Host did not advertise authentication

[thi-baut]

Hi, I'm trying to configure an SMTP server so that a printer on my LAN can send documents by email. SMTP server does not need to be publicly accessible.

Steps I followed:

1. Start container using docker-compose file below - pointed to existing Let's encrypt wildcard cert
2. Created the user xerox@domain.com
3. Registered A record and MX record as explained in instructions (not sure I need this for a private SMTP server though)

I checked

The error I can see in the logs (when trying from the printer or using swaks) are :

swaks -server mail.domain.com:587 -tls --auth-user "xerox@domain.com" --auth-password "password" --to test-email@gmail.com --from xerox@domain.com

=== Trying mail.domain.com:587...
=== Connected to mail.domain.com.
<-  220 mail.domain.com ESMTP
 -> EHLO Raven
<-  250-mail.domain.com
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-ETRN
<-  250-STARTTLS
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250-DSN
<-  250 CHUNKING
 -> STARTTLS
<-  220 2.0.0 Ready to start TLS
=== TLS started with cipher TLSv1.3:TLS_AES_256_GCM_SHA384:256
=== TLS no local certificate set
=== TLS peer DN="/CN=domain.com"
 ~> EHLO Raven
<~  250-mail.domain.com
<~  250-PIPELINING
<~  250-SIZE 10240000
<~  250-ETRN
<~  250-ENHANCEDSTATUSCODES
<~  250-8BITMIME
<~  250-DSN
<~  250 CHUNKING
*** Host did not advertise authentication
 ~> QUIT
<~  221 2.0.0 Bye
=== Connection closed with remote host.

Container logs (testing using swaks on the server) :

Oct  2 21:08:13 mail postfix/postscreen[3975]: CONNECT from [127.0.0.1]:42154 to [127.0.0.1]:25
Oct  2 21:08:13 mail postfix/postscreen[3975]: PASS OLD [127.0.0.1]:42154
Oct  2 21:08:13 mail postfix/smtpd[3976]: connect from localhost[127.0.0.1]
Oct  2 21:08:13 mail opendmarc[364]: ignoring connection from localhost
Oct  2 21:08:13 mail opendmarc[364]: ignoring connection from localhost
Oct  2 21:08:13 mail postfix/smtpd[3976]: Anonymous TLS connection established from localhost[127.0.0.1]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
Oct  2 21:08:13 mail postfix/smtpd[3976]: lost connection after STARTTLS from localhost[127.0.0.1]
Oct  2 21:08:13 mail postfix/smtpd[3976]: disconnect from localhost[127.0.0.1] ehlo=1 starttls=1 commands=2

I used the following compose file:

services:
  mailserver:
    image: ghcr.io/docker-mailserver/docker-mailserver:latest
    container_name: mailserver
    hostname: mail.domain.com
    env_file: mailserver.env
    ports:
      - "465:465"  # ESMTP (implicit TLS)
      - "587:587"  # ESMTP (explicit TLS => STARTTLS)
      - "25:25"  
    volumes:
      - ./docker-data/dms/mail-data/:/var/mail/
      - ./docker-data/dms/mail-state/:/var/mail-state/
      - ./docker-data/dms/mail-logs/:/var/log/mail/
      - ./docker-data/dms/config/:/tmp/docker-mailserver/
      - /etc/localtime:/etc/localtime:ro
      - /home/thibaut/nginx/data/certbot/conf:/etc/letsencrypt
    restart: always
    stop_grace_period: 1m
    healthcheck:
      test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
      timeout: 3s
      retries: 0

Any help appreciated, thanks

EDIT, I tested TLS config like this to check if it's working:

docker exec mailserver openssl s_client   -connect 0.0.0.0:25   -starttls smtp   -CApath /etc/ssl/certs/

Can't use SSL_get_servername
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = domain.com
verify return:1
250 CHUNKING
DONE
CONNECTED(00000003)
---
Certificate chain
 0 s:CN = domain.com
   i:C = US, O = Let's Encrypt, CN = R3
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIE9TCCA92g[........]==
-----END CERTIFICATE-----
subject=CN =domain.com

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4728 bytes and written 396 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

[polarathene]

env_file: mailserver.env

This isn't helpful. What ENV have you set?

[thi-baut]

Thanks for your response, I've tested with both swaks and my printer, the errors were the same. I tried to :

1. Remove the SSL_DOMAIN=domain.com option
2. Create a postfix-main.cf file in my config folder, added the "broken_sasl_auth_clients=no"
3. Then tried with "broken_sasl_auth_clients=yes" (which is the default) but no luck.
4. Also tried to explicitely set "smtpd_sasl_security_options=noanonymous" but same result.

I restarted the container between each step.

