Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I get this warning from postfix-2.7.1

Apr 18 13:08:40 bar-work postfix/smtp[5112]: warning: mx-foo[10.132.10.100]:587 offered no supported AUTH mechanisms: 'GSSAPI NTLM'
Apr 18 13:08:41 bar-work postfix/smtp[5112]: certificate verification failed for mx-foo[10.132.10.100]:587: untrusted issuer /CN=FOOEXCH01
Apr 18 13:08:41 bar-work postfix/smtp[5112]: C9D0F10D5770D: to=<user@example.com>, relay=mx-foo[10.132.10.100]:587, delay=0.55, delays=0.01/0/0.37/0.18, dsn=2.6.0, status=sent (250 2.6.0 <20120418110840.22315.51521@bar-work.example2.intern> Queued mail for delivery)
Apr 18 13:08:41 bar-work postfix/qmgr[2926]: C9D0F10D5770D: removed

First postfix says it can't find a supported auth, but the mail gets delivered. Which auth method succeeded?

I ask out of curiosity, because the service works like it should.

share|improve this question

1 Answer

up vote 1 down vote accepted

Apr 18 13:08:40 bar-work postfix/smtp[5112]: warning: mx-foo[10.132.10.100]:587 offered no supported AUTH mechanisms: 'GSSAPI NTLM'

  • postfix connects to mx-foo.
  • mx-foo responds with 220 and, among other capabilities, AUTH
  • postfix tries to negotiate an authentication mechanism
  • the server only advertises GSSAPI and NTLM, which postfix does not support

Apr 18 13:08:41 bar-work postfix/smtp[5112]: certificate verification failed for mx-foo[10.132.10.100]:587: untrusted issuer /CN=FOOEXCH01

  • postfix now tries STARTTLS, since the remote server may be configured to only offer AUTH after TLS is established
  • postfix fails to verify the server TLS certificate, but continues with a warning
  • mx-foo does not offer AUTH after TLS

Apr 18 13:08:41 bar-work postfix/smtp[5112]: C9D0F10D5770D: to=, relay=mx-foo[10.132.10.100]:587, delay=0.55, delays=0.01/0/0.37/0.18, dsn=2.6.0, status=sent (250 2.6.0 <20120418110840.22315.51521@bar-work.example2.intern> Queued mail for delivery)

  • postfix submits a normal message
  • the message is accepted

I suggest you don't attempt AUTH in the first place, by fixing this in main.cf:

smtp_sasl_auth_enable = no

share|improve this answer
thank you very much for this detailed explanation! – guettli Apr 18 '12 at 12:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.