[Postfixbuch-users] Wer kann mir bitte helfen??? postfix mit TLS

Sandy Drobic postfixbuch-users at drobic.de
Fr Jul 24 20:59:36 CEST 2009


smaerz at mnet-online.de wrote:
> Hi.
> 
> Ich bin echt am verzweifeln...
> 
> Ich will postfix mit dovecot instalieren und hänge bei postfix an 2
> Punkten (dovecot läuft ok)
> 
> System ist debian5 (lenny) 64
> 
> Mein erstes Problem ist dass postfix keine mails nach aussen schickt...
> 
> Das zweite ist scheinbar ein TLS Problem, denn sobald ich versuche über
> SSL mails zu senden kommt es entweder zum timeout (Outlook) oder TheBat
> meldet:
> 
> SEND  - TLS-Protokollfehler: Unerwartete Nachricht
> SessionUnknownContentType ct (50)
> SEND  - Verbindung beendet - 0 Nachrichten versandt
> SEND  - Einige Nachrichten wurden nicht versendet - prüfen Sie die
> Logdatei nach Informationen
> 
> Ich bin jedem dankbar der mir hier helfen kann!!
> 
> Vielen Dank im Voraus!
> 
> postconf -n
> 
> alias_database = hash:/etc/aliases
> alias_maps = hash:/etc/aliases
> allow_min_user = yes
> append_dot_mydomain = no
> biff = no
> broken_sasl_auth_clients = yes
> config_directory = /etc/postfix
> home_mailbox = mails/
> inet_interfaces = all
> local_recipient_maps =
> luser_relay = contact
> mailbox_size_limit = 0
> mydestination = safer-print.com, safer-print.de, safer-print.eu,
> safer-print.it, localhost.$mydomain, localhost
> mydomain = safer-print.com
> mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
> myorigin = /etc/mailname
> readme_directory = no
> recipient_delimiter = +
> relay_domains = $mydestination
> relayhost =
> smtp_sasl_auth_enable = no
> smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
> smtpd_client_restrictions = reject_invalid_hostname
> smtpd_helo_required = yes
> smtpd_helo_restrictions = reject_invalid_hostname
> smtpd_recipient_restrictions = permit_sasl_authenticated
> permit_mynetworks reject_unknown_sender_domain reject_invalid_hostname
> reject_unauth_destination
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_local_domain =
> smtpd_sasl_path = private/auth
> smtpd_sasl_security_options = noanonymous
> smtpd_sasl_type = dovecot
> smtpd_sender_restrictions = reject_unknown_address
> strict_rfc821_envelopes = yes

Hier in deiner Ausgabe von "postconf -n" sehe ich keine TLS-Parameter!

> main.cf
> 
> # See /usr/share/postfix/main.cf.dist for a commented, more complete version
> 
> # Debian specific:  Specifying a file name will cause the first
> # line of that file to be used as the name.  The Debian default
> # is /etc/mailname.
> #myorigin = /etc/mailname
> #myorigin = $mydomain
> 
> smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
> biff = no
> 
> # appending .domain is the MUA's job.
> append_dot_mydomain = no
> 
> # Uncomment the next line to generate "delayed mail" warnings
> #delay_warning_time = 4h
> 
> readme_directory = no
> 
> # TLS parameters
> smtpd_tls_CAfile = /etc/postfix/ssl/demoCA/cacert.pem
> smtpd_tls_cert_file = /etc/postfix/ssl/server-crt.pem
> smtpd_tls_key_file = /etc/postfix/ssl/server-key.pem

Aber hier hast du welche angegeben!

> #smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
> #smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
> #smtpd_tls_cert_file = /etc/ssl/certs/dovecot.pem
> smtpd_use_tls = yes
> smtpd_enforce_tls = no
> smtpd_tls_auth_only = yes
> smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
> smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
> smtpd_tls_security_level = may
> 
> # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
> # information on enabling SSL in the smtp client.
> 
> #SASL parameters
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_type = dovecot
> smtpd_sasl_path = private/auth
> 
> smtpd_sasl_security_options = noanonymous
> smtpd_sasl_local_domain =
> smtp_sasl_auth_enable = no
> broken_sasl_auth_clients = yes
> 
> #Virtual Daomain parameters
> #virtual_alias_domains = safer-print.de, safer-print.eu, safer-print.it
> #virtual_alias_maps = hash:/etc/postfix/virtual_domains
> 
> #Anti SPAM
> check_policy_service = inet:127.0.0.1:12525
> 
> #myhostname = mail.safer-print.com
> mydomain = safer-print.com
> alias_maps = hash:/etc/aliases
> alias_database = hash:/etc/aliases
> myorigin = /etc/mailname
> mydestination = safer-print.com, safer-print.de, safer-print.eu,
> safer-print.it, localhost.$mydomain, localhost
> relayhost =
> relay_domains = $mydestination
> mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
> mailbox_size_limit = 0
> recipient_delimiter = +
> inet_interfaces = all
> allow_min_user = yes
> #smtpd_tls_key_file = /etc/ssl/private/dovecot.pem
> smtpd_recipient_restrictions = permit_sasl_authenticated
> permit_mynetworks reject_unknown_sender_domain reject_invalid_hostname
> reject_unauth_destination
> smtpd_helo_required = yes
> smtpd_helo_restrictions = reject_invalid_hostname
> #smtpd_recipient_restrictions = permit_mynetworks 
> reject_unknown_recipient_domain permit_sasl_authenticated
> reject_unauth_destination
> smtpd_sender_restrictions = reject_unknown_address
> smtpd_client_restrictions = reject_invalid_hostname
> strict_rfc821_envelopes = yes
> home_mailbox = mails/
> local_recipient_maps =
> luser_relay = contact
> 
> master.cf
> 
> #
> # Postfix master process configuration file.  For details on the format
> # of the file, see the master(5) manual page (command: "man 5 master").
> #
> # Do not forget to execute "postfix reload" after editing this file.
> #
> # ==========================================================================
> # service type  private unpriv  chroot  wakeup  maxproc command + args
> #               (yes)   (yes)   (yes)   (never) (100)
> # ==========================================================================
> smtp      inet  n       -       y       -       -       smtpd
> submission inet n       -       -       -       -       smtpd

