*RESOLVED* Qmail + VPOPMAIL + courierimap + NOT WORKING

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

This CANNOT be that damn dificult!

All I want is a server that allows people external to my network to connect to my server and send mail when authenticated.
What I have got thus far has been 553 rpchosts errors, relay-cntrl headaches, massive multiple conflicting "fixes", horribly written instructions that are so bad they are useless, and still not a damn thing working.
I have managed to get everyhing MOSTLY back to working. I still cannot send mail from an external site (one thats not listed as a relay)
error of:
The message could not be sent because one of the recipients was rejected by the server. The rejected e-mail address was XXXXXXXXXXXXX. Subject 'Test', Account: 'mail.boboki.com', Server: 'mail.boboki.com', Protocol: SMTP, Server Response: '553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)', Port: 25, Secure(SSL): No, Server Error: 553, Error Number: 0x800CCC79

My settings are:

kashani · Posted: Wed Mar 17, 2004 11:54 am Post subject:

Have you added the domains you recieve mail for to the following files?

/var/qmail/control/rcpthosts
/var/qmail/control/locals

kashani
_________________
Will personally fix your server in exchange for motorcycle related shop tools in good shape.

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

Yes I have.
The only way I can get it to send is if I allow relaying to whatever EXTERNAL IP I am on. It makes me think there is something wrong with my courier-pop3d or imapd, yet if I telnet into 110 and go thru the motions it accepts the password.
_________________
We the willing lead by the unknowing have done so much for so long with so little, we are now capable of doing everything with nothing.

kashani · Posted: Thu Mar 18, 2004 7:44 pm Post subject:

How are you trying to send the email, through imap or smtp? It's a bit unclear from the thread. If through imap, my understanding is that imap would authenticate you, accept the email, and then relay through qmail as localhost. If through smtp then qmail would need to authenticate you and then sends the mail itself.

The error you mentioned is qmail so I'm thinking the problem is with qmail or you don't have 127.0.0.1:allow,RELAYCLIENT="" in your /etc/tcp.smtp.

kashani
_________________
Will personally fix your server in exchange for motorcycle related shop tools in good shape.

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

I am sending via pop3.
I can send to anywhere from within an ip on my local network, simply because I allowed relaying from 192.168.0.
But anyone on any other ip anywhere else cannot send mail and gets the above error.
I have all my pertinant configs above as well. If anyone needs any other ones, I'll be happy to post them.

Besides that, I don't think Spamassasin and clamav are doing ANYTHING AT ALL. I see no checks in host headers. I see q-mailscanner checking, but nothing else.
_________________
We the willing lead by the unknowing have done so much for so long with so little, we are now capable of doing everything with nothing.

adaptr · Posted: Mon Mar 22, 2004 3:42 pm Post subject:

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

Let me restate that.
I am TRYING to send via pop3. :lol:

I don't have pop3 before smtp setup, but if that would fix my problem, I suppose I can get relay-ctrl or whatever.

I just verified that I get the SAME error if I try to use IMAP on an external ip.
I don't want to setup my server as an open relay, there HAS to be a way to fix it!
_________________
We the willing lead by the unknowing have done so much for so long with so little, we are now capable of doing everything with nothing.

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

Just found some more errors. This is from my qmail-send current log

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

More headaches.
I just did a telnet to port 25 and here is the NON-EDITED result:
220 *****************
ehlo
502 unimplemented (#5.5.1)
HELO
250 animeserver
AUTh
502 unimplemented (#5.5.1)
AUTH PLAIN
502 unimplemented (#5.5.1)

Something is seriously not right...
I copyied the original conf-smtpd and conf-pop3d files back over the old ones. then I modified QMAIL_SMTP_POST="boboki.com /var/vpopmail/bin/vchkpw /bin/true"
And uncommented the SMTP_AUTH.
Pop3 seems to check and authenticate just fine:
+OK Hello there.
USER *commented*
+OK Password required.
PASS *comented*
+OK logged in.
However I STILL get the SAME Protocol: SMTP, Server Response: '553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)', Port: 25, Secure(SSL): No, Server Error: 553, Error Number: 0x800CCC79 so its like NOTHING has changed.
I am very curious about that smtp telnet session, as it looks NOTHING like anyone elses.
_________________
We the willing lead by the unknowing have done so much for so long with so little, we are now capable of doing everything with nothing.

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

skunkworx · Posted: Mon Mar 22, 2004 11:44 pm Post subject:

Disclaimer: I don't use vpopmail, and am not familiar with how it integrates with qmail.

It looks like your original post boils down to this question: How come server mail.boboki.com is rejecting messages bound for "@boboki.com" addresses, saying, "sorry, that domain is not in my list of allowed rcpthosts"? If that is what you were asking, kashani gave you the answer: If you want your server to accept messages bound for "@boboki.com" addresses, "boboki.com" must appear in /var/qmail/control/rcpthosts. If, for example, you have "mail.boboki.com" listed, but not "boboki.com", addresses ending in "@mail.boboki.com" will work, but addresses ending in "@boboki.com" will not.

