Maildelivery to user not working on relayed smtp host with port 465

PScherrer · 2022-03-08T09:28:55+00:00

Hi folk,s I've following situation: Mailserver is not a real mailserver, it is only used internal smtp is a relayhost from ISP wiht port 465 (not starttls) M...

PScherrer

Hi folk,s
I've following situation:

Mailserver is not a real mailserver, it is only used internal
smtp is a relayhost from ISP wiht port 465 (not starttls)
Mailboxes are fetched with fetchmail-functionality

Problem:

sending mails out is working as expected
fetching mails is working as expected
transfer incoming mails to usermailbox does not work (Cannot start TLS: handshake failure)

for each message following is logged by postfix:
SSL_connect error to ::1[::1]:24: -1
[2022-03-08 10:17:33.923908]: warning: TLS library problem: error:1408F10B:SSL routines:ssl3_get_record:wrong version number:ssl/record/ssl3_record.c:332:

where I've the missconfiguration? any hints oder tips what I can check?

main.cf:
relayhost = [host]:465
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
#smtpd_sasl_auth_enable = yes

smtp_tls_wrappermode = yes
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_enforce_tls = no

smtpd_use_tls = yes

thanks

crpb

PScherrer

I'm not totally certain but maybe this will help.

relayhost = submissions:[hostname]

or maybe smtps instead of submissions

I only use relayhosts with submission (587) and can't check it here.

PS: And the sasl_passwd should be configured accordingly

EDIT: just looked over the log.. i missed the ::1[::1]:24: -1.. that's the local gromox if i'm not mistaken.
EDIT2: Ok, this is maybe due to smtp_tls_security_level = encrypt. Try it with an empty setting.

This happens because it is forced to encrypt and the local devlivery-queue is not encrypted.

WalterH

Your log snippet shows SSLv3; ssl3_get_record if I remember right, SSLv3 is not supported any longer.

PScherrer

Hi crpb,

I've tried your ideas, but without luck. I receive same error or other errors related to that.
I cannot cahnge security_level because of wrappermode = yes

PScherrer

Hi Walter,

That is a good information, but what I need to change. I really don't know where or what.

crpb

If your external relay only supports the wrapper-mode(465 SMTP via SSL - this is was called back in the day i think) i would suggest using
https://www.postfix.org/postconf.5.html#smtp_tls_per_site
With that you can set per-target-modes and maybe get around the problem.
Reading a bit i think maybe you should use https://www.postfix.org/postconf.5.html#smtp_tls_policy_maps nowadays g.. So many choices.. So many setups...So many versions.... sooo many problems...

I'm lucky only to rely on

smtp_sasl_auth_enable=yes
smtp_sasl_security_options=noanonymous
smtp_sasl_password_maps=lmdb:/etc/postfix/sasl_passwd
smtp_use_tls=yes