TLS and SMTP auth problem

Hello,

I'm running the following mailserver setup:
I'm running a Debian woody server at home with postfix, which relays all
mail over to my external Debian sarge root server, running qmail. Now I
want to use smtp auth and tls.
This is how my qmail server answers to telnet localhost 25

EHLO
250-rom.iunius.org
250-STARTTLS
250-AUTH LOGIN CRAM-MD5 PLAIN
250-AUTH=LOGIN CRAM-MD5 PLAIN
250-PIPELINING
250 8BITMIME

But this is how the postfix server at home opens the tls connection to
my qmail server.

Apr 30 16:30:07 santa postfix/smtp[17645]: TLS connection established to
iunius.org: TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)

The result is that I can not relay, because i'm not authenticated:

553 sorry, that domain isn't in my list of allowed rcpthosts; no valid
cert for gatewaying (#5.7.1))

Incoming TLS connections to my postfix server are working, as you can see:

Apr 30 16:46:33 santa postfix/smtpd[18101]: TLS connection established
from barney.springfield.home[10.10.42.18]: TLSv1 with cipher RC4-MD5
(128/128 bits)

And this is how the postfix server answers to telnet localhost 25:

250-santa.springfield.home
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH GSSAPI DIGEST-MD5 CRAM-MD5
250-AUTH=GSSAPI DIGEST-MD5 CRAM-MD5
250-XVERP
250 8BITMIME

So, as far as I understand the problem, my postfix is using the wrong
cipher, when connecting to my external mail relay. Is this right, so far?
If yes, how do I change this for example to MD5 as above?

Or is this an other kind of problem?

Hope someone can help me.

King Regards,
Andreas

--

No votes yet

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

TLS and SMTP auth problem

On Mon, Apr 30, 2007 at 11:59:18PM +0200, Andreas Krummrich wrote:
> Hello,
>
> I'm running the following mailserver setup:
> I'm running a Debian woody server at home with postfix, which relays all
> mail over to my external Debian sarge root server, running qmail. Now I
> want to use smtp auth and tls.
> This is how my qmail server answers to telnet localhost 25
>
If they are both on the same network and you have control over both
machines, just have the relay machine trust the other machine. In
postfix this can be done with the mynetworks option. I am not sure what
the qmail equivalent is.

The only time this might not be a good idea is if you run some sort of
open WAP or have random people connecting to your network.

Regards,

-Roberto
--
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com

TLS and SMTP auth problem

Hi Roberto,
Roberto C. Sánchez schrieb:
> On Mon, Apr 30, 2007 at 11:59:18PM +0200, Andreas Krummrich wrote:
>
>> Hello,
>>
>> I'm running the following mailserver setup:
>> I'm running a Debian woody server at home with postfix, which relays all
>> mail over to my external Debian sarge root server, running qmail. Now I
>> want to use smtp auth and tls.
>> This is how my qmail server answers to telnet localhost 25
>>
>>
> If they are both on the same network and you have control over both
> machines, just have the relay machine trust the other machine. In
> postfix this can be done with the mynetworks option. I am not sure what
> the qmail equivalent is.
>
No, the machines are not in the same network. The postfix machine is
localed at home in my private net with a dynamic ip, connecting to the
internet and the qmail server is a root server with an official ip.
I thin TLS would be the better solution in this scenario.
> The only time this might not be a good idea is if you run some sort of
> open WAP or have random people connecting to your network.
>
> Regards,
>
> -Roberto
>
Kind Regard,
Andreas

--

Syndicate content