Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Port 25 blocked, need to get postfix to use 587

  1. #1
    Join Date
    May 2021
    Beans
    3

    Port 25 blocked, need to get postfix to use 587

    My new ISP blocks port 25 outbound. Before I changed ISPs I would have a cron job on my linux NAS box perform an mdadm command, create a log file and then mail the log
    file to me at my Gmail account. It worked slick for years until my new ISP. I have verified port 25 is blocked and that port 587 is open. I followed some suggestions to get Postfix to use a relay and port 587. That doesn't seem to work. I either don't understand what system to use as the relay or my errors are telling me I'm not authorized to use the relay. The following is the script that checks my RAID and then sends me an email with the body being the log file created by the script.

    Code:
    ##########
    # Check for a good internet connection.
    wget --spider --quiet http://yahoo.com
    if [ "$?" != 0 ]; then
      echo "Internet Connection down!" | mail -s "Internet issues" <user>@gmail.com
    fi
    
    
    echo `date` > /tmp/nas-raid-status.log
    echo >> /tmp/nas-raid-status.log
    
    
    /sbin/mdadm --detail /dev/md0 >> /tmp/nas-raid-status.log
    echo "-----" >> /tmp/nas-raid-status.log
    echo >> /tmp/nas-raid-status.log
    
    
    echo `date` >> /tmp/nas-raid-status.log
    
    
    cat /tmp/nas-raid-status.log | mail -s "NAS RAID Status" <user>@gmail.com
    ##########
    The following are the entries I added to my main.cf file in /etc/postfix.

    Code:
    ###########
    smtp_sasl_auth_enable = yes
    smtp_sasl_password_maps = static:<user>@gmail.com:Password
    smtp_sasl_security_options = noanonymous
    smtp_tls_security_level = encrypt
    relayhost = [smtp.gmail.com]:587
    ###########
    The following are the errors in /var/log/mail.log

    Code:
    May 26 13:07:47 xxxxxxxx postfix/pickup[4909]: D9398E601AA: uid=0 from=<root@xxxxxxxx.com>
    May 26 13:07:47 xxxxxxxx postfix/cleanup[5221]: D9398E601AA: message-id=<20210526190747.D9398E601AA@nas>
    May 26 13:07:47 xxxxxxxx postfix/qmgr[4910]: D9398E601AA: from=<root@xxxxxxxx.com>, size=1258, nrcpt=1 (queue active)
    May 26 13:07:48 xxxxxxxx postfix/smtp[5223]: D9398E601AA: SASL authentication failed; server smtp.gmail.com[172.253.117.109] said: 535-5.7.8 Username and Password not accepted. Learn more at?535 5.7.8  https://support.google.com/mail/?p=BadCredentials n12sm14789pjk.48 - gsmtp
    May 26 13:07:48 xxxxxxxx postfix/smtp[5223]: connect to smtp.gmail.com[2607:f8b0:400e:c0a::6c]:587: Network is unreachable
    May 26 13:07:48 xxxxxxxx postfix/smtp[5223]: D9398E601AA: to=<xxxxxxxx@gmail.com>, relay=none, delay=0.84, delays=0.08/0.02/0.75/0, dsn=4.4.1, status=deferred (connect to smtp.gmail.com[2607:f8b0:400e:c0a::6c]:587: Network is unreachable)
    Last edited by deadflowr; May 26th, 2021 at 08:33 PM. Reason: resetting fonts to forums defaults; placed in code tags

  2. #2
    Join Date
    Oct 2005
    Location
    Lab, Slovakia
    Beans
    10,387

    Re: Port 25 blocked, need to get postfix to use 587

    The best source for information is the Postfix web site:
    http://www.postfix.org/TLS_README.html

  3. #3
    Join Date
    May 2021
    Beans
    3

    Re: Port 25 blocked, need to get postfix to use 587

    Thanks for the reply. That's a great article. After reading the section that applies to my situation, I'm still confused about one thing. The "relayhost" directive. Is it suppose to be "Gmail/Google" for my example or is it suppose to be my local linux machine that is sending the message to my Gmail account? That's unclear in all of the docs that I've read.

  4. #4
    Join Date
    May 2021
    Beans
    3

    Re: Port 25 blocked, need to get postfix to use 587

    SOLVED: Everything in my configuration files and scripts are correct. It was a configuration change I needed to make on the Gmail side of things. Since I was using two factor authentication on my Gmail, I needed to create an App Password for my linux boxes that were sending the mail to me. Once I did that, it just started working. I followed the Google Help page.

    https://support.google.com/mail/answer/185833?hl=en

    Following this procedure created a large random password for my Linux boxes. I copied and pasted that password into the line -

    smtp_sasl_password_maps = static:<user>@gmail.com:Password

    Thanks!
    Last edited by CharlesA; May 27th, 2021 at 05:03 AM. Reason: disabled smilies so it didn't mess up the static mapping

  5. #5
    Join Date
    Mar 2010
    Location
    Squidbilly-Land
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Port 25 blocked, need to get postfix to use 587

    Quote Originally Posted by jdstaffon View Post
    Thanks for the reply. That's a great article. After reading the section that applies to my situation, I'm still confused about one thing. The "relayhost" directive. Is it suppose to be "Gmail/Google" for my example or is it suppose to be my local linux machine that is sending the message to my Gmail account? That's unclear in all of the docs that I've read.
    Well, really the relay host should have been the ISP's relay host on port 25.

    There are 3 SMTP(s) ports for MTAs like postfix, sendmail, exim.

