search

the-djmaze / snappymail

Simple, modern & fast web-based email client
https://snappymail.eu
GNU Affero General Public License v3.0
1.01k stars 121 forks source link

"Cannot enable STARTTLS" to IMAP server -- SMTP seems ok #381

Closed kouinkouin closed 2 years ago

kouinkouin commented 2 years ago

SnappyMail version, browser, browser version

Expected behavior and actual behavior

Similarly at #347 , the IMAP (and not the SMTP) tab shows a "Cannot enable STARTTLS" error. The SnappyMail instance is on the same server (OVH dedicated server) than Rainloop instance. For the same domain (on a old mailserver, the Rainloop (and Thunderbird, Mail, ...) works but not SnappyMail. For another domain (and more recent mailserver), Rainloop and SnappyMail work.

image

Context

I think the important point is the mail server. Not because an IP is blocked, but because the stack Postfix/* is old (Postfix 2.9.6-2 on a debian 7.8/wheezy) and the ciphers/algo used for openssl are deprecated (and so, the support removed from SnappyMail and not Rainloop). (I precise the migration of this old mailserver is pending ;-) ).

-> The question is : How to find the security parameter(s) to update, mailserver side and/or SnappyMail side, to have a SnappyMail working?

Steps to reproduce the problem

Create a domain (/?admin#/domains) based on a (very) old mail server and setup IMAP with STARTTLS on port 143.

