Email Media Type not able to work with unauthenticated SMTP

[highway_fixer_man]

Hi,

I have been given access to an SMTP server from my zabbix instance. This allows me to telnet into the SMTP server on port 25 or 465 and send an email via telnet (Hostnames and IPs changed for security):

root@zabbix-master:~# telnet smtp.server.com 25
Trying 152.15.1.19...
Connected to smtp.server.com.
Escape character is '^]'.
220 CVG6h.server.com Microsoft ESMTP MAIL Service ready at Thu, 8 Dec 2022 11:52:01 +0200
ehlo ptops.co.za
250-CVG6h.server.com Hello [152.15.1.19]
250-SIZE 20971520
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-8BITMIME
250-BINARYMIME
250 CHUNKING
mail from: [email protected]
250 2.1.0 Sender OK
rcpt to: [email protected]
250 2.1.5 Recipient OK
data
354 Start mail input; end with <CRLF>.<CRLF>
Subject: Test

This is a test mail

.
250 2.6.0 <[email protected]> [InternalId=116664196661621, Hostname=CVG6h.server.com] 1593 bytes in 6.913, 0,225 KB/sec Queued mail for delivery​

This works for me and I am able to send mails from my zabbix server using this SMTP via telnet.

When I configure and test this media type via the GUI, I get various errors, depending on the way its setup.

• If I set "Connection Security" to none, and "Authentication" to none, I get "wrong answer on HELO "501 5.5.4 Invalid domain name"
• If I set "Connection Security" to "STARTTLS" and leave "SSL verify peer" and "SSL verify host" unchecked, and "Authentication" to none, I get "Access denied to remote resource: Remote access denied: 501"
• If I set "Connection Security" to "STARTTLS" and check "SSL verify peer" and leave "SSL verify host" unchecked, and "Authentication" to none, I get "Access denied to remote resource: Remote access denied: 501"
• If I set "Connection Security" to "STARTTLS" and check "SSL verify peer" and check "SSL verify host" and "Authentication" to none, I get "Access denied to remote resource: Remote access denied: 501"
• If I set "Connection Security" to "SSL/TLS" (using port 465) and leave "SSL verify peer" and "SSL verify host" unchecked, and "Authentication" to none, I get "SSL connect error: error:1408F10B:SSL routines:ssl3_get_record:wrong version number"
• If I set "Connection Security" to "SSL/TLS" (using port 465) and check "SSL verify peer" and "SSL verify host" unchecked, and "Authentication" to none, I get "SSL connect error: error:1408F10B:SSL routines:ssl3_get_record:wrong version number"
• If I set "Connection Security" to "SSL/TLS" (using port 465) and check "SSL verify peer" and check "SSL verify host" and "Authentication" to none, I get "SSL connect error: error:1408F10B:SSL routines:ssl3_get_record:wrong version number"

"Authentication" is always set to "None" as I do not have a username and password for this server - its open to me to relay through from my Zabbix server's IP.

If I check the /var/log/zabbix/zabbix_server.log, I dont see much of relevance, other than the errors listed above. There is nothing more in the logs to indicate what the issue is. Because telnet works, I would expect Zabbix should be able to send mails through the SMTP.

As always, I welcome and comments, suggestions or feedback.

[highway_fixer_man]

Turns out it was a DNS issue on my end.

[MADxHAWK]

Glad it worked out for you and you found a solution

[MADxHAWK]

Hi,

If I set "Connection Security" to none, and "Authentication" to none, I get "wrong answer on HELO "501 5.5.4 Invalid domain name"

It looks like either your host on wich zabbis is running is using an invalid domain name, or the name you entered in SMTP helo using invalid characters.

Make sure your Server running zabbix has a full qualified domain name (just a hostname is not enough) i had simmilar problems with only giving the server a hostname)
and the SMTP helo Entry in zabbix is not using illegal chars.
I just use zabbix as SMTP helo in the Emailconfiguration of zabbix

On linux you can also check /var/log/mail.log and /var/log/mail.err it might give further information what exactly is wrong.

BTW: on Linux check if sendmail is installed on the system. i had this problem once.

You can check if sendmail is working by

echo "Subject: Sendmail test" | sendmail -v [email protected]

[highway_fixer_man]

Thanks MADxHAWK.

Turns out it was an odd DNS issue whereby the SMTP name was resolving to a different, badly configured SMTP. Added correct IP to /etc/hosts and I am sorted.

Worth mentioning - I dont need sendmail. Its currently not installed and working well.

[highway_fixer_man]

Turns out it was a DNS issue on my end.

[MADxHAWK]

Glad it worked out for you and you found a solution