5

Trying to use postfix with smtp to connect to google's smtp. When trying to send mail, I get this error:

Sep 15 14:04:41 zedsaid postfix/smtp[20271]: certificate verification failed for smtp.gmail.com[74.125.95.109]:587: untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certificate Authority
Sep 15 14:04:42 zedsaid postfix/smtp[20271]: warning: SASL authentication failure: No worthy mechs found
Sep 15 14:04:42 zedsaid postfix/smtp[20271]: 1BACD968B23: to=<nic@zedsaid.com>, relay=smtp.gmail.com[74.125.95.109]:587, delay=0.92, delays=0.06/0.03/0.83/0, dsn=4.7.0, status=deferred (SASL authentication failed; cannot authenticate to server smtp.gmail.com[74.125.95.109]: no mechanism available)

Running Debian 4.0.

Ideas?

  • Post the output of postconf -n and all other relevant configuration files of Postfix. You don't seem to have smtp_sasl_password_maps configured in your main.cf. – joschi Sep 18 '10 at 5:50
2

It looks like the clue is right here:

untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certificate Authority

you need to get the equifax cert and add it to your list of trusted CA certs.

I think that these are available here: http://www.geotrust.com/resources/root-certificates/

5

(New user, can't post comment reply to sebix. Also removed all links.)

For modern installations (such as Ubuntu 16.04) that use Postfix as an SMTP client with SASL-auth to a remote server (e.g. like shown on the Debian wiki), it might indeed be needed to specify

smtp_sasl_security_options = noanonymous

What this does, however, is remove the noplaintext option (currently the default is noplaintext, noanonymous as per the postconf manual). smtp_sasl_tls_security_options defaults to $smtp_sasl_security_options. This could become an issue under some (mis)configurations, or in the future if defaults change.

EDITED: At the moment, though, it doesn't seem likely, especially if SASL is done in a TLS session. This is forced if the remote server has smtpd_tls_auth_only or smtpd_enforce_tls (which implies the former) or whatever non-Postfix equivalent.

To check what Postfix defaults to, use postconf -d (via).

2

Possibly multiple problems here, the certs being one and another maybe related to smtp_sasl_security_options. I once solved a problem involving that "no mechs" message by setting smtp_sasl_security_options=noanonymous following a clue found on linuxquestions.org

  • What is the suggested solution? – sebix Jan 8 '15 at 22:31
1

this solved it for me (on centos 7 not default, was OK on older Centos versions)

yum install cyrus-sasl{,-plain} 
service postfix restart

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.