bug-mailfromd

Search for: Advanced

Re: [Bug-mailfromd] Postfix TLS Macros?

Hi Mehmet,

> Any pointers on how I can check for that?

Use --gacopyz-log=proto option to mailfromd[1].  It produces a very
copious log (a detailed dump of each MTA milter command and response),
so take care if using it on a heavy loaded server.

Notice the following:

1. Postfix defines both cert_subject and cert_issuer only if the following
two conditions are met:

  (a) postfix is configured with smtpd_tls_ask_ccert=yes or
  smtpd_tls_req_ccert=yes and
  (b) the client sends their certificate during TLS handshake.

That means that they are not defined during normal TLS sessions.
  
2. The (b) obviously takes effect only after STARTTLS has finished
successfully.

3. In TLS session, the EHLO command is issued twice: first time right
after establishing connection, and second time after STARTTLS.
Correspondingly, prog helo is invoked twice.  Oviously, both macros are
not defined during the first call, and are defined during the second
one.

4. Provided that the condition 1.(a) is met, you can use the following
command to emulate the TLS session:

  openssl s_client -connect HOST:25 -starttls smtp -key KFILE -cert CFILE
  
where HOST stands for the host name or IP of your SMTP server, KFILE for
the name of the client certificate key file, and CFILE for the name of
the client certificate file (both in PEM).  Once the connection is
established, type

  EHLO HOSTNAME

(replace HOSTNAME with any suitable host name).  After that command,
you should see the cert_subject value printed in your mailfromd log
output.

5. You may wish to set smtpd_tls_loglevel=2 in your postfix
configuration to have it print out client certificate data during TLS
negotiation.

Hope that helps.

Regards,
Sergey

[1] https://www.gnu.org.ua/software/mailfromd/manual/Logging-and-Debugging-Options.html#gacopyz_002dlog-option