Connection problems smtps ports 465 and 587 - Carbonio General

RE: Connection problems smtps ports 465 and 587

cisco72 — Tue, 06 Aug 2024 05:39:24 +0000

Hello everyone, I also have the same problem, I'm testing the latest version 24.7.0, installed everything without problem, installed the certificates via Letsencrypt, from Web interface and mobile app everything works perfectly but I can't send emails via SMTP from clients like Thunderbird or Outlook, receiving IMAP works perfectly. Has anyone solved it?

RE: Connection problems smtps ports 465 and 587

Kris — Mon, 15 May 2023 13:24:00 +0000

Posted by: @a-luciano

Hello, I found why we have this behavior and how to fix it.
Zextras developers introduce in the code directive on MTA side reject_sender_login_mismath

so to solve it you can go here /opt/zextras/conf/zmconfigd/smtpd_sender_restrictions.cf and delete reject_sender_login_mismath.
%%exact VAR:zimbraMtaSmtpdSenderRestrictions reject_authenticated_sender_login_mismatch%%
%%contains VAR:zimbraMtaSmtpdSenderRestrictions check_sender_access lmdb:/opt/zextras/conf/postfix_reject_sender%%
%%contains VAR:zimbraServiceEnabled cbpolicyd^ check_policy_service inet:localhost:%%zimbraCBPolicydBindPort%%%%
%%contains VAR:zimbraServiceEnabled amavis^ check_sender_access regexp:/opt/zextras/common/conf/tag_as_originating.re%%
permit_mynetworks
permit_sasl_authenticated
permit_tls_clientcerts
%%contains VAR:zimbraServiceEnabled amavis^ check_sender_access regexp:/opt/zextras/common/conf/tag_as_foreign.re%%
Here the discussion on github https://github.com/Zextras/carbonio-mta/pull/2 where I have already reported what I found.

I am sorry that the developers have not properly checked the behavior after this change and also that they have not written on the forum.

did as described, does not send mail through scripts, there is no connection with the server, the kernel is 23.4.0 latest
there was also a jamb that without an ssl certificate, mail through an external application did not send at all, is there any other solution?

RE: Connection problems smtps ports 465 and 587

Yuriy — Wed, 26 Apr 2023 07:15:06 +0000

@a-luciano It's not entirely safe. Server users get the opportunity to send mail with any email sender. Let's take for example. The user will correct his sender's email in the letter to the boss's email and write whatever he wants. You can also change the email of another domain, gmail.com for example.

RE: Connection problems smtps ports 465 and 587

a.luciano — Tue, 25 Apr 2023 08:43:00 +0000

Hello, I found why we have this behavior and how to fix it.
Zextras developers introduce in the code directive on MTA side reject_sender_login_mismath

so to solve it you can go here /opt/zextras/conf/zmconfigd/smtpd_sender_restrictions.cf and delete reject_sender_login_mismath.

%%exact VAR:zimbraMtaSmtpdSenderRestrictions reject_authenticated_sender_login_mismatch%%
%%contains VAR:zimbraMtaSmtpdSenderRestrictions check_sender_access lmdb:/opt/zextras/conf/postfix_reject_sender%%
%%contains VAR:zimbraServiceEnabled cbpolicyd^ check_policy_service inet:localhost:%%zimbraCBPolicydBindPort%%%%
%%contains VAR:zimbraServiceEnabled amavis^ check_sender_access regexp:/opt/zextras/common/conf/tag_as_originating.re%%
permit_mynetworks
permit_sasl_authenticated
permit_tls_clientcerts
%%contains VAR:zimbraServiceEnabled amavis^ check_sender_access regexp:/opt/zextras/common/conf/tag_as_foreign.re%%

Here the discussion on github https://github.com/Zextras/carbonio-mta/pull/2 where I have already reported what I found.

I am sorry that the developers have not properly checked the behavior after this change and also that they have not written on the forum.

RE: Connection problems smtps ports 465 and 587

Yuriy — Tue, 25 Apr 2023 04:59:05 +0000

Viewed the logs on the server. There are the following entries:

