Virtual Users And Domains With Postfix, Courier And MySQL - TLS not working

[c4rdinal]

Hi,

I noticed that TLS is not working:

telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.domain.com ESMTP Postfix
ehlo localhost
250-mail.domain.com
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN


I cannot find STARTTLS.

/var/log/mail.log indicates:

Apr 17 22:41:35 mail postfix/smtpd[4679]: connect from localhost[127.0.0.1]
Apr 17 22:46:35 mail postfix/smtpd[4679]: SSL_accept error from localhost[127.0.0.1]: -1
Apr 17 22:46:35 mail postfix/smtpd[4679]: lost connection after STARTTLS from localhost[127.0.0.1]

mail:/etc/postfix/ssl# openssl s_client -connect localhost:25 -starttls smtp
CONNECTED(00000003)
5480:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:


What could be the problem?

TIA

[topdog]

handshake failure is usually a problem with the certificates, check the postfix logs for that particular time should get some indication of what is wrong

[c4rdinal]

Originally Posted by topdog

handshake failure is usually a problem with the certificates, check the postfix logs for that particular time should get some indication of what is wrong

Postfix logs:

#/var/log/mail.log

Apr 17 22:41:35 mail postfix/smtpd[4679]: connect from localhost[127.0.0.1]
Apr 17 22:46:35 mail postfix/smtpd[4679]: SSL_accept error from localhost[127.0.0.1]: -1
Apr 17 22:46:35 mail postfix/smtpd[4679]: lost connection after STARTTLS from localhost[127.0.0.1]

# netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:55555 0.0.0.0:* LISTEN 2106/perl
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1990/mysqld
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1664/portmap
tcp 0 0 0.0.0.0:2416 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:2801 0.0.0.0:* LISTEN 2426/rpc.statd
tcp 0 0 0.0.0.0:113 0.0.0.0:* LISTEN 2279/inetd
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 2106/perl
tcp 0 0 0.0.0.0:125 0.0.0.0:* LISTEN 5436/master
tcp6 0 0 :::993 :::* LISTEN 4524/couriertcpd
tcp6 0 0 :::995 :::* LISTEN 4414/couriertcpd
tcp6 0 0 :::110 :::* LISTEN 4366/couriertcpd
tcp6 0 0 :::143 :::* LISTEN 4486/couriertcpd
tcp6 0 0 :::80 :::* LISTEN 2465/apache2
tcp6 0 0 :::22 :::* LISTEN 2370/sshd
tcp6 0 0 :::125 :::* LISTEN 5436/master

[topdog]

Are you sure that is all that is being logged ?

[c4rdinal]

Originally Posted by topdog

Are you sure that is all that is being logged ?

Yes, that's all you can see as far as the command:

# openssl s_client -connect localhost:25 -starttls smtp
CONNECTED(00000003)
5480:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

Postfix Logs: /var/log/mail.log

Apr 17 22:41:35 mail postfix/smtpd[4679]: connect from localhost[127.0.0.1]
Apr 17 22:46:35 mail postfix/smtpd[4679]: SSL_accept error from localhost[127.0.0.1]: -1
Apr 17 22:46:35 mail postfix/smtpd[4679]: lost connection after STARTTLS from localhost[127.0.0.1]

#telnet localhost 25

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.domain.com ESMTP Postfix
ehlo domain.com
250-mail.domain.com
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye


Postfix Logs: /var/log/mail.log

Apr 18 00:25:34 mail postfix/smtpd[5615]: connect from localhost[127.0.0.1]
Apr 18 00:26:02 mailpostfix/smtpd[5615]: disconnect from localhost[127.0.0.1]
Apr 18 00:29:46 mail postfix/smtpd[5618]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
Apr 18 00:29:46 mail postfix/smtpd[5618]: connect from localhost[127.0.0.1]
qApr 18 00:30:04 mail postfix/smtpd[5618]: disconnect from localhost[127.0.0.1]

[topdog]

What of syslog ?

[falko]

Can you re-do chapter 5 from http://www.howtoforge.com/virtual_us...debian_etch_p2 ?

[c4rdinal]

Hi Falko,

redoing chap. 5 didn't do anything. Same problem.

Maybe, I should reinstall and redo everything from scratch.

Thank you so much for your support.