfix   3531  0.0  0.1  27176  1516 ?        S    20:19   0:00 anvil -l -t unix -u -c
postfix   3535  0.0  0.1  27188  1544 ?        S    20:20   0:00 trivial-rewrite -n rewrite -t unix -u -c

The log files say absolutely nothing related to TLS except for this:

Nov  6 02:19:45 apps postfix/master[3525]: daemon started -- version 2.9.6, configuration /etc/postfix
Nov  6 02:19:49 apps postfix/smtpd[3528]: initializing the server-side TLS engine
Nov  6 02:19:49 apps postfix/tlsmgr[3530]: open smtpd TLS cache btree:/var/lib/postfix/smtpd_scache
Nov  6 02:19:49 apps postfix/tlsmgr[3530]: tlsmgr_cache_run_event: start TLS smtpd session cache cleanup
Nov  6 02:19:49 apps postfix/smtpd[3528]: connect from unknown[204.16.68.108]

Neither syslog nor mail.err shows any indication of a problem. As far as the whole system is concerned, all is well. But there is no STARTTLS and so I suddenly can't send any email at all.

Help???

share|improve this question
    
To get a more detailed TLS log, have a look at this –  Anders F. U. Kiær Nov 6 '13 at 2:40
    
smtpd_tls_loglevel=3 is already present in the configuration I posted above. It has no effect. –  Savanni D'Gerinel Nov 6 '13 at 2:44
    
could you post full main.cf and master.cf at a pastebin service? –  Anders F. U. Kiær Nov 6 '13 at 2:50
    
pastebin.com/mnSauVen <-- good for two weeks. I'll update my question with the relevant information when we have an answer. –  Savanni D'Gerinel Nov 6 '13 at 2:53
add comment

1 Answer

from main.cf

For more tls logging: smtp_tls_note_starttls_offer = yes

comment out or remove:

smtp_tls_CAfile = /etc/ssl/certs/savannidgerinel_com_CA.pem
smtp_tls_cert_file = /etc/ssl/certs/apps.savannidgerinel.com.pem
smtp_tls_key_file = /etc/ssl/private/apps.savannidgerinel.com.key.pem

"Do not configure client certificates unless you must present client TLS certificates to one or more servers. Client certificates are not usually needed, and can cause problems in configurations that work well without them. The recommended setting is to let the defaults stand."

Reload config or restart postfix.

I tested your server:

EHLO apps.savannidgerinel.com
250-apps.savannidgerinel.com
250-PIPELINING
250-SIZE 10240000
250-VRFY 250-ETRN
250-STARTTLS
250-AUTH PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

It do offer 250-STARTTLS. So something is intercepting your traffic on port 25 like a proxy. It might be any kind of firewall or advanced router, with such extended functionality that your local computer connects thru. If you have no firewall or advanced router, is it most likely an antispam-policy from your ISP to prevent spam originate from their IP-ranges. In worst case is someone doing a man in the middle attack.

share|improve this answer
    
That did not change anything. vim syntax highlighting registers that as a keyword, and if I type it wrong I get a lot of error messages when I restart postfix, but starttls is still not listed in the ehlo and I still can't actually issue the starttls command. –  Savanni D'Gerinel Nov 6 '13 at 3:54
    
did you add # in front of the lines I listed? –  Anders F. U. Kiær Nov 6 '13 at 3:58
    
I had to check it myself; EHLO apps.savannidgerinel.com 250-apps.savannidgerinel.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN **250-STARTTLS** 250-AUTH PLAIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN –  Anders F. U. Kiær Nov 6 '13 at 4:04
    
So... when I'm logged into the server and telnet to port 25, I get that result as well. But from my local computer, if I telnet to port 25 on the server, STARTTLS is still not present. It is as though the server is refusing to offer TLS to my computer in particular. –  Savanni D'Gerinel Nov 6 '13 at 4:20
    
Ok, something is intercepting your traffic on port 25 like a proxy. Do you have any kind of firewall or advanced router with that functionality that the local computer connects thru? If no, then it might be a policy from your ISP to prevent spam originate from their IP-ranges. –  Anders F. U. Kiær Nov 6 '13 at 8:40
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.