EXIM – Fix ‘Auth Not Advertised When Using EHLO’

authenticationdovecotexim

I've moved my mail server from one VM over to another. Everything has been configured as it was previously, and from the perspective of IMAP, there are no issues.

Currently however, I'm having an issue with sending emails. It's stating that a relay is not permitted, however looking at the configuration, this shouldn't be the case. To confirm the relay issue, I started to look at the an OpenSSL/Telnet communication to dig further.

This lead me to the fact that AUTH is not being advertised. I already have an ACL that allows sending an email from an authenticated user. I've also have 2 dovecot authenticators in my exim configuration:

dovecot_login:
  driver = dovecot
  public_name = LOGIN
  server_socket = /var/run/dovecot/auth-client
  server_set_id = $auth1

dovecot_plain:
  driver = dovecot
  public_name = PLAIN
  server_socket = /var/run/dovecot/auth-client
  server_set_id = $auth1

I have the authentication configuration on Dovecot configured as well, however, I'm still not getting AUTH advertised.

# stat /var/run/dovecot/auth-client
  File: ‘/var/run/dovecot/auth-client’
  Size: 0           Blocks: 0          IO Block: 4096   socket
Device: 13h/19d Inode: 327490      Links: 1
Access: (0660/srw-rw----)  Uid: (   93/    exim)   Gid: (    0/    root)
Context: system_u:object_r:dovecot_var_run_t:s0
Access: 2018-09-28 17:36:19.665586834 +0100
Modify: 2018-09-28 17:36:19.665586834 +0100
Change: 2018-09-28 17:36:19.665586834 +0100
 Birth: -

I have SELinux set to permissive, so I know that isn't causing an issue. This is the OpenSSL communication:

250 HELP
EHLO home.pc
250-mail.domain.com Hello home.pc [ip.ip.ip.ip]
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-CHUNKING
250-PRDR
250 HELP
AUTH
503 AUTH command used when not advertised
DONE

I'm a little stuck on how to resolve this. Any pointers on what to look at would be a godsend.

EDIT: Here is full Exim config: https://pastebin.com/q2zmQLiM

Best Answer

You have missed condition for auth advertising.
May be the simpliest way is to advertise the auth only for those hosts that have used TLS for connection: 

auth_advertise_hosts = ${if eq{$tls_cipher}{}{}{*}}

Semantics of the condition above is the next: auth is advertised for every host having non-empty tls-cipher(i.e. TLS is already established). All hosts that refuse to use TLS will be not advertised to autenticate.

That strategy is useful to prevent plain-pass autentication over unencrypted connections.

Related Topic