Can't send e-mail from host with SASL authenticated account

[daks]

Following https://github.com/orgs/docker-mailserver/discussions/4253 I'm trying to configure my host server to send e-mails with an SASL authenticated account, through DMS which is running on Docker rootless on this server.

What I have:

• on the host side /etc/postfix/main.cf with

relayhost = [127.0.0.1]:8465
smtp_sasl_password_maps = hash:/etc/postfix/sasl_password
smtp_sasl_auth_enable = yes
smtp_tls_security_level = encrypt
smtp_sasl_security_options =

and sasl_password contains [127.0.0.1]:8465 [email protected]:password and postmap has been executed
(8465 is the local port used for SMTPS/Submission)

• on DMS site I created the [email protected] with its password

When I send an e-mail from the host, I see this on DMS side

mailserver  | 2024-12-10T15:51:25.247411+01:00 imap postfix/submissions/smtpd[995]: connect from unknown[10.0.2.2]

and nothing more

on the host side the message has relay=127.0.0.1[127.0.0.1]:8465, delay=300, delays=0.13/0.01/300/0, dsn=4.4.2, status=deferred (conversation with 127.0.0.1[127.0.0.1] timed out while receiving the initial server greeting)

I'm not sure what's going on, I tried adding 10.0.2.2/32 to postfix-main.cf to allowlist the IP but no success. (no e-mail to destination or in relay)
I remember having seen more explicit messages about postscreen being involved in this timeout but I don't see any right now. (edit: those appeared when using port 25 to send email instead of port 465)

[polarathene]

TL;DR: Best guess is your host Postfix needs to ensure it connects to the port with the expected TLS handshake process, since you chose implicit TLS (port 465), you need to adjust the default in Postfix for the relay service to use.

---

You could perhaps try with a 2nd DMS container running in the same docker network to verify that works? (DMS presently only supports relaying to an MTA over port 25 or 587)

If you view our DMS docs for relay host config the bottom section shows what Postfix config is used without any DMS integration, so you could possibly compare that. Maybe try with port 587 too.

---

Actually, it's probably due to the port and similar to the reason DMS presently doesn't support connecting to a relay host over port 465. You'd need to adjust your /etc/postfix/master.cf for the relay service similar to what is done for inbound port 465:

docker-mailserver/target/postfix/master.cf

Lines 31 to 33 in 96bffd7

	submissions inet n - n - - smtpd
	-o syslog_name=postfix/submissions
	-o smtpd_tls_wrappermode=yes

docker-mailserver/target/postfix/master.cf

Line 67 in 96bffd7

relay unix - - n - - smtp

smtpd_tls_wrappermode=yes is needed for port 465 to treat it as implicit TLS instead of using STARTTLS (explicit TLS for port 25 / 587).

The equivalent for your host Postfix config is smtp_tls_wrappermode=yes (_smtp_ instead of smtpd_). You would need to apply that config override to the relay service highlighted above in master.cf (in your host Postfix, not our DMS container).

EDIT: DMS could probably add support for this need (or at least better document the below postfix-master.cf approach). I'm not too big on adding ENV toggles into DMS for single line config changes though 😅

---

Probable solution

You should be able to do this by either manual file edit or with this command:

postconf -P 'relay/unix/smtp_tls_wrappermode=yes'

DMS provides such support via our postfix-master.cf config override support which runs that same postconf -P command.

For reference if you need to change anything else in master.cf in a similar way but more than just -o setting=value changes, I've documented how to do that here: #4218

[daks]

Solution has been as simple as adding the smtp_tls_wrappermode=yes directive in my host Postfix config! Thank you so much.

I wonder though why I need to specify smtp_sasl_security_options = and it doesn't work when I set it to noanonymous

• it's weird because I want to authenticate to the DMS server
• also the DMS server itself has the option smtpd_sasl_security_options = noanonymous which I believe is its counterpart

Do you have any idea?

[polarathene]

Solution has been as simple as adding the smtp_tls_wrappermode=yes directive in my host Postfix config! Thank you so much.

While you can do it with the main postfix config, that will apply it to port 25 and anything else that inherits it. Normally you wouldn't want that if the mail server was being used to do anything else (like send mail out through port 25 instead of the relay port 465), thus being more specific with an override via master.cf is better in that case than main.cf.

---

I wonder though why I need to specify smtp_sasl_security_options = and it doesn't work when I set it to noanonymous

• it's weird because I want to authenticate to the DMS server
• also the DMS server itself has the option smtpd_sasl_security_options = noanonymous which I believe is its counterpart

Do you have any idea?

You can view the Postfix docs for smtp_sasl_security_options, the default value assigned is noplaintext, noanonymous.

• noanonymous prevents login without any password.
• noplaintext prevents the PLAIN SASL mechanism, but plaintext is fine for the password to be sent if the connection established is secure with TLS.

We don't want to allow anonymous authentication, but we do want to allow plaintext since we have configured the security for it.

Since you're using your own Postfix instance to connect to DMS, you need to also allow plaintext for the relay, just like the screenshot from our docs shows is done (which is safe due to the smtp_tls_security_level = encrypt enforcing TLS to be established before sending).

