Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256311 > unrolled thread

Re: exim failure

Started bypeter@easthope.ca
First post2023-03-23 19:50 +0100
Last post2023-03-25 05:20 +0100
Articles 2 — 2 participants

Back to article view | Back to linux.debian.user

Contents

  Re: exim failure peter@easthope.ca - 2023-03-23 19:50 +0100
    Re: exim failure David Wright <deblis@lionunicorn.co.uk> - 2023-03-25 05:20 +0100

#256311 — Re: exim failure

Frompeter@easthope.ca
Date2023-03-23 19:50 +0100
SubjectRe: exim failure
Message-ID<GcyaB-ezX8-5@gated-at.bofh.it>
Header lines not handled by Web interface.
In-reply-to: <ZBt73O0yIqk5VMNv@axis.corp>
References: <5674e986a67af53a04b27f08cd16146f@easthope.ca> 
<ZBt73O0yIqk5VMNv@axis.corp>

     From: David Wright <deblis@lionunicorn.co.uk>
     Date: Wed, 22 Mar 2023 17:06:20 -0500
> What are the contents of /etc/exim4/update-exim4.conf.conf, the
> configuration file?

# /etc/exim4/update-exim4.conf.conf
#
# Most of the heading comments removed.
#
# This is a Debian specific file

dc_eximconfig_configtype='smarthost'
dc_other_hostnames=''
dc_local_interfaces='127.0.0.1'
dc_readhost='dalton.invalid'
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost='hornby.islandhosting.com::465'
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname='true'
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'

> I assumed you just stared at the screen until this timeout appeared.

My thought was "broken configuration".

> You've now got to type something. It will then talk back to you.
> Try typing (ignore my indentation):
> 
>   ehlo dalton.invalid              ← that's not a typo
>   mail from: peter@easthope.ca
>   rcpt to: peter@easthope.ca
>   data
>   from: peter@easthope.ca
>   to: peter@easthope.ca
>   subject: hand written test 01
>                                    ← that's a blank line
>   Hand written test 01
>   .                                ← that's nothing but a fullstop 
> Return
>   quit

root@dalton:/home/root# exim -bh 142.103.107.137.465

**** SMTP testing session as if from host 142.103.107.137
**** but without any ident (RFC 1413) callback.
**** This is not for real!

