Prev: How to disable Postfix Mail Delivery Report
Next: lmtp: panic: mystrdup: null pointer argument
From: Carlos Mennens on 22 Mar 2010 08:26
I noticed that I am no longer able to send email via Postfix with
STARTTLS enabled on my server. I have not changed anything on my
Postfix server over the weekend. I only changed my Firewall appliance
but everything appears to be in order. I don't understand why Postfix
can't send emails any more via STARTTLS. I have attempted to 'Telnet'
into my server and I don't see STARTTLS in EHLO command nor do
Thunderbird / Evolution clients so I think it's an issue on Postfix's
end.

carlos(a)tiger:~$ telnet 192.168.0.200 25
Trying 192.168.0.200...
Connected to 192.168.0.200.
Escape character is '^]'.
220 ******************************
EHLO carlos.iamghost.com
250-mail.iamghost.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-XXXXXXXA
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

I disabled TLS on my client end and was able to send a message
perfectly but when TLS is enabled on the client end for SMTP, it fails
and tells me:

"Sending mesage failed.
Unable to connect to SMTP server 192.168.0.200 via STARTTLS since it
doesn't offer STARTTLS in EHLO response. Please verify your settings
and try again."

I am really clueless as to why this stopped working. I am running
Postfix 2.7.0-1 and it has been perfect until now. No changes have
been made that I can recall. The logs /var/log/mail.log show me
nothing when I try to send a message. The logs only show my IMAP
connection to the server. Nothing when I try and send.

Below is my output of Postconf -n:

alias_database = $alias_maps
alias_maps = hash:/etc/postfix/aliases
bounce_queue_lifetime = 1d
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/lib/postfix
debug_peer_level = 2
delay_warning_time = 4h
home_mailbox = mail/
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
mail_owner = postfix
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
mydestination = $myhostname, $mydomain, mail.$mydomain
mydomain = iamghost.com
myhostname = mail.iamghost.com
mynetworks = $config_directory/mynetworks
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases
queue_directory = /var/spool/postfix
readme_directory = no
recipient_delimiter = +
relayhost =
sample_directory = /etc/postfix/sample
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtp_helo_timeout = 60s
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtpd_recipient_restrictions =
permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_non_fqdn_recipient,
reject_unknown_recipient_domain, reject_non_fqdn_helo_hostname,
reject_invalid_helo_hostname, reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net, check_policy_service
inet:127.0.0.1:10030
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = /var/run/dovecot/auth-client
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks
smtpd_tls_cert_file = /etc/ssl/certs/mail.crt
smtpd_tls_key_file = /etc/ssl/private/mail.key
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
smtpd_use_tls = yes
unknown_local_recipient_reject_code = 450's

I appreciate any and all assistance!

-Carlos

From: Stefan Foerster on 22 Mar 2010 08:29
* Carlos Mennens <carloswill(a)gmail.com>:
> I noticed that I am no longer able to send email via Postfix with
> STARTTLS enabled on my server. I have not changed anything on my
> Postfix server over the weekend. I only changed my Firewall appliance
> but everything appears to be in order. I don't understand why Postfix
> can't send emails any more via STARTTLS. I have attempted to 'Telnet'
> into my server and I don't see STARTTLS in EHLO command nor do
> Thunderbird / Evolution clients so I think it's an issue on Postfix's
> end.
>
> carlos(a)tiger:~$ telnet 192.168.0.200 25
> Trying 192.168.0.200...
> Connected to 192.168.0.200.
> Escape character is '^]'.
> 220 ******************************
> EHLO carlos.iamghost.com
> 250-mail.iamghost.com
> 250-PIPELINING
> 250-SIZE 10240000
> 250-VRFY
> 250-ETRN
> 250-XXXXXXXA
> 250-AUTH PLAIN LOGIN
> 250-AUTH=PLAIN LOGIN
> 250-ENHANCEDSTATUSCODES
> 250-8BITMIME
> 250 DSN

Your firewall is filtering SMTP traffic, replacing the standard
Postfix banner with something of it's own. Is that a PIX? If yes, turn
off SMTP inspection.


