I have sendmail running successfully on a Debian 10 derivative, 8.15.2,
and have installed sendmail to my Debian 12, 8.17.1, virtual server. I
copied the configuration files from my Debian 10 server to the Debian 12
server. I can send mail to the server using a Thunderbird client or
telnet from anywhere. What I can't do is connect to the submision port
and relay mail. The error I'm getting from Thunderbird is: "Sending of
the message failed.
An error occurred while sending mail. The mail server responded:
Authentication required. Please verify that your email address is
correct in your account settings and try again."

I can send mail to the Debian 12 server from anywhere. I can log into
the Debian 12 server and using telnet on port 25 send mail to my Debian
10 server elsewhere. That's probably because the access database says
localhost can relay.

I have an authentication issue somewhere. The certificates are self
signed as they are on the Debian 10 server. I have sasl2-bin installed
and running. Thunderbird is configured to use STARTTLS.

Any ideas greatly appreciated.

If I try to connect to the Debian 12 server with telnet from home I get
this:

knute@knute-XPS-8700:~$ telnet domain.com 25
Trying 176.126.240.209...
Connected to domain.com.
Escape character is '^]'.
ehlo knute
554 domain.com ESMTP not accepting messages
250-domain.com Hello [216.24.32.226], pleased to meet you
250 ENHANCEDSTATUSCODES

I get the same on port 587. If I use HELO instead of EHLO it looks like
it is going to go but when I enter the mail from: I get 550 5.0.0
Command rejected.

knute@knute-XPS-8700:~$ telnet domain.com 25
Trying 176.126.240.209...
Connected to domain.com.
Escape character is '^]'.
helo knute
554 domain.com ESMTP not accepting messages
250 domain.com Hello [216.24.32.226], pleased to meet you
mail from: knute@otherdomain.com
550 5.0.0 Command rejected

So the result is if the connection to the Debian 12 server is local on
port 25 or is an inbound connection it works. If the connection is to
relay mail it doesn't work.

My sendmail.mc file:

divert(-1)dnl

#-----------------------------------------------------------------------------
divert(0)dnl
# # Copyright (c) 1998-2005 Richard Nelson. All Rights Reserved.
# # This file is used to configure Sendmail for use with Debian systems.
# define(`_USE_ETC_MAIL_')dnl
include(`/usr/share/sendmail/cf/m4/cf.m4')dnl
VERSIONID(`$Id: sendmail.mc, v 8.17.1.9-2 2023-01-11 23:26:28 cowboy Exp $')
OSTYPE(`debian')dnl
DOMAIN(`debian-mta')dnl
dnl # Items controlled by /etc/mail/sendmail.conf - DO NOT TOUCH HERE
undefine(`confHOST_STATUS_DIRECTORY')dnl #DAEMON_HOSTSTATS=
dnl # Items controlled by /etc/mail/sendmail.conf - DO NOT TOUCH HERE
dnl #
dnl # General defines
define(`confLOG_LEVEL',25)dnl
dnl #
FEATURE(`no_default_msa')dnl
DAEMON_OPTIONS(`Family=inet, Name=MTA-v4, Port=smtp, M=A')dnl
DAEMON_OPTIONS(`Family=inet, Name=MSP-v4, Port=submission, M=Ea')dnl
dnl #
define(`confPRIVACY_FLAGS',dnl
`needmailhelo,needexpnhelo,needvrfyhelo,restrictqrun,restrictexpand,nobodyreturn,authwarnings')dnl
dnl #
dnl # Define connection throttling and window length
define(`confCONNECTION_RATE_THROTTLE', `15')dnl
define(`confCONNECTION_RATE_WINDOW_SIZE',`10m')dnl
dnl #
dnl # Features
dnl #
dnl # use /etc/mail/local-host-names
FEATURE(`use_cw_file')dnl
dnl #
dnl # The access db is the basis for most of sendmail's checking
FEATURE(`access_db', , `skip')dnl
dnl #
dnl # The greet_pause feature stops some automail bots - but check the
dnl # provided access db for details on excluding localhosts...
FEATURE(`greet_pause', `1000')dnl 1 seconds
dnl #
dnl # Delay_checks allows sender<->recipient checking
FEATURE(`delay_checks', `friend', `n')dnl
dnl #
dnl # If we get too many bad recipients, slow things down...
define(`confBAD_RCPT_THROTTLE',`3')dnl
dnl #
dnl # Stop connections that overflow our concurrent and time connection
rates
FEATURE(`conncontrol', `nodelay', `terminate')dnl
FEATURE(`ratecontrol', `nodelay', `terminate')dnl
dnl #
dnl # I added this
TRUST_AUTH_MECH(`PLAIN')dnl
define(`confAUTH_MECHANISM',`PLAIN')dnl
define(`confAUTH_OPTIONS',`A p y')dnl
include(`/etc/mail/sasl/sasl.m4')dnl
include(`/etc/mail/tls/starttls.m4')dnl
dnl #
include(`/etc/mail/m4/dialup.m4')dnl
include(`/etc/mail/m4/provider.m4')dnl
dnl #
dnl # Default Mailer setup
MAILER_DEFINITIONS
MAILER(`local')dnl
MAILER(`smtp')dnl

