Help requested getting moderation notice email working

[UnixRonin]

I've recently created a couple of linked sites using Nikola, on one of which I installed isso for comments support. (I can provide detailed configuration information for Gentoo Linux now, by the way, including a working openrc init script.) It took me a while to figure out the right Apache configuration, but eventually I solved it, and got everything working... EXCEPT for email moderation notices.

When I create a comment, postfix logs only the following:

May  5 17:27:20 minbar postfix/submission/smtpd[23002]: connect from localhost[127.0.0.1]
May  5 17:27:20 minbar postfix/submission/smtpd[23002]: disconnect from localhost[127.0.0.1] ehlo=1 mail=0/1 rset=0/1 quit=1 commands=2/4

Postfix, apache, and isso are all running on the same host. My isso SMTP configuration section looks like this (actual destination address redacted):

[moderation]
enabled = true
approve-if-email-previously-approved = false
purge-after = 30d

[smtp]
username =
password =
host = localhost
port = 587
security = none
to = [email protected]
from = [email protected]
timeout = 10

I've tried it also with 'to' and 'from' blank, with the same results. Clearly I am missing something or doing something wrong, but I can't figure out from the documentation alone what I'm doing wrong. Can anyone advise?

[welpo]

I'm sending the moderation e-mails from a 3rd party; I'm not sure how much help I can offer.

My settings are as follows:

[moderation]
enabled = true
approve-if-email-previously-approved = true
purge-after = 90d

[smtp]
host = smtp.example.com
port = 587
security = starttls
username = [email protected]
password = mypassword
from = "Isso Comments" <[email protected]>
to = [email protected]
timeout = 20

[UnixRonin]

On 5/6/24 17:56, Óscar wrote: I'm sending the moderation e-mails from a 3rd party; I'm not sure how much help I can offer. My settings are as follows: [moderation] enabled = true approve-if-email-previously-approved = true purge-after = 90d [smtp] host = smtp.example.com port = 587 security = starttls username = ***@***.*** password = mypassword from ="Isso Comments" ***@***.***> to = ***@***.*** timeout = 20

Interesting. If I try to enable starttls, I get a certificate error: File "/usr/lib/python3.11/ssl.py", line 1382, in do_handshake self._sslobj.do_handshake() ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010) Yet I know my certificate is correctl..... OH. I wonder if the certificate is not parsed as valid for "localhost"...?

…

-- Phil Stracchino Fenian House Publishing ***@***.*** ***@***.*** Landline: +1.603.293.8485 Mobile: +1.603.998.6958

[UnixRonin]

Ha! That was the TLS problem at least! "localhost" is not named on the certificate, so it's not accepted. I've changed most to smtp.mydomain, and starttls works now.

I'll re-test moderation notices tomorrow.

[UnixRonin]

And the answer to that is, no it's still not working yet. In fact, starttls isn't working yet, still throwing:

  File "/usr/lib/python3.11/ssl.py", line 1382, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

I also saw an error fro Postfix this time:

May  7 10:43:33 minbar postfix/submission/smtpd[25808]: connect from minbar.caerllewys.net[10.24.32.15]
May  7 10:43:33 minbar postfix/submission/smtpd[25808]: SSL_accept error from minbar.caerllewys.net[10.24.32.15]: -1
May  7 10:43:33 minbar postfix/submission/smtpd[25808]: warning: TLS library problem: error:0A000418:SSL routines::tlsv1 alert unknown ca:../openssl-3.2.1/ssl/record/rec_layer_s3.c:865:SSL alert number 48:
May  7 10:43:33 minbar postfix/submission/smtpd[25808]: lost connection after STARTTLS from minbar.caerllewys.net[10.24.32.15]

I must have missed a step testing that last night. I don't know why it would be saying 'unknown CA' unless something in the code chain is failing to recognize LetsEncrypt for some reason. But the mail system itself is demonstrably working as normal, it just can't seem to come to a working agreement with isso.
I tried creating a local user and filling in the user/password fields, and if I did that, isso threw a different error:

  File "/usr/lib/python3.11/smtplib.py", line 716, in login
    raise SMTPNotSupportedError(
smtplib.SMTPNotSupportedError: SMTP AUTH extension not supported by server.

So for now, I'm still baffled.

[UnixRonin]

OK, I figured out a way to make it work, by adding a second smtp listener port SPECIFICALLY for isso with TLS and SASL disabled. My Isso SMTP section :

[smtp]
; username = isso
; password = "xxxxxxxx"
host = smtp.example.com
port = 588
security = none
to = [email protected]
from = "<Isso Moderation> [email protected]"
timeout = 10

And the Postfix listener service for it:

588 inet n       -       n       -       -       smtpd
	-o syslog_name=postfix/submission
	-o smtpd_tls_security_level=none
	-o smtpd_sasl_auth_enable=yes
	-o smtpd_reject_unlisted_recipient=no
	-o smtpd_client_restrictions=
	-o smtpd_helo_restrictions=
	-o smtpd_sender_restrictions=
	-o smtpd_recipient_restrictions=
	-o smtpd_relay_restrictions=permit_mynetworks,reject_unauth_destination
	-o milter_macro_daemon_name=ORIGINATING

THIS finally sends me moderation notices. So if anyone else runs into this problem, this is how to solve it.

[welpo]

Glad to hear you worked it out! Thanks for sharing the fix :)