Page 1 of 4 123 ... LastLast
Results 1 to 10 of 40

Thread: [SOLVED] Can relaying be allowed for authenticated users?

  1. #1
    Join Date
    Jun 2007
    Location
    Plantation, FL
    Posts
    59
    Rep Power
    8

    Default [SOLVED] Can relaying be allowed for authenticated users?

    I recently installed ZCS 4.5.9 (OS) on an Ubuntu 7.10 server (success coming eventually after editing DISTRIB_VERSION to 6).

    I now have the odd situation that when our users (with addresses of the form myaddress@ourdomain.com) attempt to use an email client (Outlook or Thunderbird) with an IMAP-configured account to send mail to addresses outside our domain (of the form youraddress@otherdomain.com), the following error message appears:

    An error occurred while sending mail. The mail server responded: <target email address>: Relay access denied. Please check the message recipients and try again.

    Having thus failed to send, if they then save the message in their Drafts folder, and open up the Zimbra web interface at mail.ourdomain.com and simply send that same saved message, it flies the coop without so much as a whimper.

    Is there some setting I have missed that would allow the email client attempt to succeed?

    On Microsoft Exchange I could make settings that allowed relaying from specified IPs (I've found that setting on Zimbra and made it accordingly) and FROM AUTHENTICATED USERS. I can't find the similar setting on Zimbra.

    I can't specify all the thousands of potential IPs from which our authenticated users may want to send messages to addresses outside our domain ...

    Thanks in advance for any help.

  2. #2
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,587
    Rep Power
    58

    Default

    Welcome to the forums.

    All authenticated users can relay through the Zimbra server by default. Check the settings for mynetwork and see if that fixes the problem.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  3. #3
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    If your users are inside a LAN as I believe your post suggests, add the subnet of your LAN to the MTA Trusted Networks list (admin UI, Global Settings, MTA tab) and they'll send whether authenticated or not.

    Dan

  4. #4
    Join Date
    Jun 2007
    Location
    Plantation, FL
    Posts
    59
    Rep Power
    8

    Default

    Sometimes they're inside our LAN, sometimes they're not.

    Take myself, for example. At the moment, I'm at home, with a cable connection to the internet thanks to the services of Comcast. If I compose a message in Thunderbird from myself (using my company email address as the From address on an account that connects via IMAP to the Zimbra mail server) to my GMail account and click Send. I immediately get the "cannot relay" error quoted above. The unsent message is still there in the compose window. If I save it into my Drafts folder, which is synced with the Zimbra account Drafts folder, open up a web browser to mail.ourcompany.com, I find said message sitting there in the Drafts folder. I'm still at home in the exact same situation, connecting to the internet via Comcast. If I open up the message from the web browser Drafts folder and click Send, the message dutifully departs without error, and very shortly shows up in my Thunderbird Inbox having been delivered via GMail.

    I'm the mail administrator, darn it! If I'm experiencing such non-parallel behavior, who knows what anomalies my users are struggling with.

    Why do I get the "can't relay" message when sending the same message from the same place to the same destination using Thunderbird and not when using the Zimbra web interface?

    This behavior does NOT occur if I were sitting at my desk at the office, using the exact same laptop as I am using now and performing the exact same experiment.

    I am positive that the mynetworks configuration is perfectly correct.

  5. #5
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,587
    Rep Power
    58

    Default

    Quote Originally Posted by EdMartin View Post
    Why do I get the "can't relay" message when sending the same message from the same place to the same destination using Thunderbird and not when using the Zimbra web interface?
    It happens for the obvious reason that when you're logged into the Zimbra server with your browser you are a local user i.e. your mail is sent from the local host not a remote IP.

    Quote Originally Posted by EdMartin View Post
    This behavior does NOT occur if I were sitting at my desk at the office, using the exact same laptop as I am using now and performing the exact same experiment.
    Well, we'll need to see some evidence of what's happening - how about some log info showing this problem? Have you disabled any firewall, SElinux and IPv6 on the zimbra server? Anything else that could interfere with the external connections? I'm assuming that you are just sitting behind a NAT router, what make/model is it?
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  6. #6
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,587
    Rep Power
    58

    Default

    BTW, please post the details of your mynetworks config with the following commands:

    Code:
    zmprov gs yourdomain.com | grep -i mtamy
    postconf mynetworks
    plus the following:

    Code:
    host `hostname`  <-- type as-is with backticks not single quotes
    dig yourdomain.com mx
    dig yourdomain.com any
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  7. #7
    Join Date
    Jun 2007
    Location
    Plantation, FL
    Posts
    59
    Rep Power
    8

    Default

    I'm having a hard time posting a reply. This is my third attempt. The previous two have been no-shows. Perhaps I'm exceeding a length limit. Let's deal with the second response first.

    zmprov gs mail.imacs.org | grep -i mtamy

    zimbraMtaMyDestination: localhost
    zimbraMtaMyNetworks: 127.0.0.0/8 208.62.28.224/27 192.168.1.0/24

    [Comment: The 208... subnet is a collection of public-facing servers that includes a small load-balancing web farm that send email via our mail server in response to certain web page form activities. The mail server is on that same subnet. The 192... subnet is our LAN.]

    postconf mynetworks

    mynetworks = 127.0.0.0/8 208.62.28.224/27 192.168.1.0/24

    host `hostname`

    mail.imacs.org has address 208.62.28.245
    mail.imacs.org mail is handled by 0 mail.imacs.org

    dig mail.imacs.org mx

    ; <<>> DiG 9.4.1-P1 <<>> mail.imacs.org mx
    ;; global options: printcmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30126
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

    ;; QUESTION SECTION:
    ;mail.imacs.org. IN MX

    ;; ANSWER SECTION:
    mail.imacs.org. 7127 IN MX 0 mail.imacs.org.

