Email not working SMTP Relay Gmail

Installation Issues
1

I’m installing on Ubuntu 20.4 with Docker. So far so good. I’ve managed to install it properly and I can log in to my account with no problems. The only problem is that I cannot send emails.
I would like to connect to our SMTP Relay server of our gmail domain and receive the emails from ‘passbolt@mydoimain.com’. In our organitzation, we have no authentication and we authorize connections with a IP whitelist.

When i run ./bin/cake passbolt send_test_email --recipient=youremail@domain.com i get:


     ____                  __          ____  
    / __ \____  _____ ____/ /_  ____  / / /_ 
   / /_/ / __ `/ ___/ ___/ __ \/ __ \/ / __/ 
  / ____/ /_/ (__  |__  ) /_/ / /_/ / / /    
 /_/    \__,_/____/____/_.___/\____/_/\__/   

 Open source password manager for teams
---------------------------------------------------------------
 Debug email shell
---------------------------------------------------------------

Email configuration
---------------------------------------------------------------
Host: smtp-relay.gmail.com
Port: 587
Username: 
Password: *********
TLS: false

Sending email from: passbolt@mydomain.com
Sending email to: myuser@mydomain.com
---------------------------------------------------------------

Trace
[220] smtp-relay.gmail.com ESMTP y15sm33283ljc.40 - gsmtp

A test email could not be sent.
Error: SMTP server did not accept the connection.
PHP Warning:  fwrite(): supplied resource is not a valid stream resource in /var/www/passbolt/vendor/cakephp/cakephp/src/Console/ConsoleOutput.php on line 255
PHP Warning:  fwrite(): supplied resource is not a valid stream resource in /var/www/passbolt/vendor/cakephp/cakephp/src/Console/ConsoleOutput.php on line 255

And my passbolt.env looks like this:

# Email
EMAIL_TRANSPORT_DEFAULT_HOST=smtp-relay.gmail.com
EMAIL_TRANSPORT_DEFAULT_PORT=25
#EMAIL_TRANSPORT_DEFAULT_USERNAME=''
#EMAIL_TRANSPORT_DEFAULT_PASSWORD=''
EMAIL_DEFAULT_FROM=passbolt@mydomain.com
#EMAIL_TRANSPORT_DEFAULT_TLS=null

We don’t use TLS neither SMTP authentication on our SMTP-Relay server.
I tried to debug using telnet and I could send emails to any email address on my domain.
Anyone knows how to configure it properly?

Thank you so much!

2

Hi @csbertran, welcome to the forum!

I noticed on your trace:

Email configuration
---------------------------------------------------------------
Host: smtp-relay.gmail.com
Port: 587

Port 587 is a TLS port I think the relay is using port 25 or 2525 (not sure). Can you confirm the env variable EMAIL_TRANSPORT_DEFAULT_PORT is using the expected port (25) before executing the email testing command?

Something like env |grep EMAIL_TRANSPORT_DEFAULT_PORT

1 Like
3

Same issue even I change the port to 25. (I checked and relay use port 25)


     ____                  __          ____  
    / __ \____  _____ ____/ /_  ____  / / /_ 
   / /_/ / __ `/ ___/ ___/ __ \/ __ \/ / __/ 
  / ____/ /_/ (__  |__  ) /_/ / /_/ / / /    
 /_/    \__,_/____/____/_.___/\____/_/\__/   

 Open source password manager for teams
---------------------------------------------------------------
 Debug email shell
---------------------------------------------------------------

Email configuration
---------------------------------------------------------------
Host: smtp-relay.gmail.com
Port: 25
Username: 
Password: *********
TLS: false

Sending email from: passbolt@mydomain.com
Sending email to: myuser@mydomain.com
---------------------------------------------------------------

Trace
[220] smtp-relay.gmail.com ESMTP m5sm357213wrv.21 - gsmtp

A test email could not be sent.
Error: SMTP server did not accept the connection.
PHP Warning:  fwrite(): supplied resource is not a valid stream resource in /var/www/passbolt/vendor/cakephp/cakephp/src/Console/ConsoleOutput.php on line 255
PHP Warning:  fwrite(): supplied resource is not a valid stream resource in /var/www/passbolt/vendor/cakephp/cakephp/src/Console/ConsoleOutput.php on line 255
4

I haven’t setup the smtp relay myself but apparently there are some configurations according with https://support.google.com/a/answer/2956491?hl=en

Have you configured the smtp relay to not use TLS and whitelisted a range of ip addresses? Otherwise it looks like you should use EMAIL_TRANSPORT_DEFAULT_TLS=true, point to port 587 and use credentials such as username and password.

1 Like
5

Yes, my IP is whitelisted and I can send email with telnet using port 25.

root@e25057e20791:/var/www/passbolt# telnet smtp-relay.gmail.com 25
Trying 74.125.193.28...
Connected to smtp-relay.gmail.com.
Escape character is '^]'.
220 smtp-relay.gmail.com ESMTP d18sm357648wrw.11 - gsmtp
HELO mydomainname.com
250 smtp-relay.gmail.com at your service
MAIL FROM: <passbolt@mydomain.com>
250 2.1.0 OK d18sm357648wrw.11 - gsmtp
RCPT TO: <myuser@mydomain.com>        
250 2.1.5 OK d18sm357648wrw.11 - gsmtp
DATA
354  Go ahead d18sm357648wrw.11 - gsmtp
test 
.
250 2.0.0 OK  1605525972 d18sm357648wrw.11 - gsmtp
QUIT
221 2.0.0 closing connection d18sm357648wrw.11 - gsmtp
Connection closed by foreign host.

