Authentication e-mail with Postfix

PeterTuson · Post by **PeterTuson** » 26 Sep 2008, 09:32

When I try and send emails from my bubba server, postfix fails to authenticate - see log below.

Sep 26 14:13:45 bubba postfix/cleanup[19412]: F1F742420221: message-id=<20080926131344.F1F742420221@bubba.localdomain>
Sep 26 14:13:45 bubba postfix/qmgr[19395]: F1F742420221: from=<root@localhost>, size=287, nrcpt=1 (queue active)
Sep 26 14:13:45 bubba postfix/smtp[19414]: warning: SASL authentication failure: No worthy mechs found
Sep 26 14:13:45 bubba postfix/smtp[19414]: F1F742420221: to=<peter.tuson@btinternet.com>, relay=mail.btinternet.com[217.146.188.192], delay=1, status=deferred (Authentication failed: cannot SASL authenticate to server mail.btinternet.com[217.146.188.192]: no mechanism available)

postfix is configured with:
relayhost = [mail.btinternet.com]
smtp_sasl_auth_enable=yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

My sasl_passwd has the entry like
[mail.btinternet.com] myusername@btinternet.com:mypassword

This was more or less as it was set up through bubba's web interface. Does anyone have any ideas on how to fix it?

Eek · Post by **Eek** » 26 Sep 2008, 10:40

did you hash the password file?
cheers
Eek

PeterTuson · Post by **PeterTuson** » 26 Sep 2008, 12:12

Yes I do hash the password file with

postmap /etc/postfix/sasl_password

Eek · Post by **Eek** » 26 Sep 2008, 13:04

did you see this post?
http://forum.excito.net//viewtopic.php?t=1160
cheers
Eek

PeterTuson · Post by **PeterTuson** » 27 Sep 2008, 07:53

Eek thanks for your prompt.

smtp_sasl_security_options was set to noplaintext and noanonymous. Now set to JUST noanonymous.

Log now says:

relay=mail.btinternet.com[217.146.188.192], delay=77814, status=bounced (host mail.btinternet.com[217.146.188.192] said: 553 From: address not verified; see http://help.yahoo.com/l/us/yahoo/mail/o ... om-07.html (in reply to MAIL FROM command))

Any ideas?

Fetchmail is working fine for me. I can send e-mails to my bubba server through my ISP without any problems.

PeterTuson · Post by **PeterTuson** » 27 Sep 2008, 08:31

Eek, thanks for your help.

I have now got this working by setting up an alternative identity for the person sending e-mails from the bubba server.

This identity is set to the identity that the ISP expects to see if I was using a client email tool such as evolution, i.e. username@btinternet.com.

carl · Post by **carl** » 27 Sep 2008, 11:03

PeterTuson wrote:Eek, thanks for your help.

I have now got this working by setting up an alternative identity for the person sending e-mails from the bubba server.

This identity is set to the identity that the ISP expects to see if I was using a client email tool such as evolution, i.e. username@btinternet.com.

Remember that the option "noplaintext" is for security reasons, as usually, you don't want the world to be able to see your passwords

/Carl

PeterTuson · Post by **PeterTuson** » 28 Sep 2008, 10:08

Carl,

Thanks for the advice. This is the only way I could get my ISP to authenticate SMTP. I have contacted them to see if this is correct>

PeterTuson · Post by **PeterTuson** » 28 Sep 2008, 13:11

Spoke too soon.

Unfortunately, postfix returns an unaccepted e-mail to the sender with from=<>, which is then rejected by my ISP. The log is:

Sep 27 17:24:37 bubba postfix/local[21347]: C443D2420287: to=<localuser@localhost>, relay=local, delay=1, status=bounced (data format error)
Sep 27 17:24:37 bubba postfix/cleanup[21346]: 7A0712420289: message-id=<20080927162437.7A0712420289@bubba.localdomain>
Sep 27 17:24:37 bubba postfix/qmgr[21326]: 7A0712420289: from=<>, size=3605, nrcpt=1 (queue active)
Sep 27 17:24:37 bubba postfix/qmgr[21326]: C443D2420287: removed
Sep 27 17:24:38 bubba postfix/smtp[21355]: 7A0712420289: to=<myusername@btinternet.com>, relay=mail.btinternet.com[217.146.188.192], delay=1, status=bounced (host mail.btinternet.com[217.146.188.192] said: 553 From: address not verified; see http://help.yahoo.com/l/us/yahoo/mail/o ... om-07.html (in reply to MAIL FROM command))

The "from" should actually be the local user to whom the e-mail was sent.

Any ideas?

Eek · Post by **Eek** » 28 Sep 2008, 16:23

yeah
try

Create the canonical file, which maps outgoing mail to a given email address
Code:
vi /etc/postfix/canonical

Add the following contents
Code:
eek@bubba.excito.com eek@myisp.com

you can check also
References

1. http://souptonuts.sourceforge.net/postfix_tutorial.html
2. http://www.postfix.org
3. http://forum.excito.net/viewtopic.php?p=3060
4. http://www.postfix.org/STANDARD_CONFIGU ... ml#fantasy

cheers
Eek

PeterTuson · Post by **PeterTuson** » 29 Sep 2008, 06:02

Eek,

I have tried the canonical file. It makes no difference.

With the current setup, I am able to relay emails through my ISP and receive emails from my ISP successfully.

The problem comes when an email from my ISP fails its checks and is rejected. This happens because I am post-processing the email (using .forward) and returning an error code if it cannot be processed. In this case, the from field is set to <> which fails authentication at the ISP.

I have read somewhere that postfix does this to prevent backscatter. How would I change <> to the username@isp.com that my isp would recognise?

Thanks, Peter.

Eek · Post by **Eek** » 29 Sep 2008, 06:16

the canonical file only works when the email is send
as a local user, it then rewrites it to the external email address.
what kind of post-processing are you doing?

PeterTuson · Post by **PeterTuson** » 29 Sep 2008, 06:38

I use the server to control my house - lights, curtains and appliances. It is also linked in with the security system - which monitors doors, spaces, CO, fire and water - and is about to be linked with environmental and energy sensors.

By post processing email sent to a specific user then I can command the server to carry out actions. In addition, I can get the server to email me when it detects events.

Within ~user/.forward, I use a | command to call an external shell script. This exits with a 0 to indicate success or an error code >= 1 to indicate failure. Postfix then handles the exit code. Within the script, I check that the email contents are valid and then task the server to carry out the action.

As this is carried out within a specific user space so I would expect Postfix to flag failure return as from the user.

Correctly formatted emails do get the server to issues the correct actions. Also the script does detect problems and return error codes. Postfix picks up the error code, e.g. data format error in the previous log but fails to pick up the from field.

PeterTuson · Post by **PeterTuson** » 30 Sep 2008, 09:01

I have found a fix to this now.

I still have postfix successfully delivering post to the local user, which is then processed according to the .forward file. This worked well before.

Now, as a result of processing the email, I send a specific email back to the sender indicating success or the identified error. I am then able to specify the 'from' parameter using sendmail such that it is authenticated by my ISP. Now the .forward processing always exits with a success code (0) such that postfix does not have to bounce the email back to the sender.

I can provide the processing code if anyone is interested.

Peter.