Toon posts:

Sendmail client SMTP-authenticatie

Pagina: 1
Acties:
  • 104 views sinds 30-01-2008
  • Reageer

zaterdag 9 juni 2007 20:51

Acties:
  • Ivo
  • Registratie: Juni 2001
  • Laatst online: 14-01-2025

Ivo

Topicstarter
Ik heb een mailserver opgezet die sendmail draait en die als relay dient voor mijn andere systemen. Op de server draait sendmail en als authenticatie wordt cyrus-sasl met een sasldb gebruikt.

Op mijn desktop draai ik OpenBSD en heb ik de lokale sendmail ingesteld, zodat deze de server als relay gebruikt. Ik heb daartoe de volgende stappen doorlopen:
- sendmail hercompileren met WANT_SMTPAUTH=yes toegevoegd aan /etc/mk.conf
- cyrus-sasl geinstalleerd
- sendmail configuratie aangepast
- authenticatieinformatie toegevoegd

Dit werkt allemaal prima. De server staat in hetzelfde lokale netwerk als de desktop. Nu heb ik ook een laptop die ook OpenBSD draait en daar wil ik hetzelfde mee doen. Omdat ik de laptop echter buitenshuis gebruik stel ik hier alles in op de remote hostname van de server. Op de een of andere manier lukt het niet om de de sendmail op de laptop zich fatsoenlijk te laten authenticeren bij de sendmail op de server. Dit is wat er telkens in de logs verschijnt (op het hoogste debugniveau):
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

Jun  9 20:20:52 ivo sm-mta[24780]: NOQUEUE: connect from laptop_hostname [laptop_ip]
Jun  9 20:20:52 ivo sm-mta[24780]: AUTH: available mech=OTP GSSAPI DIGEST-MD5 CRAM-MD5, allowed mech=CRAM-MD5
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: Milter: no active filter
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 220 server_hostname ESMTP Sendmail 8.14.0/8.14.0; Sat, 9 Jun 2007 20:20:52 +0200 (CEST)
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: <-- EHLO arrakis.my.domain
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-server_hostname Hello laptop_hostname [87.209.154.8], pleased to meet you
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-ENHANCEDSTATUSCODES
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-PIPELINING
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-8BITMIME
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-SIZE
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-DSN
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-ETRN
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-AUTH CRAM-MD5
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250-DELIVERBY
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 250 HELP
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: <-- AUTH CRAM-MD5
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 334 ******************************************************
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: --- 235 2.0.0 OK Authenticated
Jun  9 20:20:52 ivo sm-mta[24780]: AUTH=server, relay=laptop_hostname [laptop_ip], authid=ivo, mech=CRAM-MD5, bits=0
Jun  9 20:20:52 ivo sm-mta[24780]: l59IKqin024780: <-- MAIL From:<ivo@arrakis.my.domain> SIZE=497 AUTH=<>
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqin024780: --- 250 2.1.0 <ivo@arrakis.my.domain>... Sender ok
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqin024780: <-- RCPT To:<i.g.j.v.d.sangen@student.tue.nl>
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqin024780: --- 250 2.1.5 <i.g.j.v.d.sangen@student.tue.nl>... Recipient ok
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqin024780: <-- DATA
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqin024780: --- 354 Enter mail, end with "." on a line by itself
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqin024780: from=<ivo@arrakis.my.domain>, size=713, class=0, nrcpts=1, msgid=<20070609182015.GA9312@arrakis.tue.nl>, proto=ESMTP, daemon=MTA, relay=laptop_hostname [laptop_ip]
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqin024780: --- 250 2.0.0 l59IKqin024780 Message accepted for delivery
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqio024780: <-- QUIT
Jun  9 20:20:53 ivo sm-mta[24780]: l59IKqio024780: --- 221 2.0.0 server_hostname closing connection
Jun  9 20:20:53 ivo sm-mta[6878]: l59IKqin024780: --- 050 <i.g.j.v.d.sangen@student.tue.nl>... Connecting to smtp.wanadoo.nl. via relay...
Jun  9 20:20:53 ivo sm-mta[6878]: l59IKqin024780: makeconnection (smtp.wanadoo.nl. [193.252.22.245]) failed: Invalid argument
Jun  9 20:20:53 ivo sm-mta[6878]: l59IKqin024780: makeconnection (smtp.wanadoo.nl. [193.252.22.251]) failed: Invalid argument
Jun  9 20:20:53 ivo sm-mta[6878]: l59IKqin024780: makeconnection (smtp.wanadoo.nl. [193.252.22.233]) failed: Invalid argument
Jun  9 20:20:53 ivo sm-mta[6878]: l59IKqin024780: SMTP outgoing connect on [192.168.2.202]
Jun  9 20:20:54 ivo sm-mta[6878]: l59IKqin024780: --- 550 5.1.1 <i.g.j.v.d.sangen@student.tue.nl>... User unknown (hold)
Jun  9 20:20:54 ivo sm-mta[6878]: l59IKqin024780: to=<i.g.j.v.d.sangen@student.tue.nl>, delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30713, relay=smtp.wanadoo.nl. [193.252.22.234], dsn=5.1.3, stat=User unknown
Jun  9 20:20:54 ivo sm-mta[6878]: l59IKqin024780: l59IKsin006878: DSN: User unknown
Jun  9 20:20:54 ivo sm-mta[6878]: l59IKsin006878: --- 050 <ivo@arrakis.my.domain>... Using cached ESMTP connection to smtp.wanadoo.nl. via relay...
Jun  9 20:20:54 ivo sm-mta[6878]: l59IKsin006878: --- 050 <ivo@arrakis.my.domain>... Sent (Ok: queued as 6147C1C00083)
Jun  9 20:20:54 ivo sm-mta[6878]: l59IKsin006878: to=<ivo@arrakis.my.domain>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=31737, relay=smtp.wanadoo.nl. [193.252.22.234], dsn=2.0.0, stat=Sent (Ok: queued as 6147C1C00083)
Jun  9 20:20:54 ivo sm-mta[6878]: l59IKsin006878: done; delay=00:00:00, ntries=1
Jun  9 20:20:54 ivo sm-mta[6878]: l59IKqin024780: done; delay=00:00:01, ntries=1
Jun  9 20:20:54 ivo sm-mta[6878]: NOQUEUE: --- 050 Closing connection to smtp.wanadoo.nl.