Apr 21 12:25:39 pm mail postfix/submission/smtpd: connect from unknown
Apr 21 12:25:39 mail postfix/submission/smtpd: Anonymous TLS connection established from unknown: TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Apr 21 12:25:39 PM mail saslauthd: zmauth: authenticating against elected url 'https://mail.example.com:7071/service/admin/soap/' ...
Apr 21 12:25:39 pm mail slapd: slap_get_csn: conn=1022 op=120594 generated new csn=20230421072539.913386Z#000000#000#000000 manage=1
Apr 21 12:25:39 pm
Apr 21 12:25:39 pm mail slapd: slap_graduate_commit_csn: removing 0x7f000ca0d940 20230421072539.913386Z#000000#000#000000
Apr 21 12:25:39 pm mail saslauthd: zmpost: url='https://mail.example.com:7071/service/admin/soap/' returned buffer->data=' 0_c99544f49719978a71e4141f43f22b82ed24d86a_69643d33363a39613561626233652d3366376642d3461 636235623333339383661363b6578703d31333a313638323233343733393931323b747970653d363a7a696d6272613b753d313a613b7469643d393a313135Token3 time>172799996', hti->error=''
Apr 21 12:25:39 pm mail saslauthd: auth_zimbra: tech@example.com auth OK
Apr 21 12:25:39 PM mail postfix/submission/smtpd: NOQUEUE: filter: RCPT from unknown: : Sender address triggers FILTER smtp-amavis::10026; from= to= proto=ESMTP helo=
Apr 21 12:25:39 PM mail postfix/submission/smtpd: NOQUEUE: reject: RCPT from unknown: 553 5.7.1 : Sender address rejected: not owned by user tech@example.com from= to= proto=ESMTP helo=
Apr 21 12:25:39 mail postfix/submission/smtpd: lost connection after DATA from unknown

On the client in the logs (Client is a website):

user = tech@example.com from = tech@example.com
Apr 21 12:25:40 host=10.130.29.26 tls=on auth=on user=tech@example.com from=tech@example.com recipients=test-03hsjo9ky@srv1.mail-tester.com smtpstatus=553 smtpmsg= '553 5.7.1 : Sender address rejected: not owned by user tech@example.com' errormsg='recipient address test-03hsjo9ky@srv1.mail-tester.com not accepted by the server' exitcode =EX_DATAERR

More log entries from the server (already another client, the mozilla thunderbird client):

Apr 21 15:06:53 mail saslauthd: zmauth: authenticating against elected url 'https://mail.example.com:7071/service/admin/soap/' ...
Apr 21 15:06:53 mail slapd: slap_get_csn: conn=1013 op=121114 generated new csn=20230421100653.640789Z#000000#000#000000 manage=1
Apr 21 15:06:53 mail slapd: slap_queue_csn: queuing 0x7f0007e0d180 20230421100653.640789Z#000000#000#000000
Apr 21 15:06:53 mail slapd: slap_graduate_commit_csn: removing 0x7f0007e0d180 20230421100653.640789Z#000000#000#000000
Apr 21 15:06:53 mail saslauthd: zmpost: url='https://mail.example.com:7071/service/admin/soap/' returned buffer->data=' 0_43ad377d2a3f44852961d5ed8b81e9d67ac0829d_69643d33363a62316435353234332d3237664302d2338646 646666313535396561353b6578703d31333a313638323234343431333633393b747970653d363a7a696d6272613b753d313a613b7469643d31303a333bau3634 >172799996', hti->error=''
Apr 21 15:06:53 mail saslauthd: auth_zimbra: gpetrushel@example.com auth OK
Apr 21 15:06:53 mail postfix/smtps/smtpd: NOQUEUE: filter: RCPT from unknown: : Sender address triggers FILTER smtp-amavis::10026; from= to= proto=ESMTP helo=<>
Apr 21 15:06:53 mail postfix/smtps/smtpd: NOQUEUE: reject: RCPT from unknown: 553 5.7.1 : Sender address rejected: not owned by user gpetrushel@example.com; from= to= proto=ESMTP helo=<>
Apr 21 15:06:53 mail postfix/smtps/smtpd: lost connection after RCPT from unknown

When connecting to a VPN server, no proxy is used. Firewall set up correctly access to 465, 587 ports is open.

RE: Connection problems smtps ports 465 and 587

Yarii — Mon, 24 Apr 2023 20:26:21 +0000

Hello,

I have the same problem too.

>>3) I know that delving into log files might be not the most pleasant of the tasks, but did you find some relevant error message?

When i send mail from any mail application or mailer-script in logs I see:

Apr 24 23:12:28 qmail postfix/submission/smtpd: NOQUEUE: filter: RCPT from unknown: : Sender address triggers FILTER smtp-amavis::10026; from= to= proto=ESMTP helo=
Apr 24 23:12:28 qmail postfix/submission/smtpd: NOQUEUE: reject: RCPT from unknown: 553 5.7.1 : Sender address rejected: not owned by user test1@samedomain.com; from= to= proto=ESMTP helo=

From web-interface sending mail works ok. Issue started after the upgrade on 23.3.0.

