[GH-ISSUE #1134] Modoboa on Debian 9 / SSL version used by Dovecot and webmailer #939

New issue

Closed

opened 2026-02-27 11:14:22 +03:00 by kerem · 2 comments

kerem commented

2026-02-27 11:14:22 +03:00

Owner

Originally created by @ghost on GitHub (Jun 10, 2017).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/1134

Impacted versions

Modoboa: 1.7.4
installer used: Yes
Webserver: Nginx

Steps to reproduce

I tried to install Modoboa on a fresh Debian 9/stretch, which will become the "stable" Debian on next saturday [1]. When opening the webmailer it fails with the error Error: Connection to IMAP server failed: [Errno 104] Connection reset by peer. The syslog furthermore says:

Jun 10 13:09:39 mail dovecot: imap-login: Fatal: Invalid ssl_protocols setting: Unknown protocol 'SSLv2'
Jun 10 13:09:39 mail dovecot: master: Error: service(imap-login): command startup failed, throttling for 2 secs

According to this post [2] openssl does not support SSLv2 from version 1.1. Debian stretch uses openssl 1.1.0f-3, so it has no SSLv2 support anymore. In contrast Debian jessie (the stable release at the moment) uses openssl 1.0.1t, so there should be no problem.

According to this post and some posts in Debian mailing lists, the solution to this problem would be changing the SSL version in Dovecot config (file /etc/dovecot/conf.d/10-ssl.conf) from

# SSL protocols to use
ssl_protocols = !SSLv2 !SSLv3

# SSL protocols to use
ssl_protocols = !SSLv3

After restarting the whole system there are still errors. The webmailer now reports this error:

Error: Connection to IMAP server failed: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:661)

while syslog says:

Jun 10 13:19:34 mail dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<BBS0QplRuuB/AAAB>

Does this mean, that the webmailer only supports SSLv2 while openssl used by dovecot only supports SSLv3?

Expected behavior

A working webmailer

Video/Screenshot link (optional)

Webmail-Settings:

Changing the IMAP secure connection to No still results in

Error: ['[AUTHENTICATIONFAILED] Authentication failed.']

Links

[1] https://lists.debian.org/debian-devel-announce/2017/05/msg00002.html
[2] https://bbs.archlinux.org/viewtopic.php?id=225535

Originally created by @ghost on GitHub (Jun 10, 2017). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1134 # Impacted versions * Modoboa: 1.7.4 * installer used: Yes * Webserver: Nginx # Steps to reproduce I tried to install Modoboa on a fresh Debian 9/stretch, which will become the "stable" Debian on next saturday [1]. When opening the webmailer it fails with the error ` Error: Connection to IMAP server failed: [Errno 104] Connection reset by peer`. The syslog furthermore says: Jun 10 13:09:39 mail dovecot: imap-login: Fatal: Invalid ssl_protocols setting: Unknown protocol 'SSLv2' Jun 10 13:09:39 mail dovecot: master: Error: service(imap-login): command startup failed, throttling for 2 secs According to this post [2] openssl does not support SSLv2 from version 1.1. Debian stretch uses openssl 1.1.0f-3, so it has no SSLv2 support anymore. In contrast Debian jessie (the stable release at the moment) uses openssl 1.0.1t, so there should be no problem. According to this post and some posts in Debian mailing lists, the solution to this problem would be changing the SSL version in Dovecot config (file `/etc/dovecot/conf.d/10-ssl.conf`) from # SSL protocols to use ssl_protocols = !SSLv2 !SSLv3 to # SSL protocols to use ssl_protocols = !SSLv3 After restarting the whole system there are still errors. The webmailer now reports this error: Error: Connection to IMAP server failed: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:661) while syslog says: Jun 10 13:19:34 mail dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<BBS0QplRuuB/AAAB> Does this mean, that the webmailer only supports SSLv2 while openssl used by dovecot only supports SSLv3? # Expected behavior A working webmailer # Video/Screenshot link (optional) Webmail-Settings: ![bildschirmfoto von 2017-06-10 13-22-25](https://user-images.githubusercontent.com/29311710/27002350-f058fb22-4ddf-11e7-9a4e-25a1c5ff1f91.png) Changing the IMAP secure connection to No still results in Error: ['[AUTHENTICATIONFAILED] Authentication failed.'] # Links [1] https://lists.debian.org/debian-devel-announce/2017/05/msg00002.html [2] https://bbs.archlinux.org/viewtopic.php?id=225535

kerem closed this issue

2026-02-27 11:14:22 +03:00

kerem commented

2026-02-27 11:14:23 +03:00

Author

Owner

@tonioo commented on GitHub (Jun 16, 2017):

@tir42 Thank you for reporting this but it is an installer issue. Could you please move it to the appropriate repository?
About the webmail, python2 imaplib (and so the webmail) does not support STARTTLS. Have you tried to change IMAP port to 993? (instead of 143)

@tonioo commented on GitHub (Jun 16, 2017): @tir42 Thank you for reporting this but it is an installer issue. Could you please move it to the appropriate repository? About the webmail, python2 imaplib (and so the webmail) does not support STARTTLS. Have you tried to change IMAP port to 993? (instead of 143)

kerem commented

2026-02-27 11:14:23 +03:00

Author

Owner

@ghost commented on GitHub (Jun 16, 2017):

Thanks, changing the port to 993 did the trick. But only when I log in as a normal user. When I try to open webmail as admin it still fails with Error: ['[AUTHENTICATIONFAILED] Authentication failed.'].
But this is another issue and has nothing to do with Debian stretch.

@ghost commented on GitHub (Jun 16, 2017): Thanks, changing the port to 993 did the trick. But only when I log in as a normal user. When I try to open webmail as admin it still fails with `Error: ['[AUTHENTICATIONFAILED] Authentication failed.']`. But this is another issue and has nothing to do with Debian stretch.