search

kubernetes-mail-server / postfix

The postfix SMTP/SMTPD server used to send and receive emails from the outside world
4 stars 1 forks source link

TLS errors #3

Open knfoo opened 4 years ago

knfoo commented 4 years ago

I am slowly moving my setup in to production. I have seen this error that I do not really understand. Once receiving an email from a public mail server I get this tls related error:

warning: TLS library problem: error:060A209F:digital envelope routines:EVP_MD_size:message digest is null:crypto/evp/evp_lib.c:323

And the email is not delivered to my server

christhomas commented 4 years ago

There are so many parts that work together in this setup it's not really something that pops out as a reason why.

check your tls setup and make sure that it passes all the checks because it could be incorrectly configured, maybe you're not setting up the TLS certificate in the right way, or perhaps your ingress doesn't create one, or perhaps it's not being setup with your domain, etc, etc.

However, I took a look into my logs and found this, relating to your issue here that you sent me, so that's a nice touch

Apr  2 09:02:01 postfix-588b7cd947-nm425 postfix/postscreen[19068]: PASS NEW [192.30.252.198]:47735
Apr  2 09:02:02 postfix-588b7cd947-nm425 postfix/smtpd[19069]: connect from out-7.smtp.github.com[192.30.252.198]
Apr  2 09:02:02 postfix-588b7cd947-nm425 postfix/smtpd[19069]: Anonymous TLS connection established from out-7.smtp.github.com[192.30.252.198]: TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)
Apr  2 09:02:02 postfix-588b7cd947-nm425 postfix/smtpd[19069]: CBDB54A0009: client=out-7.smtp.github.com[192.30.252.198]
Apr  2 09:02:02 postfix-588b7cd947-nm425 postfix/smtpd[19069]: warning: TLS library problem: error:060A209F:digital envelope routines:EVP_MD_size:message digest is null:crypto/evp/evp_lib.c:316:
Apr  2 09:02:02 postfix-588b7cd947-nm425 postfix/smtpd[19069]: lost connection after DATA (0 bytes) from out-7.smtp.github.com[192.30.252.198]
Apr  2 09:02:02 postfix-588b7cd947-nm425 postfix/smtpd[19069]: disconnect from out-7.smtp.github.com[192.30.252.198] ehlo=2 starttls=1 mail=1 rcpt=1 data=0/1 commands=5/6
Apr  2 09:02:03 postfix-588b7cd947-nm425 postfix/postscreen[19068]: CONNECT from [167.89.101.202]:54543 to [167.86.110.116]:25
Apr  2 09:02:09 postfix-588b7cd947-nm425 postfix/postscreen[19068]: PASS OLD [167.89.101.202]:54543
Apr  2 09:02:09 postfix-588b7cd947-nm425 postfix/smtpd[19069]: connect from o11.sgmail.github.com[167.89.101.202]
Apr  2 09:02:10 postfix-588b7cd947-nm425 postfix/smtpd[19069]: Anonymous TLS connection established from o11.sgmail.github.com[167.89.101.202]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Apr  2 09:02:11 postfix-588b7cd947-nm425 postfix/smtpd[19069]: 861CF4A0009: client=o11.sgmail.github.com[167.89.101.202]
Apr  2 09:02:12 postfix-588b7cd947-nm425 postfix/cleanup[19072]: 861CF4A0009: message-id=<kubernetes-mail-server/postfix/issues/3@github.com>
Apr  2 09:02:12 postfix-588b7cd947-nm425 postfix/qmgr[464]: 861CF4A0009: from=<bounces+848413-98e4-chris.thomas=antimatter-studios.com@sgmail.github.com>, size=4947, nrcpt=1 (queue active)
Apr  2 09:02:12 postfix-588b7cd947-nm425 postfix/lmtp[19073]: 861CF4A0009: to=<chris.thomas@antimatter-studios.com>, relay=dovecot.mail-server[10.97.14.134]:24, delay=1, delays=0.95/0.01/0.02/0.04, dsn=2.0.0, status=sent (250 2.0.0 <chris.thomas@antimatter-studios.com> TXOYEBSqhV5KAQAAZX7cTg Saved)
Apr  2 09:02:12 postfix-588b7cd947-nm425 postfix/qmgr[464]: 861CF4A0009: removed
Apr  2 09:02:14 postfix-588b7cd947-nm425 postfix/smtpd[19069]: disconnect from o11.sgmail.github.com[167.89.101.202] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7

You can see, I'm getting that same error, but I do get the email. So I would think the problem is not related to this error, but another configuration issue.

knfoo commented 4 years ago

Yeah strange. I upgraded to the alpine 3.11 image and disallowed sslv3 and tls1 and now the problem seems to be gone.

christhomas commented 4 years ago

This probably has something to do with it: https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/comment-page-1/

Do you also receive the email like you expected to? Or is it just the error message that has gone?

christhomas commented 4 years ago

Remember to do a pull request for your changes which fix the problem :) danke!