Tag Archives: Pix

Postfix : TLS not working outside my network

As I just finished setting TLS and SASL to secure the access to my Postfix server, I realized that it was working only from inside my network.

What I got from my lan :

$ telnet mars 25
Trying 192.168.222.10...
Connected to phocean.net.
Connected to phocean.net.
Escape character is '^]'.
220 phocean.net ESMTP Postfix (Debian/GNU)
220 phocean.net ESMTP Postfix (Debian/GNU)
ehlo phocean.net
ehlo phocean.net
250-phocean.net
250-phocean.net
250-PIPELINING
250-SIZE 200000000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH NTLM DIGEST-MD5 CRAM-MD5
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

I shows well that the TLS handshake is initiated.

But from this outside, I just got this weired thing :

$ telnet phocean.net 25

$ telnet phocean.net 25
Trying 81.64.194.119...
Connected to phocean.net.
Connected to phocean.net.
Escape character is '^]'.
220 **********************************************
ehlo phocean.net
ehlo phocean.net
502 5.5.2 Error: command not recognized


Of course, the firewall, a Cisco Pix one, was properly set to redirect port 25 UDP/TCP to my server.


However, I soon focused my effort on this equipment. I considered a while that the cause could be some filtering from my provider, but most probably, the problem came from the Pix.


That was not difficult to figure out : it had some protocol inspector activated for SMTP :


$ sh ru
[...]
fixup protocol smtp 25
[...]


Just after :


> no fixup protocol smtp 25


… it started to work perfectly well !!!


The engine for the SMTP protocol could not recognize the TLS handshake, considered that the SMTP session as not valid and therefore blocked it !


I can deactivate it without any fear as my Postfix server is already pretty well secured, or at least configured to reject any weired SMTP dialog.

How to connect to a Cisco device using the serial port on Linux

Using the serial port is still necessary to manage some devices, when it is reseted to factory defaults. It could be also a security choice…

Nowadays many computers – and especially laptops don’t have anymore a built-in serial port. Not a problem, there are many cheap serial-usb converters like this.

As an alternative to the Hyperterminal of Microsoft, there is Minicom on Linux.

It is very easy to install and configure :

$ apt-get install minicom lrzsz

Before going further, you need to know what is the corresponding Linux device for the port where you plugged the router. As I used an usb adapter, my device was /dev/ttyUSB0. Otherwise, it will probably be one of the /dev/ttyS* devices.
Checking the dmesg output while you plug the device will give you the right device to use.

Now start minicom this way to edit the configuration :

$ minicom -s

In the menu, select Serial Port Configuration and :

  • press A and update the serial port path with the one you found in dmesg
  • press E and then C to change the speed to 9600
  • press F to switch off the hardware flow control
  • select Save the configuration as… and name it as, let’s say, “cisco”

You should be able to connect right now. Next time, just start Minicom like this :

$ minicom cisco

That’s it !

FTP configuration issues

I found that it was a real mess to set up a FTP server in a DMZ, behind a firewall Cisco Asa (501 model with IOS version 7.0).

The FTP server is on the DMZ area, and therefore I natted a public IP to the private IP in the DMZ subnet of this server.

static (dmz,outside) <public IP> <private_IP> netmask 255.255.255.255

Doing so, I expect that my FTP server (like Vsftpd on Linux) to be reachable within its public IP, from the Asa external interface.
Continue reading →