[Solved] Email problems, dovecot ports and protocols

UCS - Univention Corporate Server
,
#1

Hi everyone,

In the last few days we tried to enable email in our domain. Here I must explain we are only planning to use it internally, for notifications etc.

We’ve installed the Mail Server app and tried to connect using a number of clients.

First problem was that not all clients could connect. Some failing auth, some not recognising ports (port/protocol combination i.e.: 143 / STARTTLS)

We also noticed that SMTP unauthenticated send was working on port 25.

Looking at the logs we found this:
/var/log/dovecot.warn

Jul 13 02:27:57 dc01 dovecot: doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:61: ssl_protocols has been replaced by ssl_min_protocol
Jul 13 02:27:57 dc01 dovecot: doveconf: Error: Could not find a minimum ssl_min_protocol setting from ssl_protocols = SSLv2 SSLv3: Unrecognized protocol 'SSLv2'

/var/log/dovecot.err

Jul 13 02:27:57 dc01 dovecot: doveconf: Error: Could not find a minimum ssl_min_protocol setting from ssl_protocols = SSLv2 SSLv3: Unrecognized protocol 'SSLv2'
Jul 13 02:27:57 dc01 dovecot: config: Error: Could not find a minimum ssl_min_protocol setting from ssl_protocols = SSLv2 SSLv3: Unrecognized protocol 'SSLv2'

And surely that’s configured in UCR
dovecot_sslv2

Looking at Dovecot documentation we decided to use the “TLSv1.2”. This made the error go away from dovecot.err and dovecot.warn.

Searching for the SSLv2 & v3 we noticed this:
postfix_sslv2

Again, Postfix documentation is quite clear (here and here)
We went with “>=TLSv1.2” for postfix, however this does not produce any log files.

Couple of questions:

  • Why can’t we use UCS docs to configure email client? What to do to get this rectified?
  • Should the defaults in UCR be changed to reflect current state of Dovecot and Postfix docs?
  • How to enable postfix log
#2

Hello,

thanks for bringing this up, we have a bug report to keep track of changing the defaults and will do so with an upcoming version of UCS: Bug 52737 – Disable deprecated TLS-protocols by default for Postfix and Dovecot
Regarding the logs: Have you tried to change the loglevel of Postfix with mail/postfix/smtp/tls/loglevel? Where did you look for them, /var/log/mail.log?

Regards
Jan-Luca

#3

Thanks for coming back,

Yes, I think I’m blind, I missed the mail.log :man_facepalming:

And by looking at it, all I had to do was to change postfix protocol from “>=TLSv1.2” to “TLSv1.2” in UCR.

Email seems to be working

#4

Glad it worked out! :slight_smile:

Mastodon