postfix cannot receive emai [SOLVED]

[jankom]

wrong version number:../openssl-3.0.12/ssl/record/ssl3_record.c:354

My postfix mailserver has been working fine but recently did an eix-sync and now I cannot receive email from the outside world. Sending mail with claws, sendmail or telnet works, but even if I do a telnet - STARTTLS session test email sent to myself the email is not delivered. Here is a relevant section of /var/log/mail.log:

[grknight]

This looks like a client is trying to connect with something less than TLS1.2 which will fail with OpenSSL-3 by default.

Telnet cannot do TLS (unless there's something new I don't know about), but openssl s_client can.

[jankom]

[grknight]

[freke]

I see that a few times a month on my server - for me it's mostly scanners it seems (stretchoid.com)
(And I disable anything below TLSv1.2 in main.cf)

I usually use https://www.checktls.com/TestReceiver to test my setup when changing configs/setup etc.

[jankom]

@ grknight:

[freke]

Could it be the 10.100.0.1 machine have openssl-issues? did you update that, too?

It seems CheckTLS connected fine - but unable to verify ssl-cert.

Can also try to add varbose output to smtpd in /etc/postfix/master.cf

[grknight]

[freke]

[freke]

You can also try to change the output-format on the CheckTLS-site to SSLDetail or Debug to see if that reveals more.

A standard Detail-output on my hosts just gives this

[jankom]

Yes, 10.100.0.1 has the same openssl-3.0.12 as my home mailserver.

Added

[freke]

IIRC multiple -v can be added for increased verbosity if needed.
(and remember to reload with postfix reload )

[jankom]

Verbose mail.log indicates some troubling signs (excerpt):

[jankom]

(1) openssl verify <my email server> fails because of no intermediate certificate, but could not fix it even after re-issuing acme certificates. Howver:
(2) I can receive emails sent from an openssl -s_clien session started from an outside computer. I think my email server acts as a relay here and delivers the DATA to my own account on the mailserver.
(3) Sending mail from an email account on an outside mailserver (gmail ,etc) is not delivered. After resetting back master.cf of postfix no non-verbose smtp logging I get this log from a mail sent on 15:52:30

[freke]

[jankom]

Thanks, freke.

[jankom]

Finally my pstfix/dovecot mailserver works again, receiving emails from foreign mailservers. "foreign" means any other mailserver on the Internet.

Lessons learned, what was the problem? Unfortunately, not exactly sure. Nvertheless, created backups of configuration files for future reference in similar situations.

My best guess is that the root cause was eix-sync on February 26. This created some ._...* configuration file changes that I duely executed. However, part of the system update was an updated version of postfix. The updated version requires TLSv1.2 or newer. This was already a requirement in dovecot, but not in postfix. Also, dovecot documentation indicates that mbox mailbox format is deprecated. This, and confusion about configuration files lead me to frustrating trial and error debugging steps. A frustrating lesson learned was that even an invisable space character put in a wrong place can wrac havoc in the mailserver operation.

1) Configuration confusion: syntax of how the comment (#) character is used.
"#" without "space" character following it implies that it is a default setting, no need to uncomment it. However sometimes there are choices. In that case it is not clear which is the default setting: the first choice, or a choice has to be made explicitely by uncommenting one of those. I don't know who creates these distribution configuration files: gentoo or the source developer. My suggestion is that in such cases put a space character after the comment character, thus indicating that one of the choices need to be uncommented.

2) Confusion - postfix main and master:
main.cf vs main.cf.default vs main.cf.proto
looks like main.cf is similar to main.proto, but main.cf.default has more items. Main .cf.default is a list of all configurable parameters, some having definitions for default, some blank, tut some of the blank items do need entries.
mmaster.cf vs master.cf.proto
different story: master.cf is identical to master.cf.proto and there is no .default version.

3) Confusion Postfix - Gentoo wiki states that main,conf should have "mynetworks_style = host". This does not work in my case. Yes, the same wiki says that "There are means and ways, like SMTP Authentication, that allow to secure access to a mail server even further".

I have also hardened my mailserver because of recommendations of Gentoo Complete Virtual Mailserver web page. Just as an aside: what does it mean "virtual" here?

Yet another question: why are there two submission stanzas in master.cf: one as "submission", he other with "submissions" (plural)? Just curious.

Help and comments in this forum guided me for a better understanding of the mailserver system, thank you grknight and freke for staying with me.

Finally, I show here my configuration settings where they differ from default. I attempted to use default settings as much as possible and logical. Comments are welcome.

Postfix main.cf

[figueroa]

In my experience, often enough (too often) a postfix update brings with it suggested changes to postfix configuration files, mainly main.cf, that will effectively destroy the user's local mailserver configuration and set many things back to default. This requires careful reading and often tedious editing to keep things working properly. Many times I've just discarded the new configurations without adverse effect. I attend to post-update configuration changes with dispatch-conf. Your mileage may vary.

Glad you have been able to set things back to working.
_________________
Andy Figueroa
hp pavilion hpe h8-1260t/2AB5; spinning rust x3
i7-2600 @ 3.40GHz; 16 gb; Radeon HD 7570
amd64/23.0/split-usr/desktop (stable), OpenRC, -systemd -pulseaudio -uefi