Adding Postfix SMTP server credentials (sasl?)

Stuffe · 01-03-2015, 04:31 PM

So I am kind of a Linux newbie, but finally managed to set up a postfix server that I can send from locally and doesn't get caught in various spam filters. But now I want to be able to use it as an alias from my gmail account and Gmail asks for SMTP credentials. I searched a lot and didn't find any good answers how to set this up and it doesn't help that when you search for postfix smtp relay 95% of the results are how you use postfix with an external smtp server, which is the wrong way around.

Now I found this guide and through it I enabled the SMTP relay function and I verified that it is listening, but I just don't know how to add credentials. I read it uses something called sasl, is there a general way to add credentials to that?

descendant_command · 01-03-2015, 04:42 PM

http://www.postfix.org/SASL_README.html

Stuffe · 01-03-2015, 05:33 PM

Quote:

Originally Posted by descendant_command

http://www.postfix.org/SASL_README.html

Thanks, that is actually one of the many documents I had already skimmed through, but on closer inspection there was a lot I had missed (expected it would be trivial to add credentials, like adding it to some file). But I have now installed Cyrus sasl, which is default for postfix, started sasl in /etc/shadow mode, have added both the root user, the user I want to login with and the postfix user to the sasl group and tested with testsaslauthd that the credentials work. Still I see in the postfix logs that google cant authenticate... Not sure what I have missed :/

descendant_command · 01-03-2015, 06:23 PM

Quote:

Originally Posted by Stuffe

Not sure what I have missed :/

Posting any *actual* evidence, so anyone can reply with something more sensible than "that's nice, dear..."

Stuffe · 01-03-2015, 06:36 PM

Quote:

Originally Posted by descendant_command

Posting any *actual* evidence, so anyone can reply with something more sensible than "that's nice, dear..."

I am not sure what else to add but the postfix log.

Code:

$ nano /var/log/mail.log
...
Jan  4 00:23:43 smartstash postfix/smtpd[18712]: connect from mail-ig0-f172.google.com[209.85.213.172]
Jan  4 00:23:43 smartstash postfix/smtpd[18712]: warning: SASL authentication failure: Password verification failed
Jan  4 00:23:43 smartstash postfix/smtpd[18712]: warning: mail-ig0-f172.google.com[209.85.213.172]: SASL PLAIN authentication failed: authentication failure
Jan  4 00:23:43 smartstash postfix/smtpd[18712]: lost connection after AUTH from mail-ig0-f172.google.com[209.85.213.172]
Jan  4 00:23:43 smartstash postfix/smtpd[18712]: disconnect from mail-ig0-f172.google.com[209.85.213.172]
Jan  4 00:27:04 smartstash postfix/anvil[18715]: statistics: max connection rate 1/60s for (smtp:209.85.213.172) at Jan  4 00:23:43
Jan  4 00:27:04 smartstash postfix/anvil[18715]: statistics: max connection count 1 for (smtp:209.85.213.172) at Jan  4 00:23:43
Jan  4 00:27:04 smartstash postfix/anvil[18715]: statistics: max cache size 1 at Jan  4 00:23:43

I conclude looking at that that the authentication fails. But when I try:

Code:

$ sudo testsaslauthd -u username -p password
0: OK "Success."

I don't know where else to look for where it fails. Sorry, I am a complete Linux newb :/

descendant_command · 01-03-2015, 06:48 PM

Any way to crank up log verbosity in the cyrus sasl config? (I use dovecot)
Anything show up in /var/log/auth.log ? (or such - you haven't said your distro/version)
Can you relay from a mail client using the same / any credentials?

Stuffe · 01-03-2015, 08:16 PM

What the fuck... I just opened /var/log/auth.log and apparently IPs from China and other good places have been guessing my ssh server password wrong about every second for the last two weeks... Even if my password is strong enough that I know they will never brute force it, I guess I better set up a connection using certificates instead of credentials, if not for anything else, then just to save bandwidth.

I managed to find these lines in the mess:

Code:

Jan  4 01:49:42 smartstash sudo: smartstash : TTY=pts/27 ; PWD=/etc ; USER=root ; COMMAND=/usr/sbin/saslauthd -a shadow
Jan  4 01:49:42 smartstash sudo: pam_unix(sudo:session): session opened for user root by smartstash(uid=0)
Jan  4 01:49:42 smartstash saslauthd[21805]: detach_tty      : master pid is: 21805
Jan  4 01:49:42 smartstash saslauthd[21805]: ipc_init        : listening on socket: /var/run/saslauthd/mux
Jan  4 01:49:42 smartstash sudo: pam_unix(sudo:session): session closed for user root

My distro is Ubuntu server 14.04.

I tried to use a program called smtp test and got these results. Not sure if it is helpful at all.

Code:

$ smtptest -a username localhost
S: 220 domain.com ESMTP Postfix (Ubuntu)
C: EHLO smtptest
S: 250-domain.com
S: 250-PIPELINING
S: 250-SIZE 10240000
S: 250-VRFY
S: 250-ETRN
S: 250-STARTTLS
S: 250-AUTH DIGEST-MD5 CRAM-MD5 NTLM PLAIN LOGIN
S: 250-AUTH=DIGEST-MD5 CRAM-MD5 NTLM PLAIN LOGIN
S: 250-ENHANCEDSTATUSCODES
S: 250-8BITMIME
S: 250 DSN
C: AUTH DIGEST-MD5
S: 334 Base64 string (I cut this out)
Please enter your password: (I entered what was supposed to be correct password)
C: Base64 string (I cut this out)
S: 535 5.7.8 Error: authentication failed: authentication failure
Authentication failed. generic failure
Security strength factor: 0

The weirdest thing is that when I run:

Code:

$ testsaslauthd -u username -p password    
connect() : Permission denied
$ sudo -u postfix testsaslauthd -u username -p password
0: OK "Success."