References

smtpd_sasl_auth_enable needs to be enabled for submission(s) ports 587/465:

docker-mailserver/target/postfix/master.cf

Line 35 in 96bffd7

-o smtpd_sasl_type=dovecot

For Dovecot which provides the SASL backend for Postfix to use, we have a password database that uses plain and login (deprecated) SASL mechanisms:

docker-mailserver/target/dovecot/auth-passwdfile.inc

Lines 10 to 14 in 96bffd7

	passdb {
	driver = passwd-file
	mechanisms = plain login
	args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/userdb
	}

docker-mailserver/target/dovecot/10-auth.conf

Lines 5 to 10 in 96bffd7

	# Disable LOGIN command and all other plaintext authentications unless
	# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
	# matches the local IP (ie. you're connecting from the same computer), the
	# connection is considered secure and plaintext authentication is allowed.
	# See also ssl=required setting.
	#disable_plaintext_auth = yes

docker-mailserver/target/scripts/helpers/ssl.sh

Lines 348 to 360 in 96bffd7

	# Dovecot configuration:
	# https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/
	# > The plaintext authentication is always allowed (and SSL not required) for connections from localhost, as they’re assumed to be secure anyway.
	# > This applies to all connections where the local and the remote IP addresses are equal.
	# > Also IP ranges specified by login_trusted_networks setting are assumed to be secure.
	#
	# no => insecure auth allowed, yes (default) => plaintext auth only allowed over a secure connection (insecure connection acceptable for non-plaintext auth)
	local DISABLE_PLAINTEXT_AUTH='no'
	# no => disabled, yes => optional (secure connections not required), required (default) => mandatory (only secure connections allowed)
	local DOVECOT_SSL_ENABLED='no'
	sed -i -r "s|^#?(disable_plaintext_auth =).*|\1 ${DISABLE_PLAINTEXT_AUTH}|" /etc/dovecot/conf.d/10-auth.conf
	sed -i -r "s|^(ssl =).*|\1 ${DOVECOT_SSL_ENABLED}|" "${DOVECOT_CONFIG_SSL}"
	;;

[daks]

Solution has been as simple as adding the smtp_tls_wrappermode=yes directive in my host Postfix config! Thank you so much.

While you can do it with the main postfix config, that will apply it to port 25 and anything else that inherits it. Normally you wouldn't want that if the mail server was being used to do anything else (like send mail out through port 25 instead of the relay port 465), thus being more specific with an override via master.cf is better in that case than main.cf.

I'm not sure I understand correctly.
In this case I want my SMTP client to use TLS not my server processes. Isn't master.cf for Postfix daemons?

Anyway in my case currently I only want one destination which is the DMS server. Which is why I use relayhost and not a transport_maps to implement more complex 'routing'.

I wonder though why I need to specify smtp_sasl_security_options = and it doesn't work when I set it to noanonymous

• it's weird because I want to authenticate to the DMS server
• also the DMS server itself has the option smtpd_sasl_security_options = noanonymous which I believe is its counterpart

Do you have any idea?

You can view the Postfix docs for smtp_sasl_security_options, the default value assigned is noplaintext, noanonymous.

* `noanonymous` prevents login without any password.

* `noplaintext` prevents the `PLAIN` SASL mechanism, but plaintext is fine for the password to be sent if the connection established is secure with TLS.

We don't want to allow anonymous authentication, but we do want to allow plaintext since we have configured the security for it.

Since you're using your own Postfix instance to connect to DMS, you need to also allow plaintext for the relay, just like the screenshot from our docs shows is done (which is safe due to the smtp_tls_security_level = encrypt enforcing TLS to be established before sending).

I finally got it to work, I had a typo in "noanomynous", once fixed, it works as intended!

Thanks for your detailed answers :)

[polarathene]

I'm not sure I understand correctly.
In this case I want my SMTP client to use TLS not my server processes. Isn't master.cf for Postfix daemons?

It configures various Postfix services. Some are for inbound and outbound traffic, like port 465 that your mail client could connect to when submitting mail for Postfix to send.

While the relay service in master.cf gets configured with a port for outbound connections, it still needs to be configured for if it will use explicit or implicit TLS, which it will default to whatever main.cf has configured (since each service inherits that config as a base).

You want SMTP client => Postfix (host) => Postfix (DMS)

Your SMTP client can use TLS, but the Postfix host relay to Postfix in DMS is also using TLS since you configured a relay to the authenticated port 465.

If you didn't configure SSL_TYPE ENV, then technically implicit TLS is disabled:

docker-mailserver/target/scripts/helpers/ssl.sh

Lines 338 to 346 in 96bffd7

	# Postfix master.cf (per connection overrides):
	# Disables implicit TLS on port 465 for inbound (smtpd) and outbound (smtp) traffic. Treats it as equivalent to port 25 SMTP with explicit STARTTLS.
	# Inbound 465 (aka service port aliases: submissions) for Postfix to receive over implicit TLS (eg from MUA or functioning as a relay host).
	# Outbound 465 as alternative to port 587 when sending to another MTA (with authentication), such as a relay service (eg SendGrid).
	sedfile -i -r \
	-e "/smtpd?_tls_security_level/s|=.*|=none|" \
	-e '/smtpd?_tls_wrappermode/s|yes|no|' \
	-e '/smtpd_tls_auth_only/s|yes|no|' \
	"${POSTFIX_CONFIG_MASTER}"