Myside's Spew - Blog of Spontaneous Combustible Spew

Postfix TLS Fingerprints for MTA to MTA Identification

28 January, 2012 06:39 CST6CDT

edited 2012-01-28 11:30:43

I have a home mail server with a Linux operating system & Postfix that is the primary mail exchange (MX) for its domain.  In addition to the primary MTA, I have a static secondary relay mail server with a FreeBSD operating system & Postfix in the case my home connection were to go down.  I was looking for a way that my secondary or primary MTA (mail transport agent) could relay e-mail to my legitimate dynamic IP address if my home mail server were to go down by doing a verification that my dynamic domain name IP address with an open port 25 was truly its relay destination.

I accomplished simple MTA to MTA verification using Postfix, which is installed on both servers, and my home TLS certificate's fingerprint.  When my backup mail exchange server receives mail, it will relay it to my dynamic home server when it becomes available, though will only be delivered if my home TLS MD5 certificate fingerprint is valid.  If the MD5 fingerprint expected does not match, it is deferred, re-queued, and repeats indefinitely until it is safe to deliver.

The first step is to do a MD5 fingerprint on your home, dynamic Postfix server's TLS PEM file defined in the Postfix main.cf configuration file with the variable smtpd_tls_cert_file=/path/to/ssl-cert.pem using the openssl command:

openssl x509 -noout -in /path/to/ssl-cert.pem -fingerprint -md5

Let's assume the MD5 fingerprint output is: d5:68:da:c4:cd:ee:0d:ba:3a:bc:dd:b6:7b:67:51:88 and our dynamic domain name is domain.not.  Let's also assume the home mail server is setup and ready to receive e-mail for this domain and your users.

On your secondary and static backup MX server, make sure that domain.not is defined in the following parameters:

  • relay_domains=domain.not
  • relay_recipient_maps = hash:${config_directory}/relay_recipient_maps.cf

The configuration file relay_recipient_maps.cf contains a table of your recipients and may look like the following:

first.last@domain.not     first.last@domain.not

Make sure to execute: postmap /etc/postfix/relay_recipient_maps.cf or replace /etc/postfix with your configuration directory.

Your "transport_maps=" may look something like the following:

domain.not   smtp:[domain.not]

If your ISP blocks port 25, you may use the following for port 26, or any upper number port that is open and available:

domain.not smtp:[domain.not]:26

Now that we have the MD5 fingerprint of our home server and the static backup server knows what e-mail to accept and where to deliver it when your home server is up, we may now define in Postfix to only deliver mail if when requested the home Postfix server shows its certificate, and the MD5 fingerprint of the certificate matches.

First tell Postfix to use MD5 hashes for TLS policies: smtp_tls_fingerprint_digest = md5  Next, define your TLS policy configuration file, smtp_tls_policy_maps = hash:${config_directory}/tls_policy.cf

Here is an example SMTP TLS policy map:

[domain.not] fingerprint
    match=d5:68:da:c4:cd:ee:0d:ba:3a:bc:dd:b6:7b:67:51:88

In the above TLS policy, domain.not requires TLS and the MD5 fingerprint of the certificate must match, match=  Be sure to postmap the tls_policy.cf file, reload postfix, and you will now be using simple, low level MTA to MTA identification.

Software  Projects  Article & Comments

Add a Comment
Verification (Required)
 authimage
Your comment will appear once it is approved and
your e-mail address will NOT be shared

Main Entry:   spew   Pronunciation:   \ˈspyü\
Function: verb
Etymology: Middle English, from Old English spīwan; akin to Old High German spIwan to spit, Latin spuere, Greek ptyein   First Known Use: before 12th century

intransitive verb
  1. VOMIT
  2. to come forth in a flood or gush
  3. to ooze out as if under pressure : EXUDE
transitive verb
  1. VOMIT
  2. to send or cast forth with vigor or violence or in great quantity <a volcano spewing out ash> —often used with out —spew·er noun
Land where drunk cows swim and home to my daily hand