Unable to configure SMTP server

[ybizeul]

[See solution below]

I'm trying to configure Zabbix to use my own SMTP server (the one I use in my email clients, all the products that needs to send emails etc).

Problem is, it doesn't seem like Zabbix is correctly sending credential and authentication is always refused. Things like :

[30/Mar/2018 15:05:44] SMTP server connection from x.x.x.x closed after 3 bad commands
[30/Mar/2018 15:43:27] Failed SMTP login from x.x.x.x with SASL method DIGEST-MD5.

SMTP Auth is enabled :

28150:20180330:175847.491 ****** Enabled features ******
28150:20180330:175847.491 SNMP monitoring: YES
28150:20180330:175847.491 IPMI monitoring: YES
28150:20180330:175847.491 Web monitoring: YES
28150:20180330:175847.491 VMware monitoring: YES
28150:20180330:175847.491 SMTP authentication: YES
28150:20180330:175847.491 Jabber notifications: YES
28150:20180330:175847.491 Ez Texting notifications: YES
28150:20180330:175847.491 ODBC: YES
28150:20180330:175847.491 SSH2 support: YES
28150:20180330:175847.491 IPv6 support: YES
28150:20180330:175847.491 TLS support: YES
28150:20180330:175847.491 ******************************

I successfully configured it with my google mail using google SMTP server, but I want it to run through my mail server.

I know I could configure postfix locally to workaround this but I should be able to talk to my SMTP server directly.

Maybe we can tweak CURL options when it comes to authentication method? How?

EDIT :

Here is a debug of the SMTP session with zabbixtest / Test123# as password

# Server
250-myserver.org
250-AUTH CRAM-MD5 PLAIN LOGIN DIGEST-MD5
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-PIPELINING
250-ETRN
250-DSN
250 HELP

# Zabbix
AUTH DIGEST-MD5

# Server
334 cmVhbG09InNydjIudHluc29lLm9yZyIsbm9uY2U9IkZtNGR6WT NyR08xRWVZbE5YTUJlNWc9PSIscW9wPSJhdXRoIixhbGdvcml0 aG09bWQ1LXNlc3M=

# Note, here is the decoded content :
# realm="myserver.org",nonce="Fm4dzY3rGO1EeYlNXMBe5g ==",qop="auth",algorithm=md5-sess

# Zabbix
dXNlcm5hbWU9InphYmJpeHRlc3QiLHJlYWxtPSJzcnYyLnR5bn NvZS5vcmciLG5vbmNlPSJGbTRkelkzckdPMUVlWWxOWE1CZTVn PT0iLGNub25jZT0iMDFiZmYzNmUiLG5jPSIwMDAwMDAwMSIsZG lnZXN0LXVyaT0ic210cC9zcnYyLnR5bnNvZS5vcmciLHJlc3Bv bnNlPTZhNzdjMmVjNWE4YTk5YWVkZDQ5NTBkMjAxM2Q2ZDk2

# Note, here is the decoded content
# username="zabbixtest",realm="myserver.org",nonce=" Fm4dzY3rGO1EeYlNXMBe5g==",cnonce="01bff36e",nc="00 000001",digest-uri="smtp/myserver.org",response=6a77c2ec5a8a99aedd4950d2013 d6d96

# Server
535 5.7.0 Authentication failed

[ltxda]

If you're using your own mail server and all e-mail notices are to be delivered to a mailbox on your own mail server you don't need SMTP authentication. E-mail will just deliver when you configure your mail server without authentication. Now, if you're wanting to relay/send e-mail notices to third parties through your mail server then you will need SMTP authentication setup. What mail server are you running? Have you tested SMTP auth on your own mail server using anything else, like through telnet?

[ybizeul]

Thanks ltxda, that's actually a good point, it's possible I won't be kicked out as I'm addressing a local recipient, I'll give it a shot.

The mail server is Kerio Mailserver and yes, SMTP auth works pretty much everywhere I tried to configure it.

[ybizeul]

Ok, so my mail server is checking against PBL's, basically any dynamic ISP range are in there and unless it's authenticated it won't let you go.

So I'm still having an issue

[ltxda]

In Kerio, are you able to setup some sort of rule to allow relaying from a specified IP address or range of IP's? If so, you may be able to allow relaying for Zabbix by allowing its IP address? I know that can be done in Exchange but not sure about Kerio.

[ybizeul]

Unfortunately not really as I have a dynamic IP address, and I don't want to open the whole IP range. I'll keep using google SMTP for now. I was just hoping someone would understand the issue with SMTP auth

[ltxda]

Ah. Yea, that would be bad. So Zabbix is on a different network than your mail server?

[ybizeul]

Yep :-/ When I get a chance I'll collect new packet trace with just authentication and no SSL and submit relevant parts here

[ybizeul]

I added debug info the the original message

[ybizeul]

So...

That was quite a journey...

Centos 7 delivers the following cURL version :

[root@zabbix ~]# curl --version
curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.28.4 zlib/1.2.7 libidn/1.28 libssh2/1.4.3

I was trying to send email with it for troubleshooting, as I found out zabbix is using libcurl to send emails.

And I couldn't send email of course, I had the same issue.

The "simple" fix was to upgrade cURL, it's kind of dirty but that's the method I used :

https://serverfault.com/questions/32...test-on-centos

It upgrades cURL to :

[root@zabbix ~]# curl --version
curl 7.59.0 (x86_64-redhat-linux-gnu) libcurl/7.59.0 NSS/3.28.4 zlib/1.2.7 libpsl/0.7.0 (+libicu/50.1.2) libssh2/1.8.0 nghttp2/1.21.1

Now everything work

[ltxda]

Nice. Glad it's working for you now.