Sendmail - Relaying denied. Proper authentication required.

mfoley · 02-02-2017, 11:20 PM

I'm getting the relaying denied message on my mail server and I don't know why. /etc/mail/access has:

192.168.0. RELAY

Other hosts on this network use the mail server myserver.com as the smart host and have no problem. I'm trying to send from Thunderbird on a host on the same LAN. What's wrong?

Code:

Feb  3 00:00:37 server sm-mta[4549]: v1350Zcc004549: ruleset=check_rcpt, arg1=<touser@dom.org>, relay=router.asus.com [192.168.0.1], reject=550 5.7.1 <touser@dom.org>... Relaying denied. Proper authentication required.
Feb  3 00:00:47 server sm-mta[4549]: v1350Zcc004549: from=<me@myserver.com>, size=2425, class=0, nrcpts=0, bodytype=8BITMIME, proto=ESMTP, daemon=MTA, relay=router.asus.com [192.168.0.1]

.mc file:

Code:

nclude(`../m4/cf.m4')
VERSIONID(`$Id: server.mc,v 1.9 2016/10/22 15:33:00 root Exp $')dnl
OSTYPE(`linux')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`SMART_HOST',`mail.twc.com')dnl
define(`confTO_IDENT', `0')dnl
define(`confBAD_RCPT_THROTTLE',`1')dnl
define(`confCONNECTION_RATE_THROTTLE',`3')dnl
define(`confDEAD_LETTER_DROP',`/dev/null')dnl
define(`confDOUBLE_BOUNCE_ADDRESS',`nobody')dnl
define(`confDF_BUFFER_SIZE',`16384')dnl
define(`confXF_BUFFER_SIZE',`16384')dnl
FEATURE(`authinfo',`hash -o /etc/mail/authinfo.db')dnl
FEATURE(`use_cw_file')dnl
FEATURE(`use_ct_file')dnl
FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
FEATURE(`access_db', `hash -T<TMPF> /etc/mail/access')dnl
FEATURE(`lookupdotdomain')dnl
FEATURE(`blacklist_recipients')dnl
FEATURE(`dnsbl', `bl.spamcop.net')dnl
FEATURE(`delay_checks',`friend',`n')dnl 
FEATURE(`local_procmail',`',`procmail -t -Y -a $h -d $u')dnl
FEATURE(`always_add_domain')dnl
FEATURE(`redirect')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_OPTIONS', `A y')dnl
define(`confCACERT_PATH', `/etc/mail/certs/')dnl
define(`confCACERT',`/etc/mail/certs/root.cer')dnl
define(`confSERVER_CERT',`/etc/mail/certs/cert.pem')dnl
define(`confSERVER_KEY',`/etc/mail/certs/privkey.pem')dnl
define(`confCLIENT_CERT',`/etc/mail/certs/cert.pem')dnl
define(`confCLIENT_KEY',`/etc/mail/certs/privkey.pem')dnl
INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamass.sock, F=,T=C:15m;S:4m;R:4m;E:10m')dnl
define(`confMILTER_MACROS_CONNECT',`t, b, j, _, {daemon_name}, {if_name}, {if_addr}')dnl
define(`confMILTER_MACROS_HELO',`s,{tls_version},{cipher},{cipher_bits},{cert_subject},{cert_issuer}')dnl
define(`confMILTER_MACROS_ENVRCPT',`r, v, Z')dnl[12]
MASQUERADE_AS(`novatec-inc.com')dnl
MASQUERADE_EXCEPTION(`mercureytech.com')dnl
EXPOSED_USER(`root')dnl
LOCAL_DOMAIN(`localhost.localdomain')dnl
MAILER(local)dnl
MAILER(smtp)dnl
MAILER(procmail)dnl

mfoley · 02-03-2017, 07:47 AM

more info ...

I had the Thunderbird client set to no authentication; that's when I got the error posted. When I set it to Normal password, it worked. When I set it to encrypted password it did not.