My /etc/mail/access file:

Connect:127 RELAY
GreetPause:127 0
ClientRate:127 0
ClientConn:127 0
Connect:IPv6:::1 RELAY
GreetPause:IPv6:::1 0
ClientRate:IPv6:::1 0
ClientConn:IPv6:::1 0
# Defaults
GreetPause: 5000
ClientRate: 10
ClientConn: 10
# Spam:postmaster@ FRIEND
Spam:abuse@ FRIEND
Spam:spam@ FRIEND
# # Blacklisted users
# Connect:169.254 REJECT
Connect:192.0.2 REJECT
Connect:224 REJECT
Connect:255 REJECT

My submit.mc file:

divert(-1)dnl
#-----------------------------------------------------------------------------
divert(0)dnl
# define(`_USE_ETC_MAIL_')dnl
include(`/usr/share/sendmail/cf/m4/cf.m4')dnl
VERSIONID(`$Id: submit.mc, v 8.17.1.9-2 2023-01-11 23:26:28 cowboy Exp $')
OSTYPE(`debian')dnl
DOMAIN(`debian-msp')dnl
dnl #---------------------------------------------------------------------
FEATURE(`msp', `[127.0.0.1]', `25')dnl
dnl
include(`/etc/mail/sasl/sasl.m4')dnl
include(`/etc/mail/tls/starttls.m4')dnl

--

Knute Johnson

Am 07.10.2023 um 13:35:38 Uhr schrieb Knute Johnson:

> I have sendmail running successfully on a Debian 10 derivative,
> 8.15.2, and have installed sendmail to my Debian 12, 8.17.1, virtual
> server. I copied the configuration files from my Debian 10 server to
> the Debian 12 server. I can send mail to the server using a
> Thunderbird client or telnet from anywhere. What I can't do is
> connect to the submision port and relay mail. The error I'm getting
> from Thunderbird is: "Sending of the message failed.
> An error occurred while sending mail. The mail server responded:
> Authentication required. Please verify that your email address is
> correct in your account settings and try again."

> Any ideas greatly appreciated.
>
> If I try to connect to the Debian 12 server with telnet from home I
> get this:
>
> knute@knute-XPS-8700:~$ telnet domain.com 25
> Trying 176.126.240.209...
> Connected to domain.com.
> Escape character is '^]'.
> ehlo knute
> 554 domain.com ESMTP not accepting messages
> 250-domain.com Hello [216.24.32.226], pleased to meet you
> 250 ENHANCEDSTATUSCODES
>
> I get the same on port 587. If I use HELO instead of EHLO it looks
> like it is going to go but when I enter the mail from: I get 550
> 5.0.0 Command rejected.

If you have "a" in your DAEMON_OPTIONS, it will require authentication
and auth needs ESMTP, so EHLO is mandatory.

Use that and try manual PLAIN authentication.
You can also use a client like Claws Mail that give you the full
network log, so you can exactly see what is being sent and received.

> define(`confAUTH_OPTIONS',`A p y')dnl

https://docstore.mik.ua/orelly/other/Sendmail_3rd/1565928393_ch24-50956.html

p will make the use of TLS (port 465) or STARTTLS mandatory for using
PLAIN.

