שגיאת SMTP 503 5.5.1: אימות לא הופעל

תמיכה התקנה

סיכום מבוסס בינה מלאכותית

User tiagofreitas87 is encountering an SMTP 503 5.5.1 “authentication not enabled” error while using a local Postfix server with Discourse. Despite successful manual testing via swaks and TLS, Discourse fails to authenticate. itsbhanusharma suggests checking smtp_sasl_auth_enable = yes in Postfix config, which tiagofreitas87 confirms is set. However, itsbhanusharma points out a potential conflict: Discourse is configured for plain authentication, while Postfix’s smtpd_sasl_security_options restricts plaintext and anonymous auth — a mismatch. tiagofreitas87 clarifies they don’t use SASL and previously ran SMTP without it for local apps like Nextcloud and Thunderbird, questioning why SASL is mandatory in this context. itsbhanusharma theorizes that the Docker container’s isolation from the host Postfix may require SASL, suggesting relaxing Postfix security to test. tiagofreitas87 seeks more secure alternatives, noting the default Discourse config doesn’t list all options. After removing smtpd_sasl_security_options restrictions without success tiagofreitas87, itsbhanusharma clarifies that Discourse only uses smtp_* parameters, not smtpd_*, implying the smtpd_ settings are irrelevant. tiagofreitas87 confirms only smtp_sasl_auth_enable = yes is set, with no other restrictions — yet the error persists. The core issue remains unresolved: Discourse’s authentication mechanism isn’t aligning with Postfix’s configuration, despite valid SMTP connectivity.

1

I am using a local postfix smtp and getting this error:

503 5.5.1 Error: authentication not enabled

DISCOURSE_SMTP_ADDRESS: mail.xxx.net
DISCOURSE_SMTP_PORT: 587
DISCOURSE_SMTP_USER_NAME: resources@xxx.net
DISCOURSE_SMTP_PASSWORD: password123?
DISCOURSE_SMTP_ENABLE_START_TLS: true # (optional, default true)
DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
DISCOURSE_SMTP_AUTHENTICATION: “plain”

I added the last 2 options as a last resort but made no effect.

The smtp server works in all testing tools I used, like openssl or swaks from inside the docker container.


root@resources-app:/# swaks --to resources@xxx.net --server mail.xxx.net:587 -tls
=== Trying mail.xxx.net:587...
=== Connected to mail.xxx.net.
<-  220 mail.xxx.net ESMTP Postfix (Ubuntu)
 -> EHLO resources-app
<-  250-mail.xxx.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-STARTTLS
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250-DSN
<-  250-SMTPUTF8
<-  250 CHUNKING
 -> STARTTLS
<-  220 2.0.0 Ready to start TLS
=== TLS started with cipher TLSv1.3:TLS_AES_256_GCM_SHA384:256
=== TLS no local certificate set
=== TLS peer DN="/CN=*.xxx.net"
 ~> EHLO resources-app
<~  250-mail.xxx.net
<~  250-PIPELINING
<~  250-SIZE 10240000
<~  250-VRFY
<~  250-ETRN
<~  250-ENHANCEDSTATUSCODES
<~  250-8BITMIME
<~  250-DSN
<~  250-SMTPUTF8
<~  250 CHUNKING
 ~> MAIL FROM:<root@resources-app>
<~  250 2.1.0 Ok
 ~> RCPT TO:<resources@xxx.net>
<~  250 2.1.5 Ok
 ~> DATA
<~  354 End data with <CR><LF>.<CR><LF>
 ~> Date: Tue, 03 Aug 2021 11:04:12 +0000
 ~> To: resources@xxx.net
 ~> From: root@resources-app
 ~> Subject: test Tue, 03 Aug 2021 11:04:12 +0000
 ~> Message-Id: <20210803110412.593268@resources-app>
 ~> X-Mailer: swaks v20181104.0 jetmore.org/john/code/swaks/
 ~>
 ~> This is a test mailing
 ~>
 ~>
 ~> .
<~  250 2.0.0 Ok: queued as 1C4ED8AA
 ~> QUIT
<~  221 2.0.0 Bye
=== Connection closed with remote host.
2

The error could mean that you don’t have smtp_sasl_auth_enable = yes in your postfix conf. what is the output of postconf -n does it contain the above string? if not, then please uncomment or edit /etc/postfix/main.cf and report back.

3

I do have
smtp_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous noplaintext
smtpd_tls_security_level = encrypt
smtpd_use_tls = yes

4

I think the above two options are contradictory. You should set the correct authentication method in discourse for this to work.

5

makes sense, I don’t use SASL so I set those options to make it more secure.
What methods are available?
Also why is SASL mandatory? I had it disabled before and SMTP worked in all other applications like nextcloud and thunderbird

SASL is only needed to send email to remote servers, but this server only works locally

Thanks

6

My understanding may be flawed here but I think sasl is needed because the docker container is logically separate from the host which has postfix running on it.

I’d say maybe try lowering the hardening of postfix and see what works best for you?

This file should give you some idea about how those settings

discourse/config/discourse_defaults.conf at main · discourse/discourse · GitHub

7

That defaults file doesn’t have all the possible values, was wondering if there is a more secure option. Will look at the code/libs later

8

removing the security options still doesn’t fix it.
do I need to run launcher app rebuild before running discourse-doctor again?

thanks

9

Notice the d

Discourse should only really need the parameters starting with smtp and not smtpd

10

I only have
smtp_sasl_auth_enable = yes

no other restrictions…