Postal: Config for STARTTLS

[liedergram]

Hello,

What is the expected postal.yml config file parameters for using STARTTLS ?

smtp:
  host: smtp.office365.com
  port: 587
  evented: true
  log_connect: true
  username: [email protected]
  password: MyPassw0rd
  from_name: My Name
  from_address: [email protected]
  ssl_mode: STARTTLS

?

If I understand properly, this configuration in the postal.yml is only for mails sent from the portal.
How can I set this up from the interface for a created mail server ?

[catphish]

In order to enable TLS, you will need a certificate and key. Once you have these, you can configure the SMTP server as follows:

smtp_server:
  tls_enabled: true

By default, Postal will look for the key and certifate in config/smtp.key and config/smtp.crt but you can configure this also if desired:

smtp_server:
  tls_enabled: true
  tls_certificate_path: config/smtp.crt
  tls_private_key_path: config/smtp.key

[liedergram]

Isn't there a difference between TLS and STARTTLS ? I see one in the code:

https://github.com/atech/postal/blob/2f0155747c5c058afb83856ce5c3c8d5f8cad341/app/models/smtp_endpoint.rb#L27

[adamcooke]

You appear to be mixing configuration options there. You're adding things into the smtp section that don't belong there. Things like ssl_mode and log_connect are not valid there - they belong under smtp_server.

You probably should be configuring your smtp to point to a mail server within your Postal installation rather than Office 365 though. Once you have it installed, you can simply create a new mail server, set the host to localhost and the password to some credentials from Postal.

[muratcorlu]

What is the default port for TLS connection when it's enabled? I couldn't use smtp_servet with tls support. Can you give a full postal config and client parameters examples about using tls on postal?

[catphish]

@muratcorlu the SMTP server supports STARTTLS which runs on the same port as normal SMTP.

[sandeep28saxena]

Hello, I enabled STARTTLS in postal.yml with configuration

smtp_server:
tls_enabled: true

and also put my domain's config/smtp.key and config/smtp.crt

but my email application shows below error while connecting and not able to connect on TLS/STARTTLS :+1:

SMTP Error: Could not connect to SMTP host.
SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting
Connection: opening to mail1.mypostaldomain.com:25, timeout=30, options=array ( 'ssl' => array ( 'verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true, ),)
Connection: opened
SMTP -> get_lines(): $data is ""
SMTP -> get_lines(): $str is "220 mail1.mypostaldomain.com ESMTP Postal/TKEG5W"
SERVER -> CLIENT: 220 mail1.mypostaldomain.com ESMTP Postal/TKEG5W
CLIENT -> SERVER: EHLO emails2.myemailclientdomain.com
SMTP -> get_lines(): $str is "250-My capabilities are"
SMTP -> get_lines(): $data is "250-My capabilities are"
SMTP -> get_lines(): $str is "250-STARTTLS"
SMTP -> get_lines(): $data is "250-My capabilities are250-STARTTLS"
SMTP -> get_lines(): $str is "250 AUTH CRAM-MD5 PLAIN LOGIN"
SERVER -> CLIENT: 250-My capabilities are250-STARTTLS250 AUTH CRAM-MD5 PLAIN LOGIN
CLIENT -> SERVER: STARTTLS
SMTP -> get_lines(): $str is "220 Ready to start TLS"
SERVER -> CLIENT: 220 Ready to start TLS
CLIENT -> SERVER: QUIT
SERVER -> CLIENT:
SMTP ERROR: QUIT command failed:
Connection: closed

Any clues what can be wrong ?

[igerzog]

If I am not mistaken the default file name for smtp certificate is smtp.cert and not smtp.crt as it is mentioned in postal defaults. Try to change file extension first.

[sandeep28saxena]

Hey @igerzog that indeed solved the issue. Thanks a lot. Could you please also let me know which page you are referring to for postal defaults ?

[igerzog]

Glad to hear that the issue is solved. The defaults are stated here: postal.defaults.yml

[sandeep28saxena]

But this page lists it as .crt and not .cert. Though for me .cert working now.

smtp_server:
port: 25
tls_enabled: false
tls_certificate_path: # Defaults to config/smtp.crt
tls_private_key_path: # Defaults to config/smtp.key

[igerzog]

Yes, there is a mistake on this page. But if you look at the fast server section you can find the correct certificate extension. So I had taken the idea and changed smtp.crt to smtp.cert like fast_server.cert

[willpower232]

Thats a good spot @igerzog, seems theres mostly .cert but a few .crt crept into the code at some point in the past.

Did you want to make a pull request to remove the .crt's to avoid future confusion?

[catphish]

Thanks for spotting this. If someone makes a pull request to standardize it that would be great.

[igerzog]

Ok, I have prepared the fix for cert file name. #350

[willpower232]

Thanks @igerzog there are a couple of other .crt's in the codebase that you should be able to change to .cert to completely standardise it if you wouldn't mind :-P

https://github.com/atech/postal/search?utf8=%E2%9C%93&q=crt&type=

[igerzog]

Well ok :)

[igerzog]

Have just created new pull request. All files changed to .cert - #354

[willpower232]

@catphish the install zip https://postal.atech.media/packages/stable/latest.tgz still contains a reference to crt in the nginx bits somewhere so the install script doesn't work

Edit: also it still doesn't contain https://github.com/atech/postal/pull/267, whats up with that?

[catphish]

I think this just means nobody's made a build recently. I assume this needs to be done manually.

[willpower232]

Ah fair enough, hope one of you can get your internal builds back in sync with github!