The Tbird clients at the office (different server/LAN) are set to no authenticate and they work. Can someone tell me what in my .mc file is requiring authentication on this server? I don't see what option is requiring this. Both .mc files look essentially the same except for minor details like timeout, buffer size, etc. The server in question does have the additional

FEATURE(`authinfo',`hash -o /etc/mail/authinfo.db')dnl

but I believe this is only used for authentication to the ISP's SMART_HOST and in any case authinfo does not have users' passwords.

jayjwa · 02-11-2017, 10:32 PM

Smarthost with authinfo and access.db is two different things. Remember, Sendmail can have two access files, sendmail.cf and submit.cf (from the *.mc or *.m4 files) so check there. I thought relaying was more like

Code:

Connect:192.168.0     RELAY

in your /etc/mail/access.db, or hosts in /etc/mail/relay-domains, but I've not done much with it so I can't suggest more than these few things to check into. Also, I know it's long, but /etc/mail/cf/README (starts with "SENDMAIL CONFIGURATION FILES", may be in another location on your system) has alot of info on doing what you're trying to do.

mfoley · 02-22-2017, 01:31 PM

I'm back. Based on web advice, I had created /etc/mail/authinfo file as follows:

Code:

AuthInfo:twc.com "U:myId@twc.com" "P:mypass" "M:PLAIN"
AuthInfo: "U:myId@twc.com" "mypass" "M:PLAIN"

and added:

Code:

define(`SMART_HOST',`mail.twc.com')dnl
FEATURE(`authinfo',`hash -o /etc/mail/authinfo.db')dnl

to my sendmail.mc file. That appeared to work for over a month, but for the past few days I have been unable to send outgoing mail. I get bounced back with:

Code:

The original message was received at Wed, 22 Feb 2017 12:16:17 -0500
from localhost [127.0.0.1]

   ----- The following addresses had permanent fatal errors -----
<mpress@somedom.org>
    (reason: 550 Outbound mail refused - See http://www.timewarnercable.com/en/residential-home/support/topics/internet/email-setup.html [R0109004])

   ----- Transcript of session follows -----
... while talking to mail.twc.com:
<<< 550 Outbound mail refused - See http://www.timewarnercable.com/en/residential-home/support/topics/internet/email-setup.html [R0109004]
554 5.0.0 Service unavailable

Although interestingly, I tried a one-off message to this same address late last night and it inexplicably worked. I thought the problem was fixed, but no. I cannot send any messages today.

On the referenced website it has:

Code:

Outgoing Mail Server (SMTP): mail.twc.com
Outgoing Server – SMTP port: 587
Inbound & Outbound User Name: Enter full email address, for example:

johndoe@[division].rr.com
johndoe@roadrunner.com
johndoe@twc.com

Inbound & Outbound Password: Email Password (same as Web Mail)
SMTP Server Requires Authentication: Checked

The only thing I can see that might be an issue is their specifying SMTP port 587. Perhaps I should try having sendmail connect to that port explicitly. I can possibly do this in iptables, but is there a way to tell sendmail which port to use instead of defaulting to 25? Before calling the TimeWarner help desk, I'd like to first make sure I'm in complete conformity with their connection requirements.

jayjwa · 02-23-2017, 04:11 PM

You have the same provider as I. Here's what I have (since people using Spamhaus end up blocking me without this, but that's a rage for another day):

Code:

define(`SMART_HOST',`mail.twc.com')dnl
FEATURE(`authinfo',`hash /etc/mail/authinfo')dnl


AuthInfo:mail.twc.com "U:smmsp" "I:jayjwa" "P:th3p4ssw0rd"

You did make the text version of files into the DB versions, correct (authinfo into authinfo.db, etc)? I don't use the 587 port (FEATURE(`no_default_msa')dnl).

Here's my files, to compare; you'll have to fit them into your system.

/etc/mail/vdrl-smtp.m4 (makes sendmail.cf via m4):

Code:

dnl ## Sendmail Configuration File
dnl ## for internal host vdrl 
dnl ##
dnl ## ----------------------------------------------------------------------------------------------

include(`/etc/mail/cf/m4/cf.m4')
VERSIONID(`vdrl-smtp.m4, v8.15.2 root')dnl
OSTYPE(`linux')dnl
DOMAIN(`generic')dnl

define(`confDONT_BLAME_SENDMAIL',`GroupReadableKeyFile')dnl
define(`STATUS_FILE',`/etc/mail/statistics')dnl

