0

I'm trying to send mail from server A running SSMTP via a server B running Postfix. The Postfix server is running just fine and has been in production for a while without any problems. It runs Postfix with Dovecot.

I can use my Gmail account to send mail from SSMTP and that works however I want to use my own Postfix server because I want more control over the entire mail process.

In the next logs and code I have replaced my own public domain with example.com.

Here is the error that SSMTP produces:

root@N40L:/etc/ssmtp# echo "test" | mailx -vvv -s "test" martin@example.com
[<-] 220 h******.stratoserver.net ESMTP Postfix (Debian/GNU)
[->] EHLO example.com
[<-] 250 DSN
[->] AUTH LOGIN
[<-] 535 5.7.8 Error: authentication failed: Invalid authentication mechanism
send-mail: Server didn't like our AUTH LOGIN (535 5.7.8 Error: authentication failed: Invalid authentication mechanism)

I'm running Debian 8 on both machines.

Here is my ssmtp.conf:

root=N40L@example.com
mailhub=example.com:465
rewriteDomain=example.com
hostname=example.com
FromLineOverride=YES
UseTLS=YES
AuthUser=N40L@example.com
AuthPass=correctpassword

I know SSMTP sometimes has trouble working with non-alphanumeric passwords so the password is a string of letters and numbers. I have verified it using Mutt and I'm certain it is the right password, the right username, the right port.

Postfix main.cf:

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = no
smtpd_tls_cert_file=/etc/letsencrypt/live/example.com/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/example.com/privkey.pem
smtpd_use_tls=yes
smtpd_tls_auth_only = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = ********.stratoserver.net
myorigin = /etc/mailname
mydestination = localhost.stratoserver.net, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
message_size_limit=20480000
virtual_mailbox_domains = a.bunch.of names.here.and example.com
virtual_mailbox_base = /var/mail/vmail
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_gid_maps = static:5000
virtual_uid_maps = static:5000
virtual_minimum_uid = 5000
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
content_filter = scan:127.0.0.1:10026
receive_override_options = no_address_mappings

The LetsEncrypt certs show the correct name and a host of phones, both Android and iPhone, as well as a number of different mail clients and its webmail are all satisfied with it. I am positive the certs are in order.

master.cf, though I'm not sure it is relevant:

smtp      inet  n       -       -       -       -       smtpd -v
 -o content_filter=spamassassin
submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
pickup    unix  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp
relay     unix  -       -       -       -       -       smtp
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix  -       n       n       -       2       pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}
spamassassin unix -     n       n       -       -       pipe
  user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}
scan      unix  -       -       n       -       16      smtp
        -o smtp_send_xforward_command=yes

127.0.0.1:10025 inet  n -       n       -       16      smtpd
        -o content_filter=
        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
        -o smtpd_helo_restrictions=
        -o smtpd_client_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o mynetworks_style=host
        -o smtpd_authorized_xforward_hosts=127.0.0.0/8

Relevant config parts in Dovecot:

# 2.2.13: /etc/dovecot/dovecot.conf
auth_debug = yes
auth_debug_passwords = yes
auth_verbose = yes
mail_debug = yes
mail_plugins = " quota"
mail_privileged_group = vmail
managesieve_notify_capability = mailto
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
protocols = " imap lmtp sieve"
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
}
service imap-login {
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0666
    user = postfix
  }
}
ssl = required
ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem
ssl_key = </etc/letsencrypt//live/example.com/privkey.pem
userdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
verbose_ssl = yes
protocol lmtp {
  mail_plugins = " quota sieve"
  postmaster_address = me@example.com
}

If I try to send mail from server A and it generates aforementioned error server B log this in /var/mail/mail.log:

Jan 16 10:29:54 postfix/smtps/smtpd[13601]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
Jan 16 10:29:54 postfix/smtps/smtpd[13601]: connect from ******.upc-h.chello.nl[62.194.***.***]
Jan 16 10:29:54 dovecot: auth: Debug: auth client connected (pid=0)
Jan 16 10:29:54 postfix/smtps/smtpd[13601]: warning: ******.upc-h.chello.nl[62.194.***.***]: SASL LOGIN authentication failed: Invalid authentication mechanism
Jan 16 10:29:54 postfix/smtps/smtpd[13601]: lost connection after AUTH from ******.upc-h.chello.nl[62.194.***.***]
Jan 16 10:29:54 postfix/smtps/smtpd[13601]: disconnect from ******.upc-h.chello.nl[62.194.***.***]

Same if I add AuthMechanism=LOGIN or AuthMechanism=CRAM-MD5 (which according to SSMTP's man page are the only mechanisms available) to ssmtp.conf so I removed that again.

