Does it verify with on port 587: openssl s_client -starttls smtp -crlf -connect localhost:587
-Andy On 8/13/2018 8:56 PM, Remo Mattei wrote: > Any suggestions on this Andy? > > openssl s_client -crlf -connect qmail.rm.ht:465 > CONNECTED(00000005) > depth=0 OU = Domain Control Validated, OU = PositiveSSL, CN = qmail.rm.ht > verify error:num=20:unable to get local issuer certificate > verify return:1 > depth=0 OU = Domain Control Validated, OU = PositiveSSL, CN = qmail.rm.ht > verify error:num=27:certificate not trusted > verify return:1 > depth=0 OU = Domain Control Validated, OU = PositiveSSL, CN = qmail.rm.ht > verify error:num=21:unable to verify the first certificate > verify return:1 > --- > Certificate chain > 0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=qmail.rm.ht > i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO > RSA Domain Validation Secure Server CA > --- > > > I do have a valid cert as you can see it’s from COMODO. But not sure > about the first few lines > > Remo > >> On Aug 13, 2018, at 21:42, Andrew Swartz <[email protected] >> <mailto:[email protected]>> wrote: >> >> I just realized that the plain text line-wrapped the script, so here >> is an unwrapped version in case anyone else wants to use it. Also, I >> made it multiline so you can cut and paste it into a terminal and >> accomplish this in about 3 seconds with netstat confirming success (it >> should print a single line showing tcpserver listening on 465). >> >> rfc8314 <https://tools.ietf.org/html/rfc8314> in Jan of this year >> reinstates port 465/tls because starttls (port 587) is broken beyond >> repair (from a security perspective). So eventually everyone may >> eventually need to go back to port 465. But since servers get to >> dictate setting to their clients without creating interoperability >> issues, it will likely be many years before this occurs. >> >> The critical flaw in starttls is that some ISP's and/or governments >> have been caught filtering out the STARTTLS packet and thus preventing >> the initiation of encryption (a "starttls downgrade attack"). In that >> case, the client's username and password are sent in the clear. And >> if an eavesdropper gets those, they can wreak havoc on your your life >> (i.e. by resetting the password for your bank or other online >> accounts, etc). With port 465/tls, the client connection either >> establishes encryption or fails; it cannot be tricked into using >> clear-text. >> >> Anyway, here is the paste-able script: >> >> qmailctl stop; \ >> cp -r /var/qmail/supervise/submission /var/qmail/supervise/smtps; \ >> chown -R qmaill:qmail /var/qmail/supervise/smtps; \ >> sed -i 's/REQUIRE_AUTH=1/REQUIRE_AUTH=1\nexport SMTPS=1/' >> /var/qmail/supervise/smtps/run; \ >> sed -i 's/587/465/' /var/qmail/supervise/smtps/run; \ >> sed -i 's/submission/smtps/' /var/qmail/supervise/smtps/log/run; \ >> sed -i 's/DH:!LOW:!MEDIUM/ECDHE:DHE:ECDH:DH:AES:!SSLv2:!SSLv3/' >> /etc/tcprules.d/tcp.smtp; \ >> qmailctl cdb; \ >> qmailctl start; \ >> netstat -lnp | grep 465 >> >> >> -Andy >> >> PS: If old clients cannot connect, then remove the "!SSLv3" from the >> cipher list in tcp.smtp >> >> >> >> >> >> >> On 8/13/2018 7:32 PM, Remo Mattei wrote: >>> Cool! I remember I did it like Eric described but the bottom line is >>> it works either way. I do not offer 465 any longer :) >>> >>> *dal mio iPhone X* >>> >>> Il giorno 13 ago 2018, alle ore 20:25, Andrew Swartz >>> <[email protected] <mailto:[email protected]>> ha scritto: >>> >>>> I eventually figured this out, and accomplished the same result though I >>>> went about it slightly differently. It is now fully functional. Below >>>> is the script which I created and accomplishes