I have had a few complaints about emails bouncing over the past
week-ish, specifically from a single dynamic IP. Have now found a few
lines in the logs that seem to indicate the problem. Nothing has been
changed (that I know of) apart from a point or two of the Ubuntu
version, so why is there a problem, what is the cause and what can I do
about it, please?
Log lines are as below for two apparently immediate attempts (sender
redacted):
May 13 12:16:22 BRISTOLWEB postfix/submission/smtpd[12960]: connect from
(redacted)]
May 13 12:16:22 BRISTOLWEB postfix/submission/smtpd[12960]: Anonymous
TLS connection established from (redacted): TLSv1.2 with cipher
ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
May 13 12:16:24 BRISTOLWEB postfix/submission/smtpd[12960]: ACA963200DC:
client=(redacted), sasl_method=PLAIN, sasl_username=(redacted)
May 13 12:16:24 BRISTOLWEB postfix/cleanup[12927]: ACA963200DC:
message-id=<d1744276-a395-1e8f-3f19-7147190a024e@(redacted)>
May 13 12:16:25 BRISTOLWEB postfix/submission/smtpd[12960]: warning: TLS
library problem: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption
failed or bad record mac:s3_pkt.c:532:
May 13 12:16:25 BRISTOLWEB postfix/submission/smtpd[12960]: lost
connection after DATA (16372 bytes) from (redacted)
May 13 12:16:25 BRISTOLWEB postfix/submission/smtpd[12960]: disconnect
from (redacted) ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=0/1 commands=6/7
May 13 12:16:35 BRISTOLWEB postfix/submission/smtpd[12960]: connect from
(redacted)
May 13 12:16:35 BRISTOLWEB postfix/submission/smtpd[12960]: Anonymous
TLS connection established from (redacted): TLSv1.2 with cipher
ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
May 13 12:16:35 BRISTOLWEB postfix/submission/smtpd[12960]: CE4553200DC:
client=(redacted), sasl_method=PLAIN, sasl_username=(redacted)
May 13 12:16:35 BRISTOLWEB postfix/cleanup[12927]: CE4553200DC:
message-id=<388cf74f-ff63-70da-aa61-b65277af849a@(redacted)>
May 13 12:16:37 BRISTOLWEB postfix/submission/smtpd[12960]: warning: TLS
library problem: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption
failed or bad record mac:s3_pkt.c:532:
May 13 12:16:37 BRISTOLWEB postfix/submission/smtpd[12960]: lost
connection after DATA (139212 bytes) from (redacted)
May 13 12:16:37 BRISTOLWEB postfix/submission/smtpd[12960]: disconnect
from (redacted) ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=0/1 commands=6/7
Versions:
server: Linux Mint 18.1 (Ubuntu 16.04.12)
postfix: 3.1.0
openssl: 1.0.2g
--
Dave Stiles
