Based on this guide I am trying to send a test email using telnet from linux
https://linuxconfig.org/send-an-email-using-telnet
but the connection immediately disconnects:
$ telnet smtp.gmail.com 465
Trying 108.177.126.108...
Connected to smtp.gmail.com.
Escape character is '^]'.
MAIL FROM: [email protected] closed by foreign host
How do I keep the connection open long enough to send my test mail?
EDIT #2 What's this error?
Aug 17 02:27:19 mail postfix/smtpd[1197]: lost connection after CONNECT from unknown[x.x.x.x]
Aug 17 02:27:19 mail postfix/smtpd[1197]: disconnect from unknown[x.x.x.x]
Aug 17 02:27:19 mail postfix/smtpd[1199]: lost connection after CONNECT from unknown[x.x.x.x]
Aug 17 02:27:19 mail postfix/smtpd[1199]: disconnect from unknown[x.x.x.x]
EDIT:
telnet localhost 587
Trying ::1...
Connected to localhost.
Escape character is '^]'.
220 SRVMAIL.DOMAIN.com ESMTP Postfix
ehlo localhost
250-mail.breezpack.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
It doesn't show auth settings?
when tried: openssl s_client -starttls smtp -connect srvmail.domain.com:587
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = srvmail.domain.com
verify return:1
---
Certificate chain
0 s:/CN=srvmail.domain.com
i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF8jCCBNqgAgEPADCCAQoCggEBALo77hAsj8p5n47uVXM/fXA7LlRS
NFRFzrOuWb8EE7rrMduIL9AVTLimHCq3b0sBnwDSp5NOx0ZGqWbnglewuP+1kgUB
NQtk5HstOW5h+Gu887QWfWgxYfc4VerhaOmiyWNETLdPDiaaISG
Iieu+Xa2Nwt6CFMB7eG2P2RVDWdrEiBLCxC1c7ucl/RApXpx5KV+xMXjf90CAwEA
AaOCAv0wggL5MGrMIGoghRhZ3JvdXAuYnJlZXpwYWNrLmNvbYIXYnJl
ZXptYWlsLmJyZWV6cGFjay5jb22CEWdwby5icmVlenBhY2suY29tghJpbWFwLmJy
ZWV6cGFjay5jb22CEm1haWwuYnJlZXpwYWNrLmNvbYIScG9wMy5icmVlenBhY2su
Y29tghRzZXJ2ZXIuYnJlZXpwYWNrLmNvbY
-----END CERTIFICATE-----
subject=/CN=srvmail.domain.com
issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
---
No client certificate CA names sent
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3613 bytes and written 462 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 88C59C5E9AB3051912D470E994EEDB3B7124750A8A71DCB3FFE43EA1170EA04C
Session-ID-ctx:
Master-Key: 1250671E949DCC8FC1B37B14BAC0B8359134979A61E0EDB4145F345526FCA5C5E29E10262F134B02E1854C2882DD741F
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
TLS session ticket lifetime hint: 3600 (seconds)
TLS session ticket:
0000 - 78 bf 36 99 bf bc 25 33-22 ed 98 a3 46 21 25 d3 x.6...%3"...F!%.
0050 - df 4c 69 08 45 95 ef 8c-d3 d5 75 c7 30 4f eb c7 .Li.E.....u.0O..
0060 - 82 01 fc 93 83 90 cd ba-d1 6a b8 85 57 99 6f 3b .........j..W.o;
0070 - 36 99 fe bd 8f 3f 32 fc-a5 47 3a 3d fd 99 2e 9b 6....?2..G:=....