    ;; ADDITIONAL SECTION:
    mail.imacs.org. 2088 IN A 208.62.28.245

    ;; Query time: 0 msec
    ;; SERVER: 192.168.1.253#53(192.168.1.253)
    ;; WHEN: Tue Nov 20 08:26:54 2007
    ;; MSG SIZE rcvd: 64

    dig mail.imacs.org any

    ; <<>> DiG 9.4.1-P1 <<>> mail.imacs.org any
    ;; global options: printcmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27426
    ;; flags: qr rd rq; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

    ;; QUESTION SECTION:
    ;mail.imacs.org. IN ANY

    ;; ANSWER SECTION:
    mail.imacs.org. 7125 IN A 208.62.28.245

    ;; Query time: 50 msec
    ;; SERVER: 192.168.1.253#53(192.168.1.253)
    ;; WHEN: Tue Nov 20 08:32:32 2007
    ;; MSG SIZE rcvd: 48

  8. #8
    Join Date
    Jun 2007
    Location
    Plantation, FL
    Posts
    59
    Rep Power
    8

    Default

    Bingo. The third time was a charm. I guess it must have been a length limit thing.

    As for your first comments, our access to the internet is through a CISCO 1760 router. I don't know if it's running NAT or not. I'll have to check with the person who deals with that side of things.

    I installed Zimbra 4.5.9 OS on a virgin Ubuntu 7.10 server (the basic Ubuntu server installation with none of the pre-configured services added). I followed the HowTo at

    How To Install Zimbra Collaboration Suite (ZCS) On Ubuntu | HowtoForge - Linux Howtos and Tutorials

    only deviating in that I edited /etc/lsb-release to set DISTRIB_RELEASE to 6 instead of 7.10 and I had to install the libstdc++5, openssl, and libdb4.3 packages in addition to the ones mentioned in the HowTo. At one point, I also had to run /opt/zimbra/libexec/zmfixperms. Other than that, I have neither deliberately enabled nor disabled any services.

    Concerning logs entries that relate to the problem I am having, where would I look for them? In

    /opt/zimbra/log/mailbox.log.2007-11-19

    I see mention of my connection from home on a Comcast IP, but there's nothing in that neighborhood in the log that speaks to me of my mail delivery problem. What keywords or other indicators should I be looking for?

  9. #9
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    Ed,

    Bill's going to be far better at the technical details than I, but let me throw in a couple of key details you may have missed--because I assumed the same thing at first.

    When you send a message from your IMAP-client email (outlook, thunderbird, whatever) you are not sending the message through IMAP, you're sending it through SMTP. Therefore, when you try to send it from home, your MTA (the Zimbra postfix) is being asked to relay an SMTP message from your home Comcast IP. However, when you save it in "Drafts" and then log onto the web client to send it, postfix is now receiving the send request directly from the IP of the Zimbra server itself. So you are NOT having dissimilar behaviors from the same source--as far as Postfix is concerned the source of the SMTP request is different in the two cases you have listed.

    Since you are having no problem sending messages from inside your LAN, you clearly must have the LAN's subnet in your allowed relay networks. Thus, again, the question of mail transmission from the LAN is completely irrelevant to the question of SMTP authentication, because you aren't relying on authentication of a user, you're sending from an allowed relay subnet.

    You can test this from home if you have a VPN set up. Connect your home PC to a VPN that maps you onto a local LAN ip address and you'll find, unless I'm gravely mistaken, that your messages shoot right on through. . .because now they're coming on a relay request from an allowed domain.

    If my theory is correct, and I'm pretty sure it is because I've seen the same behavior on my own servers, the only truly outstanding issue is SMTP authentication for users who are outside the allowed networks. This is an area where I have not yet had time to get it working, but it doesn't work out of the box on my installation either. For that I'll look forward to Bill's response as much as you will.

    I hope this clarifies things a bit,

    Dan

  10. #10
    Join Date
    Jun 2007
    Location
    Plantation, FL
    Posts
    59
    Rep Power
    8

    Default

    Here are the relevant entries from zimbra.log corresponding to a failed attempt to send a message to my GMail account from home using Thunderbird.

    Nov 21 16:03:28 mail postfix/smtpd[11885]: connect from c-65-34-211-65.hsd1.fl.comcast.net[65.34.211.65]
    Nov 21 16:03:28 mail postfix/smptd[11885]: NOQUEUE: reject: RCPT from c-65-34-211-65.hsd1.fl.comcast.net[65.34.211.65]: 554 <martin.edwardc@gmail.com>: Relay access denied; from=<emartin@imacs.org> to=<martin.edwardc@gmail.com> proto=ESMTP helo=<[192.168.99.102]>
    Nov 21 16:03:28 mail postfix/smtpd[11885]: disconnect from c-65-34-211-65.hsd1.fl.comcast.net[65.34.211.65]

    Short and to the point. But what does it mean and how do I rectify the situation?

Similar Threads

  1. Importing users with dots
    By Priyantha Bleeker in forum Migration
    Replies: 9
    Last Post: 10-19-2007, 01:14 AM
  2. need advice on configuring zimbra to work with fax server
    By pheonix1t in forum Administrators
    Replies: 0
    Last Post: 07-11-2007, 07:46 PM
  3. Testing restore on OSE with missing users upon completion
    By dmmincrjr in forum Administrators
    Replies: 3
    Last Post: 07-05-2007, 07:29 PM
  4. Replies: 7
    Last Post: 09-29-2006, 10:07 AM
  5. Installation review
    By npollock in forum Administrators
    Replies: 1
    Last Post: 01-14-2006, 09:34 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •