Re: unencrypted mail problem

Mehmet <[email protected]> Fri, 11 Sep 2020 16:48:20 +0300

Newsgroups	gmane.comp.jakarta.james.user
Message-ID	<[email protected]>

Hi Matt, thank you very much for your response.,

We tried every possible configuration but still failing. It seems a general bug or we are missing a simple detail.

 <mailet match="All" class="RemoteDelivery">
                <outgoingQueue>outgoing</outgoingQueue>
                <delayTime>5000, 100000, 500000</delayTime>
                <maxRetries>25</maxRetries>
                <maxDnsProblemRetries>0</maxDnsProblemRetries>
                <deliveryThreads>10</deliveryThreads>
                <sendpartial>true</sendpartial>
                <bounceProcessor>bounces</bounceProcessor>
                <startTLS>true</startTLS>
            </mailet>
Regards.






> cryptearth <[email protected]> şunları yazdı (9 Eyl 2020 21:16):
> 
> Hello Mehmet,
> 
> this is an easy topic.
> 
> Why this happens?
> By RFC a SMTP server has to accept incomming unencrypted connections on TCP/25, as this is the default SMTP port. It depends on the server if and what features to support. Some may be configured to only accept mails from other servers, some may configured to only accept user connections (which today is done via TCP/465 and TCP/587), but usually pretty much anything the SMTP server is capable of is supported on this default port.
> As E-Mail was invented when the internet still was just a research project and not many had even access to it, and standards like TLS were invetend decades later, even todays server which comply with the original SMTP accept unencrypted connections.
> So, why does Google complain about an e-mail was dropped over an unsecured connection?
> Although no user credentials are transmitted when one server drops a mail on another server the message body itself could contain data one might want to protected against eavesdroppers or modification.
> To ensure that the mail isn't read or modified on the way between the sending server and the receiving one this connection can be encrypted the same way as a mail client can encrypte its connection to the server: StartTLS.
> James does support to enable outgoing StartTLS via config. The file in question is <james-home>/conf/mailetcontainer.xml which, as by its file extension, is a structured xml file. Within it there's a section starting with
> <processor state="transport">
> Within the transport processor you will find this:
> <mailet match="All" class="RemoteDelivery">
> This section is responsible what happens when james has figured a mail has to go outbound to another server. To enable outgoing StartTLS just add this line:
> <startTLS>true</startTLS>
> In my config it looks like this:
> 
> <processor state="transport" enableJmx="true">
> ... some stuff
> <mailet match="All" class="RemoteDelivery">
>           <outgoing>outgoing</outgoing>
>           <startTLS>true</startTLS>
> ... the rest
> 
> This way when james sees the StartTLS extension after EHLO it will use it to establish a secured channel before dropping in the mail. This will get rid of gmail complain about a mail was dropped in via an unsecured connection.
> One note: For what ever reason it is important that the spelling is correct: It HAS TO be lowercase "start" and uppercase "TLS": "startTLS" - any other spelling will just be ignored or may throw an error at start up.
> 
> Does it increase the overall security? Well, the only thing you may protect against is that someone along the wire between your server and the nearest google mail server may read or modify the mail - but as it rely on seeing the starttls after EHLO anyone able to modify the connection can just drop it which will force james to use a regular unencrypted connection. There're some DNS records which could be used to enforce encryption, like DANE and others, but unless you use MTAs which make actual use of them and have domains providing the required records it's still just a possibility - there's no way to enforce encrypted connections yet. TLDR: If you want to secure your mails use something like S/MIME or PGP/GnuPG. StartTLS is just to secure the communication channel itself.
> 
> 
> greetings from Germany,
> 
> Matt
> 
> Am 09.09.2020 um 16:35 schrieb Mehmet:
>> Hi there, does anyone experienced unencrypted mail problem? We are sending to gmail but says unencrypted. we are using 3.5 dockerisied version. We tried some config changes but did not worked so far.
>> 
>> Any help / professional support would be appreciated.
>> 
>> Regards.
>> 
>> Mehmet
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

conf_mailetcontainer.xml (application/xml, 12.6 KB)

<?xml version="1.0"?>

<!--
  Licensed to the Apache Software Foundation (ASF) under one
  or more contributor license agreements.  See the NOTICE file
  distributed with this work for additional information
  regarding copyright ownership.  The ASF licenses this file
  to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance
  with the License.  You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing,
  software distributed under the License is distributed on an
  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  KIND, either express or implied.  See the License for the
  specific language governing permissions and limitations
  under the License.
 -->
<data-source name="maildb" class="org.apache.james.util.mordred.JdbcDataSource">
  <driver>org.gjt.mm.mysql.Driver</driver>
  <dburl>jdbc:mysql://mysql/etomMail</dburl>
  <user>root</user>
  <password>etomMailDbpassword</password>
  <max>20</max>
</data-source>

<mailetpackages> 
    <mailetpackage>org.apache.james.transport.mailets</mailetpackage>
    <mailetpackage>org.apache.james.transport.mailets.smime</mailetpackage> 
</mailetpackages>

<matcherpackages> 
    <matcherpackage>org.apache.james.transport.matchers</matcherpackage>
    <matcherpackage>org.apache.james.transport.matchers.smime</matcherpackage> 
</matcherpackages>

<mailet match="All" class="RemoteDelivery">
                <outgoingQueue>outgoing</outgoingQueue>
                <delayTime>5000, 100000, 500000</delayTime>
                <maxRetries>25</maxRetries>
                <maxDnsProblemRetries>0</maxDnsProblemRetries>
                <deliveryThreads>10</deliveryThreads>
                <sendpartial>true</sendpartial>
                <bounceProcessor>bounces</bounceProcessor>
                <startTLS>true</startTLS>
            </mailet>

<mailetcontainer enableJmx="true">

    <context>
        <postmaster>[email protected]</postmaster>
    </context>

    <spooler>
        <threads>20</threads>
    </spooler>

    <processors>
        <processor state="root" enableJmx="true">
            <mailet match="All" class="PostmasterAlias"/>
            <mailet match="RelayLimit=30" class="Null"/>


            <!-- Check attachment extensions for possible viruses -->
            <!-- Do an antivirus scan -->
            <mailet match="All" class="ClamAVScan" onMailetException="ignore">
                <host>clamav</host>
            <debug>true</debug>
            </mailet>

            <!-- If infected go to virus processor -->
            <mailet match="HasMailAttributeWithValue=org.apache.james.infected, true" class="ToProcessor">
            <processor> virus </processor>
            </mailet>

            <!-- Check attachment extensions for possible viruses -->
            <mailet match="AttachmentFileNameIs=-d -z *.exe *.com *.bat *.cmd *.pif *.scr *.vbs *.avi *.mp3 *.mpeg *.shs" class="ToProcessor">
            <processor> bad-extensions </processor>
            </mailet>

            <!-- Anti-spam processing -->
            <!-- The following two entries avoid double anti-spam analysis -->
            <!-- for forwarded messages. -->
            <!-- Has spam checking already been done? -->
            <mailet match="HasMailAttribute=spamChecked" class="ToProcessor">
                <processor>transport</processor>
            </mailet>
            <!-- Spam checking will not be done twice -->
            <mailet match="All" class="SetMailAttribute">
                <spamChecked>true</spamChecked>
            </mailet>

            <!-- Anti spam bayesian analysis -->
            <mailet match="All" class="BayesianAnalysis" onMailetException="ignore">
            <repositoryPath>db://maildb</repositoryPath>
            <maxSize>200000</maxSize>
            <headerName>X-MessageIsSpamProbability</headerName>
            <ignoreLocalSender>true</ignoreLocalSender>
            </mailet>