Maybe I'm not doing this right? when running postconf -Mf in the container I get the following:

postconf -Mf output

root@mail:/# postconf -Mf 
smtp       inet  n       -       n       -       1       postscreen
smtpd      pass  -       -       n       -       -       smtpd
tlsproxy   unix  -       -       n       -       0       tlsproxy
dnsblog    unix  -       -       n       -       0       dnsblog
submission inet  n       -       n       -       -       smtpd
    -o syslog_name=postfix/submission
    -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=no
    -o smtpd_sasl_type=dovecot
    -o smtpd_reject_unlisted_recipient=no
    -o smtpd_sasl_authenticated_header=yes
    -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    -o smtpd_sender_restrictions=$mua_sender_restrictions
    -o milter_macro_daemon_name=ORIGINATING
    -o cleanup_service_name=sender-cleanup
smtps      inet  n       -       n       -       -       smtpd
    -o syslog_name=postfix/smtps
    -o smtpd_tls_wrappermode=yes
    -o smtpd_sasl_auth_enable=no
    -o smtpd_sasl_type=dovecot
    -o smtpd_reject_unlisted_recipient=no
    -o smtpd_sasl_authenticated_header=yes
    -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    -o smtpd_sender_restrictions=$mua_sender_restrictions
    -o milter_macro_daemon_name=ORIGINATING
    -o cleanup_service_name=sender-cleanup
pickup     fifo  n       -       n       60      1       pickup
    -o content_filter=
    -o receive_override_options=no_header_body_checks
sender-cleanup unix n    -       n       -       0       cleanup
    -o syslog_name=postfix/sender-cleanup
    -o header_checks=pcre:/etc/postfix/maps/sender_header_filter.pcre
cleanup    unix  n       -       n       -       0       cleanup
qmgr       unix  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       n       1000?   1       tlsmgr
rewrite    unix  -       -       n       -       -       trivial-rewrite
bounce     unix  -       -       n       -       0       bounce
defer      unix  -       -       n       -       0       bounce
trace      unix  -       -       n       -       0       bounce
verify     unix  -       -       n       -       1       verify
flush      unix  n       -       n       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       1       proxymap
smtp       unix  -       -       n       -       -       smtp
relay      unix  -       -       n       -       -       smtp
showq      unix  n       -       n       -       -       showq
error      unix  -       -       n       -       -       error
retry      unix  -       -       n       -       -       error
discard    unix  -       -       n       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       n       -       -       lmtp
anvil      unix  -       -       n       -       1       anvil
scache     unix  -       -       n       -       1       scache
postlog    unix-dgram n  -       n       -       1       postlogd
policyd-spf unix -       n       n       -       0       spawn user=policyd-spf
    argv=/usr/bin/policyd-spf
smtp-amavis unix -       -       n       -       2       smtp
    -o syslog_name=postfix/$service_name
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20
    -o smtp_tls_security_level=none
    -o smtp_tls_wrappermode=no
127.0.0.1:10025 inet n   -       n       -       -       smtpd
    -o syslog_name=postfix/smtpd-amavis
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
    -o smtp_tls_security_level=none
policyd-spf unix -       n       n       -       0       spawn user=policyd-spf
    argv=/usr/bin/policyd-spf
smtp-amavis unix -       -       n       -       2       smtp
    -o syslog_name=postfix/$service_name
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20
    -o smtp_tls_security_level=none
    -o smtp_tls_wrappermode=no
127.0.0.1:10025 inet n   -       n       -       -       smtpd
    -o syslog_name=postfix/smtpd-amavis
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
    -o smtp_tls_security_level=none
policyd-spf unix -       n       n       -       0       spawn user=policyd-spf
    argv=/usr/bin/policyd-spf
smtp-amavis unix -       -       n       -       2       smtp
    -o syslog_name=postfix/$service_name
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20
    -o smtp_tls_security_level=none
    -o smtp_tls_wrappermode=no
127.0.0.1:10025 inet n   -       n       -       -       smtpd
    -o syslog_name=postfix/smtpd-amavis
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
    -o smtp_tls_security_level=none
policyd-spf unix -       n       n       -       0       spawn user=policyd-spf
    argv=/usr/bin/policyd-spf
smtp-amavis unix -       -       n       -       2       smtp
    -o syslog_name=postfix/$service_name
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20
    -o smtp_tls_security_level=none
    -o smtp_tls_wrappermode=no
127.0.0.1:10025 inet n   -       n       -       -       smtpd
    -o syslog_name=postfix/smtpd-amavis
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
    -o smtp_tls_security_level=none
policyd-spf unix -       n       n       -       0       spawn user=policyd-spf
    argv=/usr/bin/policyd-spf
smtp-amavis unix -       -       n       -       2       smtp
    -o syslog_name=postfix/$service_name
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20
    -o smtp_tls_security_level=none
    -o smtp_tls_wrappermode=no
127.0.0.1:10025 inet n   -       n       -       -       smtpd
    -o syslog_name=postfix/smtpd-amavis
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
    -o smtp_tls_security_level=none
policyd-spf unix -       n       n       -       0       spawn user=policyd-spf
    argv=/usr/bin/policyd-spf
smtp-amavis unix -       -       n       -       2       smtp
    -o syslog_name=postfix/$service_name
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20
    -o smtp_tls_security_level=none
    -o smtp_tls_wrappermode=no
127.0.0.1:10025 inet n   -       n       -       -       smtpd
    -o syslog_name=postfix/smtpd-amavis
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
    -o smtp_tls_security_level=none
policyd-spf unix -       n       n       -       0       spawn user=policyd-spf
    argv=/usr/bin/policyd-spf
smtp-amavis unix -       -       n       -       2       smtp
    -o syslog_name=postfix/$service_name
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20
    -o smtp_tls_security_level=none
    -o smtp_tls_wrappermode=no
127.0.0.1:10025 inet n   -       n       -       -       smtpd
    -o syslog_name=postfix/smtpd-amavis
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
    -o smtp_tls_security_level=none