>>> host in hosts_connection_nolog? no (option unset)
>>> host in host_lookup? yes (matched "*")
>>> looking up host name for 142.103.107.137
>>> IP address lookup yielded "dalton.invalid"
>>> checking addresses for dalton.invalid
>>>   127.0.1.1
>>>   142.103.107.137 OK
>>> host in host_reject_connection? no (option unset)
>>> host in sender_unqualified_hosts? no (option unset)
>>> host in recipient_unqualified_hosts? no (option unset)
>>> host in helo_verify_hosts? no (option unset)
>>> host in helo_try_verify_hosts? no (option unset)
>>> host in helo_accept_junk_hosts? no (option unset)
>>> host in pipelining_connect_advertise_hosts? yes (matched "*")
220 dalton.invalid ESMTP Exim 4.94.2 Thu, 23 Mar 2023 10:45:12 -0700
ehlo dalton.invalid
>>> host in dsn_advertise_hosts? no (option unset)
>>> host in pipelining_advertise_hosts? yes (matched "*")
>>> host in auth_advertise_hosts? yes (matched "*")
>>> host in chunking_advertise_hosts? yes (matched "*")
>>> host in tls_advertise_hosts? yes (matched "*")
>>> host in smtputf8_advertise_hosts? no (end of list)
250-dalton.invalid Hello dalton.invalid [142.103.107.137]
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-PIPE_CONNECT
250-CHUNKING
250-STARTTLS
250-PRDR
250 HELP
mail from: peter@easthope.ca
>>> using ACL "acl_check_mail"
>>> processing "accept" (/var/lib/exim4/config.autogenerated 265)
>>> accept: condition test succeeded in ACL "acl_check_mail"
>>> end of ACL "acl_check_mail": ACCEPT
250 OK
rcpt to: peter@easthope.ca
>>> using ACL "acl_check_rcpt"
>>> processing "accept" (/var/lib/exim4/config.autogenerated 277)
>>> check hosts = :
>>> host in ":"? no (end of list)
>>> accept: condition test failed in ACL "acl_check_rcpt"
>>> processing "deny" (/var/lib/exim4/config.autogenerated 292)
>>> check domains = +local_domains
>>> easthope.ca in "@:localhost"? no (end of list)
>>> easthope.ca in "+local_domains"? no (end of list)
>>> deny: condition test failed in ACL "acl_check_rcpt"
>>> processing "deny" (/var/lib/exim4/config.autogenerated 301)
>>> check domains = !+local_domains
>>> easthope.ca in "!+local_domains"? yes (end of list)
>>> check local_parts = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
>>> peter in "^[./|] : ^.*[@%!`#&?] : ^.*/\.\./"? no (end of list)
>>> deny: condition test failed in ACL "acl_check_rcpt"
>>> processing "accept" (/var/lib/exim4/config.autogenerated 307)
>>> check local_parts = postmaster
>>> peter in "postmaster"? no (end of list)
>>> accept: condition test failed in ACL "acl_check_rcpt"
>>> processing "deny" (/var/lib/exim4/config.autogenerated 322)
>>> check !acl = acl_local_deny_exceptions
>>>  using ACL "acl_local_deny_exceptions"
>>>  processing "accept" (/var/lib/exim4/config.autogenerated 238)
>>>  check hosts = ${if 
>>> exists{/etc/exim4/host_local_deny_exceptions}{/etc/exim4/host_local_deny_exceptions}{}}
>>> host in ""? no (end of list)
>>>  accept: condition test failed in ACL "acl_local_deny_exceptions"
>>>  processing "accept" (/var/lib/exim4/config.autogenerated 242)
>>>  check senders = ${if 
>>> exists{/etc/exim4/sender_local_deny_exceptions}{/etc/exim4/sender_local_deny_exceptions}{}}
>>> peter@easthope.ca in ""? no (end of list)
>>>  accept: condition test failed in ACL "acl_local_deny_exceptions"
>>>  processing "accept" (/var/lib/exim4/config.autogenerated 246)
>>>  check hosts = ${if 
>>> exists{/etc/exim4/local_host_whitelist}{/etc/exim4/local_host_whitelist}{}}
>>> host in ""? no (end of list)
>>>  accept: condition test failed in ACL "acl_local_deny_exceptions"
>>>  processing "accept" (/var/lib/exim4/config.autogenerated 250)
>>>  check senders = ${if 
>>> exists{/etc/exim4/local_sender_whitelist}{/etc/exim4/local_sender_whitelist}{}}
>>> peter@easthope.ca in ""? no (end of list)
>>>  accept: condition test failed in ACL "acl_local_deny_exceptions"
>>>  end of ACL "acl_local_deny_exceptions": implicit DENY
>>> check senders = ${if 
>>> exists{/etc/exim4/local_sender_callout}{/etc/exim4/local_sender_callout}{}}
>>> peter@easthope.ca in ""? no (end of list)
>>> deny: condition test failed in ACL "acl_check_rcpt"
>>> processing "deny" (/var/lib/exim4/config.autogenerated 333)
>>> check condition = ${if and 
>>> {{>{$rcpt_count}{10}}{<{$recipients_count}{${eval:$rcpt_count/2}}} }}
>>>                 =
>>> deny: condition test failed in ACL "acl_check_rcpt"
>>> processing "accept" (/var/lib/exim4/config.autogenerated 338)
>>> check hosts = +relay_from_hosts
>>> host in ": 127.0.0.1 : ::::1"? no (end of list)
>>> host in "+relay_from_hosts"? no (end of list)
>>> accept: condition test failed in ACL "acl_check_rcpt"
>>> processing "accept" (/var/lib/exim4/config.autogenerated 343)
>>> check authenticated = *
>>> accept: condition test failed in ACL "acl_check_rcpt"
>>> processing "require" (/var/lib/exim4/config.autogenerated 348)
>>> check condition = ${if def:sender_helo_name}
>>>                 = true
>>>   message: nice hosts say HELO first
>>> require: condition test succeeded in ACL "acl_check_rcpt"
>>> processing "require" (/var/lib/exim4/config.autogenerated 352)
>>>   message: relay not permitted
>>> check domains = +local_domains : +relay_to_domains
>>> easthope.ca in ""? no (end of list)
>>> easthope.ca in "+local_domains : +relay_to_domains"? no (end of list)
>>> require: condition test failed in ACL "acl_check_rcpt"
>>> end of ACL "acl_check_rcpt": not OK
550 relay not permitted
LOG: H=dalton.invalid [142.103.107.137] F=<peter@easthope.ca> rejected 
RCPT peter@easthope.ca: relay not permitted

root@dalton:/home/root# head -n 3 /etc/hosts
# dalton:/etc/hosts
127.0.0.1       localhost.localdomain localhost
127.0.1.1       dalton.invalid  dalton

Whereas above, exim says this.

>>> checking addresses for dalton.invalid
>>>   127.0.1.1
>>>   142.103.107.137 OK

Seems incorrect to mention 127.0.1.1 and not 127.0.0.1.

Eventually exim complains about relaying whereas the test is from
localhost.

Thx,             ... P.

[toc] | [next] | [standalone]

#256353

FromDavid Wright <deblis@lionunicorn.co.uk>
Date2023-03-25 05:20 +0100
Message-ID<Gd3xL-eUoW-3@gated-at.bofh.it>
In reply to#256311
On Thu 23 Mar 2023 at 11:27:17 (-0700), peter@easthope.ca wrote:
> 
> # /etc/exim4/update-exim4.conf.conf
> #
> # Most of the heading comments removed.
> #
> # This is a Debian specific file
> 
> dc_eximconfig_configtype='smarthost'
> dc_other_hostnames=''
> dc_local_interfaces='127.0.0.1'
> dc_readhost='dalton.invalid'
> dc_relay_domains=''
> dc_minimaldns='false'
> dc_relay_nets=''
> dc_smarthost='hornby.islandhosting.com::465'
> CFILEMODE='644'
> dc_use_split_config='false'
> dc_hide_mailname='true'
> dc_mailname_in_oh='true'
> dc_localdelivery='mail_spool'

That looks fine, and shows that you're going to send through their
port 465, which will require TLS and authentication. So first you need
to encode your username and password with:

  $ echo -e -n '\0username\0password' | base64

You'll need to cut and paste that string in a moment. Bear in mind
that you should not reveal or post that string as it's easily decoded.

Start your test session with something more like:

  $ openssl s_client -starttls smtp -crlf -connect hornby.islandhosting.com:465
  EHLO dalton.invalid
  AUTH PLAIN encodedstring

where encodedstring is the output from running the echo…base64
command. Note that it's sent encrypted.

Unlike the test of exim that you conducted with:

> root@dalton:/home/root# exim -bh 142.103.107.137.465

this one will send a real email, which you should get back as
recipient. This will be testing your new smarthost, and if it
doesn't like you, you should get the error message straightaway,
rather than having to decode what exim would have written in its
log. There's an example at the bottom.

> **** SMTP testing session as if from host 142.103.107.137
> **** but without any ident (RFC 1413) callback.
> **** This is not for real!
> 
> > > > host in hosts_connection_nolog? no (option unset)
> > > > host in host_lookup? yes (matched "*")
> > > > looking up host name for 142.103.107.137
> > > > IP address lookup yielded "dalton.invalid"
> > > > checking addresses for dalton.invalid
> > > >   127.0.1.1
> > > >   142.103.107.137 OK

[ … ]

> > > > end of ACL "acl_check_rcpt": not OK
> 550 relay not permitted
> LOG: H=dalton.invalid [142.103.107.137] F=<peter@easthope.ca> rejected
> RCPT peter@easthope.ca: relay not permitted

Fair enough—exim is configured to send to a "real" smarthost on
the Internet: almost no sites allow relaying nowadays (spam).
(My exims are set up very differently from yours.)

> root@dalton:/home/root# head -n 3 /etc/hosts

(BTW you shouldn't need to be root for exim or any of this.)

> # dalton:/etc/hosts
> 127.0.0.1       localhost.localdomain localhost
> 127.0.1.1       dalton.invalid  dalton
> 
> Whereas above, exim says this.
> 
> > > > checking addresses for dalton.invalid
> > > >   127.0.1.1
> > > >   142.103.107.137 OK
> 
> Seems incorrect to mention 127.0.1.1 and not 127.0.0.1.

You started exim with 142.103.107.137. AIUI exim looks that up and
gets dalton.invalid (presumably with a local DNS server?). It then
looks up dalton.invalid and gets 127.0.1.1 from /etc/hosts.

You'd need to start exim with 127.0.0.1 to use localhost.

> Eventually exim complains about relaying whereas the test is from
> localhost.

Here's the example session, suitably mangled:

  $ openssl s_client -starttls smtp -crlf -connect hornby.islandhosting.com:465     ←
  CONNECTED(00000003)
  [certificate stuff]
  ---
  250 OK
  ehlo dalton.invalid                                                               ←
  250-blablahornby.islandhosting.com hello [158.69.159.172], pleased to meet you
  250-HELP
  250-AUTH LOGIN PLAIN
  250-SIZE 28672000
  250-ENHANCEDSTATUSCODES
  250-8BITMIME
  250 OK
  auth plain abcdefghijklmnopqrstuvwxyz==                                           ←
  235 2.7.0 ... authentication succeeded
  mail from: peter@easthope.ca                                                      ←
  250 2.1.0 <peter@easthope.ca> sender ok
  rcpt to: peter@easthope.ca                                                        ←
  250 2.1.5 <peter@easthope.ca> recipient ok
  data                                                                              ←
  from: <peter@easthope.ca>                                                         ←
  to: <peter@easthope.ca>                                                           ←
  subject: hand written test 01                                                     ←
                                                                     (blank line)   ←
  354 enter mail, end with "." on a line by itself
  Hand written test 01                                                              ←
  .                                                                                 ←
  250 2.0.0 iHxl1z00J2LfVNE01HycHK mail accepted for delivery
  quit                                                                              ←
  221 2.0.0 blablahornby.islandhosting.com closing connection
  read:errno=0
  $ 

You type the lines indicated. The responses will differ in detail.
I EHLO with the fqdn of my computer as well, but it's just ahost.corp;
and I authenticate with my ISP credentials; but I also have to
MAIL FROM: with the ISP account's email address (which I never use).
OTOH the From: header relates to my hosting service, 3000 miles away.

These are the sort of things that can vary with different smarthosts.
When travelling, I typically -connect to my hosting service's
submissions port, authenticate with their credentials, and MAIL FROM:
with nobody@my.domain. (I could do that at home too.)

In case ports 465 and 587 are blocked, my email hosting service also
provides port 25025 as a workaround submissions port. Again, these
services vary from company to company.

Cheers,
David.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web