John Baker wrote:
Ok, that could be it.
The main culprit I am trying to figure out is Entourage (I just noticed
a bunch of messages on that I should look through).
The log for it looks like this:
Dec 11 14:49:48 arnold postfix/smtpd[6341]: connect from
c-24-63-203-109.hsd1.nh.comcast.net[24.63.203.109]
Dec 11 14:49:48 arnold postfix/smtpd[6341]: lost connection after EHLO
from c-24-63-203-109.hsd1.nh.comcast.net[24.63.203.109]
Dec 11 14:49:48 arnold postfix/smtpd[6341]: disconnect from
c-24-63-203-109.hsd1.nh.comcast.net[24.63.203.109]
Dec 11 14:56:28 arnold postfix/smtpd[4671]: connect from
c-24-63-203-109.hsd1.nh.comcast.net[24.63.203.109]
Dec 11 14:56:28 arnold postfix/smtpd[4671]: setting up TLS connection
from c-24-63-203-109.hsd1.nh.comcast.net[24.63.203.109]
Dec 11 14:56:29 arnold postfix/smtpd[4671]: TLS connection established
from c-24-63-203-109.hsd1.nh.comcast.net[24.63.203.109]: TLSv1 with
cipher DES-CBC3-SHA (168/168 bits)
Dec 11 14:56:29 arnold postfix/smtpd[4671]: lost connection after EHLO
from c-24-63-203-109.hsd1.nh.comcast.net[24.63.203.109]
Dec 11 14:56:29 arnold postfix/smtpd[4671]: disconnect from
c-24-63-203-109.hsd1.nh.comcast.net[24.63.203.109]
The error I am getting now is that the server does not support any of
the authentication methods. Before I was getting a greylist "try later"
message. I think it is trying on port 25.
Wrapper mode is not on and if I try Thunderbird with SSL it does default
to that port which is open in the firewall. But I get no attempted TLS
connection. My syslog just tracks that the ip/mac address is hitting it.
I notice in my log that there is one other instance of 168 DES ciphers
that appears to be failing while all other types appear to be working.
Could that be the issue? If so how do I fix it?
[please don't top-post]
You have two possible problems - TLS and authentication. Try
to separate them to see which one is working.
Remove the "smtpd_tls_auth_only = yes" setting from main.cf
temporarily and see if your client can authenticate without
TLS. Then try submitting mail using TLS without authentication.
The DES-CBC3-SHA 168 bit cypher seems reasonably common (here,
nearly 10% of connections) so I don't think that's the problem
unless your OpenSSL is broken. You can (temporarily) disable
this cypher with
smtpd_tls_exclude_ciphers = DES-CBC3-SHA
but you probably shouldn't, disabling cyphers can cause
interoperability problems.
If you have a recent postfix you can adjust the syslog name of
the different master.cf services so postfix logs which service
was used. Cheap example:
submission ... smtpd
-o syslog_name=postfix-submission
I still think you should enable the smtps port 465 with
wrappermode to support legacy MS clients. There should be a
commented-out smtps entry in your master.cf. You may also
need to adjust your firewall settings.
But the smtps thingy won't help T-bird. That sounds as if you
have a problem with your authentication. Make sure your
server offers both PLAIN and LOGIN auth mechanisms, and during
testing nothing else.
You can test your TLS connection with openssl s_client; note
that s_client is not a direct replacement for telnet, so might
give "unexpected" (but documented) behavior if you try to do a
whole SMTP session.
# openssl s_client -connect hostname:25 -starttls smtp
(after a bunch of TLS handshake info you should get the 220
greeting banner). Entering "ehlo fred" should give the server
response including the AUTH mechanisms supported. That's
enough to tell that TLS is very likely working correctly, so
you can enter "quit".
--
Noel Jones