Logs or screenshots

[2022-05-11 09:52:17.977][a38c23ea] INFO[DATA]: [DATE:2022-05-11 UTC][SM:2.15.1][IP:109.136.205.93][PID:677][nginx/1.14.2][fpm-fcgi][Streams:tcp,udp,unix,udg,ssl,tls,tlsv1.0,tlsv1.1,tlsv1.2,tlsv1.3]
[2022-05-11 09:52:17.977][a38c23ea] REQUEST[NOTE]: [POST] https://webmail2.mailserver.be/?/Json/&q[]=/0/
[2022-05-11 09:52:17.978][a38c23ea] JSON[NOTE]: Action: DoAccountSetup
[2022-05-11 09:52:17.978][a38c23ea] POST[DATA]: {"Email":"kouinkouin@domain.be","Password":"*******","New":1,"Action":"AccountSetup","XToken":"dde7918682b21e1a47c1cdee66c44ee0dd1bc09e"}
[2022-05-11 09:52:17.981][a38c23ea] IMAP[NOTE]: Start connection to "tcp://mail.mailserver.be:143"
[2022-05-11 09:52:17.994][a38c23ea] IMAP[NOTE]: Connect (success)
[2022-05-11 09:52:18.001][a38c23ea] IMAP[DATA]: < * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready.\r\n
[2022-05-11 09:52:18.001][a38c23ea] IMAP[DATA]: > TAG1 STARTTLS\r\n
[2022-05-11 09:52:18.002][a38c23ea] IMAP[DATA]: < TAG1 OK Begin TLS negotiation now.\r\n
[2022-05-11 09:52:18.011][a38c23ea] PHP[NOTICE]: /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php [line:236, code:2]
[2022-05-11 09:52:18.011][a38c23ea] PHP[NOTICE]: Error: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:
error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small
[2022-05-11 09:52:18.012][a38c23ea] PHP[NOTICE]: /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php [line:238, code:2]
[2022-05-11 09:52:18.012][a38c23ea] PHP[NOTICE]: Error: stream_socket_enable_crypto(): SSL/TLS already set-up for this stream
[2022-05-11 09:52:18.012][a38c23ea] PHP[NOTICE]: /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php [line:240, code:2]
[2022-05-11 09:52:18.012][a38c23ea] PHP[NOTICE]: Error: stream_socket_enable_crypto(): SSL/TLS already set-up for this stream
[2022-05-11 09:52:18.012][a38c23ea] PHP[NOTICE]: /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php [line:242, code:2]
[2022-05-11 09:52:18.012][a38c23ea] PHP[NOTICE]: Error: stream_socket_enable_crypto(): SSL/TLS already set-up for this stream
[2022-05-11 09:52:18.012][a38c23ea] IMAP[ERROR]: MailSo\Net\Exceptions\Exception: Cannot enable STARTTLS. in /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php:251
Stack trace:
#0 /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Imap/ImapClient.php(101): MailSo\Net\NetClient->EnableCrypto()
#1 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Model/Account.php(229): MailSo\Imap\ImapClient->Connect('mail.mailserver.b...', 143, 2, false, true, '')
#2 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/UserAuth.php(438): RainLoop\Model\Account->IncConnectAndLoginHelper(Object(RainLoop\Plugins\Manager), Object(MailSo\Mail\MailClient), Object(RainLoop\Config\Application))
#3 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/UserAuth.php(130): RainLoop\Actions->CheckMailConnection(Object(RainLoop\Model\AdditionalAccount), true)
#4 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/Accounts.php(96): RainLoop\Actions->LoginProcess('kouinkouin@domain...', '*******', false, false)
#5 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/ServiceActions.php(155): RainLoop\Actions->DoAccountSetup()
#6 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Service.php(133): RainLoop\ServiceActions->ServiceJson('')
#7 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Service.php(15): RainLoop\Service::RunResult()
#8 /snappymail/snappymail/v/2.15.1/include.php(169): RainLoop\Service::Handle()
#9 /snappymail/index.php(11): include('/snappymail/sna...')
#10 {main}
[2022-05-11 09:52:18.969][a38c23ea] SERVICE[WARNING]: AuthError[102]
[2022-05-11 09:52:18.969][a38c23ea] SERVICE[WARNING]:   Cannot enable STARTTLS. @ /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php#251
[2022-05-11 09:52:18.969][a38c23ea] INFO[ERROR]: MailSo\Net\Exceptions\Exception: Cannot enable STARTTLS. in /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php:251
Stack trace:
#0 /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Imap/ImapClient.php(101): MailSo\Net\NetClient->EnableCrypto()
#1 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Model/Account.php(229): MailSo\Imap\ImapClient->Connect('mail.mailserver.b...', 143, 2, false, true, '')
#2 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/UserAuth.php(438): RainLoop\Model\Account->IncConnectAndLoginHelper(Object(RainLoop\Plugins\Manager), Object(MailSo\Mail\MailClient), Object(RainLoop\Config\Application))
#3 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/UserAuth.php(130): RainLoop\Actions->CheckMailConnection(Object(RainLoop\Model\AdditionalAccount), true)
#4 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/Accounts.php(96): RainLoop\Actions->LoginProcess('kouinkouin@domain...', '*******', false, false)
#5 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/ServiceActions.php(155): RainLoop\Actions->DoAccountSetup()
#6 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Service.php(133): RainLoop\ServiceActions->ServiceJson('')
#7 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Service.php(15): RainLoop\Service::RunResult()
#8 /snappymail/snappymail/v/2.15.1/include.php(169): RainLoop\Service::Handle()
#9 /snappymail/index.php(11): include('/snappymail/sna...')
#10 {main}
[2022-05-11 09:52:18.969][a38c23ea] SERVICE[WARNING]: AuthError[102]
[2022-05-11 09:52:18.969][a38c23ea] SERVICE[WARNING]:   Cannot enable STARTTLS. @ /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php#251
[2022-05-11 09:52:18.969][a38c23ea] INFO[ERROR]: MailSo\Net\Exceptions\Exception: Cannot enable STARTTLS. in /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Net/NetClient.php:251
Stack trace:
#0 /snappymail/snappymail/v/2.15.1/app/libraries/MailSo/Imap/ImapClient.php(101): MailSo\Net\NetClient->EnableCrypto()
#1 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Model/Account.php(229): MailSo\Imap\ImapClient->Connect('mail.mailserver.b...', 143, 2, false, true, '')
#2 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/UserAuth.php(438): RainLoop\Model\Account->IncConnectAndLoginHelper(Object(RainLoop\Plugins\Manager), Object(MailSo\Mail\MailClient), Object(RainLoop\Config\Application))
#3 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/UserAuth.php(130): RainLoop\Actions->CheckMailConnection(Object(RainLoop\Model\AdditionalAccount), true)
#4 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/Accounts.php(96): RainLoop\Actions->LoginProcess('kouinkouin@domain...', '*******', false, false)
#5 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/ServiceActions.php(155): RainLoop\Actions->DoAccountSetup()
#6 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Service.php(133): RainLoop\ServiceActions->ServiceJson('')
#7 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Service.php(15): RainLoop\Service::RunResult()
#8 /snappymail/snappymail/v/2.15.1/include.php(169): RainLoop\Service::Handle()
#9 /snappymail/index.php(11): include('/snappymail/sna...')
#10 {main}

