SMTP Authorisation isn't working anymore

[SOLVED] SMTP Authorisation isn't working anymore

Hi all,

I'm running now zimbra since approx 3 years without any problems… Now I have a really strange issue I can't fix.

Everything runs smooth when using the webclient. But when I'm using the IMAP client wherever I can get my mails, but I can't send… The following is in the zimbra.log…

Nov 21 14:19:25 zimbra postfix/smtpd[6321]: connect from < client >
Nov 21 14:19:25 zimbra postfix/smtpd[6321]: setting up TLS connection from < client >
Nov 21 14:19:25 zimbra postfix/smtpd[6321]: Anonymous TLS connection established from < client >: TLSv1 with cipher AES128-SHA (128/128 bits)
Nov 21 14:19:25 zimbra saslauthd[31180]: zmauth: authenticating against elected url 'https://zimbra.domain.com:7071/service/admin/soap/' ...
Nov 21 14:19:25 zimbra saslauthd[31180]: authentication against url 'https://zimbra.domain.com:7071/service/admin/soap/' caused error 'curl_easy_perform: error(56): Received HTTP code 403 from proxy after CONNECT'
Nov 21 14:19:25 zimbra saslauthd[31180]: url 'https://zimbra.domain.com:7071/service/admin/soap/' will not be used for (at least) 600 seconds
Nov 21 14:19:25 zimbra saslauthd[31180]: Authentication cycle re-elected url https://zimbra.domain.com:7071/service/admin/soap/, giving up ...
Nov 21 14:19:25 zimbra saslauthd[31180]: auth_zimbra: user@domain.com auth failed: curl_easy_perform: error(56): Received HTTP code 403 from proxy after CONNECT
Nov 21 14:19:25 zimbra saslauthd[31180]: do_auth : auth failure: [user=user@domain.com] [service=smtp] [realm=domain.com] [mech=zimbra] [reason=Unknown]
Nov 21 14:19:25 zimbra postfix/smtpd[6321]: warning: SASL authentication failure: Password verification failed
Nov 21 14:19:25 zimbra postfix/smtpd[6321]: warning: < client >: SASL PLAIN authentication failed: authentication failure
Nov 21 14:19:25 zimbra postfix/smtpd[6321]: lost connection after AUTH from < client >

This worked some days before… I've updated from 7.2.0 to 7.2.1, hoping this would fix the issue. But I simply can't explain why this isn't working:

# zmprov getServer `zmhostname`| grep Auth
zimbraMtaAuthEnabled: TRUE
zimbraMtaAuthHost: zimbra.domain.com
zimbraMtaAuthTarget: TRUE
zimbraMtaAuthURL: https://zimbra.domain.com:443/service/soap/
zimbraMtaSaslAuthEnable: yes
zimbraMtaTlsAuthOnly: TRUE

The SSL certificate can't be the problem, this is still valid:

# mcertmgr viewdeployedcrt
::service mta::
notBefore=Feb 22 14:54:24 2011 GMT
notAfter=Feb 22 14:54:24 2014 GMT
subject= /CN=*.domain.com/emailAddress=mail@domain.com
SubjectAltName= domain.com, *.domain.com
( same cert for every service )

Are there any more logging informations, why this authentication request fails?

I would be glad if someone could help me... Thanks in advance..

Quote:

Received HTTP code 403 from proxy after CONNECT

That error seems really strange, as Zimbra shouldn't be connecting to a proxy in the first place I think.

Is it a multiserver setup? Could you check your DNS settings, if by any chance the Zimbra server is looping to itself via an external proxy?

Quote:

Originally Posted by shanxt

That error seems really strange, as Zimbra shouldn't be connecting to a proxy in the first place I think.

Interesting, I found the problem. The saslauthd uses the local bash environment for the https connector when authorizing. Since we use a cache-proxy for every dmz-host, every request is going to that proxy. We've configured that into /etc/profile.d and, obviously, Zimbra sources those configs as well.

Now I've put the following lines into the /opt/zimbra/.bash_profile:

Quote:

# User specific environment and startup programs
unset http_proxy
unset https_proxy
unset ftp_proxy

Now it works! Thanks a lot – simple solution in the end…

But why does the Zimbra environment includes the system specific configuration in /opt/zimbra/.bashrc?

Quote:

# Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi