On 13/10/15 04:41, Viktor Dukhovni wrote: > On Tue, Oct 13, 2015 at 02:11:59AM +0100, niya levi wrote: > >> I can connect to smtpd and SASL with TLS on port 25, >> but port 587 only responds with connected, then hangs >> for a while, then quits without any certificate activity. >> Is my submission section in master.cf incorrect? > Perhaps, but you're not using it. > >> (port 587) >> >> Oct 13 00:51:07 testy postfix/smtps/smtpd[23482]: connect from >> testy.tissisat.co.uk[10.2.1.10] >> Oct 13 00:51:24 testy postfix/smtps/smtpd[23482]: SSL_accept error from >> testy.tissisat.co.uk[10.2.1.10]: lost connection >> Oct 13 00:51:24 testy postfix/smtps/smtpd[23482]: lost connection after >> CONNECT from testy.tissisat.co.uk[10.2.1.10] >> Oct 13 00:51:24 testy postfix/smtps/smtpd[23482]: disconnect from >> testy.tissisat.co.uk[10.2.1.10] commands=0/0 > This service is using "wrapper mode" (fails SSL_accept right after > connect), and its syslog_name is "postfix/smtps". > >> nano /etc/postfix/master.cf >> # ========================================================================== >> # service type private unpriv chroot wakeup maxproc command + args >> # (yes) (yes) (yes) (never) (100) >> # ========================================================================== >> smtp inet n - n - - smtpd >> smtp inet n - n - - smtpd > You probably don't need two of these. > >> submission inet n - n - - smtpd >> -o syslog_name=postfix/submission >> -o smtpd_tls_security_level=encrypt >> -o smtpd_sasl_auth_enable=yes >> -o smtpd_reject_unlisted_recipient=no >> -o smtpd_sasl_security_options=noanonymous >> -o smtpd_sasl_local_domain=testy.tissisat.co.uk >> -o smtpd_client_restrictions=permit_sasl_authenticated,reject >> -o smtpd_sender_login_maps=proxy:pgsql:/etc/postfix/pgsql-boxes.cf >> -o >> smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,permit_mynetwo$ >> -o smtpd_sasl_tls_security_options=noanonymous >> -o smtpd_sasl_type=dovecot >> -o smtpd_sasl_path=private/auth >> -o milter_macro_daemon_name=ORIGINATING > This master.cf definition does not enable wrapper mode, and its > syslog_name is postfix/submission. > > So the logs you posted are for some other service (perhaps port > 465, not shown in your master.cf extract). >
Hi Victor thanks for your reply the two smtp lines is a cut and paste error , there is only one line, after you mentioned wrapper mode and the syslog name i figured out the problem i had the following in master.cf # smtps inet n - n - - smtpd -v -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_tls_auth_only=no -o smtpd_sasl_security_options=noanonymous -o smtpd_sasl_local_domain=testy.tissisat.co.uk -o smtpd_sender_login_maps=proxy:pgsql:/etc/postfix/pgsql-boxes.cf -o smtpd_sender_restrictions=reject_sender_login_mismatch -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_non_fqdn_recipient,reject_unknown_recipient_dom$ -o smtpd_sasl_security_options=noanonymous -o smtpd_sasl_tls_security_options=noanonymous -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o milter_macro_daemon_name=ORIGINATING after removing the whole section, submission now works, i was under the impression that commenting the first line commented out the options also. thanks again shadrock