Stefan

> I disabled TLS on my client end and was able to send a message
> perfectly but when TLS is enabled on the client end for SMTP, it fails
> and tells me:
>
> "Sending mesage failed.
> Unable to connect to SMTP server 192.168.0.200 via STARTTLS since it
> doesn't offer STARTTLS in EHLO response. Please verify your settings
> and try again."
>
> I am really clueless as to why this stopped working. I am running
> Postfix 2.7.0-1 and it has been perfect until now. No changes have
> been made that I can recall. The logs /var/log/mail.log show me
> nothing when I try to send a message. The logs only show my IMAP
> connection to the server. Nothing when I try and send.
>
> Below is my output of Postconf -n:
>
> alias_database = $alias_maps
> alias_maps = hash:/etc/postfix/aliases
> bounce_queue_lifetime = 1d
> broken_sasl_auth_clients = yes
> command_directory = /usr/sbin
> config_directory = /etc/postfix
> daemon_directory = /usr/lib/postfix
> debug_peer_level = 2
> delay_warning_time = 4h
> home_mailbox = mail/
> html_directory = no
> inet_interfaces = all
> inet_protocols = ipv4
> mail_owner = postfix
> mailq_path = /usr/bin/mailq
> manpage_directory = /usr/share/man
> mydestination = $myhostname, $mydomain, mail.$mydomain
> mydomain = iamghost.com
> myhostname = mail.iamghost.com
> mynetworks = $config_directory/mynetworks
> myorigin = $mydomain
> newaliases_path = /usr/bin/newaliases
> queue_directory = /var/spool/postfix
> readme_directory = no
> recipient_delimiter = +
> relayhost =
> sample_directory = /etc/postfix/sample
> sendmail_path = /usr/sbin/sendmail
> setgid_group = postdrop
> smtp_helo_timeout = 60s
> smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
> smtpd_recipient_restrictions =
> permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_non_fqdn_recipient,
> reject_unknown_recipient_domain, reject_non_fqdn_helo_hostname,
> reject_invalid_helo_hostname, reject_rbl_client zen.spamhaus.org,
> reject_rbl_client bl.spamcop.net, check_policy_service
> inet:127.0.0.1:10030
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_path = /var/run/dovecot/auth-client
> smtpd_sasl_security_options = noanonymous
> smtpd_sasl_type = dovecot
> smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks
> smtpd_tls_cert_file = /etc/ssl/certs/mail.crt
> smtpd_tls_key_file = /etc/ssl/private/mail.key
> smtpd_tls_loglevel = 1
> smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
> smtpd_use_tls = yes
> unknown_local_recipient_reject_code = 450's
>
> I appreciate any and all assistance!
>
> -Carlos

From: Sahil Tandon on 22 Mar 2010 08:35
On Mar 22, 2010, at 8:26 AM, Carlos Mennens <carloswill(a)gmail.com>
wrote:

> I noticed that I am no longer able to send email via Postfix with
> STARTTLS enabled on my server. I have not changed anything on my
> Postfix server over the weekend. I only changed my Firewall appliance
> but everything appears to be in order. I don't understand why Postfix
> can't send emails any more via STARTTLS. I have attempted to 'Telnet'
> into my server and I don't see STARTTLS in EHLO command nor do
> Thunderbird / Evolution clients so I think it's an issue on Postfix's
> end.
>
> carlos(a)tiger:~$ telnet 192.168.0.200 25
> Trying 192.168.0.200...
> Connected to 192.168.0.200.
> Escape character is '^]'.
> 220 ******************************
> EHLO carlos.iamghost.com
> 250-mail.iamghost.com
> 250-PIPELINING
> 250-SIZE 10240000
> 250-VRFY
> 250-ETRN
> 250-XXXXXXXA

Your new firewall is the culprit; it's obstructing STARTTLS. See
archives (this was recently discussed) for more.

> 250-AUTH PLAIN LOGIN
> 250-AUTH=PLAIN LOGIN
> 250-ENHANCEDSTATUSCODES
> 250-8BITMIME
> 250 DSN
>
> I disabled TLS on my client end and was able to send a message
> perfectly but when TLS is enabled on the client end for SMTP, it fails
> and tells me:
>
> "Sending mesage failed.
> Unable to connect to SMTP server 192.168.0.200 via STARTTLS since it
> doesn't offer STARTTLS in EHLO response. Please verify your settings
> and try again."
>
> I am really clueless as to why this stopped working. I am running
> Postfix 2.7.0-1 and it has been perfect until now. No changes have
> been made that I can recall. The logs /var/log/mail.log show me
> nothing when I try to send a message. The logs only show my IMAP
> connection to the server. Nothing when I try and send.
>
> Below is my output of Postconf -n:
>
> alias_database = $alias_maps
> alias_maps = hash:/etc/postfix/aliases
> bounce_queue_lifetime = 1d
> broken_sasl_auth_clients = yes
> command_directory = /usr/sbin
> config_directory = /etc/postfix
> daemon_directory = /usr/lib/postfix
> debug_peer_level = 2
> delay_warning_time = 4h
> home_mailbox = mail/
> html_directory = no
> inet_interfaces = all
> inet_protocols = ipv4
> mail_owner = postfix
> mailq_path = /usr/bin/mailq
> manpage_directory = /usr/share/man
> mydestination = $myhostname, $mydomain, mail.$mydomain
> mydomain = iamghost.com
> myhostname = mail.iamghost.com
> mynetworks = $config_directory/mynetworks
> myorigin = $mydomain
> newaliases_path = /usr/bin/newaliases
> queue_directory = /var/spool/postfix
> readme_directory = no
> recipient_delimiter = +
> relayhost =
> sample_directory = /etc/postfix/sample
> sendmail_path = /usr/sbin/sendmail
> setgid_group = postdrop
> smtp_helo_timeout = 60s
> smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
> smtpd_recipient_restrictions =
> permit_sasl_authenticated, permit_mynetworks,
> reject_unauth_destination, reject_non_fqdn_recipient,
> reject_unknown_recipient_domain,
> reject_non_fqdn_helo_hostname,
> reject_invalid_helo_hostname, reject_rbl_client
> zen.spamhaus.org,
> reject_rbl_client bl.spamcop.net, check_policy_service
> inet:127.0.0.1:10030
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_path = /var/run/dovecot/auth-client
> smtpd_sasl_security_options = noanonymous
> smtpd_sasl_type = dovecot
> smtpd_sender_restrictions = permit_sasl_authenticated,
> permit_mynetworks
> smtpd_tls_cert_file = /etc/ssl/certs/mail.crt
> smtpd_tls_key_file = /etc/ssl/private/mail.key
> smtpd_tls_loglevel = 1
> smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
> smtpd_use_tls = yes
> unknown_local_recipient_reject_code = 450's
>
> I appreciate any and all assistance!
>
> -Carlos

From: "Dudi Goldenberg" on 22 Mar 2010 08:36
Hi,

>250-mail.iamghost.com
>250-PIPELINING
>250-SIZE 10240000
>250-VRFY
>250-ETRN
>250-XXXXXXXA
>250-AUTH PLAIN LOGIN
>250-AUTH=PLAIN LOGIN
>250-ENHANCEDSTATUSCODES
>250-8BITMIME
>250 DSN

My guess is that you have a PIX with smtp fixup enabled.

D.

From: Carlos Mennens on 22 Mar 2010 09:19
On Mon, Mar 22, 2010 at 8:35 AM, Sahil Tandon <sahil(a)tandon.net> wrote:
> Your new firewall is the culprit; it's obstructing STARTTLS.  See archives
> (this was recently discussed) for more.

Yes it is. I just replaced my PIX this weekend for a newer Cisco
product (ASA) and I disabled esmtp fixup. Worked like a charm!

Thanks all!

 |  Next  |  Last
Pages: 1 2
Prev: How to disable Postfix Mail Delivery Report
Next: lmtp: panic: mystrdup: null pointer argument