            <mailet match="CompareNumericHeaderValue=X-MessageIsSpamProbability > 0.9" class="SetMailAttribute" onMatchException="noMatch">
                <isSpam>true</isSpam>
            </mailet>
            <mailet match="CompareNumericHeaderValue=X-MessageIsSpamProbability > 0.9" class="SetMimeHeader" onMatchException="noMatch">
                <name>X-MessageIsSpam</name>
                <value>true</value>
            </mailet>
            <mailet match="CompareNumericHeaderValue=X-MessageIsSpamProbability > 0.9" class="ToProcessor" onMatchException="noMatch">
                <processor>spam</processor>
                <notice>Spam not accepted</notice>
            </mailet>

            <mailet notmatch="SenderHostIsLocal" class="SpamAssassin">
                <spamdHost>spam</spamdHost>
                <spamdPort>783</spamdPort>
            </mailet>

            <mailet match="IsSMIMEEncrypted" class="SMIMEDecrypt">
                <keyStoreType>pkcs12</keyStoreType>
                <keyStoreFileName>/root/james/cert/keystore.jks</keyStoreFileName>
                <keyStorePassword>jameskokpit</keyStorePassword>
                <keyAlias>james</keyAlias>
                <keyAliasPassword>jameskokpit</keyAliasPassword>
            </mailet>

            <mailet match="IsSMIMESigned" class="SMIMECheckSignature">
                <keyStoreType>pkcs12</keyStoreType>
                <keyStoreFileName>/root/james/cert/keystore.jks</keyStoreFileName>
                <keyStorePassword>jameskokpit</keyStorePassword>
                <strip>false</strip>
                <onlyTrusted>true</onlyTrusted> 
            </mailet>

            <mailet match="HasMailAttribute=org.apache.james.SMIMECheckSignature" class="ToProcessor">
                <processor>transport</processor> 
            </mailet>

            <mailet match="HasMailAttribute=org.apache.james.SMIMECheckSignature" class="SetMimeHeader"> 
                <name>X-WasSigned</name>
                <value>true</value> 
            </mailet> 

            <mailet match="All" class="SMIMESign" onMailetException="ignore">
                <keyStoreType>pkcs12</keyStoreType>
                <keyStoreFileName>/root/james/cert/keystore.jks</keyStoreFileName>
                <keyStorePassword>jameskokpit</keyStorePassword>
                <keyAlias>james</keyAlias>
                <keyAliasPassword>jameskokpit</keyAliasPassword>
                <signerName>Kokpit Mail Trusted Server</signerName>
                <rebuildFrom>true</rebuildFrom>
                <postmasterSigns>true</postmasterSigns>
                <debug>true</debug> 
            </mailet>

            <mailet match="All" class="ToProcessor">
                <processor>transport</processor>
            </mailet>
        </processor>

        <processor state="error" enableJmx="true">
            <mailet match="All" class="MetricsMailet">
                <metricName>mailetContainerErrors</metricName>
            </mailet>
            <mailet match="All" class="Bounce"/>
            <mailet match="All" class="ToRepository">
                <repositoryPath>cassandra://var/mail/error/</repositoryPath>
            </mailet>
        </processor>

        <processor state="transport" enableJmx="true">

            <matcher name="relay-allowed" match="org.apache.james.mailetcontainer.impl.matchers.Or">
                <matcher match="SMTPAuthSuccessful"/>
                <matcher match="SMTPIsAuthNetwork"/>
                <matcher match="SentByMailet"/>
                <matcher match="org.apache.james.jmap.mailet.SentByJmap"/>
            </matcher>

            <mailet match="All" class="RemoveMimeHeader">
                <name>bcc</name>
                <onMailetException>ignore</onMailetException>
            </mailet>
            <mailet match="All" class="RecipientRewriteTable">
                <errorProcessor>rrt-error</errorProcessor>
            </mailet>
            <mailet match="RecipientIsLocal" class="org.apache.james.jmap.mailet.VacationMailet"/>
            <mailet match="RecipientIsLocal" class="Sieve"/>
            <mailet match="RecipientIsLocal" class="AddDeliveredToHeader"/>
            <mailet match="RecipientIsLocal" class="org.apache.james.jmap.mailet.filter.JMAPFiltering"/>
            <mailet match="RecipientIsLocal" class="LocalDelivery"/>
            <!--
            <mailet match="HostIsLocal" class="ToProcessor">
                <processor>local-address-error</processor>
                <notice>550 - Requested action not taken: no such user here</notice>
            </mailet>
            -->
            <mailet match="All" class="RemoteDelivery">
                <outgoingQueue>outgoing</outgoingQueue>
                <delayTime>5000, 100000, 500000</delayTime>
                <maxRetries>25</maxRetries>
                <maxDnsProblemRetries>0</maxDnsProblemRetries>
                <deliveryThreads>10</deliveryThreads>
                <sendpartial>true</sendpartial>
                <bounceProcessor>bounces</bounceProcessor>
                <startTLS>true</startTLS>
            </mailet>
            
