# 2.2.16: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.7 # OS: Linux 3.18.9-hardened x86_64 Gentoo Base System release 2.2 auth_mechanisms = plain login digest-md5 cram-md5 ntlm apop auth_verbose = yes default_client_limit = 10000 default_process_limit = 1000 default_vsz_limit = 512 M deliver_log_format = from=%f, msgid=%m, psize=%p: %$ disable_plaintext_auth = no dotlock_use_excl = no doveadm_password = yjH5KiEpCWAVLHtt lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = Active24 Sp. z o.o. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %k session=<%{session}> login_trusted_networks = 192.168.67.0/27 mail_access_groups = vmail mail_fsync = always mail_gid = 502 mail_location = maildir:~/ mail_log_prefix = "%s(%u) session=<%{session}>: " mail_plugins = mail_log notify quota mail_uid = 502 maildir_very_dirty_syncs = yes mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { autosubscribe = Trash autosubscribe2 = Spam autosubscribe3 = Sent autosubscribe4 = Drafts mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename append append mail_log_fields = box msgid from size quota = maildir quota2 = maildir:user quota quota_rule = *:storage=10GB quota_rule2 = *:messages=10000 quota_rule3 = Trash:storage=+10M quota_rule4 = Trash:messages=+100 quota_warning = storage=80%% quota-warning 80 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=100%% quota-warning 100 %u sieve_global_path = /etc/dovecot/sieve/default.sieve } sendmail_path = /usr/sbin/postfix service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service doveadm { unix_listener doveadm-server { mode = 0666 } } service imap-login { process_limit = 4096 process_min_avail = 6 service_count = 1000 } service imap { process_limit = 4096 process_min_avail = 6 service_count = 100 } service lmtp { inet_listener lmtp { address = 0.0.0.0 port = 24 ssl = yes } process_limit = 100 process_min_avail = 5 user = vmail } service pop3-login { process_limit = 4096 process_min_avail = 6 service_count = 1000 } service pop3 { process_limit = 4096 process_min_avail = 6 service_count = 100 } service quota-warning { executable = script /opt/bin/quota-warning unix_listener quota-warning { mode = 0600 user = vmail } user = vmail } ssl_ca =

W dniu 27.07.2015 o 15:03, Steffen Kaiser pisze:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Mon, 27 Jul 2015, Piotr Rotter wrote:

...

I tryed to eneble TLS connection from postfix to dovecot lmtp. Unfortunely I have problem with certificate, postfix shows,

post the output of doveconf -n

...

2015-07-27T12:51:15.025333+02:00 k30 postfix/lmtp[4572]: Untrusted TLS connection established to 192.168.67.30[192.168.67.30]:24: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)

I checked certs by openssl s_client: #openssl s_client -connect localhost:24 -showcerts -starttls smtp -CApath /etc/ssl/certs/

And I gets

didn't found starttls in server response, try anyway... depth=0 OU = GT46258006, OU = See www.rapidssl.com/resources/cps (c)15, OU = Domain Control Validated - RapidSSL(R), CN = mail.active24.pl verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 OU = GT46258006, OU = See www.rapidssl.com/resources/cps (c)15, OU = Domain Control Validated - RapidSSL(R), CN = mail.active24.pl verify error:num=27:certificate not trusted verify return:1 depth=0 OU = GT46258006, OU = See www.rapidssl.com/resources/cps (c)15, OU = Domain Control Validated - RapidSSL(R), CN = mail.active24.pl verify error:num=21:unable to verify the first certificate verify return:1

It look likes dovecot lmtp send 3 times the same certificate. I made the same test for imap in the same dovecot instance:

#openssl s_client -connect localhost:143 -showcerts -starttls imap -CApath /etc/ssl/certs/ CONNECTED(00000003) depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA verify return:1 depth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA - G3 verify return:1 depth=0 OU = GT46258006, OU = See www.rapidssl.com/resources/cps (c)15, OU = Domain Control Validated - RapidSSL(R), CN = mail.active24.pl verify return:1

For imap it looks ok. Why lmtp shows wrong certs list

# dovecot --version 2.2.16

• -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQEVAwUBVbYsIXz1H7kL/d9rAQIDbgf/UTzRhj6ZiiuknCHjmmFRwdbTk+qclXbo vo2XtuH6V3WcuBoHwRedOiTuGH5g8WO2A+tl9wSSSvtw9TWurt2lLMfUsemWO4r4 zv7SwkTn2CVCIbZmC/3D1kqXHm08fuSo9Vn5/tgfgdOFwt5r4VfNkkp+zm72wFWT o6uzL+EXSGEqnm/R1hFdC9cDZqKuzQ3MK+8qasoCPgMAr4svN0lwdi+yATaxzjgj MviyKpdtQmA9gKRfLhptVcIP17rRNkoZKCS/Eboy6g/Rjf8c4C4Hn7lUbnx+kCVe Xk4Z2cmlPhl17iyvzo8Tvyeuu/gxDEXfa/xgwRGhp0xx3c+WBOrJSg== =a+SK -----END PGP SIGNATURE-----

-- Best regards! Piotr Rotter