Pošta neprochází přes Stunnel

[Dandy]

Ahoj, mail server mi běží na Debianu a služby tam mám Courier, Qmail a teďka se mi nedaří rozchodit Stunnel. Pošta mi momentálně běží nezabezpečená, ale jakmile chci, aby šla přes SSL, tak neproleze. Hrabu se s tím už asi 4dny a stále jsem v bludném kruhu. Díky moc za pomoc.

Log z stunnel mi píše:

Kód: [Vybrat]

TCP_NODELAY option set on local socket
Waiting for a libwrap process
Acquired libwrap process #0
Releasing libwrap process #0
Released libwrap process #0
ssmtp permitted by libwrap from 90.176.166.133:26152
ssmtp accepted connection from 90.176.166.133:26152
FD 16 in non-blocking mode
connect_blocking: connecting 127.0.0.1:666
connect_blocking: s_poll_wait 127.0.0.1:666: waiting 10 seconds
connect_blocking: getsockopt 127.0.0.1:666: Connection refused (111)
Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

root:~# openssl s_client -starttls smtp -connect localhost:465

Kód: [Vybrat]

connect: Connection refused
connect:errno=111

[Reklama]

[Dalimil Gala]

Tobě běží SMTP server na portu 666? Normálně běží na 25. Pošlu sem, jak to mám na jednom výběhovém serveru (teď už používám postfix + dovecot) nastavené já.

1. Stunnel spouštím takto:
/usr/sbin/stunnel -d smtps -r smtp -p /etc/apache2/ssl/apache.pem
resp. teď pro debug ještě s parametrem -D 7

2. Po spuštění napíše stunnel do logu:
Jan 16 17:04:44 gab stunnel[14024]: Using 'smtp' as tcpwrapper service name
Jan 16 17:04:44 gab stunnel[14024]: Snagged 64 random bytes from /root/.rnd
Jan 16 17:04:44 gab stunnel[14024]: Wrote 1024 new random bytes to /root/.rnd
Jan 16 17:04:44 gab stunnel[14024]: RAND_status claims sufficient entropy for the PRNG
Jan 16 17:04:44 gab stunnel[14024]: PRNG seeded successfully
Jan 16 17:04:44 gab stunnel[14024]: Certificate: /etc/apache2/ssl/apache.pem
Jan 16 17:04:44 gab stunnel[14024]: stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004
Jan 16 17:04:44 gab stunnel[14025]: Created pid file /var/run/stunnel/stunnel.smtp.pid
Jan 16 17:04:44 gab stunnel[14025]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed
Jan 16 17:04:44 gab stunnel[14025]: SO_REUSEADDR option set on accept socket
Jan 16 17:04:44 gab stunnel[14025]: smtp bound to 0.0.0.0:465

3. Pokud dám:
openssl s_client -starttls smtp -connect localhost:465
napíše stunnel do logu:

Jan 16 17:05:19 gab stunnel[14025]: smtp accepted FD=10 from 127.0.0.1:40602
Jan 16 17:05:19 gab stunnel[14235]: smtp started
Jan 16 17:05:19 gab stunnel[14235]: smtp connected from 127.0.0.1:40602
Jan 16 17:05:19 gab stunnel[14235]: smtp connecting 127.0.0.1:25
Jan 16 17:05:19 gab stunnel[14235]: Remote FD=13 initialized
Jan 16 17:05:19 gab stunnel[14235]: Relying on OpenSSL RSA Blinding.
Jan 16 17:05:19 gab stunnel[14235]: SSL state (accept): before/accept initialization

4. Poslání mailu přes SSL (STARTTLS nemám) vypadá takto:
Jan 16 17:08:15 gab stunnel[17083]: smtp started
Jan 16 17:08:15 gab stunnel[17083]: smtp connected from 94.112.135.1:56740
Jan 16 17:08:15 gab stunnel[17083]: smtp connecting 127.0.0.1:25
Jan 16 17:08:15 gab stunnel[17083]: Remote FD=13 initialized
Jan 16 17:08:15 gab stunnel[17083]: Relying on OpenSSL RSA Blinding.
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): before/accept initialization
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 read client hello A
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 write server hello A
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 write certificate A
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 write server done A
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 flush data
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 read client key exchange A
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 read finished A
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 write change cipher spec A
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 write finished A
Jan 16 17:08:15 gab stunnel[17083]: SSL state (accept): SSLv3 flush data
Jan 16 17:08:15 gab stunnel[17083]:    1 items in the session cache
Jan 16 17:08:15 gab stunnel[17083]:    0 client connects (SSL_connect())
Jan 16 17:08:15 gab stunnel[17083]:    0 client connects that finished
Jan 16 17:08:15 gab stunnel[17083]:    0 client renegotiatations requested
Jan 16 17:08:15 gab stunnel[17083]:    2 server connects (SSL_accept())
Jan 16 17:08:15 gab stunnel[17083]:    1 server connects that finished
Jan 16 17:08:15 gab stunnel[17083]:    0 server renegotiatiations requested
Jan 16 17:08:15 gab stunnel[17083]:    0 session cache hits
Jan 16 17:08:15 gab stunnel[17083]:    1 session cache misses
Jan 16 17:08:15 gab stunnel[17083]:    0 session cache timeouts
Jan 16 17:08:15 gab stunnel[17083]: Negotiated ciphers: AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
Jan 16 17:08:15 gab stunnel[17083]: Socket closed on read
Jan 16 17:08:15 gab stunnel[17083]: SSL alert (write): warning: close notify
Jan 16 17:08:15 gab stunnel[17083]: SSL write shutdown (output buffer empty)
Jan 16 17:08:15 gab stunnel[17083]: SSL socket closed on SSL_read
Jan 16 17:08:15 gab stunnel[17083]: Connection closed: 257 bytes sent to SSL, 1321 bytes sent to socket
Jan 16 17:08:15 gab stunnel[17083]: smtp finished (0 left)

[Dandy]

SMTP mi běží na 25 a SMTPS na 465...port 666 byl testovací, zda to pomůže...

jsem obnovil certifikát a mám toto:
/etc/ssl/stunnel# openssl s_client -starttls smtp -connect localhost:465

Kód: [Vybrat]

CONNECTED(00000003)
didn't found starttls in server response, try anyway...
read:errno=32
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 24 bytes and written 25 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

do stunnel4.log se mi zatím nic nezapisuje... nejspíše mi to někde chybí..zkusím najít..

O tom postfixu už uvažuji..ale zase..vše mi chodí..jenom to SMTPS ne...a nejspíše někde nějaká malá banalita to bude... nevím už..

[Dandy]

Když to napíši podle tebe, tak se mi provede toto:

root: /etc/init.d/stunnel4 restart

Kód: [Vybrat]

Reading configuration from file -d
-d: No such file or directory (2)
Cannot read configuration

Syntax:
stunnel [<filename>] ] -fd <n> | -help | -version | -sockets
    <filename>  - use specified config file
    -fd <n>     - read the config file from a file descriptor
    -help       - get config file help
    -version    - display version and defaults
    -sockets    - display default socket options

[ET]

zdar,
posli sem vystup `openssl s_client -connect localhost:465` tj bez "-starttls smtp"

[Reklama]

[Dandy]

root@vs391:~# openssl s_client -connect localhost:465
CONNECTED(00000003)
write:errno=104