Carbonio Release 23.4.0

Server versions:

version 23.4.0
commit 37b6a20c4877f579a027d479560d9717596ed512
system_type carbonio
product Carbonio
zal_version 3.21.0
zal_commit 050d0cc2e00e924c9286706b1a7ea6d6687ce926

RE: Connection problems smtps ports 465 and 587

Yuriy — Mon, 24 Apr 2023 05:35:55 +0000

I have the same problem on my server. Some clients do not send mail. In the server and client logs "Sender address rejected: not owned by user". The username and email of the sender match. I enabled the user to send mail from any address, but this did not solve the problem.

RE: Connection problems smtps ports 465 and 587

a.luciano — Fri, 21 Apr 2023 18:02:06 +0000

Today I decided to do another test to exclude possible configuration error or issue caused by the upgrade. I installed from scratch new carbonio servers in a multi server scenario without applying customization on security’s settings etc and unfortunately the issue still present.

RE: Connection problems smtps ports 465 and 587

a.luciano — Thu, 20 Apr 2023 19:48:32 +0000

Hello Stefano,

let me try to answer you point by point:

1) This issue is visible only on the external application and is normal because the webmail talk internally with all the Carbonio component and probably this check is skipped because are part of MtaNetwork.

2) The application are Outlook, thunderbird, telnet etc etc. From Outlook I see the error message 503 5.5.1 Error: authentication not enabled. but this is an answer from Carbonio server and not an error in the application Outlook.

3) this are the log form Carbonio (of course I obscured sensible data):

Apr 20 21:09:56 mta01 postfix/submission/smtpd[1851091 Anonymous TLS connection established from xxxxxx: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Apr 20 21:09:56 mta01 postfix/submission/smtpd[1851091 Anonymous TLS connection established from xxxxxx: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Apr 20 21:09:57 mta01 saslauthd: zmauth: authenticating against elected url 'https://xxxxxxxx.xxxxx.xx:7071/service/admin/soap/' ...
Apr 20 21:09:57 mta01 saslauthd: zmpost: url='https://xxxxxxxx.xxxxx.xx:7071/service/admin/soap/' returned buffer->data='0000000000000000000000000000000000000000172799993', hti->error=''
Apr 20 21:09:57 mta01 postfix/submission/smtpd[1851091 NOQUEUE: filter: RCPT from https://xxxxxxxx.xxxxx.xx: : Sender address triggers FILTER smtp-amavis::10026; from= to= proto=ESMTP helo=
Apr 20 21:09:57 mta01 saslauthd: auth_zimbra: test@xxxx.xx auth OK
Apr 20 21:09:57 mta01 postfix/submission/smtpd[1851091 NOQUEUE: filter: RCPT from xxxxxx: : Sender address triggers FILTER smtp-amavis::10026; from= to= proto=ESMTP helo=
Apr 20 21:09:57 mta01 postfix/submission/smtpd[1851091 NOQUEUE: reject: RCPT from xxxxxx: 553 5.7.1 : Sender address rejected: not owned by user test@xxxx.xx; from= to= proto=ESMTP helo=
Apr 20 21:09:57 mta01 postfix/submission/smtpd[1851091 NOQUEUE: reject: RCPT from xxxxxx: 553 5.7.1 : Sender address rejected: not owned by user test@xxxx.xx; from= to= proto=ESMTP helo=
Apr 20 21:09:57 mta01 postfix/submission/smtpd[1851091 disconnect from xxxxxx ehlo=2 starttls=1 auth=1 mail=1 rcpt=0/1 quit=1 commands=6/7
Apr 20 21:09:57 mta01 postfix/submission/smtpd[1851091 disconnect from xxxxxx ehlo=2 starttls=1 auth=1 mail=1 rcpt=0/1 quit=1 commands=6/7

4) No, any of these component are interfering with Carbonio.

Let me add one thing, If I use outlook and in the configuration instead to use public IP I'm using private IP because I'm inside the local network of Carbonio (similar scenario to the webmail) the error does not appear and the sending goes smoothly.

Carbionio is installed on Rocky Linux release 8.7 (Green Obsidian) and Carbonio version is 23.4.0 but the issue started after the upgrade on 23.3.0
Now I hope all these details can help to investigate on this problem.

RE: Connection problems smtps ports 465 and 587

stefanodavid — Thu, 20 Apr 2023 10:19:18 +0000

Hi there, sorry for the late reply!

I understand that this problem is relevant to most of you, but I would like to ask for some more information, as :

1) Is this problem limited using external application? In other words, does email sending from Carbonio mobile apps work? I give for granted that sending emails from Carbonio's IRIS interface works smoothly.

2) can you name a few of these external applications? Do log files of these applications (if available) mention any error/warning?

3) I know that delving into log files might be not the most pleasant of the tasks, but did you find some relevant error message?

4) Do you use some authentication/VPN/proxy/firewall/whatever that may interfere with normal Carbonio's working?