2

I've set up postfix on CentOS 7, and configured it to require STARTTLS to accept incoming mail. I've run into a couple instances where a server doesn't, for whatever reason, support TLS encryption, and so never issues STARTTLS and the email bounces. Like it should. But the sender typically just gets an 'undeliverable' message from their mail server, and often is not in a position to know what happened, much less do anything about it.

Since the sending server typically issues FROM before being sent the Must issue a STARTTLS command first response, the sender's address is potentially available somewhere. Is there any utility to scrape that information and send an auto reply with an explanation and an alternate address or link to a contact form?

2
+50

You may discover sender addresses that submitted unencrypted e-mails by parsing Postfix logs, as @F.sb said. However, in my test environment, I see that Postfix does not log sender address if smtpd_tls_security_level is set to encrypt (or, in an equivalent manner, smtpd_enforce_tls is set to yes). Therefore, in order to get sender addresses from logs, smtpd_tls_security_level must be set to may and unencrypted messages must be rejected during the RCPT TO step. In order to achieve that, include reject_plaintext_session into smtpd_recipient_restrictions and set plaintext_reject_code to 530. For example:

# /etc/postfix/main.cf

smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/postfix/postfix.crt
smtpd_recipient_restrictions = reject_unauth_destination,reject_plaintext_session,permit
plaintext_reject_code = 530

Then, you can configure rsyslog to run a custom executable and supply Postfix logs via STDIN. For example:

# /etc/rsyslog.d/postfix-logs.conf

module(load="omprog")

template(name="PostfixLogs" type="string" string="%syslogtag% %msg%\n")

:syslogfacility-text, isequal, "mail" action(type="omprog"
    binary="/usr/local/bin/postfix-tls-notify.sh"
    template="PostfixLogs")

In that custom executable, you will be able to catch sender addresses through sed and send the automatic replies:

# /usr/local/bin/postfix-tls-notify.sh

/usr/bin/sed -run 's/^postfix\/smtpd(|\[[0-9]+\]):\s+noqueue:\s+reject:\s+rcpt\s+from\s+[^;]+session\s+encryption\s+is\s+required;\s+from=<([^>; ]+)>.*$/\2/ip' | while read sender; do
    /usr/bin/mailx -s 'Automatic notification' "${sender}" <<'MESSAGE'

    Please, send your inquiries by using https://www.example.com/contact.html

MESSAGE
done

Note: SELinux may prevent rsyslog from sending local messages through sendmail (which is invoked by mailx). If it happens, configure rsyslog to run in permissive mode by issuing the command semanage permissive -a syslogd_t.

  • Very nice! Just one question - does rsyslogd on CentOS 7 work out of the box with systemd/journald? Or will I have to modify my config to give access? EDIT: found this: access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… which, I think, may answer my question? – Chris Nov 10 '18 at 21:43
  • 1
    Yes, rsyslog works out of the box on CentOS 7 (and RHEL 7). By default, rsyslog is automatically installed and configured to use imjournal module to collect messages from the journal. – Anderson M. Gomes Nov 10 '18 at 22:01
  • Works like a charm! – Chris Nov 10 '18 at 22:42
1

You can use some postfix log parsers and detect this error then sent a auto reply email to sender.

Consider encryption as an option and better not to enforce it by setting smtpd_enforce_tls = yes

Just for Notice enforcing it on a public SMTP server violates RFC 3207

  • Your answer does not provide a solution, merely a generic piece of advice. Furthermore, due to security and compliance regulations, this server must not receive unencrypted emails, as messages to this server are considered privileged and protected. – Chris Nov 10 '18 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.