SMTP authentication issue

[f0x0ff]

Hello,

I have a problem with SMTP authentication.

Configured SMTP server is allowing: AUTH PLAIN LOGIN NTLM

For some reason NTLM method is not working (I tried with curl on the command line interface all available methods - PLAIN, LOGIN and NTLM and only NTLM is not working. Unfortunately I'm not sure whether the problem is with curl itself (curl 7.64.0) or with the SMTP server (didn't have a time to read how to simulate NTLM authentication with the old school way with telnet ...)

I would like to force zabbix-server/curl to use one of the other authentication methods - PLAIN or LOGIN. Is there any simple way to do that?

I've read about CURLOPT_LOGIN_OPTIONS, but obviously I don't understand it well. My assumption was that I have to do something like CURLOPT_LOGIN_OPTIONS="AUTH=PLAIN" which I added into EnvironmentFile=-/etc/default/zabbix-server, reloaded the zabbix daemon, checked CURLOPT_LOGIN_OPTIONS is properly set (cat /proc/<pid>/environ), but zabbix is still trying to use NTLM method.

Any help is highly appreciated!

Regards,
Plamen

[Hamardaban]

Do you want to send mail using curl over the smtp protocol?

curl -vk smtp://mail.blabla.com:587/ \ --mail-from [email protected] --mail-rcpt [email protected] --upload-file mail.txt\ --user '[email protected]:Password' --ssl

Or do something else?

[f0x0ff]

Thanks Hamardaban,

I can send emails with curl (even with telnet) using PLAIN or LOGIN authentication method. The problem I have is that zabbix is not able to do the same. Zabbix uses curl and curl tries to authenticate with NTLM, which is broken (either curl implementation I'm using or SMTP server, whcih is not under my control). All I want to do is to configure the zabbix-server to force libcurl to use PLAN or LOGIN authentication instead of NTLM.
Hope that makes sense.

Regards,
Plamen

[Hamardaban]

Yes - it's more understandable.
Usually the situation is the opposite - you need to try to get curl to work with NTLM... :-)

In zabix, where and how is it configured to use curl for smtp?
Do I understand correctly that when working from the command line, you can normally connect to the mail server using curl and explicitly specifying the authentication method (PLAIN, LOGIN) and calling the same command from zabbix does not work?

[f0x0ff]

I've configured STMP according to https://www.zabbix.com/documentation...ns/media/email.
I'm assuming Zabbix is using curl based on the "Attention" note at the end of the document:

To make SMTP authentication options available, Zabbix server should be compiled with the --with-libcurl compilation option with cURL 7.20.0 or higher.

Moreover in "Authentication" it says:

Select the level of authentication:
None - no cURL options are set
(since 3.4.2) Username and password - implies "AUTH=*" leaving the choice of authentication mechanism to cURL
(until 3.4.2) Normal password - CURLOPT_LOGIN_OPTIONS is set to "AUTH=PLAIN"

In my case - if I was using Zabbix version prior 3.4.2 it would use AUTH=PLAIN which would work for me. But with recent versions it is "leaving the choice of authentication mechanism to cURL" and I assume curl is choosing NTLM because NTLM is more secure than PLAN or LOGIN.
The question is - how can I configure Zabbix to ask libcurl to use AUTH=PLAIN.

Regards,
Plamen

[f0x0ff]

Any workarounds for that annoying issue?
Any kind of SMTP proxy between SMTP server and zabbix-server allowing LOGIN or PLAIN authentication methods only?
Or some kind of script instead of build-in SMTP media?
I'm also considering an update of libcurl packages or to compile it from source without NTLM (if possible), that's the last thing I may try and probably the riskiest one.

Regards,
Plamen

[Hamardaban]

If you look at the source codes (https://github.com/zabbix/zabbix/blo...xmedia/email.c), you can see that you are right - curl chooses the best method available on the server. You can modify this module by adding the options you need and compile it (by curl_easy_setopt(easyhandle, CURLOPT_LOGIN_OPTIONS, AUTH=PLAIN) ).

[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]if (SMTP_AUTHENTICATION_NORMAL_PASSWORD == smtp_authentication)[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]{[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]if (CURLE_OK != (err = curl_easy_setopt(easyhandle, CURLOPT_USERNAME, username)) ||[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]CURLE_OK != (err = curl_easy_setopt(easyhandle, CURLOPT_PASSWORD, password)))[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]{[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]goto error;[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]}[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"] [/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]/* Don't specify preferred authentication mechanism implying AUTH=* and let libcurl choose the best */[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]/* one (in its mind) among supported by SMTP server. If someday we decide to let user choose their */[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]/* preferred authentication mechanism one should know that: */[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]/* - versions 7.20.0 to 7.30.0 do not support specifying login options */[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]/* - versions 7.31.0 to 7.33.0 support login options in CURLOPT_USERPWD */[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
[TABLE="class: highlight tab-size js-file-line-container"]
[TR="class: cke_show_border"]
[TD="class: blob-code blob-code-inner js-file-line"]/* - versions 7.34.0 and above support explicit CURLOPT_LOGIN_OPTIONS */[/TD]
 		[/TR]
[TR="class: cke_show_border"]
[/TR]
[/TABLE]
 }

[f0x0ff]

Thanks Hamardaban,

Re-compiling the zabbix will definitely help. I thought it may take longer (to install gcc, libs, etc) and went into different direction.
I installed and configured a postfix relay on the same host, so it relays and authenticates to the problematic SMTP server.
Zabbix is now using 127.0.0.1 as a SMTP server, which relays to the original one.

My intention was to be 5 minutes workaround, if SMTP server wasn't behind a cisco ASA firewall messing up with ESMTP banner.... Anyway, 5 hours later zabbix is now able to send emails....

Regards,
Plamen