0090 - 2f 10 fb 80 ab ca f1 a5-f2 a7 94 c5 41 c7 d3 76 /...........A..v
Start Time: 1597572721
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
250 DSN
but when i try to connect from thunderbird or outlook it says Encryption not detected and it doesn't connect without encryption
So basically it connect with ssl from local server but remotely it doesn't
main.cf
myhostname = srvmail.domain.com
mydomain = domain.com
myorigin = $mydomain
inet_interfaces = all
smtpd_tls_cert_file = /etc/letsencrypt/live/srvmail/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/srvmail/privkey.pem
smtp_tls_CApath = /etc/letsencrypt/live/srvmail/fullchain.pem
smtpd_tls_CApath = /etc/letsencrypt/live/srvmail/fullchain.pem
smtpd_use_tls=yes
smtp_tls_security_level = may
smtpd_tls_ask_ccert = yes
smtpd_tls_security_level = may
smtp_tls_loglevel = 1
smtpd_tls_loglevel = 1
smtpd_tls_security_level=may
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_use_tls=yes
master.cf
smtp inet n - n - - smtpd
submission inet n - n - - smtpd
-o syslog_name=postfix/sumbission
-o smtpd_tls_wrappermode=no
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o mynetworks=127.0.0.0/8
-o smtpd_relay_restrictions=permit_mynetworks,permit_sasl_authenticated,defer_unauth_destination
-o milter_macro_daemon_name=ORIGINATING
Use Case: We have several Eaton PDU/PSUs that don't support SSL/TLS authentication. I was tasked with building a SMTP relay server that can take the basic SMTP/25 emails and forward them to our email provider via SSL.
Note: The relay host makes the smtps connectione on 465 using stunnel.
I am at a point where my SMTP Postfix Relay Server is able to send mail successfully via our email provider, alimail. But I cannot get it to relay emails from other hosts on our network.
/etc/postfix/main.cf
smtpd_banner = mail01v-la ESMTP
inet_interfaces = all
inet_protocols = ipv4
mynetworks = 127.0.0.0/8, 10.96.80.0/24
relayhost = [127.0.0.1]:5000
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CApath = /etc/ssl/certs
smtp_use_tls = no
smtp_generic_maps = regexp:/etc/postfix/generic
/etc/postfix/sasl_passwd
[127.0.0.1]:5000 [email protected]:notifypwd
/etc/postfix/generic
/^root@(.*)$/ [email protected]
/etc/stunnel/stunnel.conf
client = yes
foreground = no
[smtps]
accept = 5000
connect = smtp.mxhichina.com:smtps
SMTP Telnet to Provider
[root@mail01v-la ~]# telnet smtp.mxhichina.com smtp
Trying 205.204.101.152...
Connected to smtp.mxhichina.com.
Escape character is '^]'.
220 smtp.aliyun-inc.com MX AliMail Server
ehlo google.come
250-smtp.aliyun-inc.com
250-STARTTLS
250-8BITMIME
250-AUTH=PLAIN LOGIN XALIOAUTH
250-AUTH PLAIN LOGIN XALIOAUTH
250-PIPELINING
250 DSN
Checking Stunnel Connection
[root@mail01v-la ~]# telnet 127.0.0.1 5000
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 smtp.aliyun-inc.com MX AliMail Server
Sending an Email from the Relay Server
echo "Stack Body" | mail -s "Test Subject for Stack" [email protected]
Results
Feb 14 18:30:29 mail01v-la postfix/pickup[4812]: 3194940DE2: uid=0 from=<root>
Feb 14 18:30:29 mail01v-la postfix/cleanup[4865]: 3194940DE2: message-id=<[email protected]>
Feb 14 18:30:29 mail01v-la postfix/qmgr[2606]: 3194940DE2: from=<[email protected]>, size=481, nrcpt=1 (queue active)
Feb 14 18:30:30 mail01v-la postfix/smtp[4867]: 3194940DE2: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:5000, delay=1.3, delays=0.01/0.01/0.85/0.46, dsn=2.0.0, status=sent (250 Data Ok: queued as freedom)
Feb 14 18:30:30 mail01v-la postfix/qmgr[2606]: 3194940DE2: removed
Random CentOS Server
/etc/postfix/main.cf
relayhost = [10.96.80.126]:5000
Result
Feb 14 18:06:52 test01v-la postfix/pickup[1247]: BB87C305A42F: uid=0 from=<root>
Feb 14 18:06:52 test01v-la postfix/cleanup[1387]: BB87C305A42F: message-id=<[email protected]>
Feb 14 18:06:52 test01v-la postfix/qmgr[1248]: BB87C305A42F: from=<[email protected]>, size=477, nrcpt=1 (queue active)
Feb 14 18:06:53 test01v-la postfix/smtp[1389]: BB87C305A42F: to=<[email protected]>, relay=10.96.80.126[10.96.80.126]:5000, delay=0.78, delays=0.01/0.01/0.61/0.15, dsn=5.0.0, status=bounced (host 10.96.80.126[10.96.80.126] said: 553 authentication is required (in reply to MAIL FROM command))
Eaton PSU
Eaton Result
email[17131]: message error -110 in function smtp_start_session test - (Connection timed out) retrying smtp_start_session test email[17131]: Failed to connect to SMTP server 10.96.80.126:5000 with username [email protected]
This is my first time doing a setup like this. Theres likely a lot of holes in my knowledge that are causing me grief.
