eine Sendmail-Installation, die Emails für ein wichtiges (jedoch sehr altes) Perl-Programm verschickt (oder es zumindest versucht), kann Emails an einige bestimmte Accounts (immer wieder die üblichen Verdächtigen) nicht zustellen - ich erhalte immer folgende Fehlermeldung:
Code: Alles auswählen
Dec 24 10:18:06 hostname sm-mta[27084]: STARTTLS=client, error: connect failed=-1, reason=unsupported protocol, SSL_error=1, errno=0, retry=-1
Dec 24 10:18:06 hostname sm-mta[27084]: ruleset=tls_server, arg1=SOFTWARE, relay=host.example.de, reject=403 4.7.0 TLS handshake failed.
Code: Alles auswählen
#> openssl s_client -starttls smtp -crlf -connect host.example.de:smtp
CONNECTED(00000003)
140221165143168:error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1929:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 276 bytes and written 350 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
Code: Alles auswählen
Dec 24 10:38:04 hostname sm-mta[1211]: STARTTLS=client, error: connect failed=-1, reason=dh key too small, SSL_error=1, errno=0, retry=-1
Code: Alles auswählen
#> dpkg --list | grep -i -- mail
ii apticron 1.2.1 all Simple tool to mail about pending package updates - cron version
ii bsd-mailx 8.1.2-0.20180807cvs-1 amd64 simple mail user agent
ii libemail-mime-encodings-perl 1.315-2 all unified interface to MIME encoding and decoding
ii libmailtools-perl 2.18-1 all Manipulate email in perl programs
ii libmilter1.0.1:amd64 8.15.2-14~deb10u1 amd64 Sendmail Mail Filter API (Milter)
ii libopendkim11 2.11.0~alpha-12 amd64 Library for signing and verifying DomainKeys Identified Mail signatures
ii lockfile-progs 0.1.18 amd64 Programs for locking and unlocking files and mailboxes
ii mime-support 3.62 all MIME files 'mime.types' & 'mailcap', and support programs
ii opendkim 2.11.0~alpha-12 amd64 Milter implementation of DomainKeys Identified Mail
ii procmail 3.22-26 amd64 Versatile e-mail processor
ii sendmail 8.15.2-14~deb10u1 all powerful, efficient, and scalable Mail Transport Agent (metapackage)
ii sendmail-base 8.15.2-14~deb10u1 all powerful, efficient, and scalable Mail Transport Agent (arch independent files)
ii sendmail-bin 8.15.2-14~deb10u1 amd64 powerful, efficient, and scalable Mail Transport Agent
ii sendmail-cf 8.15.2-14~deb10u1 all powerful, efficient, and scalable Mail Transport Agent (config macros)
ii sensible-mda 8.15.2-14~deb10u1 amd64 Mail Delivery Agent wrapper
#>
#> cat /etc/debian_version
10.6
Code: Alles auswählen
#> sed -e '/^\#/d' -e '/^dnl\s\#/d' -e '/^$/d' sendmail.mc
divert(-1)dnl
divert(0)dnl
define(`_USE_ETC_MAIL_')dnl
include(`/usr/share/sendmail/cf/m4/cf.m4')dnl
VERSIONID(`$Id: sendmail.mc, v 8.14.4-8 2014-10-02 17:54:06 cowboy Exp $')
OSTYPE(`debian')dnl
DOMAIN(`debian-mta')dnl
undefine(`confHOST_STATUS_DIRECTORY')dnl #DAEMON_HOSTSTATS=
FEATURE(`no_default_msa')dnl
dnl DAEMON_OPTIONS(`Family=inet6, Name=MTA-v6, Port=smtp, Addr=::1')dnl
DAEMON_OPTIONS(`Family=inet, Name=MTA-v4, Port=smtp, Addr=127.0.0.1')dnl
dnl DAEMON_OPTIONS(`Family=inet6, Name=MSP-v6, Port=submission, M=Ea, Addr=::1')dnl
DAEMON_OPTIONS(`Family=inet, Name=MSP-v4, Port=submission, M=Ea, Addr=127.0.0.1')dnl
define(`confPRIVACY_FLAGS',dnl
`needmailhelo,needexpnhelo,needvrfyhelo,restrictqrun,restrictexpand,nobodyreturn,authwarnings')dnl
define(`confCONNECTION_RATE_THROTTLE', `15')dnl
define(`confCONNECTION_RATE_WINDOW_SIZE',`10m')dnl
FEATURE(`use_cw_file')dnl
FEATURE(`access_db', , `skip')dnl
FEATURE(`greet_pause', `1000')dnl 1 seconds
FEATURE(`delay_checks', `friend', `n')dnl
define(`confBAD_RCPT_THROTTLE',`3')dnl
FEATURE(`conncontrol', `nodelay', `terminate')dnl
FEATURE(`ratecontrol', `nodelay', `terminate')dnl
dnl define(`confCON_EXPENSIVE',`True')dnl
include(`/etc/mail/m4/dialup.m4')dnl
include(`/etc/mail/m4/provider.m4')dnl
FEATURE(`always_add_domain')dnl
MASQUERADE_AS(`irgendwas.de')dnl
FEATURE(`allmasquerade')dnl
FEATURE(`masquerade_envelope')dnl
CLIENT_OPTIONS(`Family=inet6,Addr=::ffff:1.2.3.4')dnl
MAILER_DEFINITIONS
MAILER(`local')dnl
MAILER(`smtp')dnl
define(`confDOMAIN_NAME', `irgendwas.de')dnl
include(`/etc/mail/tls/starttls.m4')dnl
define(`confDH_PARAMETERS', `/etc/ssl/dhparams.pem')dnl
INPUT_MAIL_FILTER(`opendkim', `S=inet:8891@localhost')dnl
#>
#> sed -e '/^\#/d' -e '/^dnl\s\#/d' -e '/^$/d' tls/starttls.m4
divert(-1)dnl
divert(0)dnl
VERSIONID(`$Id: starttls.m4,v 8.15.2-14~deb10u1 2019-08-25 15:04:16 cowboy Exp $')
ifdef(`sm_version', `dnl',
`include(`/usr/share/sendmail/cf/debian/autoconf.m4')dnl')
ifelse(eval(sm_version_math >= 527104), `1', `dnl
ifelse(sm_enable_tls, `yes', `dnl
define(`confDONT_BLAME_SENDMAIL',dnl
defn(`confDONT_BLAME_SENDMAIL')`,GroupReadableKeyFile')dnl
define(`confTO_STARTTLS', `2m')dnl # <= EDIT
define(`confCACERT_PATH', `/etc/ssl/certs')dnl # <= EDIT
define(`confCACERT', `/etc/mail/tls/sendmail-server.crt')dnl # <= EDIT
define(`confCRL', `')dnl # <= EDIT
undefine(`confCRL')dnl
define(`confSERVER_CERT', `/etc/mail/tls/sendmail-server.crt')dnl # <= EDIT
define(`confSERVER_KEY', `/etc/mail/tls/sendmail-common.key')dnl # <= EDIT
define(`confCLIENT_CERT', `/etc/mail/tls/sendmail-client.crt')dnl # <= EDIT
define(`confCLIENT_KEY', `/etc/mail/tls/sendmail-common.key')dnl # <= EDIT
define(`confDH_PARAMETERS', `/etc/mail/tls/sendmail-common.prm')dnl # <= EDIT
define(`confTLS_SRV_OPTIONS', `V')dnl # <= EDIT
')')dnl
Vielen Dank im Voraus und frohes Fest!
