Welcome! Log In Create A New Profile

Advanced

SMTP proxy with "STARTTLS only" accepts unencrypted mail

Marcus
June 03, 2019 04:18PM
Hello Nginx users,

I try to use NGiNX 1.10.3-1+deb9u2 (Debian 9 version) as SMTP proxy in
front of a postfix server. I defined one server that should accept
encrypted connections only. Therefore I set "starttls only".

But this server accepts plaintext mails also. If I use telnet to test
the proxy it provides STARTTLS but I can relay a mail without using it.

Please see my config:

---
proxy_pass_error_message on;
ssl_certificate /etc/ssl/private/cert.pem;
ssl_certificate_key /etc/ssl/private/key.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;ssl_session_timeout
10m;
resolver 127.0.0.1 valid=30s;
smtp_capabilities "SIZE 51200000" ENHANCEDSTATUSCODES 8BITMIME DSN VRFY
ETRN PIPELINING;

server {
server_name test.myserver.com;
auth_http localhost:10080/10.1.0.1-25;
listen 10.1.0.1:25;
protocol smtp;
smtp_auth none;
starttls only;
}
---

What can I do to enforce STARTTLS? Or did I miss something?

Greetings
Marcus


_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

SMTP proxy with "STARTTLS only" accepts unencrypted mail

Marcus June 03, 2019 04:18PM

Re: SMTP proxy with "STARTTLS only" accepts unencrypted mail

Maxim Dounin June 04, 2019 09:50AM

Re: SMTP proxy with "STARTTLS only" accepts unencrypted mail

Marcus June 05, 2019 03:08PM

Re: SMTP proxy with "STARTTLS only" accepts unencrypted mail

itpp2012 June 05, 2019 04:37PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 223
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready