postfix TLS (configuration/user) problem

2 msg	Remote backup Postfix server
7 msg	chose interface for outgoing mail
2 msg	Illegal address syntax ... in MAIL command: <...
1 msg	Mail Infrastructure and Zertificon
1 msg	sasl password

postfix TLS (configuration/user) problem
\ Rasmus Andersen (13 Mar 2008)
. \ mouss (13 Mar 2008)
. . \ Rasmus Andersen (15 Mar 2008)
. . . \ mouss (15 Mar 2008)
. . . . \ Rasmus Andersen (16 Mar 2008)
. . . . . \ mouss (16 Mar 2008)

7 msg	Virtual Alias Domain
3 msg	copy of email
2 msg	DNS Caching?
5 msg	Using mysql for mynetworks
5 msg	Blocking e-mail from a domain, to a particular ...
5 msg	prevent open relay
15 msg	cannot get mail from outside to my smtp server
6 msg	Error connecting Postfix to LDAP
5 msg	Config ok for TLS/SASL/Client Cert via port 587?
7 msg	mail flow architecture
3 msg	virtual forward + deliver
1 msg	Re: RESOLVED: Using Canonical Maps as an Overri...
14 msg	dual mail server
3 msg	how to specify different outgoing IP

Subject:	postfix TLS (configuration/user) problem
Group:	Postfix-users
From:	Rasmus Andersen
Date:	13 Mar 2008

Hello,

I would like to add TLS/SMTP AUTH to my postfix to allow users outside
my trusted network to send mail. I have followed the guides and have
things working... kinda. My problem is that postfix only advertises
STARTTLS when I connect to it from the server running postfix itself.
I am sure its just me messing things up, on the other hand I cant
determine what I am doing wrong. Hence this mail.

My postfix TLS/AUTH section:

smtpd_recipient_restrictions = permit_sasl_authenticated,
permit_mynetworks, reject_non_fqdn_recipient,
reject_unknown_recipient_domain, reject_unauth_destination,
check_policy_service unix:private/policy

transport_maps = hash:/etc/postfix/transport

policy_time_limit = 3600

smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth

smtpd_tls_security_level = may
#smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/ssl/postfix/server.key
smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
smtpd_tls_CAfile = /etc/ssl/postfix/server.csr
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

Full postconf -n output:

alias_database = hash:/etc/mail/aliases
alias_maps = hash:/etc/mail/aliases
append_at_myorigin = yes
append_dot_mydomain = yes
body_checks = pcre:/etc/postfix/body_checks
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/lib/postfix
debug_peer_level = 2
header_checks = pcre:/etc/postfix/header_checks
home_mailbox = .maildir/
html_directory = /usr/share/doc/postfix-2.2.10/html
inet_interfaces = all
local_recipient_maps = unix:passwd.byname $alias_maps
mail_owner = postfix
mailbox_command = /usr/bin/procmail -t
mailbox_size_limit = 7300000000
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
masquerade_domains = jaquet.dk
message_size_limit = 40960000
mime_header_checks = pcre:/etc/postfix/mime_header_checks
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
mail.$mydomain, www.$mydomain, ftp.$mydomain, firewall.intern.jaquet.dk,
pcre:/etc/postfix/mydestination_wildcard, dereference.dk, zerobit.dk,
avlebavle.dk
myhostname = mail.jaquet.dk
mynetworks = 192.168.0.0/24, 127.0.0.0/8
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases
owner_request_special = no
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.2.10/readme
sample_directory = /etc/postfix
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtpd_client_restrictions = reject_unauth_pipelining
smtpd_helo_required = yes
smtpd_helo_restrictions = reject_invalid_hostname
smtpd_recipient_restrictions = permit_sasl_authenticated,
permit_mynetworks, reject_non_fqdn_recipient,
reject_unknown_recipient_domain, reject_unauth_destination,
check_policy_service unix:private/policy
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_non_fqdn_sender,
reject_unknown_sender_domain
smtpd_tls_CAfile = /etc/ssl/postfix/server.csr
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
smtpd_tls_key_file = /etc/ssl/postfix/server.key
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transport
unknown_local_recipient_reject_code = 550

I have kept this mail short since I really dont know what (else) info to
provide. But I will of course be happy to offer other information
needed.

Cheers,
Rasmus