Email OpenSSL issue while sending mail

mcmlexe · Jan 28, 2020

CentOS Version: CentOS 7 64bit
Centmin Mod Version Installed: 123.09beta01
Nginx Version Installed: 1.17.8
PHP Version Installed: 7.3.
When was last time updated Centmin Mod code base ? : today

Persistent Config:

Code (Text):

CLANG='n'
DEVTOOLSETSEVEN='y'
NGINX_DEVTOOLSETGCC='y'
NGINX_HPACK='y'
CLOUDFLARE_ZLIB='y'
MARCH_TARGETNATIVE='n'
LIBRESSL_SWITCH='n'
LETSENCRYPT_DETECT='y'
PHPFINFO='y'

Hello,
I have a problem while sending the test email. I have another server running same setup which works fine.
Anybody can help me to fix the problem.

Some outputs for debug:

Code (Text):

echo QUIT | openssl s_client -crlf -starttls smtp -connect smtp.gmail.com:587 
socket: Bad file descriptor
connect:errno=9

Code (Text):

rpm -ql ca-certificates
/etc/pki/ca-trust
/etc/pki/ca-trust/README
/etc/pki/ca-trust/ca-legacy.conf
/etc/pki/ca-trust/extracted
/etc/pki/ca-trust/extracted/README
/etc/pki/ca-trust/extracted/java
/etc/pki/ca-trust/extracted/java/README
/etc/pki/ca-trust/extracted/java/cacerts
/etc/pki/ca-trust/extracted/openssl
/etc/pki/ca-trust/extracted/openssl/README
/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
/etc/pki/ca-trust/extracted/pem
/etc/pki/ca-trust/extracted/pem/README
/etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem
/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
/etc/pki/ca-trust/source
/etc/pki/ca-trust/source/README
/etc/pki/ca-trust/source/anchors
/etc/pki/ca-trust/source/blacklist
/etc/pki/ca-trust/source/ca-bundle.legacy.crt
/etc/pki/java
/etc/pki/java/cacerts
/etc/pki/tls
/etc/pki/tls/cert.pem
/etc/pki/tls/certs
/etc/pki/tls/certs/ca-bundle.crt
/etc/pki/tls/certs/ca-bundle.trust.crt
/etc/ssl
/etc/ssl/certs
/usr/bin/ca-legacy
/usr/bin/update-ca-trust
/usr/share/doc/ca-certificates-2019.2.32/README
/usr/share/man/man8/ca-legacy.8.gz
/usr/share/man/man8/update-ca-trust.8.gz
/usr/share/pki
/usr/share/pki/ca-trust-legacy
/usr/share/pki/ca-trust-legacy/ca-bundle.legacy.default.crt
/usr/share/pki/ca-trust-legacy/ca-bundle.legacy.disable.crt
/usr/share/pki/ca-trust-source
/usr/share/pki/ca-trust-source/README
/usr/share/pki/ca-trust-source/anchors
/usr/share/pki/ca-trust-source/blacklist
/usr/share/pki/ca-trust-source/ca-bundle.trust.p11-kit

Code (Text):

egrep '^TCP_|^TCP6_|^UDP_|^UDP6_' /etc/csf/csf.conf
TCP_IN = "20,21,22,25,53,80,110,143,161,443,465,587,993,995,1110,1186,1194,81,9418,30001:50011"
TCP_OUT = "8080,2525,465,1110,1194,9418,20,21,22,25,53,80,110,113,443,587,993,995"
UDP_IN = "67,68,1110,33434:33534,20,21,53"
UDP_OUT = "67,68,1110,33434:33534,20,21,53,113,123"
TCP6_IN = "20,21,22,25,53,80,110,143,161,443,465,587,993,995,1110,1186,1194,81,9418,30001:50011"
TCP6_OUT = "8080,2525,465,20,21,22,25,53,80,110,113,443,587,993,995"
UDP6_IN = "20,21,53"
UDP6_OUT = "20,21,53,113,123"

eva2000 · Jan 28, 2020

what about output for
Code (Text):
echo QUIT | openssl s_client -crlf -starttls smtp -CAfile /etc/ssl/certs/cacert.pem -connect smtp.gmail.com:587
and verify if it isn't a gmail only issue
Code (Text):
echo QUIT | openssl s_client -crlf -starttls smtp -CAfile /etc/ssl/certs/cacert.pem -connect smtp.yandex.com:587
tried testing with telnet ?
Code (Text):
yum -y install telnet
# enter quit to exit from telnet
# test ipv4
telnet -4 smtp.gmail.com 587
telnet -6 smtp.gmail.com 587
what output do you get for telnet command

ensure CSF Firewall is running which whitelists output port 587 for TCP ipv4 and TCP6 ipv6
Code (Text):
csf -u
systemctl status lfd csf
ensure postfix is running
Code (Text):
systemctl status postfix
any yum updates ?
Code (Text):
yum list updates
if there are some related o ca-certificates, nss or kernel, then update and reboot server

and obvious thing is which web host you using ? ask their support if TCP outbound mail on port 587 and 465 are blocked at web host level and if request it to be unblocked at the host level if required. Some web hosts block by default until you provide id verification and request unblocking to prevent spam.

mcmlexe · Jan 28, 2020

Thanks for reply. I'm using Linode. As you said, there was blocked at web host level to help combat spam.

Code (Text):

echo QUIT | openssl s_client -crlf -starttls smtp -CAfile /etc/ssl/certs/cacert.pem -connect smtp.gmail.com:587
socket: Bad file descriptor
connect:errno=9

Code (Text):

echo QUIT | openssl s_client -crlf -starttls smtp -CAfile /etc/ssl/certs/cacert.pem -connect smtp.yandex.com:587
socket: Bad file descriptor
connect:errno=9

Code (Text):

telnet -4 smtp.gmail.com 587
Trying 74.125.71.108...
telnet: connect to address 74.125.71.108: Connection timed out

telnet -6 smtp.gmail.com 587
Trying 2a00:1450:400c:c02::6c...
telnet: connect to address 2a00:1450:400c:c02::6c: Connection timed out

Code (Text):

csf -u
csf is already at the latest version: v14.01

systemctl status lfd csf
● lfd.service - ConfigServer Firewall & Security - lfd
   Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2020-01-28 00:00:03 UTC; 2h 9min ago
  Process: 36335 ExecStart=/usr/sbin/lfd (code=exited, status=0/SUCCESS)
 Main PID: 36348 (lfd - sleeping)
   CGroup: /system.slice/lfd.service
           └─36348 lfd - sleeping

Code (Text):

systemctl status postfix
● postfix.service - Postfix Mail Transport Agent
   Loaded: loaded (/usr/lib/systemd/system/postfix.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2020-01-27 15:41:32 UTC; 10h ago
 Main PID: 1470 (master)
   CGroup: /system.slice/postfix.service
           ├─ 1470 /usr/libexec/postfix/master -w
           ├─ 1474 qmgr -l -t unix -u
           ├─ 1706 tlsmgr -l -t unix -u
           ├─42253 pickup -l -t unix -u
           ├─44554 trivial-rewrite -n rewrite -t unix -u
           ├─44555 smtp -t unix -u
           ├─44556 smtp -t unix -u
           ├─44557 smtp -t unix -u
           ├─44558 smtp -t unix -u
           └─44559 smtp -t unix -u

Code (Text):

yum list updates
Loaded plugins: priorities, versionlock
363 packages excluded due to repository priority protections

eva2000 · Jan 28, 2020

mcmlexe said: ↑

Thanks for reply. I'm using Linode. As you said, there was blocked at web host level to help combat spam.
Click to expand...

Ah Linode, so you got it unblocked ?

https://www.linode.com/docs/email/running-a-mail-server/#sending-email-on-linode

Sending Email on LinodePermalink
In an effort to fight spam, Linode restricts outbound connections on ports 25, 465, and 587 on all Linodes for new accounts created after November 5th, 2019.

If you have a need to send mail from your Linode, we ask that you first configure (1) valid DNS A records and (2) rDNS records for any Linodes that you plan to use to send mail. Then, open a Support ticket from the Linode Manager – we’ll ask you to provide the following basic information:

Which Linode(s) will be used for mailing?

Do your mailing practices conform with ‘Section 3. Prohibited Usage’ of our ToS, and are they CAN-SPAM compliant?

Once you’ve completed those steps and provided that information, our Support team will be happy to review your request.
Click to expand...

eva2000 · Jan 28, 2020

Do your mailing practices conform with ‘Section 3. Prohibited Usage’ of our ToS, and are they CAN-SPAM compliant
Click to expand...

CAN-SPAM compliance can be problematic especially for 4th requirement requiring your postal address be shared with folks you send email to ! Didn't know Linode changed their outbound email policy !

There's a fine of US$43,280 per violation !

Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $43,280, so non-compliance can be costly. But following the law isn’t complicated. Here’s a rundown of CAN-SPAM’s main requirements:

Don’t use false or misleading header information. Your “From,” “To,” “Reply-To,” and routing information – including the originating domain name and email address – must be accurate and identify the person or business who initiated the message.

Don’t use deceptive subject lines. The subject line must accurately reflect the content of the message.

Identify the message as an ad. The law gives you a lot of leeway in how to do this, but you must disclose clearly and conspicuously that your message is an advertisement.

Tell recipients where you’re located. Your message must include your valid physical postal address. This can be your current street address, a post office box you’ve registered with the U.S. Postal Service, or a private mailbox you’ve registered with a commercial mail receiving agency established under Postal Service regulations.

Tell recipients how to opt out of receiving future email from you. Your message must include a clear and conspicuous explanation of how the recipient can opt out of getting email from you in the future. Craft the notice in a way that’s easy for an ordinary person to recognize, read, and understand. Creative use of type size, color, and location can improve clarity. Give a return email address or another easy Internet-based way to allow people to communicate their choice to you. You may create a menu to allow a recipient to opt out of certain types of messages, but you must include the option to stop all commercial messages from you. Make sure your spam filter doesn’t block these opt-out requests.

Honor opt-out requests promptly. Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request. Once people have told you they don’t want to receive more messages from you, you can’t sell or transfer their email addresses, even in the form of a mailing list. The only exception is that you may transfer the addresses to a company you’ve hired to help you comply with the CAN-SPAM Act.

Monitor what others are doing on your behalf. The law makes clear that even if you hire another company to handle your email marketing, you can’t contract away your legal responsibility to comply with the law. Both the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible.

Click to expand...

mcmlexe · Jan 30, 2020

They unblocked the emails port as soon as I opened the support ticket. Problem solved Thanks again

eva2000 · Jan 31, 2020

Good to know

Log in / Register

Forums

Learn about Centmin Mod LEMP Stack today

Email OpenSSL issue while sending mail

mcmlexe New Member

eva2000 Administrator Staff Member

mcmlexe New Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

mcmlexe New Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Learn about Centmin Mod LEMP Stack today

Email OpenSSL issue while sending mail

mcmlexe New Member

eva2000 Administrator Staff Member

mcmlexe New Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

mcmlexe New Member

eva2000 Administrator Staff Member

.