dnl # Logging level. 8 is about normal, 10 and higher show each step
define(`confLOG_LEVEL',`10')dnl
define(`confTRY_NULL_MX_LIST',`true')dnl
define(`confCACERT_PATH', `/etc/ssl/certs')dnl
define(`confCACERT', `/etc/ssl/CA/atr2-ca-crt.pem')dnl
define(`confSERVER_CERT', `/etc/mail/vdrl-smtp-srv-crt.pem')dnl
define(`confSERVER_KEY', `/etc/mail/vdrl-smtp-srv-key.pem')dnl
define(`confCLIENT_CERT', `/etc/mail/vdrl-smtp-client-crt.pem')dnl
define(`confCLIENT_KEY', `/etc/mail/vdrl-smtp-client-key.pem')dnl
define(`confCRL',`/etc/ssl/revolk/crl-bundle.pem')dnl
define(`confPRIVACY_FLAGS', `authwarnings,needmailhelo,novrfy,noexpn,restrictqrun,restrictmailq')dnl
define(`confHOST_STATUS_DIRECTORY', `.hoststat')dnl
define(`confBAD_RCPT_THROTTLE',`2')dnl
define(`confMAX_MESSAGE_SIZE',`50000000')dnl
define(`confTO_IDENT',`6')dnl
define(`confCONNECTION_RATE_WINDOW_SIZE',`60s')dnl

dnl # To use TWC's SMTP server as smarthost
define(`SMART_HOST',`mail.twc.com')dnl
FEATURE(`authinfo',`hash /etc/mail/authinfo')dnl

DAEMON_OPTIONS(`Port=smtp,Name=MTA,Family=inet6')dnl

dnl # The follow is to use the milter-regex mail filtering system/libmilter
dnl # INPUT_MAIL_FILTER(`milter-regex', `S=unix:/var/spool/milter-regex/socket, T=S:30s;R:2m')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
FEATURE(`no_default_msa')dnl
FEATURE(`use_cw_file')dnl
FEATURE(`use_ct_file')dnl
FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
FEATURE(`access_db', `hash -T<TMPF> /etc/mail/access')dnl
FEATURE(`blacklist_recipients')dnl
FEATURE(`ratecontrol')dnl
FEATURE(`greet_pause')dnl
FEATURE(`local_procmail',`',`procmail -t -f- -a $h -d $u')dnl
FEATURE(`always_add_domain')dnl
FEATURE(`redirect')dnl
FEATURE(`uucpdomain')dnl

MAILER(local)dnl
MAILER(smtp)dnl
MAILER(uucp)dnl
MAILER(procmail)dnl

I probably misused smrsh. Sorry.

vdrl-submit.m4 for for submit.cf via m4:

Code:

dnl ## Sendmail Submit Config file
dnl ## vdrl-submit.m4 
dnl ##
dnl ## This file controls how Sendmail works when mail is 
dnl ## being *submitted*, as is the case when you *send* a 
dnl ## piece of email. Note that this is different than the 
dnl ## Sendmail that runs as a daemon/handles the Queue.
dnl ##
dnl ## ------------------------------------------------------------  

include(`/etc/mail/cf/m4/cf.m4')dnl
VERSIONID(`vdrl-submit.m4,v 8.15.2 root')dnl

define(`confDONT_BLAME_SENDMAIL',`GroupReadableKeyFile')dnl
define(`confCF_VERSION', `Submit')dnl
define(`__OSTYPE__',`')dnl 
define(`confTIME_ZONE', `USE_TZ')dnl
define(`confDONT_INIT_GROUPS',`True')dnl
define(`confTRY_NULL_MX_LIST',`True')dnl
define(`confQUEUE_LA',`5')dnl
define(`confREFUSE_LA',`10')dnl
define(`confCACERT_PATH', `/etc/ssl/certs')dnl
define(`confCACERT', `/etc/ssl/CA/atr2-ca-crt.pem')dnl
define(`confSERVER_CERT', `/etc/mail/vdrl-smtp-srv-crt.pem')dnl
define(`confSERVER_KEY', `/etc/mail/vdrl-smtp-srv-key.pem')dnl
define(`confCLIENT_CERT',`/etc/mail/vdrl-smtp-client-crt.pem')dnl
define(`confCLIENT_KEY',`/etc/mail/vdrl-smtp-client-key.pem')dnl
define(`confCRL',`/etc/ssl/revolk/crl-bundle.pem')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun,restrictmailq')dnl 
FEATURE(`msp',`[127.0.0.1]')dnl