[SOLVED] After upgrade to ISPconfig 3.2 "Email Forward" and "Send copy to" dont work ?

Discussion in 'General' started by Arne Ytting, Oct 25, 2020.

  1. Arne Ytting

    Arne Ytting New Member HowtoForge Supporter

    Hi
    After upgrade from ISPconfig 3.1?? to 3.2 "Email Forward" and "Send copy to" when receiving mails from outside the server dont work anymore, any ideas ?
    Receive / Send in webmail roundcube is ok.

    Have made a couple af reboots after update.
    I have used ispconfig_update.sh to upgrade.
    Image = The Perfect Server - Debian 10 (Nginx, BIND, Dovecot, ISPConfig 3.1)
     
  2. Steini86

    Steini86 Active Member

    Have a look at /var/log/mail.log or in ISPC interface "Monitor" -> "Mail log" when you try something that fails and show the logs. How do you determine "don't work"? Do you get an error message? Which one?
     
  3. Arne Ytting

    Arne Ytting New Member HowtoForge Supporter

    Thank you Steini
    I don’t get any error messages when i sending, I just don’t get the copy / forward mail to my external exchange 2010 server / mail address.

    I also find out that I can not send from Outlook 2010 ( ver. 14.0.7258.5000) (also worked before upgrade)
    Sending from Outlook 2020 works but there is a delay on 5-20 minutes before I get the mail on my exchange, sending to hotmail or gmail works immediately?

    After I installed The Perfect Server I have only used the command ispconfig_update.sh to upgrade, I don’t know if I have to upgrade anything else ?

    I found some error / failure messages in the log, but don’t know much about it.
    Here are some lines from the mail log:
    Code:
    Oct 26 16:24:44 saturn2 postfix/smtpd[8664]: SSL_accept error from mail.***.dk[2.107.***.***]: -1
    Oct 26 16:24:44 saturn2 postfix/smtpd[8664]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 16:24:44 saturn2 postfix/smtpd[8664]: lost connection after STARTTLS from mail.***.dk[2.107.***.***]
    Oct 26 16:24:44 saturn2 postfix/smtpd[8664]: disconnect from mail.***.dk[2.107.***.***] ehlo=1 starttls=0/1 commands=1/2
    
    Oct 26 16:24:44 saturn2 postfix/smtpd[8753]: connect from mail.****.dk[2.107.***.***]
    Oct 26 16:24:44 saturn2 postfix/smtpd[8753]: NOQUEUE: filter: RCPT from mail.***.dk[2.107.***.***]: <**@***.dk>: Sender address triggers FILTER lmtp:[127.0.0.1]:10026; from=<**@***.dk> to=<[email protected]******.dk> proto=ESMTP helo=<remote.***.dk>
    Oct 26 16:24:44 saturn2 postfix/smtpd[8753]: NOQUEUE: filter: RCPT from mail.***.dk[2.107.***.***]: <**@***.dk>: Sender address triggers FILTER lmtp:[127.0.0.1]:10024; from=<**@***.dk> to=<[email protected]******.dk> proto=ESMTP helo=<remote.***.dk>
    Oct 26 16:24:44 saturn2 postfix/cleanup[6679]: BA192812CD: message-id=<[email protected]***.dk>
    Oct 26 16:24:44 saturn2 postfix/smtpd[8753]: NOQUEUE: reject: RCPT from mail.***.dk[2.107.***.***]:: 450 4.1.1 <[email protected]******.dk>: Recipient address rejected: unverified address: Cannot start TLS: handshake failure; from=<**@***.dk> to=<[email protected]******.dk> proto=ESMTP helo=<remote.***.dk>
    Oct 26 16:24:44 saturn2 postfix/smtpd[8753]: disconnect from mail.***.dk[2.107.***.***]: ehlo=1 mail=1 rcpt=0/1 quit=1 commands=3/4
    Oct 26 16:24:44 saturn2 postfix/qmgr[986]: BA192812CD: from=<[email protected]***.dk>, size=238, nrcpt=1 (queue active)
    Oct 26 16:24:44 saturn2 postfix/smtp[8771]: SSL_connect error to mail.***.dk[2.107.***.***]:25: lost connection
    Oct 26 16:24:45 saturn2 postfix/smtp[8771]: BA192812CD: to=<**@***.dk>, orig_to=<[email protected]******.dk>, relay= mail.***.dk[2.107.***.***]:25, delay=0.23, delays=0.04/0/0.19/0, dsn=4.7.5, status=undeliverable (Cannot start TLS: handshake failure)
    Oct 26 16:24:45 saturn2 postfix/qmgr[986]: BA192812CD: removed
    