    • 25/tcp - this is the default port configured for mail server -to- mail server communications. This is how random servers can send email to any other random email server on the internet.
    • 465/tcp - authenticated SMTP. This requires a client to authenticate using a userid and password. Often the userid would be the email address, but not necessarily the situation. This is a client -to- server connection. Generally used only by email clients like Outlook or Thunderbird or K9-Mail or Alpine.
    • 587/tcp - authenticated SMTP. This requires a client to authenticate using a userid and password. Often the userid would be the email address, but not necessarily the situation. This is a client -to- server connection. Generally used only by email clients like Outlook or Thunderbird or K9-Mail or Alpine.

    I honestly don't know why there is both 465 and 587 authenticated SMTP. Perhaps the industry picked one and Microsoft chose the other? IDK.

    It is the 25/tcp - server-to-server port that ISPs typically block to cut back on spammer emails coming from their netblocks.

    BTW, sending system emails to gmail really isn't very secure. Most email isn't encrypted, so it is like a postcard in the mail. There is almost always sensitive information inside system data.

    I'd rather see you setup an IMAP server at home, have it poll gmail plus 10 other email accounts and pull all messages local. Then you could connect to your home server over a VPN (you'd run the VPN server) and access all your email in 1, secured, location. Only 1 port would need to be open for inbound connections, just the VPN server. It isn't like anyone will get your 4K VPN key, right? For a simple, home, VPN server configuration, there is little chance of making a config mistake that let's the world in. Plus, you could set it up to force all traffic go through your home connection, so no matter where you are in the world, all internet stuff you do would appear to originate from home.

    For server-to-server MTA traffic, most of the time, people would setup some other port, say 2525/tcp to receive the email from a relay they run (free Amazon tier is fine). Then just setup the domain MX DNS records to point at the relay server, which nearly immediately forwards to your home server. I've been using an email gateway in that way for years.

  6. #6
    Join Date
    Mar 2010
    Location
    Squidbilly-Land
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Port 25 blocked, need to get postfix to use 587

    If this is really SOLVED, please use the "Thread Tools" button near the top of the page and mark it that way. Help the community find answers and don't waste the time for people seeking to be helpful. Please.

  7. #7
    Join Date
    Oct 2009
    Beans
    Hidden!
    Distro
    Ubuntu 18.04 Bionic Beaver

    Re: Port 25 blocked, need to get postfix to use 587

    Quote Originally Posted by TheFu View Post
    There are 3 SMTP(s) ports for MTAs like postfix, sendmail, exim.

    • 25/tcp - this is the default port configured for mail server -to- mail server communications. This is how random servers can send email to any other random email server on the internet.
    • 465/tcp - authenticated SMTP. This requires a client to authenticate using a userid and password. Often the userid would be the email address, but not necessarily the situation. This is a client -to- server connection. Generally used only by email clients like Outlook or Thunderbird or K9-Mail or Alpine.
    • 587/tcp - authenticated SMTP. This requires a client to authenticate using a userid and password. Often the userid would be the email address, but not necessarily the situation. This is a client -to- server connection. Generally used only by email clients like Outlook or Thunderbird or K9-Mail or Alpine.

    I honestly don't know why there is both 465 and 587 authenticated SMTP. Perhaps the industry picked one and Microsoft chose the other? IDK.
    I don't think I've ever seen port 465 in use. Most of the mail config I've dealt with uses port 587, including outlook.

    Based on what I found here, it looks like port 465 is a legacy port and the smtp specs say to use 25 or 587.
    Come to #ubuntuforums! We have cookies! | Basic Ubuntu Security Guide

    Tomorrow's an illusion and yesterday's a dream, today is a solution...

  8. #8
    Join Date
    Mar 2010
    Location
    Squidbilly-Land
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Port 25 blocked, need to get postfix to use 587

    That's me - Mr. Legacy! Just checked and my email client does use 587/tcp to connect to my email server(s). Oddly, an external account by a well-known email service said "default - 465" as the port.

    The RFC: https://datatracker.ietf.org/doc/html/rfc8314 It says the same as that link.
    RFCs are usually very easy to read. They are written by people with practical knowledge who appreciate simplicity and accuracy. Every major protocol on the internet is documented in that way.

    I didn't look at the RFC and easily could/should have before posting.

  9. #9
    Join Date
    Mar 2007
    Beans
    1,075

    Re: Port 25 blocked, need to get postfix to use 587

    ATT uses 465 but they do a lot of odd things

  10. #10
    Join Date
    Mar 2010
    Location
    Squidbilly-Land
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Port 25 blocked, need to get postfix to use 587

    Quote Originally Posted by rsteinmetz70112 View Post
    ATT uses 465 but they do a lot of odd things
    Much of AT&T email for customers is outsourced. They still support domains they had through acquisitions 15 yrs ago! My little email server got onto AT&T's virus spreading list-o-smtp servers after a friend using their service had his account hacked and sent ME an attachment with a MS-Office virus inside. I responded back to him, without the attachment and that was sufficient. I knew hundreds people inside AT&T and companies paid to run their servers at the time, including the people running the email servers for the domain my friend uses (he's still on it today). Their answer was - fill out the removal form and that will work. Well, it didn't. Not for 5 yrs. Then magically, it did. I think for a few years it was just a data gathering form, not really able to do anything, but I have no proof of that.

    If your subnet gets onto a block list, just hope it is one for a company like AT&T which is per-domain and not one of the big block lists like spamhaus. If my domain was ever added to spamhaus, I'd get some new IP subnets.

Page 1 of 2 12 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •