2

I've set up postfix on CentOS 7, and configured it to require STARTTLS to accept incoming mail. I've run into a couple instances where a server doesn't, for whatever reason, support TLS encryption, and so never issues STARTTLS and the email bounces. Like it should. But the sender typically just gets an 'undeliverable' message from their mail server, and often is not in a position to know what happened, much less do anything about it.

Since the sending server typically issues FROM before being sent the Must issue a STARTTLS command first response, the sender's address is potentially available somewhere. Is there any utility to scrape that information and send an auto reply with an explanation and an alternate address or link to a contact form?

Improve this question

2 Answers 2

Reset to default
2
+50

You may discover sender addresses that submitted unencrypted e-mails by parsing Postfix logs, as @F.sb said. However, in my test environment, I see that Postfix does not log sender address if smtpd_tls_security_level is set to encrypt (or, in an equivalent manner, smtpd_enforce_tls is set to yes). Therefore, in order to get sender addresses from logs, smtpd_tls_security_level must be set to may and unencrypted messages must be rejected during the RCPT TO step. In order to achieve that, include reject_plaintext_session into smtpd_recipient_restrictions and set plaintext_reject_code to 530. For example:

# /etc/postfix/main.cf smtpd_tls_security_level = may smtpd_tls_cert_file = /etc/postfix/postfix.crt smtpd_recipient_restrictions = reject_unauth_destination,reject_plaintext_session,permit plaintext_reject_code = 530

Then, you can configure rsyslog to run a custom executable and supply Postfix logs via STDIN. For example:

# /etc/rsyslog.d/postfix-logs.conf module(load="omprog") template(name="PostfixLogs" type="string" string="%syslogtag% %msg%\n") :syslogfacility-text, isequal, "mail" action(type="omprog" binary="/usr/local/bin/postfix-tls-notify.sh" template="PostfixLogs")

In that custom executable, you will be able to catch sender addresses through sed and send the automatic replies:

# /usr/local/bin/postfix-tls-notify.sh /usr/bin/sed -run 's/^postfix\/smtpd(|\[[0-9]+\]):\s+noqueue:\s+reject:\s+rcpt\s+from\s+[^;]+session\s+encryption\s+is\s+required;\s+from=<([^>; ]+)>.*$/\2/ip' | while read sender; do /usr/bin/mailx -s 'Automatic notification' "${sender}" <<'MESSAGE' Please, send your inquiries by using https://www.example.com/contact.html MESSAGE done

Note: SELinux may prevent rsyslog from sending local messages through sendmail (which is invoked by mailx). If it happens, configure rsyslog to run in permissive mode by issuing the command semanage permissive -a syslogd_t.

Improve this answer
3
  • Very nice! Just one question - does rsyslogd on CentOS 7 work out of the box with systemd/journald? Or will I have to modify my config to give access? EDIT: found this: access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… which, I think, may answer my question? Commented Nov 10, 2018 at 21:43
  • 1
    Yes, rsyslog works out of the box on CentOS 7 (and RHEL 7). By default, rsyslog is automatically installed and configured to use imjournal module to collect messages from the journal. Commented Nov 10, 2018 at 22:01
  • Works like a charm! Commented Nov 10, 2018 at 22:42
1

You can use some postfix log parsers and detect this error then sent a auto reply email to sender.

Consider encryption as an option and better not to enforce it by setting smtpd_enforce_tls = yes

Just for Notice enforcing it on a public SMTP server violates RFC 3207

Improve this answer
1
  • Your answer does not provide a solution, merely a generic piece of advice. Furthermore, due to security and compliance regulations, this server must not receive unencrypted emails, as messages to this server are considered privileged and protected. Commented Nov 10, 2018 at 23:24

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.