Qmail SMTP Whitelist & SMTP Authentication

authenticationemailsmtpwhitelist

How can I get qmail to work with both an smtp whitelist and smtp authentication?

If my IP is whitelisted, SMTP authentication does not seem to work (error: "the server does not support SMTP password authentication). This is particularly annoying when using our SMTP server on a roaming device, eg. an iPhone.

As soon as the iPhone is not using the whitelisted IP (ie. not in the office, but over 3G), then SMTP authentication works fine.

Best Answer

If you have the option, install something specifically as a Mail Submission Agent (MSA) for authenticated SMTP mail submission listening on port 587, and have that forward mails to your qmail MTA for subsequent delivery.

Related Solutions

SMTP Authentication – Can Two Mail Servers Communicate Without Authentication?

A common configuration is that email destined to addresses "inside" the organization does not require authentication, while "outbound" email does require authentication. This allows an organization to receive inbound email while not becoming a source of spam sent by unscrupulous random people on the internet.

This is often implemented by having completely separate sets of servers responsible for inbound and outbound email. Outbound servers are configured to require authentication in all cases, while inbound servers do not require authentication but will only accept messages destined for delivery inside the organization.

I queried for the MX of googles mail servers and tried initiating SMTP session via telnet, but it didn't seem to work, I just had a black screen, no HELO, no EHLO, nothing.

This seems to work as expected.

$ host -t mx google.com
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.

$ telnet aspmx.l.google.com. 25
Trying 74.125.131.27...
Connected to aspmx.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP db10si2487268vdc.138

Can’t connect to SMTP over 587

SASL Authentication Check List

Base on question and comments, sasl may not be setup correctly. Following check list is created base on Ubunut Guide provided in question.

Check file/etc/postfix/sasl/smtpd.conf, should be like following
```
pwcheck_method: saslauthd
mech_list: plain login
```

Check libsasl installed

dpkg -l | grep sasl

Should have the following (version number may differ)

ii  libsasl2-2           2.1.25.dfsg1-4    Cyrus SASL - authentication abstraction library
ii  libsasl2-modules     2.1.25.dfsg1-4    Cyrus SASL - pluggable authentication modules
ii  sasl2-bin            2.1.25.dfsg1-4    Cyrus SASL - administration programs for SASL users database

Check saslauthd is running
```
ps -ef | grep sasl
```

Check saslauthd PWDIR

grep PWDIR /etc/default/saslauthd

Output should be

PWDIR="/var/spool/postfix/var/run/saslauthd"

Postfix submission/587

/etc/postfix/master.cf

The Ubuntu guide only un-comment one line

submission inet n       -       -       -       -       smtpd

Try ucomment the whole section, including the options following it

submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Then restart postfix

sudo service postfix restart

Double check your smtp login name

Since the guide is not using virtual user, your smtp login name should be joe only, not joe@mysite.com. Double check email clients on your deivces/computers/webservices(gmail) are NOT using your email address as smtp login name. (Many do that for you. You will have to manually change it if so.)
Remove Password Map

I believe you are authenticating against local Linux account, not virtual user. Remove the following lines in /etc/postfix/main.cf
```
# password maps will not work. Customer must provide credentials
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
```