Port 25 or Port 587

[impirecom]

Hello,

Can Postal support multiple ports?

Also, will port 587 provide more security by default? Per this article it does:

https://www.cloudflare.com/learning/email-security/smtp-port-25-587/

[willpower232]

Postal can only bind to a single port however there is nothing stopping you routing multiple ports within the server with iptables. If you search the issues/discussions for 2525 then you should be able to find an example of it.

The only thing Postal doesn't support is implicit TLS, all connections to Postal must upgrade to TLS via STARTTLS after initially connecting insecurely.

I wouldn't say that just using a different port number provides any additional security as in Postal case it is the same service and code receiving the network traffic. It mostly depends on any network blocks you need to work around.

[impirecom]

I am grateful for your help.

Tried with what you suggested, but client still can't connect. Openssl test command also came back with same result as before. Email clients still cannot connect. SMTP tests failed.

FYI: The two files smtp.key and smtp.key are located in /opt/postal/config/

Current config below I wasn't sure if /config/ or just config/. Does it matter?

smtp_server:
port: 587
tls_enabled: true
tls_certificate_path: config/smtp.cert
tls_private_key_path: config/smtp.key

root@postal:~# openssl s_client -starttls smtp -crlf -connect postal.yourdomain.com:587

CONNECTED(00000003)
write:errno=104
no peer certificate available
No client certificate CA names sent
SSL handshake has read 136 bytes and written 351 bytes
Verification: OK
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

[willpower232]

Judging from the install repo, it should be /config.

If that doesn't fix it then it might be worth trying port 25 which you may have better experience with long term anyway.

[impirecom]

I have tried /config as the parameter, still same issue. I also tried port 25. But strangely, first time see different error. Ran command again, shown same error as before:

port: 25
tls_enabled: true
tls_certificate_path: /config/smtp.cert
tls_private_key_path: /config/smtp.key

Something is off. Seems like it doesn't even see the certificate and key:

root@vm1:~# openssl s_client -starttls smtp -crlf -connect postal.example.com:25

4007C6D6C67F0000:error:8000006F:system library:BIO_connect:Connection refused:../crypto/bio/bio_sock2.c:125:calling connect()
4007C6D6C67F0000:error:10000067:BIO routines:BIO_connect:connect error:../crypto/bio/bio_sock2.c:127:
connect:errno=111

root@vm1:~# openssl s_client -starttls smtp -crlf -connect postal.example.com:25

CONNECTED(00000003)
write:errno=104
no peer certificate available
No client certificate CA names sent
SSL handshake has read 136 bytes and written 351 bytes
Verification: OK
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

Anyway, I do need this to work on port 587. some apps that I uses support port 587 and block port 25 (Hexospark, Instantly and Mystrika as examples). I have no choice but to use port 587. When I asked them to open port 25, they sent me the below article and told to use better practice:

https://www.cloudflare.com/learning/email-security/smtp-port-25-587/

I am back to square one and losing hairs (what's left of i). At this point, I would like to pay someone to implement this. Couldn't understand why Postal made it so hard for users to use port 587 with SSL.

[willpower232]

if you've copied the certificate files to the config directory, you could try postal bash smtp and ls -hal /config to confirm the permissions on the files. It may be that they're restricted to root or something that prevents Postal from reading it.

[impirecom]

That worked. It was the permission issue. chmod command solved it. Thank you much.

[impirecom]

I am not sure if this is related. The day after I added SSL and enabled port 587, incoming mails showing as zero. Outgoing still works but strangely server show no incoming messages.

[willpower232]

if you no longer have port 25 routed to Postal, it is highly likely that incoming messages are not making it to Postal at all

[impirecom]

Thank you Will. You are right, mail relay to the smtp connections are not working. How do I route port 25 to postal?

Also, do you have an instruction on creating a cron job to auto-reboot the servers to avoid Let's Encrypt SSL expired issue?

I was wondering how I can install cloudflare SSL, which can last up to 15 years. This should eliminate the need to reboot the servers every 90 days.