On Tue, Oct 13, 2015 at 02:11:59AM +0100, niya levi wrote:
> I can connect to smtpd and SASL with TLS on port 25,
> but port 587 only responds with connected, then hangs
> for a while, then quits without any certificate activity.
> Is my submission section in master.cf incorrect?
Perhaps, but you're not using it.
> (port 587)
>
> Oct 13 00:51:07 testy postfix/smtps/smtpd[23482]: connect from
> testy.tissisat.co.uk[10.2.1.10]
> Oct 13 00:51:24 testy postfix/smtps/smtpd[23482]: SSL_accept error from
> testy.tissisat.co.uk[10.2.1.10]: lost connection
> Oct 13 00:51:24 testy postfix/smtps/smtpd[23482]: lost connection after
> CONNECT from testy.tissisat.co.uk[10.2.1.10]
> Oct 13 00:51:24 testy postfix/smtps/smtpd[23482]: disconnect from
> testy.tissisat.co.uk[10.2.1.10] commands=0/0
This service is using "wrapper mode" (fails SSL_accept right after
connect), and its syslog_name is "postfix/smtps".
> nano /etc/postfix/master.cf
> # ==========================================================================
> # service type private unpriv chroot wakeup maxproc command + args
> # (yes) (yes) (yes) (never) (100)
> # ==========================================================================
> smtp inet n - n - - smtpd
> smtp inet n - n - - smtpd
You probably don't need two of these.
> submission inet n - n - - smtpd
> -o syslog_name=postfix/submission
> -o smtpd_tls_security_level=encrypt
> -o smtpd_sasl_auth_enable=yes
> -o smtpd_reject_unlisted_recipient=no
> -o smtpd_sasl_security_options=noanonymous
> -o smtpd_sasl_local_domain=testy.tissisat.co.uk
> -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> -o smtpd_sender_login_maps=proxy:pgsql:/etc/postfix/pgsql-boxes.cf
> -o
> smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,permit_mynetwo$
> -o smtpd_sasl_tls_security_options=noanonymous
> -o smtpd_sasl_type=dovecot
> -o smtpd_sasl_path=private/auth
> -o milter_macro_daemon_name=ORIGINATING
This master.cf definition does not enable wrapper mode, and its
syslog_name is postfix/submission.
So the logs you posted are for some other service (perhaps port
465, not shown in your master.cf extract).
--
Viktor.
