Use Case: We have several Eaton PDU/PSUs that don’t support SSL/TLS authentication. I was tasked with building a SMTP relay server that can take the basic SMTP/25 emails and forward them to our email provider via SSL.
Note: The relay host makes the smtps connectione on 465 using stunnel.
I am at a point where my SMTP Postfix Relay Server is able to send mail successfully via our email provider, alimail. But I cannot get it to relay emails from other hosts on our network.
smtpd_banner = mail01v-la ESMTP inet_interfaces = all inet_protocols = ipv4 mynetworks = 127.0.0.0/8, 10.96.80.1/24 relayhost = [127.0.0.1]:5000 smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd smtp_sasl_security_options = noanonymous smtp_tls_CApath = /etc/ssl/certs smtp_use_tls = no smtp_generic_maps = regexp:/etc/postfix/generic
client = yes foreground = no [smtps] accept = 5000 connect = smtp.mxhichina.com:smtps
SMTP Telnet to Provider
[root@mail01v-la ~]# telnet smtp.mxhichina.com smtp Trying 188.8.131.52... Connected to smtp.mxhichina.com. Escape character is '^]'. 220 smtp.aliyun-inc.com MX AliMail Server ehlo google.come 250-smtp.aliyun-inc.com 250-STARTTLS 250-8BITMIME 250-AUTH=PLAIN LOGIN XALIOAUTH 250-AUTH PLAIN LOGIN XALIOAUTH 250-PIPELINING 250 DSN
Checking Stunnel Connection
[root@mail01v-la ~]# telnet 127.0.0.1 5000 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 smtp.aliyun-inc.com MX AliMail Server
Sending an Email from the Relay Server
echo "Stack Body" | mail -s "Test Subject for Stack" firstname.lastname@example.org
Feb 14 18:30:29 mail01v-la postfix/pickup: 3194940DE2: uid=0 from=<root> Feb 14 18:30:29 mail01v-la postfix/cleanup: 3194940DE2: message-id=<20200215023029.3194940DE2@mail01v-la.domain.com> Feb 14 18:30:29 mail01v-la postfix/qmgr: 3194940DE2: from=<email@example.com>, size=481, nrcpt=1 (queue active) Feb 14 18:30:30 mail01v-la postfix/smtp: 3194940DE2: to=<firstname.lastname@example.org>, relay=127.0.0.1[127.0.0.1]:5000, delay=1.3, delays=0.01/0.01/0.85/0.46, dsn=2.0.0, status=sent (250 Data Ok: queued as freedom) Feb 14 18:30:30 mail01v-la postfix/qmgr: 3194940DE2: removed
Testing with other hosts
Random CentOS Server
/etc/postfix/main.cf relayhost = [10.96.80.126]:5000
Feb 14 18:06:52 test01v-la postfix/pickup: BB87C305A42F: uid=0 from=<root> Feb 14 18:06:52 test01v-la postfix/cleanup: BB87C305A42F: message-id=<20200215020652.BB87C305A42F@test01v-la.domain.com> Feb 14 18:06:52 test01v-la postfix/qmgr: BB87C305A42F: from=<email@example.com>, size=477, nrcpt=1 (queue active) Feb 14 18:06:53 test01v-la postfix/smtp: BB87C305A42F: to=<firstname.lastname@example.org>, relay=10.96.80.126[10.96.80.126]:5000, delay=0.78, delays=0.01/0.01/0.61/0.15, dsn=5.0.0, status=bounced (host 10.96.80.126[10.96.80.126] said: 553 authentication is required (in reply to MAIL FROM command))
email: message error -110 in function smtp_start_session test - (Connection timed out) retrying smtp_start_session test email: Failed to connect to SMTP server 10.96.80.126:5000 with username email@example.com
This is my first time doing a setup like this. Theres likely a lot of holes in my knowledge that are causing me grief.
In a proper setup, do you even need to re-type credentials for any hosts that want to use the relay server? For example, in the eaton smtp config, should it be the creds of the email used in the sasl file? Or a system account permitted for forwarding with postfix? Or an account name defined in the postfix/generic file? A bit lost.
Is stunnel even the proper way I should be connecting via ssl/tls? I see starttls available in the telnet prompt for smtp.mxhichina.com.
Honestly, I think I’m overcomplicating this or am missing something obvious. If anyone has a better setup to accomodate my use case, it be greatly appreciated as well.