[gentoo-user] SSL CUPS and SMTP on port 587

[gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

Does anyone have any experience printing with CUPS via SSL?  I need to
print across the internet so I need the data to be transmitted via
SSL.  I know CUPS supports SSL, but I can't find any information on
making it work.  This guys has the same problem:

http://www.cups.org/newsgroups.php?s15392+gcups.general+v15401+T0

My ISP (Cox) blocks outgoing port 25 so I can't submit mail to my
remote mail server.  From what I understand, port 587 is commonly used
to get around this.  Can I have postfix listen on port 25 and port
587?  Has anyone set that up?

- Grant
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Willie Wong]

On Sun, Feb 17, 2008 at 07:18:00AM -0800, Penguin Lover Grant squawked:
> My ISP (Cox) blocks outgoing port 25 so I can't submit mail to my
> remote mail server.  From what I understand, port 587 is commonly used
> to get around this.  Can I have postfix listen on port 25 and port
> 587?  Has anyone set that up?

I do it slightly differently: I leave an SSH connection from my box to
the mail server, which maps some local port to port 25 on the mail
server, and send all my mail to the local port. 

HTH,

W
-- 
"`Incidentally,' he said, `what does teleport mean?'
Another moment passed.
Slowly, the others turned to face him.
`Probably the wrong moment to ask,' said Arthur, `It's just 
I remember you use the word a short while ago and I only 
bring it up because...'
`Where,' said Ford quietly, `does it say teleport?'
`Well, just over here in fact,' said Arthur, pointing at a 
dark control box in the rear of the cabin, `Just under the 
word "emergency", above the word "system" and beside the 
sign saying "out of order".'"

- Arthur finding an escape route from a certain death 
situation. 
Sortir en Pantoufles: up 436 days, 15:48
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

> > My ISP (Cox) blocks outgoing port 25 so I can't submit mail to my
> > remote mail server.  From what I understand, port 587 is commonly used
> > to get around this.  Can I have postfix listen on port 25 and port
> > 587?  Has anyone set that up?
>
> I do it slightly differently: I leave an SSH connection from my box to
> the mail server, which maps some local port to port 25 on the mail
> server, and send all my mail to the local port.

Yeah I think I'll do that if port 587 doesn't work out.  From what I
understand, using 587 in this way is somewhat of a standard?

- Grant


> HTH,
>
> W
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[kashani]

Grant wrote:
>>> My ISP (Cox) blocks outgoing port 25 so I can't submit mail to my
>>> remote mail server.  From what I understand, port 587 is commonly used
>>> to get around this.  Can I have postfix listen on port 25 and port
>>> 587?  Has anyone set that up?
>> I do it slightly differently: I leave an SSH connection from my box to
>> the mail server, which maps some local port to port 25 on the mail
>> server, and send all my mail to the local port.
> 
> Yeah I think I'll do that if port 587 doesn't work out.  From what I
> understand, using 587 in this way is somewhat of a standard?

In your master.cf uncomment the following lines and then restart 
Postfix. It should just work if you already have TLS setup.

smtps     inet  n       -       n       -       -       smtpd
         -o smtpd_tls_wrappermode=yes

kashani
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

> >>> My ISP (Cox) blocks outgoing port 25 so I can't submit mail to my
> >>> remote mail server.  From what I understand, port 587 is commonly used
> >>> to get around this.  Can I have postfix listen on port 25 and port
> >>> 587?  Has anyone set that up?
> >> I do it slightly differently: I leave an SSH connection from my box to
> >> the mail server, which maps some local port to port 25 on the mail
> >> server, and send all my mail to the local port.
> >
> > Yeah I think I'll do that if port 587 doesn't work out.  From what I
> > understand, using 587 in this way is somewhat of a standard?
>
> In your master.cf uncomment the following lines and then restart
> Postfix. It should just work if you already have TLS setup.
>
> smtps     inet  n       -       n       -       -       smtpd
>          -o smtpd_tls_wrappermode=yes
>
> kashani

I uncommented the above line and added the following to main.cf:

smtpd_tls_security_level = may

as instructed here:

http://www.postfix.org/TLS_README.html#server_enable

and restarted postfix, but I still can't send.  In claws-mail, I tried
specifying 587 and I'm specifying Use SSL for SSMTP.  I'm guessing TLS
isn't set up properly?

- Grant
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

> > >>> My ISP (Cox) blocks outgoing port 25 so I can't submit mail to my
> > >>> remote mail server.  From what I understand, port 587 is commonly used
> > >>> to get around this.  Can I have postfix listen on port 25 and port
> > >>> 587?  Has anyone set that up?
> > >> I do it slightly differently: I leave an SSH connection from my box to
> > >> the mail server, which maps some local port to port 25 on the mail
> > >> server, and send all my mail to the local port.
> > >
> > > Yeah I think I'll do that if port 587 doesn't work out.  From what I
> > > understand, using 587 in this way is somewhat of a standard?
> >
> > In your master.cf uncomment the following lines and then restart
> > Postfix. It should just work if you already have TLS setup.
> >
> > smtps     inet  n       -       n       -       -       smtpd
> >          -o smtpd_tls_wrappermode=yes
> >
> > kashani
>
> I uncommented the above line and added the following to main.cf:
>
> smtpd_tls_security_level = may
>
> as instructed here:
>
> http://www.postfix.org/TLS_README.html#server_enable
>
> and restarted postfix, but I still can't send.  In claws-mail, I tried
> specifying 587 and I'm specifying Use SSL for SSMTP.  I'm guessing TLS
> isn't set up properly?
>
> - Grant

Also I can see with nmap that smtps 465 is open and 587 is not.  No
luck specifying 465 in claws-mail though.

- Grant
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[kashani]

Grant wrote:
> I uncommented the above line and added the following to main.cf:
> 
> smtpd_tls_security_level = may
> 
> as instructed here:
> 
> http://www.postfix.org/TLS_README.html#server_enable
> 
> and restarted postfix, but I still can't send.  In claws-mail, I tried
> specifying 587 and I'm specifying Use SSL for SSMTP.  I'm guessing TLS
> isn't set up properly?

You need more than that. My /etc/postfix/main.cf looks like this and 
you'll need to create the actual certs listed below as well. I recommend 
smtpd_tls_auth_only so that anyone trying to smtp auth is required to do 
it over an encrypted session.

# TLS stuff
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/postfix/newkey.pem
smtpd_tls_cert_file = /etc/postfix/newcert.pem
smtpd_tls_CAfile = /etc/postfix/cacert.pem
#smtpd_tls_loglevel = 3
#smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

Additionally check to see what port Postfix is listening on. It's on 
port 465 on my server and you'll need to set your mail client to SSL 
rather than TLS.

kashani
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

> > I uncommented the above line and added the following to main.cf:
> >
> > smtpd_tls_security_level = may
> >
> > as instructed here:
> >
> > http://www.postfix.org/TLS_README.html#server_enable
> >
> > and restarted postfix, but I still can't send.  In claws-mail, I tried
> > specifying 587 and I'm specifying Use SSL for SSMTP.  I'm guessing TLS
> > isn't set up properly?
>
> You need more than that. My /etc/postfix/main.cf looks like this and
> you'll need to create the actual certs listed below as well. I recommend
> smtpd_tls_auth_only so that anyone trying to smtp auth is required to do
> it over an encrypted session.
>
> # TLS stuff
> smtpd_tls_security_level = may
> smtpd_tls_auth_only = yes
> smtpd_tls_key_file = /etc/postfix/newkey.pem
> smtpd_tls_cert_file = /etc/postfix/newcert.pem
> smtpd_tls_CAfile = /etc/postfix/cacert.pem
> #smtpd_tls_loglevel = 3
> #smtpd_tls_received_header = yes
> smtpd_tls_session_cache_timeout = 3600s
> tls_random_source = dev:/dev/urandom
>
> Additionally check to see what port Postfix is listening on. It's on
> port 465 on my server and you'll need to set your mail client to SSL
> rather than TLS.

Thank you kashani.  Now I'm getting "Relay access denied".  I've been
sending via squirrelmail running on the same server so I need to make
an adjustment.  What I'd like to do is allow relaying for any
authenticated smtp client but I don't see any option for that in the
main.cf comments.  I tried adding "grant" to the postdrop group with
no luck.

Here's my main.cf (I'm using postgrey):

mydestination = mydomain.com
setgid_group = postdrop
smtpd_recipient_restrictions =
        permit_mynetworks,
        check_policy_service inet:127.0.0.1:10030
        reject_unauth_destination,
        permit
virtual_alias_maps = hash:/etc/postfix/virtual
message_size_limit = 20480000
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/ssl/postfix/server.key
smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

How does that look?

