Hi
I’ve recently moved (not upgraded) a very old version of MIAB to a new MIAB server on a new IP address with a new hostname.
I’ve managed to get all of the old emails across and to be honest it wasn’t a major hassle at all. I managed to get nginix working for SSL connections for this mail server and others so was feeling pretty please with myself. So of course something comes along to put me back in my place.
I’m struggling to get a 2020 Xerox colour laser printer that we use for scanning to emails working with MIAB. It used to work with the old MIAB version but not the new one.
The error I’m getting is
warning: TLS library problem: error:0A0000C1:SSL routines::no shared cipher:../ssl/statem/statem_srvr.c:2220:
My Xerox printer (192.168.1.62) is sitting in a green zone one side of a firewall with the mail server in the DMZ side of the firewall (192.168.2.12). There are no issues with the firewall per se, I have other activities that use the firewall and so this shouldn’t be an issue and the logging supports this.
The Xerox printer claims to support TLS1.0, TLS1.1 and TLS1.2. I think this is correct but the printer is trying to use a cypher that MIAB doesn’t support (thats my best guess anyway).
I’ve upgraded the firmware on the Xerox and that made zero difference. I don’t really want to downgrade MIAB and soften the security.
I’m struggling as to what options I have here to get this working. Putting some sort of mail proxy in the middle to sort out the cyphers might be possible but I’m getting deep into something that I don’t want to get into. I have tried many different permutations of TLS on the Xerox, each takes about 10 mins to test as it reboots the printer.
Any suggestions very much welcomed.
I’ve redacted the domain from the debugging below.
This is from a verbose debugging session
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: connect from unknown[192.168.1.62]
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: smtp_stream_setup: maxtime=300 enable_deadline=0
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: match_hostname: smtpd_client_event_limit_exceptions: unknown ~? 127.0.0.0/8
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: match_hostaddr: smtpd_client_event_limit_exceptions: 192.168.1.62 ~? 127.0.0.0/8
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: match_hostname: smtpd_client_event_limit_exceptions: unknown ~? [::ffff:127.0.0.0]/104
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: match_hostaddr: smtpd_client_event_limit_exceptions: 192.168.1.62 ~? [::ffff:127.0.0.0]/104
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: match_hostname: smtpd_client_event_limit_exceptions: unknown ~? [::1]/128
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: match_hostaddr: smtpd_client_event_limit_exceptions: 192.168.1.62 ~? [::1]/128
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: match_list_match: unknown: no match
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: match_list_match: 192.168.1.62: no match
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: auto_clnt_open: connected to private/anvil
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: event_enable_read: fd 18
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: vstream_buf_get_ready: fd 18 got 25
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: private/anvil: wanted attribute: protocol
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute name: protocol
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute value: anvil_protocol
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: private/anvil: wanted attribute: (list terminator)
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute name: (end)
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: send attr request = connect
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: send attr ident = submission:192.168.1.62
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 18 flush 47
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: vstream_buf_get_ready: fd 18 got 25
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: private/anvil: wanted attribute: status
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute name: status
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute value: 0
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: private/anvil: wanted attribute: count
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute name: count
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute value: 1
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: private/anvil: wanted attribute: rate
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute name: rate
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute value: 1
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: private/anvil: wanted attribute: (list terminator)
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: input attribute name: (end)
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: report connect to all milters
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter8_connect: non-protocol events for protocol version 6:
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter8_connect: transport=inet endpoint=127.0.0.1:8891
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: trying... [127.0.0.1]
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: vstream_tweak_tcp: TCP_MAXSEG 32741
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: fd=19: stream buffer size old=0 new=130964
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter8_connect: my_version=0x6
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter8_connect: my_actions=0x1ff SMFIF_ADDHDRS SMFIF_CHGBODY SMFIF_ADDRCPT SMFIF_DELRCPT SMFIF_CHGHDRS SMFIF_QUARANTINE SMFIF_CHGFROM SMFIF_ADDRCPT_PAR SMFIF_SETSYMLIST
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter8_connect: my_events=0x1fffff SMFIP_NOCONNECT SMFIP_NOHELO SMFIP_NOMAIL SMFIP_NORCPT SMFIP_NOBODY SMFIP_NOHDRS SMFIP_NOEOH SMFIP_NR_HDR SMFIP_NOUNKNOWN SMFIP_NODATA SMFIP_SKIP SMFIP_RCPT_REJ SMFIP_NR_CONN SMFIP_NR_HELO SMFIP_NR_MAIL SMFIP_NR_RCPT SMFIP_NR_DATA SMFIP_NR_UNKN SMFIP_NR_EOH SMFIP_NR_BODY S
MFIP_HDR_LEADSPC
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 19 flush 17
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: vstream_buf_get_ready: fd 19 got 17
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter8_connect: milter inet:127.0.0.1:8891 version 6
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter8_connect: events SMFIP_NOHELO SMFIP_NOUNKNOWN SMFIP_NODATA SMFIP_SKIP SMFIP_HDR_LEADSPC
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter8_connect: requests SMFIF_ADDHDRS SMFIF_CHGHDRS SMFIF_SETSYMLIST
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter_macro_lookup: "j"
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter_macro_lookup: result "box.XXXXXXXX.com"
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter_macro_lookup: "{daemon_name}"
Sep 1 21:08:19 box postfix/submission/smtpd[3936]: milter_macro_lookup: result "box.XXXXXXXX.com"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: "{daemon_addr}"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: result "192.168.2.12"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: "v"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: result "Postfix 3.6.4"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: "_"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: result "unknown [192.168.1.62]"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter8_conn_event: milter inet:127.0.0.1:8891: connect unknown/192.168.1.62
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: event: SMFIC_CONNECT; macros: j=box.XXXXXXXX.com {daemon_name}=box.XXXXXXXX.com {daemon_addr}=192.168.2.12 v=Postfix 3.6.4 _=unknown [192.168.1.62]
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 19 flush 174
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_buf_get_ready: fd 19 got 5
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: reply: SMFIR_CONTINUE data 0 bytes
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 220 box.XXXXXXXX.com ESMTP Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: watchdog_pat: 0x562394079590
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 17 flush 107
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_buf_get_ready: fd 17 got 27
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: < unknown[192.168.1.62]: EHLO xerox-colour-printer
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: report helo to all milters
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: "{tls_version}"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: "{cipher}"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: "{cipher_bits}"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: "{cert_subject}"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter_macro_lookup: "{cert_issuer}"
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter8_helo_event: milter inet:127.0.0.1:8891: helo xerox-colour-printer
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: event: SMFIC_HELO; macros: (none)
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: skipping event SMFIC_HELO for milter inet:127.0.0.1:8891
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_list_match: unknown: no match
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_list_match: 192.168.1.62: no match
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-box.XXXXXXXX.com
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-PIPELINING
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-SIZE 134217728
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-VRFY
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-ETRN
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-STARTTLS
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-ENHANCEDSTATUSCODES
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-8BITMIME
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250-DSN
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 250 CHUNKING
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: watchdog_pat: 0x562394079590
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 17 flush 161
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_buf_get_ready: fd 17 got 10
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: < unknown[192.168.1.62]: STARTTLS
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: query milter states for other event
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter8_other_event: milter inet:127.0.0.1:8891
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: > unknown[192.168.1.62]: 220 2.0.0 Ready to start TLS
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 17 flush 30
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: abort all milters
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter8_abort: abort milter inet:127.0.0.1:8891
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: event_request_timer: reset 0x7f4d19281c10 0x562393fa6030 5
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: send attr request = seed
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: send attr size = 32
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 13 flush 22
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_buf_get_ready: fd 13 got 60
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: private/tlsmgr: wanted attribute: status
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: input attribute name: status
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: input attribute value: 0
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: private/tlsmgr: wanted attribute: seed
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: input attribute name: seed
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: input attribute value: n9IgM0Zl8AJqjC3q7KIDICSSeR3P1IcRt7E0dW6Q9mk=
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: private/tlsmgr: wanted attribute: (list terminator)
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: input attribute name: (end)
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: SSL_accept error from unknown[192.168.1.62]: -1
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: warning: TLS library problem: error:0A0000C1:SSL routines::no shared cipher:../ssl/statem/statem_srvr.c:2220:
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_hostname: smtpd_client_event_limit_exceptions: unknown ~? 127.0.0.0/8
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_hostaddr: smtpd_client_event_limit_exceptions: 192.168.1.62 ~? 127.0.0.0/8
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_hostname: smtpd_client_event_limit_exceptions: unknown ~? [::ffff:127.0.0.0]/104
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_hostaddr: smtpd_client_event_limit_exceptions: 192.168.1.62 ~? [::ffff:127.0.0.0]/104
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_hostname: smtpd_client_event_limit_exceptions: unknown ~? [::1]/128
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_hostaddr: smtpd_client_event_limit_exceptions: 192.168.1.62 ~? [::1]/128
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_list_match: unknown: no match
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: match_list_match: 192.168.1.62: no match
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: send attr request = disconnect
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: send attr ident = submission:192.168.1.62
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 18 flush 50
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_buf_get_ready: fd 18 got 10
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: private/anvil: wanted attribute: status
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: input attribute name: status
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: input attribute value: 0
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: private/anvil: wanted attribute: (list terminator)
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: input attribute name: (end)
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: lost connection after STARTTLS from unknown[192.168.1.62]
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: disconnect event to all milters
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: milter8_disc_event: quit milter inet:127.0.0.1:8891
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: vstream_fflush_some: fd 19 flush 16
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: disconnect from unknown[192.168.1.62] ehlo=1 starttls=0/1 commands=1/2
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: free all milters
Sep 1 21:08:20 box postfix/submission/smtpd[3936]: free milter inet:127.0.0.1:8891