N.B. "User unknown". Ik heb echter precies dezelfde informatie ingevuld als op mijn desktop.

Dit is mijn sendmail.mc file:
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168

divert(-1)
#
# Adapted OpenBSD sendmail configuration for systems accepting mail
# from the internet.
#
# Note that lines beginning with "dnl" below are comments.

divert(0)dnl
VERSIONID(`@(#)openbsd-proto.mc $Revision: 1.11 $')dnl
OSTYPE(openbsd)dnl
dnl
dnl If you have a non-static IP address you may wish to forward outgoing mail
dnl through your ISP's mail server to prevent matching one of the dialup
dnl DNS black holes.  Just uncomment the following line and replace
dnl mail.myisp.net with the hostname of your ISP's mail server.
dnl
define(`confLOG_LEVEL', `16')dnl
define(`SMART_HOST', `server_hostname')dnl
dnl define(`RELAY_MAILER_ARGS', `TCP $h 1024')
define(`confAUTH_MECHANISMS', `CRAM-MD5')dnl
FEATURE(`authinfo', `hash /etc/mail/auth/client-info')dnl
TRUST_AUTH_MECH(`CRAM-MD5')dnl
dnl
dnl Disable EXPN and VRFY to help thwart address harvesters and require
dnl senders to say hello.
dnl
define(`confPRIVACY_FLAGS', `authwarnings,needmailhelo,noexpn,novrfy,nobodyreturn')dnl
dnl
dnl We wish to make the existence of the local-host-names and
dnl trusted-users files optional, hence the "-o" below.
dnl
define(`confCW_FILE', `-o MAIL_SETTINGS_DIR`'local-host-names')dnl
define(`confCT_FILE', `-o MAIL_SETTINGS_DIR`'trusted-users')dnl
dnl
dnl Use of UUCP-style addresses in the modern internet are generally
dnl an error (and sometimes used by spammers) so disable support for them.
dnl To simply treat '!' as a normal character, change `reject' to
dnl `nospecial'.
dnl
FEATURE(nouucp, `reject')dnl
dnl
dnl The access database allows for certain actions to be taken based on
dnl the source address.
dnl
FEATURE(`access_db', `hash -o -T<TMPF> /etc/mail/access')dnl
FEATURE(`blacklist_recipients')dnl
dnl
dnl Enable support for /etc/mail/local-host-names.
dnl Contains hostnames that should be considered local.
dnl
FEATURE(`use_cw_file')dnl
dnl
dnl Enable support for /etc/mail/mailertable.
dnl
FEATURE(`mailertable', `hash -o /etc/mail/mailertable')dnl
dnl
dnl Enable support for /etc/mail/trusted-users.
dnl Users listed herein may spoof mail from other users.
dnl
FEATURE(`use_ct_file')dnl
dnl
dnl Enable support for /etc/mail/virtusertable.
dnl Used to do N -> N address mapping.
dnl
FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable')dnl
dnl
dnl Rewrite (unqualified) outgoing email addresses using the
dnl mapping listed in /etc/mail/genericstable
dnl
FEATURE(genericstable, `hash -o /etc/mail/genericstable')dnl
dnl
dnl Normally only local addresses are rewritten.  By using
dnl generics_entire_domain and either GENERICS_DOMAIN
dnl or GENERICS_DOMAIN_FILE addresses from hosts in the
dnl specified domain(s) will be rewritten too.
dnl
dnl FEATURE(generics_entire_domain)dnl
dnl GENERICS_DOMAIN(`othercompany.com')dnl
