Question Require SMTPS on Dovecot

[fmdeveloper]

Server operating system version

Ubuntu 22.04.5 LTS

Plesk version and microupdate number

Plesk Obsidian v18.0.79_build1800260720.04

Currently running Dovecot on Ubuntu 22.04.5 LTS. The cyber insurance company is flagging the server for running "Email Service without SSL/TLS." The server is set up to send through a specific IP, and the IP being flagged is a site IP. Is there any way to either a) block the site IP from responding to port 25, or b) require all SMTP traffic to be over SSL/TLS? SSL/TLS is enabled on the service.

Thanks in advance.

 

[scsa20]

Dovecot is use for IMAP/POP3. For SMTP the default service is usually Postfix but it's possible you are using Qmail. You can check under Services Management for SMTP Server.

In either case, by default, Postfix should be using TLS on port 25 when communicating but to enforce it to only do that requires manual configuration iirc. Not sure about Qmail since I've never used it before.

 

[fmdeveloper]

Dovecot is use for IMAP/POP3. For SMTP the default service is usually Postfix but it's possible you are using Qmail. You can check under Services Management for SMTP Server.

In either case, by default, Postfix should be using TLS on port 25 when communicating but to enforce it to only do that requires manual configuration iirc. Not sure about Qmail since I've never used it before.

Using Postfix. I'll see if I can find a guide on enforcing TLS on Postfix.

 

[learning_curve]

Using Postfix. I'll see if I can find a guide on enforcing TLS on Postfix.

Postfix TLS Support

and/or

Ubuntu 22.04 : SSL/TLS (Postfix & Dovecot) : Server World

This is an example of how to apply SSL/TLS settings to encrypt communication with SMTP/POP/IMAP servers on Ubuntu 22.04 LTS.

www.server-world.info

 

[fmdeveloper]

Here's what I did.

sudo nano /etc/postfix/main.cf

Change:
smtpd_tls_security_level = encrypt

I had issues with delivery after that, so I had to disable the line:

#content_filter = smtp-amavis:[127.0.0.1]:10024

The error I was getting was:

Must issue a STARTTLS command first at (eval 121) line 1283
***
Does anyone know why Amavis is throwing that error with this configuration?

 

[learning_curve]

We don't use Amavis at all, but maybe (you can run your own verification process to check) Amavis is throwing that error, because setting smtpd_tls_security_level = encrypt in your main.cf file, enforces mandatory TLS globally across the entire Postfix system doesn't it? Therefore, this restriction would apply to local internal services, including the loop back interface where Amavis passes its filtered mail back to Postfix. So when Amavis handles your email & attempts to inject it back into Postfix (port 10025?) the Postfix smtpd service on that port, would demand encryption first, but... isn't the local loop back traffic between Amavis and Postfix unencrypted by default? If yes, that, would make Amavis fail to comply & crash with error messages. Assuming this is so (to be verified by yourself) you would just need to explicitly tell Postfix to disable mandatory TLS for internal Amavis loops to fix it... There's a lot of online posts (fixes) on this subject, if, this is indeed, the case.