On 5/18/2015 10:08 PM, pgndev wrote:
> I'm locking down a postfix smarthost.
>
> Goal is to only accept submissions to the smarthost from clients that
> match known TLS fingerprints.
>
> smarthost' service config is
>
> [172.30.6.19]:587 inet n - n - - smtpd
> -o syslog_name=postfix/smarthost
> -o smtp_helo_name=smarthost.${myhostname}
> -o smtpd_tls_loglevel=2
> -o smtpd_enforce_tls=yes
> -o smtpd_tls_auth_only=no
> -o smtpd_tls_security_level=encrypt
> -o smtpd_tls_mandatory_protocols=!TLSv1.1,!TLSv1,!SSLv3,!SSLv2
> -o smtpd_tls_mandatory_ciphers=high
> -o smtpd_sasl_auth_enable=no
> -o smtpd_tls_wrappermode=no
> -o relay_clientcerts=lmdb:/etc/postfix/smarthost_clientcerts
> -o smtpd_tls_req_ccert=yes
> -o smtpd_tls_ccert_verifydepth=2
> -o smtpd_tls_CApath=/etc/ssl/certs
> -o smtpd_tls_fingerprint_digest=sha1
> -o smtpd_client_restrictions=
> -o smtpd_helo_restrictions=
> -o smtpd_sender_restrictions=
> -o
> smtpd_relay_restrictions=permit_mynetworks,permit_tls_clientcerts,reject_unauth_destination
> -o smtpd_recipient_restrictions=
> -o smtpd_data_restrictions=
> -o smtpd_end_of_data_restrictions=
> -o smtpd_etrn_restrictions=
> -o alias_maps=
> -o alias_database=
> -o relayhost=
> -o relay_domains=
> -o content_filter=
>
> The test client's crt fingerprint is
>
> openssl x509 -pubkey -noout -in commercial.crt | openssl pkey
> -pubin -outform DER | openssl dgst -sha1 -c
> (stdin)= 17:32:c4:9c:1e:c7:3d:13:ff:09:ec:19:ef:d3:13:1c:96:d3:e4:c3
>
> I've def'd
>
> cat /etc/postfix/smarthost_clientcerts
> 17:32:c4:9c:1e:c7:3d:13:ff:09:ec:19:ef:d3:13:1c:96:d3:e4:c3
> commercial.crt
>
> On mail submit from the client via the smarthost, log on the smarthost reports
>
> May 18 19:14:56 border postfix/smarthost/smtpd[9615]:
> internal.XXX.com[172.30.7.113]: subject_CN=*.XXX.com, issuer=COMODO
> RSA Domain Validation Secure Server CA,
> fingerprint=42:1C:FD:99:2F:81:B2:55:07:42:D5:1F:EF:49:6D:43:96:1E:BC:D9,
> pkey_fingerprint=17:32:c4:9c:1e:c7:3d:13:ff:09:ec:19:ef:d3:13:1c:96:d3:e4:c3
> May 18 19:14:56 border postfix/smarthost/smtpd[9615]: Untrusted
> TLS connection established from internal.XXX.com[172.30.7.113]:
> TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
> May 18 19:14:56 border postfix/smarthost/smtpd[9615]: NOQUEUE:
> abort: TLS from internal.XXX.com[172.30.7.113]: Client certificate not
> trusted
>
> The pkey_fingerprint= matches, but the Client's not trusted.
>
> I've missed something. Why's this not matching?
>
> PGNd
>
Have you tried with the default setting of smtpd_tls_ccert_verifydepth?