- Grant
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

> > > I uncommented the above line and added the following to main.cf:
> > >
> > > smtpd_tls_security_level = may
> > >
> > > as instructed here:
> > >
> > > http://www.postfix.org/TLS_README.html#server_enable
> > >
> > > and restarted postfix, but I still can't send.  In claws-mail, I tried
> > > specifying 587 and I'm specifying Use SSL for SSMTP.  I'm guessing TLS
> > > isn't set up properly?
> >
> > You need more than that. My /etc/postfix/main.cf looks like this and
> > you'll need to create the actual certs listed below as well. I recommend
> > smtpd_tls_auth_only so that anyone trying to smtp auth is required to do
> > it over an encrypted session.
> >
> > # TLS stuff
> > smtpd_tls_security_level = may
> > smtpd_tls_auth_only = yes
> > smtpd_tls_key_file = /etc/postfix/newkey.pem
> > smtpd_tls_cert_file = /etc/postfix/newcert.pem
> > smtpd_tls_CAfile = /etc/postfix/cacert.pem
> > #smtpd_tls_loglevel = 3
> > #smtpd_tls_received_header = yes
> > smtpd_tls_session_cache_timeout = 3600s
> > tls_random_source = dev:/dev/urandom
> >
> > Additionally check to see what port Postfix is listening on. It's on
> > port 465 on my server and you'll need to set your mail client to SSL
> > rather than TLS.
>
> Thank you kashani.  Now I'm getting "Relay access denied".  I've been
> sending via squirrelmail running on the same server so I need to make
> an adjustment.  What I'd like to do is allow relaying for any
> authenticated smtp client but I don't see any option for that in the
> main.cf comments.  I tried adding "grant" to the postdrop group with
> no luck.

Is allowing relay access based on authentication not something postfix
does?  It makes sense to me.  How do you guys make the relay decision?

- Grant


> Here's my main.cf (I'm using postgrey):
>
> mydestination = mydomain.com
> setgid_group = postdrop
> smtpd_recipient_restrictions =
>         permit_mynetworks,
>         check_policy_service inet:127.0.0.1:10030
>         reject_unauth_destination,
>         permit
> virtual_alias_maps = hash:/etc/postfix/virtual
> message_size_limit = 20480000
> smtpd_tls_security_level = may
> smtpd_tls_auth_only = yes
> smtpd_tls_key_file = /etc/ssl/postfix/server.key
> smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
> smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
> smtpd_tls_session_cache_timeout = 3600s
> tls_random_source = dev:/dev/urandom
>
> How does that look?
>
> - Grant
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[kashani]

Grant wrote:
> Here's my main.cf (I'm using postgrey):
> 
> mydestination = mydomain.com
> setgid_group = postdrop
> smtpd_recipient_restrictions =
>         permit_mynetworks,
>         check_policy_service inet:127.0.0.1:10030
>         reject_unauth_destination,
>         permit
> virtual_alias_maps = hash:/etc/postfix/virtual
> message_size_limit = 20480000
> smtpd_tls_security_level = may
> smtpd_tls_auth_only = yes
> smtpd_tls_key_file = /etc/ssl/postfix/server.key
> smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
> smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
> smtpd_tls_session_cache_timeout = 3600s
> tls_random_source = dev:/dev/urandom
> 
> How does that look?

Where is your mynetwork statement. You need to have at least 127.0.0.1 
in it or locally generated emails won't be able to relay.

kashani

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

> > Here's my main.cf (I'm using postgrey):
> >
> > mydestination = mydomain.com
> > setgid_group = postdrop
> > smtpd_recipient_restrictions =
> >         permit_mynetworks,
> >         check_policy_service inet:127.0.0.1:10030
> >         reject_unauth_destination,
> >         permit
> > virtual_alias_maps = hash:/etc/postfix/virtual
> > message_size_limit = 20480000
> > smtpd_tls_security_level = may
> > smtpd_tls_auth_only = yes
> > smtpd_tls_key_file = /etc/ssl/postfix/server.key
> > smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
> > smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
> > smtpd_tls_session_cache_timeout = 3600s
> > tls_random_source = dev:/dev/urandom
> >
> > How does that look?
>
> Where is your mynetwork statement. You need to have at least 127.0.0.1
> in it or locally generated emails won't be able to relay.

I actually don't have a mynetworks statement in main.cf at all and I
send from squirrelmail all over the place.

I won't be able to specify a single IP for my laptop.  Can I allow
authenticated users to send?

- Grant
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[kashani]

Grant wrote:
> I actually don't have a mynetworks statement in main.cf at all and I
> send from squirrelmail all over the place.
> 
> I won't be able to specify a single IP for my laptop.  Can I allow
> authenticated users to send?

