{"id":318,"date":"2015-05-02T14:53:25","date_gmt":"2015-05-02T13:53:25","guid":{"rendered":"https:\/\/cronenberg.cc\/blog\/?p=318"},"modified":"2015-05-02T14:53:25","modified_gmt":"2015-05-02T13:53:25","slug":"count-smtp-connections-without-tls","status":"publish","type":"post","link":"https:\/\/cronenberg.cc\/blog\/2015\/05\/02\/count-smtp-connections-without-tls\/","title":{"rendered":"Count SMTP connections without TLS"},"content":{"rendered":"<p>As I manage my own mail server with postfix, I was curious to see how many connecting mail server do not use best practise and drop their mail without transport encryption. In the end I was possible to create my own <em>list of shame<\/em> of domains.<\/p>\n<p>First it is important that postfix supports TLS encryption. There are a lot of <a href=\"https:\/\/bettercrypto.org\/static\/applied-crypto-hardening.pdf\" target=\"_blank\">good<\/a> <a href=\"http:\/\/www.postfix.org\/docs.html\" target=\"_blank\">guides<\/a> on the web.<br \/>\nThen you need to ensure that the correct logging is enabled in <code>\/etc\/postfix\/main.cf<\/code>:<br \/>\n<code><br \/>\nsmtpd_tls_loglevel = 1<br \/>\n<\/code><\/p>\n<p>Now you can have a look at your logs for example with this cool tool: <a href=\"http:\/\/logreporters.sourceforge.net\/\" target=\"_blank\">postfix-logwatch<\/a>.<br \/>\nBut for my list of shame I needed to write a new script:<\/p>\n<pre><code>\r\n#! \/bin\/bash\r\n\r\nlogpath=\"\/var\/log\/messages*\" # Adapt to your needs\r\nignoreDomain=\"test.org\"      # for example your local domain\r\n\r\nyesTLS=$(zegrep -A1 'smtpd.*: connect from' $logpath | grep -v 'smtpd.*: connect from' | grep -v '\\-\\-' | grep 'Anonymous TLS connection established' | wc -l)\r\n\r\nnoTLS=$(zegrep -A1 'smtpd.*: connect from' $logpath | grep -v 'smtpd.*: connect from' | grep -v '\\-\\-' | grep 'smtpd.*: client=' | wc -l)\r\n\r\nNoTLSwoMe=$(zegrep -A1 'smtpd.*: connect from' $logpath | grep -v 'smtpd.*: connect from' | grep -v '\\-\\-' | grep 'smtpd.*: client=' | grep -v $ignoreDomain | wc -l)\r\n\r\necho \"List of Shame:\"\r\nzegrep -A1 'smtpd.*: connect from' $logpath | grep -v 'smtpd.*: connect from' | grep -v '\\-\\-' | grep 'smtpd.*: client=' | grep -v $ignoreDomain | sed 's\/.*client=\\(.*\\)\\(\\[.*\\)\/\\1\\t\\t\\2\/' |sort | uniq -c |sort\r\n\r\necho \"-----------------------------------------\"\r\necho -e \"Connections with TLS:\\t\\t\\t\" $yesTLS\r\necho -e \"Connections wo TLS - incl. local:\\t\" $noTLS\r\necho -e \"Connection wo TLS - remote:\\t\\t\" $NoTLSwoMe\r\necho -e $(echo 100*$NoTLSwoMe\/$yesTLS| bc)\"% of the remote connections dont use TLS\"\r\n<\/code><\/pre>\n<p>The script should work without to much modification on any postfix installation.<\/p>\n<p>It is kind of depressing to see how many big domains ignore transport encryption. But with this script I found already two mail servers which just had configuration errors.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As I manage my own mail server with postfix, I was curious to see how many connecting mail server do not use best practise and drop their mail without transport encryption. In the end I was possible to create my own list of shame of domains. First it is important that postfix supports TLS encryption. [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[8,12],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/posts\/318"}],"collection":[{"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/comments?post=318"}],"version-history":[{"count":2,"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/posts\/318\/revisions"}],"predecessor-version":[{"id":320,"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/posts\/318\/revisions\/320"}],"wp:attachment":[{"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/media?parent=318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/categories?post=318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cronenberg.cc\/blog\/wp-json\/wp\/v2\/tags?post=318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}