dnl GENERICS_DOMAIN_FILE(`/etc/mail/generics-domains')dnl
dnl
dnl Include the local host domain even on locally delivered mail
dnl (which would otherwise contain only the username).
FEATURE(always_add_domain)dnl
dnl
dnl Bounce messages addressed to "address.REDIRECT".  This allows the
dnl admin to alias a user who has moved to "new_address.REDIRECT" so
dnl that senders will know the user's new address.
FEATURE(redirect)dnl
dnl
dnl Accept incoming connections on any IPv4 or IPv6 interface for ports
dnl 25 (SMTP) and 587 (MSA).
dnl
FEATURE(`no_default_msa')dnl
DAEMON_OPTIONS(`Family=inet, Address=0.0.0.0, Name=MTA')dnl
DAEMON_OPTIONS(`Family=inet6, Address=::, Name=MTA6, M=O')dnl
DAEMON_OPTIONS(`Family=inet, Address=0.0.0.0, Port=587, Name=MSA, M=E')dnl
DAEMON_OPTIONS(`Family=inet6, Address=::, Port=587, Name=MSA6, M=O, M=E')dnl
dnl
dnl Use either IPv4 or IPv6 for outgoing connections.
dnl
CLIENT_OPTIONS(`Family=inet, Address=0.0.0.0')dnl
CLIENT_OPTIONS(`Family=inet6, Address=::')dnl
dnl
dnl Some broken nameservers will return SERVFAIL (a temporary failure)
dnl on T_AAAA (IPv6) lookups.
dnl
define(`confBIND_OPTS', `WorkAroundBrokenAAAA')dnl
dnl
dnl TLS/SSL support; uncomment and read starttls(8) to use.
dnl
dnl define(`CERT_DIR', `MAIL_SETTINGS_DIR`'certs')dnl
dnl define(`confCACERT_PATH', `CERT_DIR')dnl
dnl define(`confCACERT', `CERT_DIR/mycert.pem')dnl
dnl define(`confSERVER_CERT', `CERT_DIR/mycert.pem')dnl
dnl define(`confSERVER_KEY', `CERT_DIR/mykey.pem')dnl
dnl define(`confCLIENT_CERT', `CERT_DIR/mycert.pem')dnl
dnl define(`confCLIENT_KEY', `CERT_DIR/mykey.pem')dnl
dnl
dnl Masquerading -- rewriting the From address to a specific domain.
dnl Please see the "MASQUERADING AND RELAYING" section of
dnl /usr/share/sendmail/README for details.
dnl
dnl MASQUERADE_AS(`server_hostname')dnl
dnl
dnl Masquerade the envelope From in addition to the From: header.
dnl
dnl FEATURE(masquerade_envelope)dnl
dnl
dnl Masquerade host.sub.dom.ain as well as host.dom.ain.
dnl
dnl FEATURE(masquerade_entire_domain)dnl
dnl
dnl Only masquerade messages going outside the local domain.
dnl
dnl FEATURE(local_no_masquerade)dnl
dnl
dnl Rewrite addresses from user@othercompany.com when relayed in
dnl addition to locally-generated messages.
dnl
dnl MASQUERADE_DOMAIN(`othercompany.com')dnl
dnl
dnl Specific hosts that should be excepted from MASQUERADE_DOMAIN.
dnl
dnl MASQUERADE_EXCEPTION(`host.othercompany.com')dnl
dnl
dnl Only masquerade for hosts listed by MASQUERADE_DOMAIN
dnl (normally any host considered local is also masqueraded).
dnl
dnl FEATURE(limited_masquerade)dnl
dnl
dnl Specific users that should be excepted from masquerading.
dnl
dnl EXPOSED_USER(`root')dnl
dnl EXPOSED_USER(`daemon')dnl
dnl EXPOSED_USER_FILE(`/etc/mail/exposed-users')dnl
dnl
dnl End of masquerading section.
MAILER(local)dnl
MAILER(smtp)dnl
dnl
dnl Enforce valid Message-Id to help stop spammers.
dnl
LOCAL_RULESETS
HMessage-Id: $>CheckMessageId

SCheckMessageId
R< $+ @ $+ >        $@ OK
R$*         $#error $: 553 Header Error

En auth/client-info:
code:
1

AuthInfo:server_hostname "U:ivo" "P:secret" "M:CRAM-MD5"


Ter vergelijking een log entry van een mail verstuurd vanaf de desktop die dus wel aankomt:
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

Jun  9 20:48:11 ivo sm-mta[6251]: NOQUEUE: connect from root@[192.168.2.167]
Jun  9 20:48:11 ivo sm-mta[6251]: AUTH: available mech=OTP GSSAPI DIGEST-MD5 CRAM-MD5, allowed mech=CRAM-MD5
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: Milter: no active filter
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 220 server_hostname ESMTP Sendmail 8.14.0/8.14.0; Sat, 9 Jun 2007 20:48:11 +0200 (CEST)
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: <-- EHLO caladan.
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-server_hostname Hello root@[192.168.2.167], pleased to meet you
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-ENHANCEDSTATUSCODES
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-PIPELINING
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-8BITMIME
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-SIZE
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-DSN
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-ETRN
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-AUTH CRAM-MD5
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250-DELIVERBY
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250 HELP
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: <-- AUTH CRAM-MD5
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 334 ******************************************************
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 235 2.0.0 OK Authenticated
Jun  9 20:48:11 ivo sm-mta[6251]: AUTH=server, relay=root@[192.168.2.167], authid=ivo, mech=CRAM-MD5, bits=0
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: <-- MAIL From:<ivo@caladan.""> SIZE=482 AUTH=<>
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250 2.1.0 <ivo@caladan."">... Sender ok
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: <-- RCPT To:<i.g.j.v.d.sangen@student.tue.nl>
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250 2.1.5 <i.g.j.v.d.sangen@student.tue.nl>... Recipient ok
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: <-- DATA
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 354 Enter mail, end with "." on a line by itself
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: from=<ivo@caladan."">, size=673, class=0, nrcpts=1, msgid=<20070609184810.GA30443@caladan>, proto=ESMTP, daemon=MTA, relay=root@[192.168.2.167]
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8E006251: --- 250 2.0.0 l59ImB8E006251 Message accepted for delivery
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8F006251: <-- QUIT
Jun  9 20:48:11 ivo sm-mta[6251]: l59ImB8F006251: --- 221 2.0.0 server_hostname closing connection
Jun  9 20:48:11 ivo sm-mta[684]: l59ImB8E006251: --- 050 <i.g.j.v.d.sangen@student.tue.nl>... Connecting to smtp.wanadoo.nl. via relay...
Jun  9 20:48:12 ivo sm-mta[684]: l59ImB8E006251: makeconnection (smtp.wanadoo.nl. [193.252.22.234]) failed: Invalid argument
Jun  9 20:48:12 ivo sm-mta[684]: l59ImB8E006251: makeconnection (smtp.wanadoo.nl. [193.252.22.245]) failed: Invalid argument
Jun  9 20:48:12 ivo sm-mta[684]: l59ImB8E006251: makeconnection (smtp.wanadoo.nl. [193.252.22.251]) failed: Invalid argument
Jun  9 20:48:12 ivo sm-mta[684]: l59ImB8E006251: SMTP outgoing connect on [192.168.2.202]
Jun  9 20:48:12 ivo sm-mta[684]: l59ImB8E006251: --- 050 <i.g.j.v.d.sangen@student.tue.nl>... Sent (Ok: queued as 482367000085)
Jun  9 20:48:12 ivo sm-mta[684]: l59ImB8E006251: to=<i.g.j.v.d.sangen@student.tue.nl>, delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30673, relay=smtp.wanadoo.nl. [193.252.22.234], dsn=2.0.0, stat=Sent (Ok: queued as 482367000085)
Jun  9 20:48:12 ivo sm-mta[684]: l59ImB8E006251: done; delay=00:00:01, ntries=1
Jun  9 20:48:12 ivo sm-mta[684]: NOQUEUE: --- 050 Closing connection to smtp.wanadoo.nl.
Jun  9 20:48:12 ivo dovecot: IMAP(ivo): Disconnected: Logged out

Heeft iemand enig idee waarom het vanaf de laptop niet zou werken en vanaf de desktop wel? Ik begin langzaam wanhopig te worden.
Reageer

Apple iPhone 17 LG OLED evo G5 Google Pixel 10 Samsung Galaxy S25 Star Wars: Outlaws Nintendo Switch 2 Apple AirPods Pro (2e generatie) Sony PlayStation 5 Pro

Tweakers is onderdeel van DPG Media B.V.
Alle rechten voorbehouden - Auteursrecht © 1998 - 2026 • Hosting door TrueFullstaq