You connect to squirrelmail from many different IPs via HTTP, but 
squirrelmain only calls SMTP from the localhost IP, 127.0.0.1. So add 
the default mynetworks back in if you want Squirrelmail to be able to 
send at all. And quit trying out poorly thought out security tricks in 
Postfix if you don't know what you're doing.

Once that is fixed you can start looking at why you can't authenticate. 
I'm going to guess that you haven't bothered to setup smtp 
authentication via sasl yet.

kashani


-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

> > I actually don't have a mynetworks statement in main.cf at all and I
> > send from squirrelmail all over the place.
> >
> > I won't be able to specify a single IP for my laptop.  Can I allow
> > authenticated users to send?
>
> You connect to squirrelmail from many different IPs via HTTP, but
> squirrelmain only calls SMTP from the localhost IP, 127.0.0.1. So add
> the default mynetworks back in if you want Squirrelmail to be able to
> send at all. And quit trying out poorly thought out security tricks in
> Postfix if you don't know what you're doing.

I haven't removed the mynetworks statement.  It was never there.
Could it be somewhere other than main.cf and master.cf?  Maybe
127.0.0.1 is the default.  I can send from squirrelmail just fine as
always.  Admittedly "all over the place" was a bad choice of words.

> Once that is fixed you can start looking at why you can't authenticate.
> I'm going to guess that you haven't bothered to setup smtp
> authentication via sasl yet.

I didn't realize I wasn't authenticating.  I'm working on sasl now.

- Grant

> kashani
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] SSL CUPS and SMTP on port 587

[Grant]

> > > I actually don't have a mynetworks statement in main.cf at all and I
> > > send from squirrelmail all over the place.
> > >
> > > I won't be able to specify a single IP for my laptop.  Can I allow
> > > authenticated users to send?
> >
> > You connect to squirrelmail from many different IPs via HTTP, but
> > squirrelmain only calls SMTP from the localhost IP, 127.0.0.1. So add
> > the default mynetworks back in if you want Squirrelmail to be able to
> > send at all. And quit trying out poorly thought out security tricks in
> > Postfix if you don't know what you're doing.
>
> I haven't removed the mynetworks statement.  It was never there.
> Could it be somewhere other than main.cf and master.cf?  Maybe
> 127.0.0.1 is the default.  I can send from squirrelmail just fine as
> always.  Admittedly "all over the place" was a bad choice of words.
>
> > Once that is fixed you can start looking at why you can't authenticate.
> > I'm going to guess that you haven't bothered to setup smtp
> > authentication via sasl yet.
>
> I didn't realize I wasn't authenticating.  I'm working on sasl now.

Got it!  Thanks a lot for everyone's help.  I'm running
courier-imapd-ssl, postfix, and saslauthd.  With the following config
everything should be encrypted between my laptop and the server:

/etc/postfix/main.cf:

[snip]
smtpd_sasl_auth_enable = yes
smtpd_sasl2_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
smtpd_recipient_restrictions =
        permit_sasl_authenticated,
        permit_mynetworks,
        check_policy_service inet:127.0.0.1:10030
        reject_unauth_destination,
        permit
virtual_alias_maps = hash:/etc/postfix/virtual
message_size_limit = 20480000
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/ssl/postfix/server.key
smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

/etc/postfix/master.cf:

smtp      inet  n       -       n       -       -       smtpd
smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes

/etc/sasl2/smtpd.conf:

mech_list: PLAIN LOGIN
pwcheck_method:saslauthd

- Grant
-- 
gentoo-user@lists.gentoo.org mailing list

[gentoo-user] Re: SSL CUPS and SMTP on port 587

[Grant]

> Does anyone have any experience printing with CUPS via SSL?  I need to
> print across the internet so I need the data to be transmitted via
> SSL.  I know CUPS supports SSL, but I can't find any information on
> making it work.  This guys has the same problem:
>
> http://www.cups.org/newsgroups.php?s15392+gcups.general+v15401+T0
>
> My ISP (Cox) blocks outgoing port 25 so I can't submit mail to my
> remote mail server.  From what I understand, port 587 is commonly used
> to get around this.  Can I have postfix listen on port 25 and port
> 587?  Has anyone set that up?
>
> - Grant

For SSL CUPS, I have 'SSLPort 443' in the CUPS server's cupsd.conf and
'ServerName <hostname>:443' in the client's client.conf.  'lpr
file.pdf' on the client prints and I get "cupsdCloseClient: SSL
shutdown successful!" in the server's error log after printing.  I
think it's working.

- Grant
-- 
gentoo-user@lists.gentoo.org mailing list