Next RainLoop\Exceptions\ClientException: AuthError[102] in /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/UserAuth.php:454
Stack trace:
#0 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/UserAuth.php(130): RainLoop\Actions->CheckMailConnection(Object(RainLoop\Model\AdditionalAccount), true)
#1 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Actions/Accounts.php(96): RainLoop\Actions->LoginProcess('kouinkouin@domain...', '*******', false, false)
#2 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/ServiceActions.php(155): RainLoop\Actions->DoAccountSetup()
#3 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Service.php(133): RainLoop\ServiceActions->ServiceJson('')
#4 /snappymail/snappymail/v/2.15.1/app/libraries/RainLoop/Service.php(15): RainLoop\Service::RunResult()
#5 /snappymail/snappymail/v/2.15.1/include.php(169): RainLoop\Service::Handle()
#6 /snappymail/index.php(11): include('/snappymail/sna...')
#7 {main}
[2022-05-11 09:52:18.969][a38c23ea] JSON[DATA]: {"Action":"AccountSetup","Result":false,"ErrorCode":102,"ErrorMessage":"","ErrorMessageAdditional":"Cannot enable STARTTLS.","Time":1000}
[2022-05-11 09:52:18.969][a38c23ea] INFO[MEMORY]: Memory peak usage: 2MB
[2022-05-11 09:52:18.970][a38c23ea] INFO[TIME]: Time delta: 1.0008380413055
[2022-05-11 09:52:18.970][a38c23ea] IMAP[NOTE]: Disconnected from "tcp://mail.mailserver.be:143" (success)

:warning: Because the mailserver is a old dinosaur with probably many security issues, the real email/login has been replaced with "kouinkouin@domain.be" and the mailserver domain has been replaced with "mail.mailserver.be". Do not try to execute connection/DNS tests on these domains.

the-djmaze commented 2 years ago

Because the instance is on 127.0.0.1, can't you just disable TLS for local connections?

kouinkouin commented 2 years ago

Because the instance is on 127.0.0.1, can't you just disable TLS for local connections?

The webmail (SnappyMail) is on a different server than the mailserver :thinking: . Or you mean on the Postfix settings of the mailserver?

the-djmaze commented 2 years ago

Ah, so Postfix is not on the same server as SnappyMail. That makes it harder then.

I could enable < TLS1.2 through application.ini setting.

kouinkouin commented 2 years ago

I could enable < TLS1.2 through application.ini setting.

Did not find it (grep -i tls .../application.ini return nothing, even on a fresh application.ini).

But indeed, I think that could be solve my problem :-D .

kouinkouin commented 2 years ago

logs of dovecot (mailserver side):

May 11 14:36:08 imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2002, ret=-1: unknown state [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client hello A [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server hello A [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate A [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server done A [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL alert: where=0x4004, ret=552: fatal handshake failure [1.2.3.4]
May 11 14:36:08 imap-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [1.2.3.4]

(where 1.2.3.4 is the IP of SnappyMail.) The fatal handshake failure seems confirm the cypher/tls version error.

the-djmaze commented 2 years ago

Could you try the above change?

kouinkouin commented 2 years ago

Building (release.php)... I tell you when I tried!

the-djmaze commented 2 years ago

When it doesn't, you could fiddle with this line 239: https://github.com/the-djmaze/snappymail/blob/5f788dfda70069f4c0971ccbb79d68eaa02a6dcd/snappymail/v/0.0.0/app/libraries/MailSo/Net/NetClient.php#L239

Like:

$crypto_method |= STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT;

or

$crypto_method |= STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT | STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT | STREAM_CRYPTO_METHOD_SSLv3_CLIENT;
kouinkouin commented 2 years ago

I tried with the 3 $crypto_method possibilities (and with and die(...) to verify the code was executed) and the result of stream_socket_enable_crypto() is false. I will check which TLSvX my server talk...

By the way, with SSL/TLS on port 993, for the 3 possibilities of $crypto_method, full JSON result is:

{
  "Action":"AdminDomainTest",
  "Result":{
    "Imap":"stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages:\nerror:141A318A:SSL routines:tls_process_ske_dhe:dh key too small",
    "Smtp":"Cannot enable STARTTLS.",
    "Sieve":true
  },
  "Time":52
}

edit: the "By the way" section is tested with SSL/TLS on port 993

kouinkouin commented 2 years ago

From webmail server:

