Postfix smtp vs smtpd -o options

Question

Table below shows which protocols/ports could be used in each step of the email transfer. Table also indicates which protocols/ports I want to use on my postfix server setup by marking them with ✘ or ✔.

n	operation	sender	receiver	possible protocols/ports
1	"mail submission"	MUA	MSA	(✘) SMTP `25` (✘) SMTP `25` & `STARTTLS` (✘) SMTP `587` & `STARTTLS` (✔) SMTPS `465` & implicit TLS
2	"server internal"	MSA	MTA	/
3...	"mail relay"	MTA	MTA	(✘) SMTP `25` (✘) SMTP `25` & `STARTTLS` (✔) SMTP `25` & `STARTTLS` & DANE
n -2	"server internal"	MTA	MDA	/
n - 1	"server internal"	MDA	MS	/
n	"mailbox access"	MS	MUA	(✘) POP3 `110` & `STARTTLS` (✘) POP3S `995` & implicit TLS (✘) IMAP `143` & `STARTTLS` (✔) IMAPS `993` & implicit TLS

Before I continue I would ask you to agree or disagree with two of assumptions:

ASSUMPTION A:

I assume from this old answer that Postfix service 465 was renamed to smtps somewhere along the way. Therefore I am using service smtps in order to listen on "mail submission" SMTPS port 465.

ASSUMPTION B:

The top of my /etc/postfix/master.cf file looks like this:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
# ==========================================================================
smtp      inet  n       -       y       -       -       smtpd
smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_security_level=encrypt
  -o smtpd_use_tls=yes
  -o smtpd_tls_wrappermode=yes
  -o smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
  -o smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
  -o smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key

  ...

I read here that:

postfix/smtpd - is SMTP daemon process for "incoming mail" and routing it to the appropriate internal location.

postfix/smtp - is SMTP daemon process for "outgoing mail" out to the world.

So now I am assuming that postfix/smtpd is listening on port 465 for "incoming email" from local users and on port 25 for "incomming email" from everywhere else. I am also asumming that postfix/smtp is using port 25 where it sends "outgoing email".

PROBLEM:

When I was configuring Postfix somewhere along the way I disabled an entire TLS section inside /etc/postfix/main.cf because I did not want global settings to mess with my settings for individual services that I set inside /etc/postfix/master.cf.

As you can see I used no -o options for the service smtp while I used a lot -o options for service smtps. What confuses me most is that in the official documentation /etc/postfix/main.cf I can find a lot of almost duplicated options like:

According to the cited text I should use:

the ones starting with smtp_ for "outgoing mail"
the ones starting with smtpd_ for "incomming mail".

If my philosophy is correct, then my current setup should work. It partialy does because I can achieve a TLS 1.3 handshake using openssl command on a different computer like this:

┌───┐
│ $ │ ziga > ziga--workstation > ~
└─┬─┘
  └─> openssl s_client -connect pis.eu:465 -tls1_3

CONNECTED(00000003)
depth=0 CN = tek-eu
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = tekpi-eu
verify return:1
---
Certificate chain
 0 s:CN = tek-eu
   i:CN = tek-eu
---
Server certificate
-----BEGIN CERTIFICATE-----

  < REMOVED FOR CLARITY >

-----END CERTIFICATE-----
subject=CN = tek-eu

issuer=CN = tek-eu

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1286 bytes and written 313 bytes
Verification error: self signed certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 18 (self signed certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 45F832A32F5F27CEAA41B271F28545ECA98DC1AC61F51A484123DD28B2535C30
    Session-ID-ctx: 
    Resumption PSK: 3175AD1641D8D77511FD5C76508D339D01F5D1CE02DBF90F33FEBD334A7E76FD44B52808A846C281616469143977B6F1
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:

    < REMOVED FOR CLARITY >

    Start Time: 1607602078
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
220 mail.pis.eu -------> "HELLO!"

Above I used a parameter -tls1_3 that should work because my configuration parameter -o smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1 should forbid any handshake other thanTLS 1.2 and TLS 1.3. But if change parameter -tls1_3 to -tls1 to try TLS 1 handshake it suceeds!?

┌───┐
│ $ │ ziga > ziga--workstation > ~
└─┬─┘
  └─> openssl s_client -connect pis.eu:465 -tls1
CONNECTED(00000003)
depth=0 CN = tek-eu
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = tek-eu
verify return:1
---
Certificate chain
 0 s:CN = tek-eu
   i:CN = tek-eu
---
Server certificate
-----BEGIN CERTIFICATE-----

  < REMOVED FOR CLARITY >

-----END CERTIFICATE-----
subject=CN = tek-eu

issuer=CN = tek-eu

---
No client certificate CA names sent
Peer signing digest: MD5-SHA1
Peer signature type: RSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1385 bytes and written 227 bytes
Verification error: self signed certificate
---
New, TLSv1.0, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : ECDHE-RSA-AES256-SHA
    Session-ID: C1E39786A475DA48ED222EAB5247CCE57D49875AE9A442A73027FBE1F9BB7C4D
    Session-ID-ctx: 
    Master-Key: 5900F37B79A7949871008A827904F2BA907F42EE8BBC73328CD49DF7E37AF2687C06B316922D7D76DDC36FA1DF912E7A
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:

    < REMOVED FOR CLARITY >
    
    Start Time: 1607602884
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)
    Extended master secret: yes
---
220 mail.pis.eu -------> "HELLO!"

How come that this suceed? What am I doing wrong? Curently my setup only has -o smtpd_ options. Should I also use -o smtp_ options? Where should I put these?

As you see I am confused...

I solved this. The problem was that option `smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1` was only for *"oportunistic TLS"* which is applicable only to ports `25` and `587`. But there is a similar option ` `smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1` that is for "mandatory TLS" which is applicable to port `465` and this is the one that I want. Well in fact now I have both because I want to support only TLS 1.2 & TLS 1.3. — 71GA, Dec 10 '20 at 17:32
A much shorter way to ask this: *"Why does my `smtpd_tls_protocols` configuration not affect on my TLS-wrapped service?"* - the answer would mostly be the first sentence of each the 2 relevant sections in `man postconf(5)`. — anx, Dec 13 '20 at 11:53

Postfix smtp vs smtpd -o options

ASSUMPTION A:

ASSUMPTION B:

PROBLEM:

0 Answers0