Hardened default SSL/TLS setting - cannot get connection to SMTP server

I also had a connection problem for a service, when upgrading v13=>v14.

SSL / TLS is handled by stunnel now. Your service may need to to be 'directed through' stunnel. It will work on a fresh install, but may break when v13 configs are restored back to a v14 appliance.

see here v14.0 is different 

From a glance It looks to me like you are trying to send emails in the open (i.e. no TLS) and your SMTP requires TLS authentication. I would look at the sendmail settings...

[edited to fix a mistake in my text; I originally mistakenly wrote "sendmail" rather than "postfix" in my second sentence].

Just to comment your answer as well (forgot in th other post...):

The v14.0 appliance does send emails OOTB. The "problems" were exactly the ones you describe in your post (although in my case dynamic IPs were not the issue as I was on a fixed IP).

And I'm definitely sure you can configure the postfix mailserver in a way that all the issues are solved within the TKL appliance. I just took my solution with using an already existing (and working) mailserver because this was an "easier" solution for me to get it working.

I had to find a solution quickly for my forum, so once the "quick and dirty" solution worked, I was just happy with that and didn't dig deeper into anything else...

Your solution of using a separate SMTP server is completely valid and legitimate. And we probably should have it documented.

The v14.0 appliances should still send emails OOTB. Although some ISPs block direct email sending; and also sometimes your host IP may have been blacklisted (this is common with dynamic IP addresses; particularly on services like AWS which are often abused by spammers).

I received the notification about your answers only right now and have not checked manually before... So I also have a huge delay in my answer...

First of all: Thanks for your quick replies and your help!

I solved the problem a few days after my post by googling and trying other things -- and ended up in digging deeper into the Postfix configuration. To be honest: I haven't even documented what I did. At the end (after a few days of trying and trying and trying...) I was just happy everything worked. As far as I remember I configured the Postfix Server in a way that it sends the mails over another ("well configured") SMTP Server. It's probably not a very clever and clean solution, but it works...

And yes, TKL v14 IS indeed very different from previous versions, which were "a breeze" even for a complete linux newbie like me. It seems that security (and I totally agree that this is a very, very important issue...) takes it's toll...

With this: Thanks again!

Chris

As I  already said: I don't remember all the steps I made to get it to work...

But if you take all the information here, a couple of hours time and Google as your friend, hopefully you get it to work as well...

I looked it up and as far as I can remember and find out from history I can reproduce at least the following steps (don't remember the right order...):

• Installed the following: dovecot (apt-get install dovecot-imapd dovecot-pop3d)
• Installed  the following:  apt-get install libsasl2-modules-otp libsasl2-modules-ldap libsasl2-modules-sql libsasl2-modules-gssapi-mit libsasl2-modules-gssapi-heimdal
• Created file:   nano /etc/postfix/sasl_passwd  ->  [mailserver.otherdomain.tld]:587 user:password
• Done the following:  postmap /etc/postfix/sasl_passwd

and my /etc/postfix/main.cf looks like this:

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = 123.456.789.111.static.anydomain.tld
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = name.domain.tld
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = localdomain, localhost, localhost.localdomain, localhost, name.domain.tld
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
myorigin = name.domain.tld
inet_interfaces = all
smtp_generic_maps = hash:/etc/postfix/generic

# specify SMTP relay host
relayhost = [mailserver.otherdomain.tld]:587

# enable SASL authentication
smtp_sasl_auth_enable = yes
# disallow methods that allow anonymous authentication.
smtp_sasl_security_options = noanonymous
# where to find sasl_passwd
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
# Enable STARTTLS encryption
smtp_use_tls = yes
# where to find CA certificates
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

smtpd_sasl_type = dovecot

# Can be an absolute path, or relative to $queue_directory
# Debian/Ubuntu users: Postfix is setup by default to run chrooted, so it is best to leave it as-is below
smtpd_sasl_path = private/auth

If you're using TurnKey Linux and having an issue, please create a new user account, log in and start a new thread.

Please provide details on which appliance you're using, which version it is (if not sure post the output of 'turnkey-version'), where it's running (e.g. local VirtualBox VM, Hub cloud server, etc, etc), plus details on any customisation you may have done (probably don't need details at this point, just a general idea of what you've done).

Then please detail the problem you are having (feel free to post links to other threads that describe similar issue to yours). If you are seeing any errors or warnings anywhere please post them verbatim i.e. exactly as they are (ideally copy/paste the text; although screenshots can be attached to the first post in a thread if that's easier). Please also note where you saw the errors (e.g. in browser, log file, commandline, etc).

Then provide info on what you have tried already and what the results were (if any). Again please feel free to link to other posts that show similar experiences.

Armed with that info, we have a really good shot at diagnosing and fixing the issue! :)