SMTP [13] Permission denied

[Jmickey]

Hey,

I am trying to send alerts via email through my companies exchange server. I have added the servers IP to a relay receive connector in exchange and I am able to telnet to the exchange server from the zabbix server and send an email.

However, when I attempt to send an alert through zabbix to myself it doesn't send, this is the error when I go to Admin -> Audit -> Actions:

cannot connect to SMTP server [my.exch.server]: cannot connect to [[my.exch.server]:25]: [13] Permission denied.

Does anyone know why this might be? I am quite new to zabbix and linux in general.

Zabbix version: 2.2.2
Linux: CentOS 6.5

Thanks for the help in advance.

[steveboyson]

That is most likely an exchange issue. Probably you are not allowed to relay. Maybe your sender's address setting is not accepted by the exchange SMTP connector, or it needs authentication or something similar.

It's advisable to check that with your exchange guys.

[Jmickey]

I am the exchange guy. As I said though the email is sent and received fine when sent through telnet from the zabbix server.

I also setup a postfix server on the zabbix server which is set to relay messages through to exchange. Emails also send and receive fine when I telnet to the localhost postfix server. In both cases exchange relays the email without an issue.

If I set the postfix server as the smtp server I get the same permissions error. The postfix logs also don't show the email even hitting the server, so the email isn't even hitting the smtp address before it fails. Something is causing it to fail before the zabbix server even attempts to connect to the postfix server.

[steveboyson]

And what is the exact error code? Is it an SMTP error (500 or the like) or what error do you get?

I see no real difference between directly talking to SMTP and letting zabbix tell to the SMTP port as long as are settings are identical.

I would check if "SMTP helo" and "SMTP email" (your sender address) is set correctly. See those settings under "Administration - Media".

Besides that, a more verbose debug output of the server is of big help.

[Jmickey]

Hi, thanks for the reply.

Maybe I am not explaining correctly but what I am trying to say is that the issue is not with the SMTP settings within zabbix.

I have setup postfix on the zabbix server, which relays the message to my exchange server. The only purpose of the postfix server is so that it would be easier to understand any errors occurring with the communication between zabbix and exchange.

However, the email never even reaches postfix. The issue is not with postfix, because I can telnet, send an email and receive the email in my company mailbox without an issue. I telnet as follows:

# telnet localhost 25
helo localhost
mail from: [email protected]
rcpt to: [email protected]
Subject: Test
Test
.

This works without a hitch. The email is relayed through to exchange, through the receive connector and into my mailbox. Perfect.

Within zabbix Administration -> Media -> Email my settings are as follows:

Server: localhost
SMTP helo: localhost
SMTP Email: [email protected]

As you can see, these are EXACTLY the same as the commands given to postfix through telnet.

The only error message I get is through Administration -> Audit -> Actions which says

cannot connect to SMTP server [my.exch.server]: cannot connect to [[my.exch.server]:25]: [13] Permission denied.

Checking the postfix logs:

# cat /var/log/maillog

Doesn't even show the zabbix server connecting to the postfix server. It never even gets that far. This is not a settings issue. Zabbix or Linux might not be a strong suit for me but I know and understand email very well, the settings are fine.

Some research seems to suggest a permissions issue with a file or script somewhere along the line, but unfortunately I don't know where that might be? I've spent a fair amount of time googling but I can't seem to find anyone with a related issue.

[steveboyson]

Is selinux or app-armor enabled?

You could try a "su - zabbix --shell=/bin/bash" and then try the "telnet to localhost 25" stuff again.

(or use whatever user account you use for your zabbix-server)

[Jmickey]

Hi,

Thanks for your reply.

SELinux is enabled. Port 25 is also open in iptables.

The command # su - zabbix --shell=/bin/bash gives the following feedback:

su: warning: cannot change directory to /var/lib/zabbix: No such file or directory

I doubt SELinux is causing an issue, that warning regarding the zabbix user seems odd. I followed the wiki for installing zabbix on CentOS and it never said to create a user, so I imagine this was during the package installation?

Thanks for the help.

[steveboyson]

Do as root:

mkdir /var/lib/zabbix && chown zabbix /var/lib/zabbix && chgrp zabbix /var/lib/zabbix

Then try again:

su - zabbix --shell=/bin/bash
telnet localhost 25

If that works, but zabbix still not, it is SELinux.

[steveboyson]

I would bet 100 EUR that it is SELinux which causes your probs.

https://www.zabbix.com/forum/showthread.php?t=43504

https://www.zabbix.com/forum/showthread.php?t=44588

[Jmickey]

I would bet 100 EUR that it is SELinux which causes your probs.

https://www.zabbix.com/forum/showthread.php?t=43504

https://www.zabbix.com/forum/showthread.php?t=44588

YES THANK YOU SO MUCH!

Lucky for me I never make a bet on something I know very little about, not to mention the Australian Dollar -> EUR exchange rate sucks!

I ran 'setenforce 0' like it said in one of the threads you linked and tried again it it worked perfectly! Time to start researching how to fix this. I know nothing about SELinux and hadn't even heard of it until I took on this zabbix project (I had some previous experience with Linux however). I had read a little about it somewhere before and it mentioned this command:

# setsebool httpd_can_sendmail 1

I am guessing this isn't the correct command for this particular case.

Thanks again for your help, lots to learn!

[steveboyson]

Cheers, and you're welcome ;-)

[PiotrIr]

This fixed problem for me:
setsebool -P zabbix_can_network 1