this in very few lines. >>>> It copies the supervise/smtp directory to supervise/smtps and it then >>>> edits a few values in two files files (plus editing the cipher list in >>>> tcp.smtp). >>>> >>>> >>>> qmailctl stop >>>> cp -r /var/qmail/supervise/submission /var/qmail/supervise/smtps >>>> chown -R qmaill:qmail /var/qmail/supervise/smtps >>>> sed -i 's/REQUIRE_AUTH=1/REQUIRE_AUTH=1\nexport SMTPS=1/' >>>> /var/qmail/supervise/smtps/run >>>> sed -i 's/587/465/' /var/qmail/supervise/smtps/run >>>> sed -i 's/submission/smtps/' /var/qmail/supervise/smtps/log/run >>>> sed -i 's/DH:!LOW:!MEDIUM/ECDHE:DHE:ECDH:DH:AES:!SSLv2/' >>>> /etc/tcprules.d/tcp.smtp >>>> qmailctl cdb >>>> qmailctl start >>>> >>>> >>>> Thanks for confirming that I did it right, >>>> Andy >>>> >>>> >>>> On 8/13/2018 7:06 PM, Eric Broch wrote: >>>>> Stock CentOS 7 does not have SMTPS standard. You must create the >>>>> supervise scripts. >>>>> >>>>> You could stop qmail >>>>> >>>>> # qmailctl stop >>>>> >>>>> and copy smtp supervise scripts to smtps (make sure qmail is stopped or >>>>> else you'll have a mess): >>>>> >>>>> # cp -Rp /var/qmail/supervise/smtp /var/qmail/supervise/smtps >>>>> >>>>> Then change two files: >>>>> >>>>> /var/qmail/supervise/smtps/run >>>>> >>>>> <run> >>>>> >>>>> #!/bin/sh >>>>> QMAILDUID=`id -u vpopmail` >>>>> NOFILESGID=`id -g vpopmail` >>>>> MAXSMTPD=`cat /var/qmail/control/concurrencyincoming` >>>>> SMTPD="/var/qmail/bin/qmail-smtpd" >>>>> TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb" >>>>> HOSTNAME=`hostname` >>>>> VCHKPW="/home/vpopmail/bin/vchkpw" >>>>> export SMTPS=1 >>>>> >>>>> exec /usr/bin/softlimit -m 128000000 \ >>>>> /usr/bin/tcpserver -v -R -H -l $HOSTNAME -x $TCP_CDB -c >>>>> "$MAXSMTPD" \ >>>>> -u "$QMAILDUID" -g "$NOFILESGID" 0 465 \ >>>>> $SMTPD $VCHKPW /bin/true 2>&1 >>>>> >>>>> </run> >>>>> >>>>> & >>>>> >>>>> /var/qmail/supervise/smtps/log/run >>>>> >>>>> <run> >>>>> >>>>> #!/bin/sh >>>>> LOGSIZE=`cat /var/qmail/control/logsize` >>>>> LOGCOUNT=`cat /var/qmail/control/logcount` >>>>> exec /usr/bin/setuidgid qmaill /usr/bin/multilog \ >>>>> t s$LOGSIZE n$LOGCOUNT /var/log/qmail/smtps 2>&1 >>>>> >>>>> </run> >>>>> >>>>> Start qmail (# qmailctl start) >>>>> >>>>> >>>>> On 8/11/2018 6:36 PM, Andrew Swartz wrote: >>>>>> I just installed qmailtoaster onto CentOS-7. The qt_install script >>>>>> opened port 465 on the firewall. However, s_client cannot connect to >>>>>> port 465 and netstat shows that nothing is listening on port 465. >>>>>> >>>>>> Can anyone point me at appropriate instructions for setting up >>>>>> listening >>>>>> on port 465 which are specific (or applicable) to qmailtoaster? I >>>>>> searched wiki.qmailtoaster.com <http://wiki.qmailtoaster.com/> and >>>>>> found nothing. I did some general >>>>>> googling and found several somewhat conflicting descriptions but I'm >>>>>> unsure which apply to the configuration used in qmailtoaster. >>>>>> >>>>>> My interest is because 465 has been reinstated (in Jan 2018) as the >>>>>> preferred submission port due to security problems with STARTTLS >>>>>> (https://tools.ietf.org/html/rfc8314). >>>>>> >>>>>> Thanks, >>>>>> -Andy >>>>>> >>>>>> >>>>> >>>> >>>> -- >>>> Andrew W. Swartz, MD >>>> Departments of Emergency Medicine, Family Medicine, and Surgery >>>> Yukon-Kuskokwim Delta Regional Hospital >>>> Bethel, Alaska >>>> >> >> -- >> Andrew W. Swartz, MD >> Departments of Emergency Medicine, Family Medicine, and Surgery >> Yukon-Kuskokwim Delta Regional Hospital >> Bethel, Alaska > -- Andrew W. Swartz, MD Departments of Emergency Medicine, Family Medicine, and Surgery Yukon-Kuskokwim Delta Regional Hospital Bethel, Alaska
smime.p7s
Description: S/MIME Cryptographic Signature