In a proper setup, do you even need to re-type credentials for any hosts that want to use the relay server? For example, in the eaton smtp config, should it be the creds of the email used in the sasl file? Or a system account permitted for forwarding with postfix? Or an account name defined in the postfix/generic file? A bit lost.
Is stunnel even the proper way I should be connecting via ssl/tls? I see starttls available in the telnet prompt for smtp.mxhichina.com.
Honestly, I think I'm overcomplicating this or am missing something obvious. If anyone has a better setup to accomodate my use case, it be greatly appreciated as well.
Results
Feb 20 11:27:22 mail01v-la postfix/qmgr[1537]: 6B38AE5EE: from=<[email protected]>, size=479, nrcpt=1 (queue active)
Feb 20 11:27:22 mail01v-la postfix/smtp[1558]: CLIENT wrappermode (port smtps/465) is unimplemented
Feb 20 11:27:22 mail01v-la postfix/smtp[1558]: instead, send to (port submission/587) with STARTTLS
Feb 20 11:27:40 mail01v-la postfix/smtp[1558]: 6B38AE5EE: to=<[email protected]>, relay=smtp.mxhichina.com[205.204.101.152]:465, delay=613, delays=595/0.02/19/0, dsn=4.4.2, status=deferred (lost connection with smtp.mxhichina.com[205.204.101.152] while receiving the initial server greeting)
Feb 20 11:32:22 mail01v-la postfix/qmgr[1537]: A3F736B2: from=<[email protected]>, size=477, nrcpt=1 (queue active)
main.cf
inet_interfaces = all
inet_protocols = ipv4
mynetworks = 127.0.0.0/8, 10.96.80.0/24
relayhost = [smtp.mxhichina.com]:465
smtp_use_tls = yes
smtp_enforce_tls = yes
smtp_tls_wrappermode = yes
soft_bounce = yes
smtp_sasl_auth_soft_bounce = yes
/etc/postfix/sasl_passwd
smtp.mxhichina.com [email protected]:notifypwd
I'm trying to send mails with python so I configured a postfix server locally. The python part seems to work as my mails reach the smtpd server. After that, postfix seems to correctly query the MX record and tries to connect the right dns name.
The problem here seems to be that my postfix server never tries port 465, only 25, fails as the port is closed, then give up until the retry timer resets.
Here is my /etc/postfix/main.cf file. I totally know that I'm not fully aware of what I'm doing
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
# Optional, if you want this postfix to use TLS when acting as a client
smtp_use_tls=yes
smtp_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = yamatetsu
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = yamatetsu, localhost.localdomain, , localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = localhost
Again, all I want is to get my python client to send mail to arbitrary destinations, some of which have port 25 closed. The python client seems to connect through port 25, but I would like postfix to figure out how to reach remote servers itself. I do not want to receive mail and I care little about security since everything will be on a single machine behind a NAT.
I'm running ubuntu 14.04 and I installed with apt-get. I also tried to use self generated tls certificates with openssl, but since the line is prefixed with smtpd I'm not sure it is mandatory or not. I'm not even sure how to see if it is correctly parsed or not.