0

Ok my brain is about to explode I have been working on this issue for over a week now. I did an implace upgrade on my fc26 to fc28 which didn't go the best. So I decided to build a new fc28 fresh box. I am trying to get my local clients which are Outlook to connect to it via pop3 or pop3s (not to worried as its local). However the config I have been using doesn't appear to work. I can telnet to port 25 from the local clients so it appears to be responding ok. Outlook appears to connect ok to the dovecot (pop3 or imap) ok but part of the second check is to send a mail out - which is failing.

I have put up the debug level on sendmail to see if I can figure out what is going on. I have a cert on sendmail from Comodo which "appears" ok.

Output in maillog - I have removed the domainname and replaced with localdomain

May 13 22:52:27 whitestar2 sendmail[3146]: NOQUEUE: connect from whitestar4.localdomain [172.16.2.40]
May 13 22:52:27 whitestar2 sendmail[3146]: AUTH: available mech=GSS-SPNEGO GSSAPI ANONYMOUS, allowed mech=EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
May 13 22:52:27 whitestar2 sendmail[3146]: w4DCqR7Q003146: Milter: no active filter
May 13 22:52:27 whitestar2 sendmail[3146]: STARTTLS: x509 cert verify: depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=mail.scifioz.com, state=0, reason=unable to get certificate CRL
May 13 22:52:27 whitestar2 sendmail[3146]: STARTTLS: x509 cert verify: depth=1 /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA, state=0, reason=unable to get certificate CRL
May 13 22:52:27 whitestar2 sendmail[3146]: STARTTLS: x509 cert verify: depth=2 /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority, state=0, reason=unable to get certificate CRL
May 13 22:52:27 whitestar2 sendmail[3146]: STARTTLS: x509 cert verify: depth=3 /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root, state=0, reason=unable to get certificate CRL
May 13 22:52:27 whitestar2 sendmail[3146]: STARTTLS=server, relay=whitestar4.localdomain [172.16.2.40], version=TLSv1.2, verify=NO, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256
May 13 22:52:27 whitestar2 sendmail[3146]: STARTTLS=server, cert-subject=, cert-issuer=, verifymsg=ok
May 13 22:52:27 whitestar2 sendmail[3146]: AUTH: available mech=GSS-SPNEGO GSSAPI LOGIN PLAIN ANONYMOUS, allowed mech=EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
May 13 22:52:27 whitestar2 sendmail[3146]: w4DCqR7R003146: AUTH failure (LOGIN): generic failure (-1) SASL(-1): generic failure: checkpass failed, relay=whitestar4.localdomain [172.16.2.40]

This is also the setting for certs in sendmail.mc

define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl
define(`confCACERT', `/etc/pki/tls/certs/COMODO_DV_SHA-256_bundle.crt')dnl
define(`confSERVER_CERT', `/etc/pki/tls/certs/comodo/mail_domainname_com.crt')dnl
define(`confSERVER_KEY', `/etc/pki/tls/certs/comodo/key.pem')dnl
define(`confCRL', `/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crl')dnl

Also the mail server sits natted behind a router and thus sits on the same segment as the clients. So from a setup perspective they are able to point at the real address and not the natted one.

I fixed some issues with the cert. However still get the auth failure. Its definately not the password. What is the mechanism that sendmail is passing back to the local system for auth?

May 16 20:31:33 whitestar2 sendmail[4252]: NOQUEUE: connect from whitestar4 [172.16.2.40] May 16 20:31:33 whitestar2 sendmail[4252]: AUTH: available mech=GSS-SPNEGO GSSAPI ANONYMOUS, allowed mech=EXTERNAL GSSAPI CRAM-MD5 LOGIN PLAIN May 16 20:31:33 whitestar2 sendmail[4252]: w4GAVX1f004252: Milter: no active filter May 16 20:31:33 whitestar2 sendmail[4252]: STARTTLS=server, relay=whitestar4 [172.16.2.40], version=TLSv1.2, verify=NO, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256 May 16 20:31:33 whitestar2 sendmail[4252]: STARTTLS=server, cert-subject=, cert-issuer=, verifymsg=ok May 16 20:31:33 whitestar2 sendmail[4252]: AUTH: available mech=GSS-SPNEGO GSSAPI LOGIN PLAIN ANONYMOUS, allowed mech=EXTERNAL GSSAPI CRAM-MD5 LOGIN PLAIN May 16 20:31:33 whitestar2 sendmail[4252]: w4GAVX1g004252: AUTH failure (LOGIN): generic failure (-1) SASL(-1): generic failure: checkpass failed, relay=whitestar4 [172.16.2.40]

  • Your posted output has an error for AUTH failure after negotiating STARTTLS. This tells me he server is accepting local connections, but the login to SMTP is failing. Have you double checked the authentication credentials are configured properly on your client? – GracefulRestart May 13 '18 at 21:59
0

Could this be a firewall issue? It's been a while for me on sendmail.

You could try telnet {ip} 25

Check the result.

  • Port 25 appears to be ok from the local clients - 220 mail.domainname.com ESMTP Sendmail 8.15.2/8.15.2; Mon, 14 May 2018 07:25:44 +1000 – Warren May 13 '18 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.