$ openssl s_client -starttls imap -connect mail.mailserver.be:143

CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1
verify return:1
depth=0 CN = *.mailserver.be
verify return:1
---
Certificate chain
 0 s:CN = *.mailserver.be
   i:C = US, O = DigiCert Inc, CN = GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1
 1 s:C = US, O = DigiCert Inc, CN = GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
 2 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
subject=CN = *.mailserver.be

issuer=C = US, O = DigiCert Inc, CN = GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: DH, 1024 bits
---
SSL handshake has read 5175 bytes and written 534 bytes
Verification: OK
---
New, TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : DHE-RSA-AES256-GCM-SHA384
    Session-ID: BD0995C596725268BC81932C838B86BA5A3643BE74D363E04B1343A70BA2F7E5
    Session-ID-ctx: 
    Master-Key: 4F8C9232E82D30E1BEDC5BB642AD82A79A88BBF623871A0A1289E265E6B80A7487DD1F33EB3E072F454197CDC9713E6C
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 42 66 9f ab 3a 01 d6 fd-b5 d0 48 8c ce c8 fb 15   Bf..:.....H.....
    0010 - 69 13 0f f4 4d 3b b8 a1-dd 0c 8d 96 ae 6a 4a ef   i...M;.......jJ.
    0020 - 6b ae b3 31 70 36 3d d7-1f 0a 8b fb f7 fb cc 45   k..1p6=........E
    0030 - 42 97 84 6e 7d 16 44 18-26 f4 f9 43 10 9d 13 a4   B..n}.D.&..C....
    0040 - c7 ef 01 8c 23 1f f0 ae-56 87 71 21 56 c8 cc ec   ....#...V.q!V...
    0050 - 99 75 ff d6 c9 9a ff 00-26 4b 04 0f 28 39 88 ce   .u......&K..(9..
    0060 - ba 9f 3f ad e8 21 9d 79-aa f1 99 2e a3 fd 6b aa   ..?..!.y......k.
    0070 - 0d 46 11 58 e4 fb 41 a6-c8 7b 9e 8f b0 65 29 b7   .F.X..A..{...e).
    0080 - 3f e9 ba f4 27 88 a2 8b-0f 8d a1 5c 5a b7 98 b2   ?...'......\Z...
    0090 - fc 0e c1 45 0c 62 80 7e-92 fb b2 c5 d0 7c ce b4   ...E.b.~.....|..
    00a0 - 8b b6 87 88 d8 56 31 28-23 c2 15 20 2e 9a dc a1   .....V1(#.. ....

    Start Time: 1652300235
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
. OK Pre-login capabilities listed, post-login capabilities have more.
^C

So, the mailserver seems can talk with TLSv1.2 on port 143 (or I have a wrong interpretation of the result, which it's possible!)

the-djmaze commented 2 years ago

It does talk TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384.

The problem is dh key too small and that is security_level.

Find in NetClient.php line:

//              'disable_compression' => true

replace with

//              'disable_compression' => true,
                'security_level' => 1
kouinkouin commented 2 years ago

Nice! The SSL/TLS connection on port 993 works yet! Idem for SMTP, using SSL/TLS on port 465 instead of STARTTLS on port 587 works.

The STARTTLS is always failing. Is it pertinent to solve it for (others) people who will have the issue, or we close the issue by saying "Issue with STARTTLS? -> Use SSL/TLS!" ?

kouinkouin commented 2 years ago

My bad... I rollback your commit 5f788df, and add only the 'security_level' => 1 (7e30cb9) and STARTTLS and TLS/SSL are working!

the-djmaze commented 2 years ago

I've rearranged the connect code for future improvements.

the-djmaze commented 2 years ago

Does v2.15.2 solve it?

kouinkouin commented 2 years ago

Works!!!

A big "thank you! :heart: " for the great project "resurrect rainloop", but also for your reactivity!!!

qubadoff commented 1 year ago

It does talk TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384.

The problem is dh key too small and that is security_level.

Find in NetClient.php line:

//                'disable_compression' => true

replace with

//                'disable_compression' => true,
              'security_level' => 1

Where this file location ? i used ubuntu virtual server

the-djmaze commented 1 year ago

@qubadoff this has changed.

Global setting in /data/_data_/_default_/configs/application.ini

[ssl]

; https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html
security_level = 1

And domain settings in /data/_data_/_default_/domains/DOMAIN.TLD.json

            "security_level": 1
loganess commented 1 year ago

i am still getting error after modified security_level to 1. Is there anyone facing same issue?

Thank you

loganess commented 1 year ago

after changing to use hostname instead of ip, then it works.