Maybe Passbolt email sender forces to use credentials (even they are empty) and thats why my smtp relay server is rejecting the connections?

I have no idea of what could be wrong…

7

Is there a way to flag this as a bug to see if the developers can fix it?
I’d really want to send emails not having to authenticate in the SMTP Server.

8

I’ll give it a shot and see if I can reproduce your issue with a relay.

1 Like
10

I’ve this same issue e find out the command EHLO is misconfigured sending “EHLO localhost” instead the public IP allowed in my G Suite environment.

For a while, I’ve edited the file [passbolt dir]/vendor/cakephp/src/Mailer/Transport/SmtpTransport;php as follow, just changing the variable {$host} in lines 234 and 238 to the public IP allowed and it works fine. Take in mind that I didn’t change the variable value, I replaced for “EHLO [myIP]”, since this variable is used in other script contexts.

Original
233 try {
234 $this->_smtpSend(“EHLO {$host}”, ‘250’);
235 if ($config[‘tls’]) {
236 $this->_smtpSend(‘STARTTLS’, ‘220’);
237 $this->_socket->enableCrypto(‘tls’);
238 $this->_smtpSend(“EHLO {$host}”, ‘250’);
239 }

Waiting for comments about this workaround, as how to proper set it or if this is a bug in fact.

12

@csbertran Since you were showing that a manual HELO of your domain was working, it may be an issue of what domain your sending server is declaring.

When reading this https://support.google.com/a/answer/2956491 it appears in #6 that the Allowed senders section must note the IP address, in addition to #7 where you can limited by IP address. When I read this, your server should also have a hostname (or mailname) of your domain approved domain.

Could this be the case?

https://support.google.com/a/answer/6140680?hl=en says that your IP address needs to be whitelisted but the second bullet point under “Mail relay denied” mentions the FQDN in the HELO.

13

@heitorcmj try changing the hostname of your server. Understandably we discourage the modification of source code in the dependent libraries, but it helps that you are showing what needs to change for it to work.

EDIT: can you clarify again which IP your changing the {host} variable to? The sending server’s public IP?

14

Hi @garrett !
As mentioned, https://support.google.com/a/answer/2956491 there’s no option to use the hostname in #6, so what’s the purpose to change the server name?

About your last question: Yes. I edited the lines 234 and 238 to this, where nnn is the public IP:

$this->_smtpSend(“EHLO nnn.nnn.nnn.nnn”, ‘250’);

15

I have not set this up on a Google domain, so these are general thoughts:

It’s more a matter of how email is received than the restriction settings were are reviewing.

A server’s declared hostname is commonly checked against IP addresses. Maybe the Passbolt machine is internal-only and not public-facing and when Google tries to verify the domain it cannot. Hard to know, because this information was not provided yet. Using the IP address with a HELO command still has to be checked against the actual IP address from where the request is being made.

“Step-2” on the link above is to set the on-premises relay to point to Google. This thread however is treating a Passbolt machine as a relay. In the Configuration section of Step-2 it says:

We recommend that you configure your mail server to present a unique identifier (such as your domain name or the name of your mail server) in the HELO or EHLO command in the SMTP relay connections your server makes to Google. Avoid using generic names such as “localhost” or “smtp-relay.gmail.com,” which can occasionally result in issues with DoS limits.

So, my thought is that although the IP address is used for restriction, the declared domain (hostname) of the server is also being considered.

In my own mail server that I run, I have domain restrictions. The connecting servers can have credentials but my mail server will still not accept the connection if they do not present a whitelisted domain. In the case of an internal-only machine, this is even more relevant because my mail server cannot resolve it’s domain through normal means.

So in addition to a whitelisted domain, I also must note the IP address it has or else it gets flagged as incorrectly resolved.

16

Hi @garrett !

Thank you so much for your effort to fix this issue.

Google says “we recommend… a unique identifier in the HELO or EHLO…” but, at least since now, it’s a requirement. I made the changes you suggested to set up the FQDN and in additional I publish it on my DNS (since it’s just internal) for some possible query made by Google, but it doesn’t work.

Reviewing the script SmtpTransport.php, I realized that the variable $host is set in line 34 as “localhost”. So no matter the FQDN, this script always form the command with “EHLO localhost” and I can’t find a way to configure it on passbolt.

34 ‘host’ => ‘localhost’,

My best regards,

17

Another approach to this would be to configure Sendmail, Postfix, etc locally on the server, include the settings in the Gmail relay documentation, and send all Passbolt mail to the local mail service which then is the relay to Gmail.

1 Like
18

Hi, I may be having this same issue. What did you end up going with?

19

The use of “client” in the config was tested by @swebervna and has shown to be working. Cannot send email to Gmail SMTP-Relay - #9 by swebervna

Non-Docker:

'EmailTransport' => [
    'client' => 'ip.add.re.ss'
]

Docker:

# Email
EMAIL_TRANSPORT_DEFAULT_HOST=smtp-relay.gmail.com
EMAIL_TRANSPORT_DEFAULT_PORT=587
EMAIL_DEFAULT_FROM=passbolt@mydomain.com
EMAIL_TRANSPORT_DEFAULT_CLIENT= 'ip.add.re.ss'

Adjust other settings accordingly.