Du hast für beide Ports ein chroot angegeben (chroot = "y" oder "-"). Ich
nehme an, dass du die entsprechenden Parameter nicht ins chroot übernommen
hast. Das kann eine Ursache dafür sein.

Ist das ein Debian-System?

> #  -o smtpd_tls_security_level=encrypt
> #  -o smtpd_sasl_auth_enable=yes
> #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> #  -o milter_macro_daemon_name=ORIGINATING
> smtps     inet  n       -       y       -       -       smtpd
> #  -o smtpd_tls_wrappermode=yes
> #  -o smtpd_sasl_auth_enable=yes
> #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> #  -o milter_macro_daemon_name=ORIGINATING
> #628      inet  n       -       -       -       -       qmqpd
> pickup    fifo  n       -       -       60      1       pickup
> cleanup   unix  n       -       -       -       0       cleanup
> qmgr      fifo  n       -       n       300     1       qmgr
> #qmgr     fifo  n       -       -       300     1       oqmgr
> tlsmgr    unix  -       -       -       1000?   1       tlsmgr
> rewrite   unix  -       -       -       -       -       trivial-rewrite
> bounce    unix  -       -       -       -       0       bounce
> defer     unix  -       -       -       -       0       bounce
> trace     unix  -       -       -       -       0       bounce
> verify    unix  -       -       -       -       1       verify
> flush     unix  n       -       -       1000?   0       flush
> proxymap  unix  -       -       n       -       -       proxymap
> proxywrite unix -       -       n       -       1       proxymap
> smtp      unix  -       -       -       -       -       smtp
> # When relaying mail as backup MX, disable fallback_relay to avoid MX loops
> relay     unix  -       -       -       -       -       smtp
>         -o smtp_fallback_relay=
> #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
> showq     unix  n       -       -       -       -       showq
> error     unix  -       -       -       -       -       error
> retry     unix  -       -       -       -       -       error
> discard   unix  -       -       -       -       -       discard
> local     unix  -       n       n       -       -       local
> virtual   unix  -       n       n       -       -       virtual
> lmtp      unix  -       -       -       -       -       lmtp
> anvil     unix  -       -       -       -       1       anvil
> scache    unix  -       -       -       -       1       scache
> #
> # ====================================================================
> # Interfaces to non-Postfix software. Be sure to examine the manual
> # pages of the non-Postfix software to find out what options it wants.
> #
> # Many of the following services use the Postfix pipe(8) delivery
> # agent.  See the pipe(8) man page for information about ${recipient}
> # and other message envelope options.
> # ====================================================================
> #
> # maildrop. See the Postfix MAILDROP_README file for details.
> # Also specify in main.cf: maildrop_destination_recipient_limit=1
> #
> maildrop  unix  -       n       n       -       -       pipe
>   flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
> #
> # See the Postfix UUCP_README file for configuration details.
> #
> uucp      unix  -       n       n       -       -       pipe
>   flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
> ($recipient)
> #
> # Other external delivery methods.
> #
> ifmail    unix  -       n       n       -       -       pipe
>   flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
> bsmtp     unix  -       n       n       -       -       pipe
>   flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender
> $recipient
> scalemail-backend unix  -       n       n       -       2       pipe
>   flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
> ${nexthop} ${user} ${extension}
> mailman   unix  -       n       n       -       -       pipe
>   flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
>   ${nexthop} ${user}
> 
> Ich hoffe ich hab nichts vergessen....

Die Logzeilen von Postfix wären sehr hilfreich aus /var/log/mail.*, die zu
dieser Zeit geloggt wurden.

-- 
Sandy

Antworten bitte nur in die Mailingliste!
PMs bitte an: news-reply2 (@)drobic (.) de



Mehr Informationen über die Mailingliste Postfixbuch-users