Because the internet is very insistant on using Gmail with SSMTP I tried to humor it for a bit and tried UseSTARTTLS. This then happens on server A:

send-mail: Cannot open example.com:465
Can't send mail: sendmail process failed with error code 1

...and this is logged on server B:

Jan 16 10:46:01 postfix/smtps/smtpd[14047]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
Jan 16 10:46:01 postfix/smtps/smtpd[14047]: connect from ******.upc-h.chello.nl[62.194.***.***]
Jan 16 10:46:12 dovecot: imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges
Jan 16 10:46:12 dovecot: imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges
Jan 16 10:46:12 dovecot: auth: Debug: auth client connected (pid=14049)
Jan 16 10:46:12 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=***************AAAAAAAAAAB#011lip=::1#011rip=::1#011lport=143#011rport=60112#011resp=AG40MGxAd*****************QzE3MDE= (previous base64 data may contain sensitive data)
Jan 16 10:46:12 dovecot: auth-worker(14017): Debug: sql(n40l@example.com,::1): query: SELECT email as username, pwd AS password FROM addresses WHERE email = 'n40l@example.com'
Jan 16 10:46:12 dovecot: auth: Debug: client passdb out: OK#0111#011user=n40l@example.com
Jan 16 10:46:12 dovecot: auth: Debug: master in: REQUEST#011154140673#01114049#0111#0114d206d2a85468af9af75b8538aab7485#011session_pid=14050#011request_auth_token
Jan 16 10:46:12 dovecot: auth-worker(14017): Debug: sql(n40l@example.com,::1): SELECT 5000 AS uid, 5000 as gid, email, '/var/mail/vmail/example.com/n40l' AS home FROM addresses WHERE email = 'n40l@example.com'
Jan 16 10:46:12 dovecot: auth: Debug: master userdb out: USER#011154140673#011n40l@example.com#011uid=5000#011gid=5000#011email=n40l@example.com#011home=/var/mail/vmail/example.com/n40l#011auth_token=ff5b12*****************aedf315ac08e
Jan 16 10:46:12 dovecot: imap-login: Login: user=<n40l@example.com>, method=PLAIN, rip=::1, lip=::1, mpid=14050, secured, session=<0pDTDTNG0AAAAAAAAAAAAAAAAAAAAAAB>
Jan 16 10:46:12 dovecot: imap: Debug: Loading modules from directory: /usr/lib/dovecot/modules
Jan 16 10:46:12 dovecot: imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so
Jan 16 10:46:12 dovecot: imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so
Jan 16 10:46:12 dovecot: imap: Debug: Added userdb setting: plugin/email=n40l@example.com
Jan 16 10:46:12 dovecot: imap(n40l@example.com): Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/example.com/n40l
Jan 16 10:46:12 dovecot: imap(n40l@example.com): Debug: Quota root: name=User quota backend=maildir args=
Jan 16 10:46:12 dovecot: imap(n40l@example.com): Debug: Quota rule: root=User quota mailbox=* bytes=10737418240 messages=0
Jan 16 10:46:12 dovecot: imap(n40l@example.com): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0
Jan 16 10:46:12 dovecot: imap(n40l@example.com): Debug: Quota grace: root=User quota bytes=536870912 (5%)
Jan 16 10:46:12 dovecot: imap(n40l@example.com): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/mail/vmail/example.com/n40l
Jan 16 10:46:12 dovecot: imap(n40l@example.com): Debug: maildir++: root=/var/mail/vmail/example.com/n40l, index=, indexpvt=, control=, inbox=/var/mail/vmail/example.com/n40l, alt=
Jan 16 10:46:12 dovecot: imap(n40l@example.com): Disconnected: Logged out in=50 out=475

I can log into server B's webmail without any trouble and send and receive mail for the address I'm using so the account itself is in order. I tried other accounts and they produce the same errors.

I'm at a loss. SSMTP should be able to send mail through Postfix. Even with all debug and verbosity options on, I can't find the source of the problem. Any help is greatly appreciated.

0

ssmtp seems to simulate an Outlook client, because it uses broken auth mechanism.

broken_sasl_auth_clients = yes in postfix main.cf will "fix" this.

  • Thanks for your suggestion. Unfortunately it didn't help and nothing's changed. – Forkbeard Feb 2 '18 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.