Android Maildroid and Apple mail program cannot send mail

[tkalfaoglu]

I thought I had it all set up, but apparently the phones cannot send mail out.
(Incoming is OK.. Outgoing fails).

I tried it with Maildroid, and it complains "no common protocol was found between client and server.."
however, I have the server set up to accept ssl, tsl, plain mail. I have a wildcard certificate on the ssl,
as well as CA certificates, etc, for both qmail and courrier.

I have spamdyke as well.
How can I diagnose what's going on? what's causing these clients not to connect to mail.kalfaoglu.net ?

Thanks!
-turgut

 

[UFHH01]

Hi tkalfaoglu,

no common protocol was found between client and server..

Such issues are caused by missing ciphers in your current configuration files. Consider using the "intermediate" solution, provided by Mozilla.org, or please search here in the forum with the tag "intermediate"

Information Link: Intermediate compatibility (default) - Mozilla.org

 

[tkalfaoglu]

Thank you very much, but where do I enter that string? In the courier settings, in spamdyke or /var/qmail/bin/smtp_auth ?

Update: this link was very helpful as well.. http://talk.plesk.com/threads/ssl-poodle-sslv3-bug.323338/page-6

 

[UFHH01]

Hi tkalfaoglu,

well... let's have a look at the

Odin / Parallels Plesk Panel for Linux services logs and configuration files ( KB - article: 111 283 )​

Courier-IMAP
...

• Configuration
  • /etc/courier-imap/imapd
  • /etc/courier-imap/imapd-ssl
  • /etc/courier-imap/pop3d
  • /etc/courier-imap/pop3d-ssl

Postfix
...

• Configuration
  • /etc/postfix/master.cf
  • /etc/postfix/main.cf

Qmail
...

• Configuration
  • Control files in /var/qmail/control/
  • /etc/xinetd.d/smtp_psa
  • /etc/xinetd.d/smtps_psa
  • /etc/xinetd.d/submission_psa

Each mail-system has it's own way, to define the accepted ciphers. So for example with postfix, you will finde the desired definitions to use in the main.cf at:

...
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
smtpd_tls_protocols = !SSLv2, !SSLv3
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_protocols = !SSLv2, !SSLv3
...

Another hint is, to use the FORUM SEARCH, because after the pusblishing of the Poodle vulnerability, there were a lot of questions, how to solve that and Odin published as well a KB - article, which describes, how you might secure your server against it. Part of it, is to define other ciphers-lists, as you will notice by reading:

[Plesk] CVE-2014-3566: POODLE attack exploiting SSL 3.0 fallback ( KB - article: 123 160 )​

In some cases you might experience issues with incompatibilities for some browser and/or eMail - clients, after you followed the KB - article 123 160. It might help to read:

SSL POODLE / SSLv3 bug ( Odin / Parallels Forum - Link )​

... to solve such issues, because there are several additional solutions provided in this thread.

 

[tkalfaoglu]

Many thanks; we have qmail + courrier-imap installed.
Regards, -turgut

 

[tkalfaoglu]

I just realized that iphone clients CAN send mail, but only if I blank out username+password in the SMTP settings..
that is, if I turn off smtp auth.
pop-before-smtp is an ugly solution; but perhaps the fact that they CAN send emails if no auth is used, gives us a clue on why iphone users cannot send emails..

 

[UFHH01]

Hi tkalfaoglu,

but perhaps the fact that they CAN send emails if no auth is used, gives us a clue on why iphone users cannot send emails..

The clue is still to use another ciphers lists. Please READ the suggestions on the mentioned thread: SSL POODLE / SSLv3 bug ( Odin / Parallels Forum - Link )
Hint: "Intermediate" solution should work with most actual mobile phones.