Both the "username" and postfix users have been added to the sasl usergroup, so it seems like they should both work. And postfix is running as postfix anyway... Also I have started sasl in verbose mode, but I haven't found the log yet. I will do that tomorrow as I am so tired I can't think straight, but putting this here for now in case someone can find the problem just from this.

Stuffe · 01-04-2015, 07:22 PM

So I switched to dovecot today and it is just much simpler and it works. But how did you stop the mail from getting caught in the spam folder by gmail descendant_command?

Testing with mail-tester.com it says my spf records are in order, my messages are well formed, my IP isn't blacklisted etc. The only thing that I haven't set up is DKIM. It rates my mail 9/10, yet it gets caught in gmail spam filter. Is this DKIM really so important or am I missing something else?

Gmail says it is caught because "It's similar to messages that were detected by our spam filters.".

Example raw email with headers (sent from admin@smartstash.it to smartstash.it@gmail.com)

Code:

Delivered-To: smartstash.it@gmail.com
Received: by 10.107.48.20 with SMTP id w20csp4300820iow;
        Sun, 4 Jan 2015 17:10:29 -0800 (PST)
X-Received: by 10.194.60.19 with SMTP id d19mr168585639wjr.48.1420420229207;
        Sun, 04 Jan 2015 17:10:29 -0800 (PST)
Return-Path: <admin@smartstash.it>
Received: from smartstash.it (smartstash.it. [149.210.165.8])
        by mx.google.com with ESMTP id o3si13419579wic.59.2015.01.04.17.10.28
        for <smartstash.it@gmail.com>;
        Sun, 04 Jan 2015 17:10:28 -0800 (PST)
Received-SPF: pass (google.com: domain of admin@smartstash.it designates 149.210.165.8 as permitted sender) client-ip=149.210.165.8;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of admin@smartstash.it designates 149.210.165.8 as permitted sender) smtp.mail=admin@smartstash.it
Received: from mail-ig0-f169.google.com (mail-ig0-f169.google.com [209.85.213.169])
	(using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
	(No client certificate requested)
	by smartstash.it (Postfix) with ESMTPSA id 4EBEE1C0099
	for <smartstash.it@gmail.com>; Mon,  5 Jan 2015 02:10:14 +0100 (CET)
Received: by mail-ig0-f169.google.com with SMTP id z20so2494976igj.2
        for <smartstash.it@gmail.com>; Sun, 04 Jan 2015 17:10:26 -0800 (PST)
MIME-Version: 1.0
X-Received: by 10.42.205.197 with SMTP id fr5mr64809618icb.5.1420420226407;
 Sun, 04 Jan 2015 17:10:26 -0800 (PST)
Received: by 10.50.113.2 with HTTP; Sun, 4 Jan 2015 17:10:26 -0800 (PST)
Date: Mon, 5 Jan 2015 02:10:26 +0100
Message-ID: <CALPTFLDCi6rO_BY7u_nKTHEmURZdYT5yJ3mk0ixkx5O9FeJsNw@mail.gmail.com>
Subject: hey
From: Stefan <admin@smartstash.it>
To: smart stash <smartstash.it@gmail.com>
Content-Type: multipart/alternative; boundary=20cf303ea2de06e35b050bdd5bb5

--20cf303ea2de06e35b050bdd5bb5
Content-Type: text/plain; charset=UTF-8

test 2!

--20cf303ea2de06e35b050bdd5bb5
Content-Type: text/html; charset=UTF-8

<div dir="ltr">test 2!</div>

--20cf303ea2de06e35b050bdd5bb5--

descendant_command · 01-05-2015, 01:36 PM

Quote:

Originally Posted by Stuffe

So I switched to dovecot today and it is just much simpler and it works.

Yes

Quote:

But how did you stop the mail from getting caught in the spam folder by gmail descendant_command?

By not sending mail that smells like spam?
TBH I'm really not getting your "circular" setup, and I think it is probably, at least part of, your issue. Why are you wanting gmail to relay your outbound mail via your server?
Most "normal" setups (that use gmail at all) are the other way.

Stuffe · 01-05-2015, 02:14 PM

Quote:

Originally Posted by descendant_command

Yes

By not sending mail that smells like spam?
TBH I'm really not getting your "circular" setup, and I think it is probably, at least part of, your issue. Why are you wanting gmail to relay your outbound mail via your server?
Most "normal" setups (that use gmail at all) are the other way.

Well its like this, I would like to have access to a few different email addresses at the domain I have, like admin@domain.com etc. What I am trying to do is to set up an smtp server so that I can use a client like Outlook, Thunderbird or any other with my domain. It just so happens that gmail can serve as a (web based) client and as I use Gmail for everyday email anyway, I wanted to use that. I know it is confusing, because gmail can also also work as a smtp server. Also I see now that additionally confusion might have been caused because the gmail username of the receiver in the example is similar to the domain name of the sender. That's just a "coincidence" it might as well have been from admin@mydomain.com to johndoe@gmail.com.

So my point is, even if I used thunderbird to connect to my server and send a mail to a gmail address, gmail would still put the mail in the spam folder. And it can't be because of the text that I wrote, I tried everything from "test test" to a longer very standard personal letter, just to test that.

descendant_command · 01-05-2015, 05:58 PM

Well you could try asking them, but i'm pretty sure the're not going to tell you how to avoid their spam filters and they obviously dislike your addresses or IP or mails for some reason.
Try training them as "not spam" in your Gmail box.