QUIRK Sendmail AUTH SMTP problems

[DoubleDriveLine]

Well I am heading down this twisted road of trying to get sendmail on the PBX to function with my email server. I have tried it about 4 other times and always given up and gone down the ssmtp route. Like Bullwinkle and Rocky "This time I know you will get it for sure!"

I am closer than I have been before. I am finally sending the email as the right account but not getting authenticated.

I have followed the instructions here http://nerdvittles.com/?p=31290 and used the sendmail.mc.gmail file but modified it to use my server as the smarthost.

I had to deviate slightly to get the system to transmit the correct email address to the server as the sending email. In genericstable I had to add the below code.
This changes the sending email address from [email protected] to example1@mypersonalDomain. Naturally the email server does not like the root account because it is not present.

root    [email protected]

After that bit of code makemap has to be run again on the genericstable file.

makemap -r hash genericstable.db < genericstable

In the sendmail.mc file Here are the only mofifications I have made that deviate from the tutorial.

define(`SMART_HOST', `mail.mypersonalDomain.something')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
MASQUERADE_DOMAIN(mypersonalDomain.something)dnl

The code in my client-info file is as follows. Initially I had the I: value as the full email address. Then when double checking everything before I go to post this I found Ward's wording "# Replace user_id with your gMail account name without @gmail.com". I had missed the @domain name and am not sure if for me it is necessary or not. I have tried it both ways.

AuthInfo:mail.mypersonalDomain.something "U:smmsp" "I:[email protected]" "P:{password cleared}" "M:PLAIN"
AuthInfo:mail.mypersonalDomain.something:587 "U:smmsp" "I:[email protected]" "P:{password cleared}" "M:PLAIN"
AuthInfo:mail.mypersonalDomain.something:465 "U:smmsp" "I:[email protected]" "P:{password cleared}" "M:PLAIN"
AuthInfo:mail.mypersonalDomain.something: "U:root" "I:example1" "P:{password cleared}" "M:PLAIN"
AuthInfo:mail.mypersonalDomain.something:587 "U:root" "I:example1" "P:{password cleared}" "M:PLAIN"
AuthInfo:mail.mypersonalDomain.something:465 "U:root" "I:example1" "P:{password cleared}" "M:PLAIN"

For referance the server name is pbx2020.mypersonalDomain.something and has been added to the hostname and hosts file. The server is virtual Centos 7 running in VMWare at my site.

Here is the maillog entry from a test email sent from the command line while logged in as root

root@pbx2020:~ $ tail -f /var/log/maillog

Sep 18 08:25:07 pbx2020 sendmail[29192]: 08ICOqDh029192: from=root, size=81, class=0, nrcpts=1, msgid=<[email protected]>, relay=root@localhost
Sep 18 08:25:08 pbx2020 sendmail[29192]: STARTTLS=client, relay=mypersonalDomain.something., version=TLSv1/SSLv3, verify=FAIL, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256/256
Sep 18 08:25:08 pbx2020 sendmail[29192]: 08ICOqDh029192: [email protected], ctladdr=root (0/0), delay=00:00:16, xdelay=00:00:01, mailer=relay, pri=30081, relay=mypersonalDomain.something. [IPAddress], dsn=5.1.1, stat=User unknown

This is the typical server error message in the /var/log/exim_rejectlog file

2020-09-17 21:08:52 H=3.sub-174-x-x.x [IPAddress] (pbx2020.mypersonalDomain.something) [IPAddress]:6359 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<[email protected]> rejected RCPT <[email protected]>: SMTP AUTH is required for message submission on port 587

I send the test message using the sendmail command. The issue seems to be I am never sending the log on credentials. They should be sent after the marker below. Here is a link to a working example. https://access.redhat.com/solutions/60803 scroll down to this section "To test the authentication, send an email to remote MTA using following command:".

Any help is greatly appreciated.

I have pretty much run out of ideas and again spent way too much time on sendmail.

root@pbx2020:/etc/mail/auth $ sendmail -Am -v -t
To: [email protected]
From: root
Subject: Test Message
Body of the message
[email protected]... Connecting to mypersonalDomain.something. port 587 via relay...
220-server1.hostingServer ESMTP Exim 4.93 #2 Fri, 18 Sep 2020 08:22:00 -0400
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.
>>> EHLO pbx2020.mypersonalDomain.something
250-server1.hostingServer Hello 3.sub-174-x-x.x [IPAddress]
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-STARTTLS
250 HELP
>>> STARTTLS
220 TLS go ahead
>>> EHLO pbx2020.mypersonalDomain.something
250-server1.hostingServer Hello 3.sub-174-x-x.x [IPAddress]
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-AUTH PLAIN LOGIN
250 HELP #<---- After this there should be the log in credentials but they never show up. The Server goes straight to sending the email.
>>> MAIL From:<[email protected]> SIZE=81
250 OK
>>> RCPT To:<[email protected]>
>>> DATA
550 SMTP AUTH is required for message submission on port 587
/root/dead.letter... Saved message in /root/dead.letter
Closing connection to mypersonalDomain.something.
WARNING: Always run Incredible PBX behind a secure firewall.

For reference here is the response from the server when using the openssl test.

root@pbx2020:/etc/pam.d $ openssl s_client -connect mail.mypersonalDomain.something:587 -starttls smtp
CONNECTED(00000003)
depth=3 C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
verify return:1
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify return:1
depth=1 C = US, ST = TX, L = Houston, O = "cPanel, Inc.", CN = "cPanel, Inc. Certification Authority"
verify return:1
depth=0 CN = server1.hostingServer
verify return:1
---
Certificate chain
0 s:/CN=server1.hostingServer
   i:/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
1 s:/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
---
Server certificate
-----BEGIN CERTIFICATE-----
{...SNIP}
-----END CERTIFICATE-----
subject=/CN=server1.hostingServer
issuer=/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5348 bytes and written 450 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: {...SNIP}
    Session-ID-ctx:
    Master-Key: {...SNIP}
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1600426978
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
250 HELP
EHLO pbx2020.mypersonalDomain.something
250-server1.hostingServer Hello 3.sub-174-x-x.x [IPAddress]
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-AUTH PLAIN LOGIN
250 HELP
^C
WARNING: Always run Incredible PBX behind a secure firewall.

 

[DoubleDriveLine]

We can put this one back into the failed column but not necessarily from the sendmail side. After searching the web and testing different configuration changes I just could not get it to authenticate. My server is a cPanel server and one of the posts I found also had the same issue. When trying to authenticate sendmail to the cpanel server it would not authenticate. With the same settings in sendmail but pointed to a different smarthost sendmail sent the authentication.

I tested and came to the same conclusion. I installed Postfix on my OPNsense router and changed the smarthost on the PBX to point to my router. I sent the test email from the PBX and watched it run through all of the authentication methods without missing a beat. Naturally it failed to authenticate because postfix was not configured with email addresses and no smarthost relay. I then setup Postfix to send mail to my cPanel server as the smarthost and it works. I did have to remove the graylisting from the email address as the server was blocking the email.

Searching the original error message I found a lot of results but they all suggested the same fix. Removing authentication from cPanel.

The final fix was to setup sendmail to use port 25 and no authentication to my router. The router is setup with only 1 address (the PBX) that is allowed to send mail. It uses TLS to my cPanel server.

 

[wardmundy]

cPanel does lots of stuff behind the scenes so I wouldn't put all the blame on SendMail for this one.