    And here are some from Mail Warn log:
    Code:
    Oct 26 17:11:10 saturn2 postfix/smtpd[11468]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:11:15 saturn2 postfix/smtpd[11331]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:11:21 saturn2 postfix/smtpd[11331]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:11:26 saturn2 postfix/smtpd[11331]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:12:10 saturn2 postfix/smtpd[11331]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:12:15 saturn2 postfix/smtpd[11470]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:12:22 saturn2 postfix/smtpd[9953]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:12:27 saturn2 postfix/smtpd[9953]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:13:02 saturn2 postfix/smtps/smtpd[9537]: warning: unknown[212.70.149.**9]: SASL LOGIN authentication failed: UGF*********
    Oct 26 17:13:11 saturn2 postfix/smtpd[9953]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:13:16 saturn2 postfix/smtpd[11470]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:13:23 saturn2 postfix/smtpd[11331]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:13:28 saturn2 postfix/smtpd[11470]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:13:44 saturn2 postfix/smtpd[11331]: warning: unknown[212.70.149.**4]: SASL LOGIN authentication failed: UGF*********
    Oct 26 17:14:07 saturn2 postfix/smtpd[11468]: warning: unknown[212.70.149.**4]: SASL LOGIN authentication failed: UGF*********
    Oct 26 17:14:11 saturn2 postfix/smtpd[11470]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:14:14 saturn2 postfix/smtpd[11331]: warning: unknown[212.70.*49.**5]: SASL LOGIN authentication failed: UGF*********
    Oct 26 17:14:16 saturn2 postfix/smtpd[9332]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:14:24 saturn2 postfix/smtpd[11470]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:14:29 saturn2 postfix/smtpd[9953]: warning: TLS library problem: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2267:
    Oct 26 17:14:31 saturn2 postfix/smtpd[9332]: warning: unknown[212.70.*49.**4]: SASL LOGIN authentication failed: UGF*********
    Oct 26 17:14:37 saturn2 postfix/smtpd[11331]: warning: unknown[212.70.*49.**5]: SASL LOGIN authentication failed: UGF*********
    Oct 26 17:14:59 saturn2 postfix/smtps/smtpd[9537]: warning: unknown[212.70.*49.**9]: SASL LOGIN authentication failed: UGF*********
    Oct 26 17:15:00 saturn2 postfix/smtpd[11468]: warning: unknown[212.70.*49.**5]: SASL LOGIN authentication failed: UGF*********
    
     
    Last edited: Oct 26, 2020
  4. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Did you reconfigure services on update?

    It could be that TLSv1 or TLSv1.1 was used. TLSv1 and TLSv1.1 does not work in 3.2 because there are no ciphers for them in the Postfix config. You can add them:
    Code:
    nano /etc/postfix/main.cf
    And then replacing
    Code:
    tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    tls_preempt_cipherlist = no
    with
    Code:
    tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
    tls_preempt_cipherlist = yes
    This will be fixed in 3.2.1 aswell.
     
  5. Arne Ytting

    Arne Ytting New Member HowtoForge Supporter

    Thank you so much Th0m
    Looks like everything is working again :):)

    No i did not reconfigure services on update.
    And your guide was easy to use, when like me i dont know anything about it o_O thanks again.:)
     
    Th0m likes this.
  6. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    No problem, I'm glad it works again :)
     
  7. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    There were significant changes in postfix config, you can expect to find other issues until you reconfigure services.
     
  8. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Upgrading the operating system packages is also needed. On debian it is done like this as root:
    Code:
    apt update
    apt upgrade
    ISPConfig Panel tab Monitor shows you when there are updates available for the OS.
     
  9. Arne Ytting

    Arne Ytting New Member HowtoForge Supporter

    Wow thank you Taleman, there was 214 Packages that needed upgrade
    If i run these 3 commands in the future, it will upgrade all that is necessary on the server ?
    ispconfig_update.sh
    apt update
    apt upgrade

    Jesse how do i reconfigure services ?
     
  10. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Most of the time yes. Sometimes there is an update that involves removing or adding a package, then apt dist-upgrade or apt full-upgrade is needed.
    I tend to install unattended-upgrades and configure it to install the usual updates, then I only have to worry about the exceptions when dist-upgrade is needed.
    Download the ISPConfig installation package for your version of ISPConfig, then run the following commands and choose reconfigure services when it asks for that. The commands can be copied from the end of every ISPConfig release notes.
    Code:
    cd /tmp
    wget https://www.ispconfig.org/downloads/ISPConfig-3.2.tar.gz
    tar xvfz ISPConfig-3.2.tar.gz
    cd ispconfig3_install/install
    php -q update.php
     
    Jesse Norell likes this.
  11. Arne Ytting

    Arne Ytting New Member HowtoForge Supporter

    Thanks for the the guide, it went well, i just had to edit /etc/postfix/main.cf again after reconfigure services.
    Hope i got everything updated now, and no more errors :)
     
  12. pongraczi

    pongraczi Member

    Hi,
    Should I use the same cipher list for dovecot, too?
    ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA

    It seems some clients just failed to connect to the imap service with the following error message:
    TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
    Thanks
     

Share This Page