            <mailet match="All" class="ToProcessor">
                <processor>relay-denied</processor>
            </mailet>

        </processor>

        <processor state="local-address-error" enableJmx="true">
            <mailet match="All" class="MetricsMailet">
                <metricName>mailetContainerLocalAddressError</metricName>
            </mailet>
            <mailet match="All" class="Bounce">
                <attachment>none</attachment>
            </mailet>
            <mailet match="All" class="ToRepository">
                <repositoryPath>cassandra://var/mail/address-error/</repositoryPath>
            </mailet>
        </processor>

        <processor state="relay" enableJmx="true">
            <mailet match="All" class="RemoteDelivery">
                <outgoingQueue>outgoing</outgoingQueue>
                <delayTime>5000, 100000, 500000</delayTime>
                <maxRetries>25</maxRetries>
                <maxDnsProblemRetries>0</maxDnsProblemRetries>
                <deliveryThreads>10</deliveryThreads>
                <sendpartial>true</sendpartial>
                <bounceProcessor>bounces</bounceProcessor>
                <startTLS>true</startTLS>
            </mailet>
        </processor>

        <processor state="relay-denied" enableJmx="true">
            <mailet match="All" class="MetricsMailet">
                <metricName>mailetContainerRelayDenied</metricName>
            </mailet>
            <mailet match="All" class="Bounce">
                <attachment>none</attachment>
            </mailet>
            <mailet match="All" class="ToRepository">
                <repositoryPath>cassandra://var/mail/relay-denied/</repositoryPath>
                <notice>Warning: You are sending an e-mail to a remote server. You must be authenticated to perform such an operation</notice>
            </mailet>
        </processor>

        <processor state="bounces" enableJmx="true">
            <mailet match="All" class="MetricsMailet">
                <metricName>bounces</metricName>
            </mailet>
            <mailet match="All" class="DSNBounce">
                <passThrough>false</passThrough>
            </mailet>
        </processor>

        <processor state="rrt-error" enableJmx="false">
            <mailet match="All" class="ToRepository">
                <repositoryPath>cassandra://var/mail/rrt-error/</repositoryPath>
                <passThrough>true</passThrough>
            </mailet>
            <mailet match="IsSenderInRRTLoop" class="Null"/>
            <mailet match="All" class="Bounce"/>
        </processor>

	<processor state="spam" enableJmx="true">
		<mailet match="RecipientIsLocal" class="ToRecipientFolder">
           		<folder>Junk</folder>
   		        <consume>false</consume>
   		</mailet>
		<mailet match="All" class="ToRepository">
			 <repositoryPath>cassandra://var/mail/spam/</repositoryPath>
		</mailet>
	</processor>
    

        <!-- Messages containing viruses -->
        <processor name="virus"  enableJmx="true">

           <!-- To avoid a loop while bouncing -->
           <mailet match="All" class="SetMailAttribute">
              <org.apache.james.infected>true, bouncing</org.apache.james.infected>
           </mailet>

           <mailet match="SMTPAuthSuccessful" class="Bounce">
              <sender>[email protected]</sender>
              <inline>heads</inline>
              <attachment>none</attachment>
              <notice>Warning: We were unable to deliver the message below because it was found infected by virus(es).</notice>
           </mailet>
         
           <mailet match="All" class="Null"/>
        </processor>

    </processors>

</mailetcontainer>