I imagine vpopmail has its own interface for editing /var/qmail/control/rcpthosts, so you may want to use that.

Depending on how vpopmail handles virtual users, "boboki.com" will also need to appear in either /var/qmail/control/locals or /var/qmail/control/virtualdomains. I suspect the latter file is used, and again, you may want to use vpopmail's interface for configuring these files.

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

Great post. Let me get to the answers.

I can recive mail to boboki.com just fine. All messages that are sent to say boboki@boboki.com (my address) have no problems getting there.
The virtualdomains file DOES have boboki.com. The problem comes in when I am trying to send an e-mail OUT to ANYWHERE in the world from an external ip via pop or imap. It seems that when I am sending from an IP that is NOT set in the tcp.smtp as a open relay, it will NOT send e-mail and get the standard 533 error. Also, I verified that there are not other smtp programs loaded.. emerge -C ssmtp exium postfix sendmail

Let me take a second to reitterate that I can recive ALL mail fine, be it from webfrontend, imap, or pop3. HOWEVER, I cannot send with pop3 or imap, I can ONLY send using the webfrontend, and the only reason I belive i can do that is becuase i have 127.0.0.1 and 192.168.0 as open relays.

The output I came to find out is what smtp looks like when it goes thru a PIX 501 firewall. I will look a tad bit more into that, make sure thats not conflicting with authentication. As far as I know it however, the pix is configured to allow smtp, and the ports are forwarded to that internal ip.
With the same configuration (I didn't change it when I switched to linux from windows 2003) it worked on my older setup, windows 2003 and mdaemon.
_________________
We the willing lead by the unknowing have done so much for so long with so little, we are now capable of doing everything with nothing.

skunkworx · Posted: Tue Mar 23, 2004 4:56 pm Post subject:

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

Yeah, you hit that on the head.
The pix 501 uses stateful packet filtering... and it is supposed to block attacks to smtp when using fixup, HOWEVER, it does this by stripping the auth headers!
So yeah, no wonder things were not working.
I just did a no fixup protocol smtp 25 and things are running great now.

Here is my WORKING conf-smtpd

skunkworx · Posted: Wed Mar 24, 2004 4:25 pm Post subject:

vcihon · Tux's lil' helper Joined: 19 Aug 2003 Posts: 107

I'm having a similar problem. I've been reading till I can't see anymore and my conf-smtpd looks exactly like yours below.

So since I have the same prob as this:

skunkworx · Posted: Sat May 15, 2004 11:30 pm Post subject:

vcihon · Tux's lil' helper Joined: 19 Aug 2003 Posts: 107

Thanks for the reply skunkworx.

I am using vchkpw for my auth, not md5 (FYI).

Here is the output:

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

vcihon · Tux's lil' helper Joined: 19 Aug 2003 Posts: 107

No but right now, I'm not even trying to get SSL working. I am only trying to get auth working. The issue is that I am not clear, given skunkworx's test how to try it with the vchkpw instead of MD5.

skunkworx · Posted: Mon May 17, 2004 5:07 pm Post subject:

vcihon: It looks like you're using a qmail ebuild newer than 1.03-r13. The newer ebuilds have an option, which is enabled by default, to force SMTP clients to request an encrypted session before the AUTH command is allowed. Trying to test AUTH without encryption will fail every time in this scenario.

If you want to allow authentication without encryption, you will need to either use ebuild 1.03-r13 instead, or re-emerge your ebuild with the "notlsbeforeauth" USE flag. (Note: I believe I remember reading that this USE flag doesn't actually work as designed in one of the qmail ebuilds, possibly 1.03-r14. A search through the forums and/or Gentoo's Bugzilla will confirm or deny that.)

The password checking program you use will not have an effect on the output you see when using the SMTP commands I suggested for testing. However, do keep in mind that the example output is based on the 1.03-r13 ebuild, and may be slightly different with the newer ebuilds (I haven't tried anything past 1.03-r13 yet). In any case, the response to the AUTH command should start with "334" in order for authentication to work.
_________________
Proud to be a... eh, forget it.

"Everyday is just one day." -- not the Traveling Wilburys

vcihon · Tux's lil' helper Joined: 19 Aug 2003 Posts: 107

skunkworx - thanks for the response. I am using 1.03-r13.

One question, if I remerge qmail, will I lose any of my config settings or will it be smart enough to keep them. This is a quasi production server already (meaning for my own email

).

Also, can you give me the correct syntax of the emerge statement - is it:

USE="notslbeforeauth" emerge -U qmail

to go to r15?

Thanks.

p4m · n00b Joined: 10 Feb 2004 Posts: 14