Also tried different swaks parameters, such as:

thibaut@Raven:~/mail$ swaks -t test@gmail.com -s mail.domain:465 -tls -a
Username: xerox@domain.com
Password: *************
=== Trying mail.domain.com:465...
=== Connected to mail.domain.com.
<** Timeout (30 secs) waiting for server response
 -> QUIT
*** Remote host closed connection unexpectedly.

and observed in the logs:

Oct  3 21:44:55 mail postfix/smtps/smtpd[2242]: SSL_accept error from serverNameOnMyLAN.domain.com[10.0.3.100]: -1
Oct  3 21:44:55 mail postfix/smtps/smtpd[2242]: warning: TLS library problem: error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:331:
Oct  3 21:44:55 mail postfix/smtps/smtpd[2242]: lost connection after CONNECT from serverNameOnMyLAN.domain.com[10.0.3.100]
Oct  3 21:44:55 mail postfix/smtps/smtpd[2242]: disconnect from serverNameOnMyLAN.domain.com[10.0.3.100] commands=0/0

[polarathene]

Just to confirm, you're not using anything inbetween DMS and swaks right? There isn't something like Traefik as a reverse proxy in the mix?

You'll probably want to raise a proper bug report at this point to provide more info and visibility. Something about your environment seems to be contributing to the issue which makes that difficult to pinpoint 🤷‍♂️

I would suggest checking port 587 works as an alternative, that could be helpful. And perhaps an alternative client other than swaks? Thunderbird perhaps?

---

I restarted the container between each step.
Maybe I'm not doing this right? when running postconf -Mf in the container I get the following

In the docs we have tried to make this rather prominent for restarting the image:

Perhaps we could raise the awareness of that somewhere else in the docs too?

Basically you will want to prefer docker compose up --force-recreate or the docker compose down && docker compose up command sequence to recreate the container instead of restarting it. If you just use ctrl +c to exit the container and run docker compose up to bring it back up again, it can restart / resume the prior container instance and this carries existing changes.

Unfortunately DMS isn't too good at handling that right now, so you get some weird config changes like you've observed above.

[thi-baut]

Thanks again, nothing inbetween DMS and swaks, I run swaks on the Docker host. I tried to setup Thunderbird on a client within my LAN (STARTTTLS, normal password, port 587) and got the following error when trying to send an email - so at least some progress:

Oct  4 20:24:14 mail postfix/submission/smtpd[10617]: connect from prism.domain.com[10.0.1.50]
Oct  4 20:24:14 mail postfix/submission/smtpd[10617]: Anonymous TLS connection established from prism.domain.com[10.0.1.50]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
Oct  4 20:24:14 mail postfix/submission/smtpd[10617]: NOQUEUE: reject: RCPT from prism.domain.com[10.0.1.50]: 554 5.7.1 <prism.domain.com[10.0.1.50]>: Client host rejected: Access denied; from=<xerox@domain.com> to=<redacted@proton.me> proto=ESMTP helo=<[10.0.1.50]>

I recreated container after config changes. I have a bug that may be related: upon 1st container run, I need to manually run "docker exec -ti mailserver touch /etc/postfix/vmailbox" to create the vmailbox file otherwise I can't create a user. I found workaround here: #663

[thi-baut]

I tried to change SMTP_ONLY to 0 and it looks like it's going through (I'm not receiving email probably because of lack of DKIM config, DNS issue etc. "Cannot assign requested address" error but I think I can manage from here). This is likely a bug with the user not being properly setup/created with this parameter set to 1