Problem with Postfix and LDAP (SSL / TLS)

3 msg	Server configuration Error
1 msg	relay_transport
1 msg	Catch-all mailbox
4 msg	Trouble with HTC S710 device and SMTPS
3 msg	psotfix server TLS failed
3 msg	failed-delivery message notifications setup
2 msg	proxy_interfaces understanding
1 msg	warning: transport virtual failure
2 msg	how to relay for most recipients and forward fo...
2 msg	Rewriting outbound addresses
2 msg	virtual mailboxes/domains and aliases
3 msg	Enforced TLS Success?
1 msg	Postfix 2.5 RC2 and snapshot release

Problem with Postfix and LDAP (SSL / TLS)
\ Artur Muecke (16 Jan 2008)
. \ (Wietse Venema) (16 Jan 2008)
. . \ Artur Muecke (16 Jan 2008)
. . . \ (Wietse Venema) (16 Jan 2008)
. . . \ (Wietse Venema) (16 Jan 2008)
. . . . \ Artur Muecke (17 Jan 2008)
. . . . . \ (Wietse Venema) (17 Jan 2008)
. . . . . . \ Victor Duchovni (17 Jan 2008)
. . . \ Victor Duchovni (16 Jan 2008)
. . . . \ Artur Mücke (16 Jan 2008)
. . . . . \ Victor Duchovni (16 Jan 2008)

4 msg	More on Enforced TLS
3 msg	delivery reciept
4 msg	How to repeat delay_warning_time messages ?
2 msg	sender notification
5 msg	Using 'nolisting' to reduce spam
1 msg	mail priority by sender

Subject:	Problem with Postfix and LDAP (SSL / TLS)
Group:	Postfix-users
From:	Artur Muecke
Date:	16 Jan 2008

Hi everyone,

I have trouble to configure Postfix using SSL or TLS to connect to my
OpenLDAP-Server. Here are some information about the versions I am using:

Postfix-OS: Debian (Etch)
LDAP-OS: Debian (Etch)
Postfix: postfix-2.3.8-2+b1 postfix-ldap-2.3.8-2+b1
LDAP: slapd 2.3.30

Here is what I am doing. My postfix server relays mails after checking them
(SPAM and Viruses) to another postfix server.
Therefore it reads the "relay-domains" and "relay-recipient-maps" from an
external LDAP-Server.

Here is how I configured postfix to do this:

main.cf
===================
...
relayhost = [my2ndSMTP.de]:25
relay_domains = ldap:/etc/postfix/domains.cf
relay_recipient_maps = ldap:/etc/postfix/users.cf
ldap:/etc/postfix/aliases.cf
...

domains.cf
==================
## RELAY - DOMAINS ##
server_host = ldap://10.3.5.32:389
version = 3
start_tls = yes
tls_ca_cert_file = /etc/ssl/certs/CA.pem
tls_cert = /etc/ssl/certs/toa20cert.pem
tls_key = /etc/ssl/certs/toa20key.pem
bind = no
search_base =
ou=DNSObjects,ou=AdminObjects,ou=OxObjects,dc=ldap,dc=mydomain,dc=com
query_filter = (domainName=%s)
result_attribute = domainName
=================

aliases.cf and users.cf are alsmost the same, just with a different
search-base and so on.

Without using TLS everything works fine but as soon as I turn on TLS in
Postfix, the server doesnt relay any mails.

The LDAP- and Postfix certificates should be correct because
a "ldapsearch -x -ZZ ..." works (same certificates).

My TLS-LDAP conf looks like that:
==================
TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSCACertificateFile /etc/ldap/certs/CA.pem
TLSCertificateFile /etc/ldap/certs/ldapcert.pem
TLSCertificateKeyFile /etc/ldap/certs/ldapkey.pem
==================

"openssl s_client -connect 10.3.5.32:636 -CAfile /etc/ssl/certs/CA.pem"

Says that everything is fine:

...
Start Time: 1200495781
Timeout : 300 (sec)
Verify return code: 0 (ok)
...

I checked the TLS config with postmap like that:
=====================================================
postmap -q "domain.com" ldap:/etc/postfix/domains.cf
=====================================================
and it works perfect.

When I start postfix and try to send (relay) mails, I get the following error
messages in my mail.log:

=============================================================================
Jan 16 15:45:09 toa20 postfix/smtpd[13366]: connect from localhost[127.0.0.1]
Jan 16 15:45:15 toa20 postfix/master[13359]: warning:
process /usr/lib/postfix/trivial-rewrite pid 13369 exit status 2
Jan 16 15:45:16 toa20 postfix/smtpd[13366]: warning: problem talking to
service rewrite: Success
Jan 16 15:45:16 toa20 postfix/master[13359]: warning:
process /usr/lib/postfix/trivial-rewrite pid 13370 exit status 2
Jan 16 15:45:16 toa20 postfix/master[13359]:
warning: /usr/lib/postfix/trivial-rewrite: bad command startup -- throttling
=============================================================================

Btw, postfix is running chrooted on Debian. Cause of that I copied the
certificates to the chrooted directory (/var/spool/postfix/etc/ssl/certs),
according to the config shown above. I dont know if that is necessary.

It shouldnt be something about the user permissions, because I tried the
postmap commando with the postfix user and it works as good as with root.

Now I am kind of innocent and wonder if someone can help me out.

Would be happy 'about some advices.

Cheers,

Artur

"There are 10 kinds of people in the world, those who understand binary
math, and those who don't."