Postfix

後綴 TLS 錯誤

  • December 17, 2016

我正在使用 Postfix/Dovecot/Roundcube 設置，旨在建立一個可以通過網際網路發送郵件的虛擬使用者郵件系統，如此處所述。

一切似乎都執行良好；Dovecote 顯示沒有問題，我可以遠端登錄到我的所有埠；但是，每當我嘗試通過 Roundcube 發送郵件時，我都會收到錯誤消息：

SMTP Error (220): Authentication failed.

從日誌中：

[17-Jan-2015 05:27:31 +0000]: SMTP Error: SMTP error: Authentication failure: STARTTLS failed (Code: ) in /usr/share/webapps/roundcubemail/program/lib/Roundcube/rcube.php on line 1505 (POST /roundcube/?_task=mail&_unlock=loading1421472451594&_lang=en_US&_framed=1?_task=mail&_action=send)

我想既然 Postfix 負責 SMTP，它一定是罪魁禍首。在我的 Postfix 日誌中，我看到：

Jan 16 21:14:35 steelhorse postfix/smtpd[18426]: disconnect from localhost.localdomain[127.0.0.1]
Jan 16 21:14:35 steelhorse postfix/smtpd[18426]: lost connection after STARTTLS from localhost.localdomain[127.0.0.1]
Jan 16 21:14:35 steelhorse postfix/smtpd[18426]: warning: TLS library problem: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1293:SSL alert number
Jan 16 21:14:35 steelhorse postfix/smtpd[18426]: SSL_accept error from localhost.localdomain[127.0.0.1]: 0

我的 SSL 證書使用 localhost 作為 CN 簽名，因為它解決了我遇到的另一個問題。Postfix 使用 $myhostname 參數設置為郵件。

$$ mydomain $$並使用 Afraid DynDNS 我為 mail.mydomain 設置了一個 A 記錄以及一個類似於 1:mail 的 MX 記錄。$$ mydomain $$. 我嘗試將這些都設置為$$ mydomain $$它沒有用。一個 telnet 會話如下所示：

telnet [mydomain] 587
Trying [myip]...
Connected to [mydomain].
Escape character is '^]'.
220 [mydomain] ESMTP Postfix
ehlo [mydomain]
250-[mydomain]
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

我的 Postfix main.cf （不包括大多數預設行）：

#soft_bounce = no
queue_directory = /var/spool/postfix
command_directory = /usr/bin
daemon_directory = /usr/lib/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
#default_privs = nobody
myhostname = [mydomain]
#myhostname = virtual.domain.tld
mydomain = [mydomain]
#myorigin = $myhostname
myorigin = $mydomain
#inet_interfaces = all
#inet_interfaces = $myhostname
#inet_interfaces = $myhostname, localhost
#proxy_interfaces =
#proxy_interfaces = 1.2.3.4
#mydestination = $myhostname, localhost.$mydomain, localhost
...
#local_recipient_maps = unix:passwd.byname $alias_maps
unknown_local_recipient_reject_code = 550
#mynetworks_style = class
#mynetworks_style = subnet
mynetworks_style = host
#mynetworks = 168.100.189.0/28, 127.0.0.0/8
#mynetworks = $config_directory/mynetworks
#mynetworks = hash:/etc/postfix/network_table
#relay_domains = $mydestination
#relayhost = $mydomain
...
relay_domains = *
virtual_alias_maps = proxy:mysql:/etc/postfix/virtual_alias_maps.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/virtual_mailbox_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/virtual_mailbox_maps.cf
virtual_mailbox_base = /home/vmail
virtual_mailbox_limit = 512000000
virtual_minimum_uid = 5000
virtual_transport = virtual
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
local_transport = virtual
local_recipient_maps = $virtual_mailbox_maps
transport_maps = hash:/etc/postfix/transport

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/run/dovecot/auth-client
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated,     reject_unauth_destination
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/private/server.crt
smtpd_tls_key_file = /etc/ssl/private/server.key
smtpd_sasl_local_domain = $mydomain
broken_sasl_auth_clients = yes
smtpd_tls_loglevel = 1

我還嘗試按照此處將 Roundcube smtp_conn_options 設置為 null 。我真的不確定問題在於 DNS 記錄、SSL 證書還是什麼。任何和所有的幫助將不勝感激！

更新

將我的 Roundcube conf.inc.php 設置為 verify_peer(_name) = false 後

/* Local configuration for Roundcube Webmail */
$config['db_dsnw'] = 'mysql://roundcube_user:steelcube@localhost/roundcube_db';
$config['default_host'] = 'ssl://localhost/';
$config['default_port'] = 993;
$config['smtp_server'] = 'tls://localhost/';
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['smtp_auth_type'] = 'LOGIN';
$config['smtp_conn_options'] = null;
$config['imap_conn_options'] = array(
 'ssl'         => array(
    'verify_peer'  => false,
    'verfify_peer_name' => false,
  ),
);
$config['smtp_conn_options'] = array(
 'ssl'         => array(
    'verify_peer'      => false,
    'verify_peer_name' => false,
 ),
);

$config['smtp_port'] = 587;
$config['support_url'] = '';
$config['des_key'] = '[secret]';
$config['plugins'] = array('archive', 'zipdownload');
$config['mime_types'] = '/etc/httpd/conf/mime.types';

這SMTP Error (535): Authentication failed在發送電子郵件時給了我新的錯誤。這裡是roundcube錯誤的內容

[18-Jan-2015 02:58:06 UTC] PHP Deprecated:  Non-static method PEAR::raiseError() should not be called statically, assuming $this from incompatible context in /usr/share/webapps/roundcubemail/program/lib/Net/SMTP.php on line 371
[18-Jan-2015 02:58:06 UTC] PHP Deprecated:  Non-static method PEAR::raiseError() should not be called statically, assuming $this from incompatible context in /usr/share/webapps//roundcubemail/program/lib/Net/SMTP.php on line 371
[18-Jan-2015 02:58:06 +0000]: SMTP Error: SMTP error: Failed to set sender /roundcubemail/program/lib/Net/SMTP.php on line 371'[username]@[mydomain]' in /usr/share/webapps/roundcubemail/program/lib/Roundcube/rcube.php on line 1505 (POST /roundcube/?_task=mail&_unlock=loading1421549886598&_lang=en_US&_framed=1?_task=mail&_action=send)

和郵件日誌條目

Jan 18 20:18:21 steelhorse postfix/smtpd[1942]: connect from localhost.localdomain[127.0.0.1]
Jan 18 20:18:21 steelhorse postfix/smtpd[1942]: Anonymous TLS connection established from localhost.localdomain[127.0.0.1]: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128    
Jan 18 20:18:21 steelhorse postfix/smtpd[1942]: warning: localhost.localdomain[127.0.0.1]: SASL LOGIN authentication failed: Invalid authentication mechanism
Jan 18 20:18:21 steelhorse postfix/smtpd[1942]: disconnect from localhost.localdomain[127.0.0.1]

按照聊天中的要求，這是dovecot -a | grep auth_mechanism

auth_mechanisms = plain

OK 看起來你的 postfix、roundcube 和 dovecot 配置中有太多不匹配的地方。讓我們一一分解。

STARTTLS 錯誤

此日誌行

warning: TLS library problem: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1293:SSL alert number

表示 PHP 無法驗證對等證書，因為 CA 未知。這是與此問題完全相同的問題：Roundcube & Postfix SMTP: SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c。從你已經通過在圓形立方體中添加這些行來解決它的問題

$config['smtp_conn_options'] = array(
 'ssl'         => array(
    'verify_peer'      => false,
    'verify_peer_name' => false,
 ),
);

身份驗證失敗錯誤

為此，我們必須查看 postfix 和 roundcube 日誌以辨識問題。真實的消息是在後綴日誌文件中擷取的

Jan 18 20:18:21 steelhorse postfix/smtpd[1942]: warning: localhost.localdomain[127.0.0.1]: SASL LOGIN authentication failed: Invalid authentication mechanism

現在因為 dovecot 提供了後綴 SASL 機制，所以您應該通過 run 檢查 dovecot 提供的機制dovecot -a | grep auth_mechanism。

通過查看 roundcube$config['smtp_auth_type']和 dovecotauth_mechanisms配置，您可以看到這兩者之間的不匹配。Dovecot 僅提供 PLAIN 機制。但是圓形立方體被配置為使用登錄機制。

解決方案可以是其中之一或兩者

auth_mechanisms = plain login

在鴿舍配置中。

$config['smtp_auth_type'] = 'PLAIN';

引用自：https://serverfault.com/questions/660241

相關問答

Ubuntu

郵件伺服器，無法發送/接收任何郵件

  • December 19, 2017
檢視問答
Postfix

可以發送，但不能接收電子郵件

  • November 7, 2014
檢視問答
Postfix

Postfix：專用使用者發送電子郵件

  • August 28, 2022
檢視問答
Postfix

來自網際網路的 Postfix bar 身份驗證

  • May 3, 2022
檢視問答
Postfix

後綴收件人地址被拒絕：刪除 permit_mynetworks 後訪問被拒絕錯誤

  • April 4, 2022
檢視問答
Postfix

如何使用 SpamAssassin 拒絕電子郵件

  • March 15, 2022
檢視問答