Re: Mail relaying on postfix using the Jamm environemnt

It looks as though my certificates are bad - strange as they are the ones I 
used for setting up imap with Jamm, and imap works fine.

Still, I entered the following command to communicate with postfix tls and 
didn't get the right answer: :

openssl s_client -starttls smtp -connect localhost:25

This command contacts postfix and sets up tls. I should get as the last line 
before "---" and the server's 220: "Verify return code: 19 (self signed 
certificate in certificate chain)". If you
get anything else, your certs are bad or can't be read. The exact text
should tell you what. You can also use the 'openssl s_server' utility
for testing, instead of Postfix.

I actually got 'Verify return code : 21 (unable to verify trhe first 
certificate)

I'll fix this first thing tomorrow.

Boy, is this going to be a fun howto. I've also aged considerably over the 
last 4 days!

Best
Buzz


>From: "buzz lightyear" <[email protected]>
>Reply-To: [email protected]
>To: [email protected]
>Subject: Re: [Jamm-users] Mail relaying on postfix using the Jamm 
>environemnt
>Date: Tue, 25 May 2004 13:10:05 +0000
>
>
>>
>>you did do a "make tidy" before recompiling postfix ??
>>
>>if that doesn't work start with a complete fresh postfix source, patch it 
>>compile it and try again.
>>
>where is your openssl installed ? default /usr/local/ssl ?
>>
>
>I think I'm slowly edging forward.
>
>I've just downloaded and reinstalled openssl (latest version) and postfix 
>(2.1.0) - made sure that when I did a config for openssl that I specified 
>'shared' (that's why ldd didn't show the ssl and crypto libs) and repatched 
>the new postfix with the appropriate patch. So, postfix is referencing the 
>ssl and crypto libs.
>
>TLS is still not making the connection - I used Outlook Explorer this time, 
>which gave an error of :
>
>Unable to establish a SSL connection with the server. Account: 'wotan', 
>Server: 'wotan', Protocol: SMTP, Server Response: '454 TLS not available 
>due to temporary reason', Port: 25, Secure(SSL): Yes, Server Error: 454, 
>Error Number: 0x800CCC7F
>
>Looking at syslog I can see the initial handshake but then a QUIT -
>
>>unknown[192.168.0.4]: 220 backup.example.com ESMTP Postfix
>watchdog_pat: 7c828
>< unknown[192.168.0.4]: EHLO walse
>>unknown[192.168.0.4]: 250-backup.example.com
>>unknown[192.168.0.4]: 250-PIPELINING
>>unknown[192.168.0.4]: 250-SIZE 10240000
>>unknown[192.168.0.4]: 250-VRFY
>>unknown[192.168.0.4]: 250-ETRN
>>unknown[192.168.0.4]: 250-STARTTLS
>match_list_match: unknown: no match
>match_list_match: 192.168.0.4: no match
>>unknown[192.168.0.4]: 250 8BITMIME
>watchdog_pat: 7c828
>< unknown[192.168.0.4]: QUIT
>>unknown[192.168.0.4]: 221 Bye
>disconnect from unknown[192.168.0.4]
>master_notify: status 1
>connection closed
>watchdog_stop: 7c828
>
>
>.. and looking at the patched version of smtpd.c I can see that this is 
>thrown up when !pfixtls_serverengine
>
>Looks like the tls engine can't start
>
>These are my main.cf tls parameters
>## TLS
>#  Transport Layer Security
>#  TLS-Patch by Lutz J„nicke
>#
>smtpd_sasl_auth_enable = yes
>smtpd_use_tls = yes
>smtpd_tls_auth_only = yes
>###smtpd_sasl_local_domain = $myhostname
>broken_sasl_auth_clients = yes
>smtpd_recipient_restrictions = permit_mynetworks, 
>permit_sasl_authenticated, check_relay_domains
>smtpd_sasl_security_options = noanonymous
>smtpd_tls_key_file = /usr/local/ssl/postfix/privatekey.pem
>smtpd_tls_cert_file = /usr/local/ssl/postfix/servercrt.pem
>smtpd_tls_CAfile = /usr/local/ssl/postfix/cacert.pem
>smtpd_tls_loglevel = 3
>smtpd_tls_received_header = yes
>smtpd_tls_session_cache_timeout = 3600s
>tls_random_source = dev:/dev/urandom
>html_directory = no
>
>... the certificates are only readable by user 'postfix'
>
>Gotta keep going
>
>Best
>Buzz
>
>_________________________________________________________________
>Get a FREE connection, FREE modem and one month's FREE line rental, plus a 
>US or European flight when you sign up for BT Broadband!   
>http://www.msn.co.uk/specials/btbroadband
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by: Oracle 10g
>Get certified on the hottest thing ever to hit the market... Oracle 10g. 
>Take an Oracle 10g class now, and we'll give you the exam FREE.
>http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
>_______________________________________________
>Jamm-users mailing list
>[email protected]
>https://lists.sourceforge.net/lists/listinfo/jamm-users

_________________________________________________________________
Express yourself with cool new emoticons http://www.msn.co.uk/specials/myemo



-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click