{"id":145,"date":"2016-01-26T09:42:44","date_gmt":"2016-01-26T09:42:44","guid":{"rendered":"http:\/\/iain.rauch.co.uk\/blog\/?p=145"},"modified":"2016-01-26T09:42:44","modified_gmt":"2016-01-26T09:42:44","slug":"freebsd-postfix-sasl-smtp-authentication-troubles","status":"publish","type":"post","link":"https:\/\/iain.rauch.co.uk\/blog\/2016-01\/freebsd-postfix-sasl-smtp-authentication-troubles\/","title":{"rendered":"FreeBSD Postfix SASL SMTP Authentication Troubles"},"content":{"rendered":"<p>Ever tried sending mail from your own server and ended up on the\u00a0Spamhaus\u00a0Policy Block List (PBL)? I have, a couple of times.<\/p>\n<p>From\u00a0my FreeBSD sever, I get daily emails; &#8220;daily run output&#8221; and &#8220;security run output&#8221;. I&#8217;m not particularly interested in these, but it&#8217;s important that I get SMART notifications.<\/p>\n<p>What I noticed is that whenever my IP address changes (every couple of months) the emails start coming through again. If you look at the mail log (\/var\/log\/maillog), you&#8217;ll see something like<br \/>\n<code>Dec 24 03:14:24 myhostname\u00a0postfix\/smtp[6740]: 9B8A5CB111C: to=&lt;user@example.com&gt;, orig_to=&lt;user&gt;, relay=smtp.examplehost.net[x.x.x.x]:25, delay=43, delays=0\/0.22\/21\/21, dsn=5.0.0, status=bounced (host smtp.examplehost.net[x.x.x.x] said: 550-\"JunkMail rejected - me.exampleisp.com (myhostname.mydomain.net) 550-[x.x.x.x]:63909 is in an RBL, see 550 https:\/\/www.spamhaus.org\/query\/ip\/x.x.x.x\" (in reply to RCPT TO command))<\/code><\/p>\n<p>So nicely, they&#8217;ve given a link to lookup why you&#8217;re blocked. In my case it&#8217;s due to using an unauthenticated mail port (25). Since I had this problem before, I though I had setup authentication but in the FAQ it&#8217;s very clear that you cannot get this error if you have authentication enabled.<\/p>\n<p>So what else does does it say in the mail log? Well, just before that line:<br \/>\n<code>Dec 24 03:13:54 myhostname postfix\/smtp[6753]: warning: smtp_sasl_auth_enable is true, but SASL support is not compiled in<\/code><\/p>\n<p>This is a problem with the Postfix package for FreeBSD. I can&#8217;t find any other way around it other than to compile Postfix yourself from Ports. Here&#8217;s a link to the (unresolved) request\u00a0in <a href=\"https:\/\/bugs.freebsd.org\/bugzilla\/show_bug.cgi?id=195662\" target=\"_blank\">FreeBSD Bugzilla<\/a>\u00a0to add a package with it compiled in. So if you&#8217;re looking for a FreeBSD package with SMTP SASL authentication &#8211; give up (unless that bug has been resolved since the time of posting).<\/p>\n<p>I&#8217;m not going to go into details of how to set up the SMTP + SASL on FreeBSD, there are already many guides that do that. I found these helpful:<\/p>\n<ul>\n<li><a href=\"http:\/\/proger.i-forge.net\/%D0%9A%D0%BE%D0%BC%D0%BF%D1%8C%D1%8E%D1%82%D0%B5%D1%80\/FreeBSD\/[11.01.20]%20Setting%20up%20SMTP%20authorization%20for%20Postfix%20using%20Cyrus%20SASL.html\" target=\"_blank\">Setting up SMTP authorization for Postfix using Cyrus SASL<\/a><\/li>\n<li><a href=\"http:\/\/postfix.state-of-mind.de\/patrick.koetter\/smtpauth\/sasldb_configuration.html\" target=\"_blank\">Configuring SASL to use sasldb<\/a><\/li>\n<\/ul>\n<p>One other small roadblock I ran into was trying to use port 465. When checking my web host, they\u00a0specify that port of authenticated SSL, but I found the following error in the logs:<br \/>\n<code>CLIENT wrappermode (port smtps\/465) is unimplemented<br \/>\ninstead, send to (port submission\/587) with STARTTLS<br \/>\nstatus=deferred (lost connection with smtp.examplehost.net[x.x.x.x] while receiving the initial server greeting<\/code><\/p>\n<p>My host didn&#8217;t give any indication that it supported SMTP on port 587 and if you search for this problem on the web you&#8217;ll find many people trying to solve it with\u00a0stunnel. A quick telnet to my host on 587 showed it was open, so I just gave it a try. Lo and behold Postfix authenticated and sent my mail. So give port 587 a try even if you&#8217;re recommended to use 465 for\u00a0your relayhost provider.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ever tried sending mail from your own server and ended up on the\u00a0Spamhaus\u00a0Policy Block List (PBL)? I have, a couple of times. From\u00a0my FreeBSD sever, I get daily emails; &#8220;daily run output&#8221; and &#8220;security run output&#8221;. I&#8217;m not particularly interested &hellip; <a href=\"https:\/\/iain.rauch.co.uk\/blog\/2016-01\/freebsd-postfix-sasl-smtp-authentication-troubles\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[7],"tags":[],"class_list":["post-145","post","type-post","status-publish","format-standard","hentry","category-freebsd"],"_links":{"self":[{"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/posts\/145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=145"}],"version-history":[{"count":7,"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/posts\/145\/revisions"}],"predecessor-version":[{"id":152,"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/posts\/145\/revisions\/152"}],"wp:attachment":[{"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/iain.rauch.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}