On 10/7/23 15:03, Marco Moock wrote:
> Am 07.10.2023 um 13:35:38 Uhr schrieb Knute Johnson:
>
>> I have sendmail running successfully on a Debian 10 derivative,
>> 8.15.2, and have installed sendmail to my Debian 12, 8.17.1, virtual
>> server. I copied the configuration files from my Debian 10 server to
>> the Debian 12 server. I can send mail to the server using a
>> Thunderbird client or telnet from anywhere. What I can't do is
>> connect to the submision port and relay mail. The error I'm getting
>> from Thunderbird is: "Sending of the message failed.
>> An error occurred while sending mail. The mail server responded:
>> Authentication required. Please verify that your email address is
>> correct in your account settings and try again."
>
>> Any ideas greatly appreciated.
>>
>> If I try to connect to the Debian 12 server with telnet from home I
>> get this:
>>
>> knute@knute-XPS-8700:~$ telnet domain.com 25
>> Trying 176.126.240.209...
>> Connected to domain.com.
>> Escape character is '^]'.
>> ehlo knute
>> 554 domain.com ESMTP not accepting messages
>> 250-domain.com Hello [216.24.32.226], pleased to meet you
>> 250 ENHANCEDSTATUSCODES
>>
>> I get the same on port 587. If I use HELO instead of EHLO it looks
>> like it is going to go but when I enter the mail from: I get 550
>> 5.0.0 Command rejected.
>
> If you have "a" in your DAEMON_OPTIONS, it will require authentication
> and auth needs ESMTP, so EHLO is mandatory.
>
> Use that and try manual PLAIN authentication.
> You can also use a client like Claws Mail that give you the full
> network log, so you can exactly see what is being sent and received.
>
>> define(`confAUTH_OPTIONS',`A p y')dnl
>
> https://docstore.mik.ua/orelly/other/Sendmail_3rd/1565928393_ch24-50956.html
>
> p will make the use of TLS (port 465) or STARTTLS mandatory for using
> PLAIN.
>

All of those things being deliberate. This configuration has been
working for years on my Debian 10 system. I don't understand what is
causing the:

554 domain.com ESMTP not accepting messages

when I login from another location. I've searched for this on the
internet and found nothing.

--

Knute Johnson

Maybe the AUTH warning: no mechanisms at 15:22:42 is a clue but I don't
know to what.

Oct 08 15:22:40 domains.com sm-mta[5256]: NOQUEUE: connect from
[xx.xx.xx.xx]
Oct 08 15:22:40 domains.com sm-mta[5256]: AUTH warning: no mechanisms
Oct 08 15:22:40 domains.com sm-mta[5256]: 398FMeAX005256: Milter: no
active filter
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 220
domains.com ESMTP Sendmail 8.17.1.9/8.17.1.9/Debian-2; Sun, 8 Oct 2023
15:22:40 GMT; (No UCE/UBE) logging access from:
[xx.xx.xx.xx](FAIL)-[xx.xx.xx.xx]
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: <-- EHLO
[192.168.10.104]
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: ---
250-domains.com Hello [xx.xx.xx.xx], pleased to meet you
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: ---
250-ENHANCEDSTATUSCODES
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250-PIPELINING
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250-EXPN
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250-VERB
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250-8BITMIME
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250-SIZE
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250-DSN
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250-STARTTLS
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250-DELIVERBY
Oct 08 15:22:41 domains.com sm-mta[5256]: 398FMeAX005256: --- 250 HELP
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAX005256: <-- STARTTLS
Oct 08 15:22:42 domains.com sm-mta[5256]: engine=(null), path=(null),
ispre=0, pre=0, initialized=0
Oct 08 15:22:42 domains.com sm-mta[5256]: tls_srv_features=(null),
relay=[xx.xx.xx.xx] [xx.xx.xx.xx]
Oct 08 15:22:42 domains.com sm-mta[5256]: tls_srv_features=empty,
stat=0, relay=[xx.xx.xx.xx] [xx.xx.xx.xx]
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAX005256: --- 220 2.0.0
Ready to start TLS
Oct 08 15:22:42 domains.com sm-mta[5256]: STARTTLS=server, info:
fds=8/4, err=2
Oct 08 15:22:42 domains.com sm-mta[5256]: STARTTLS=server, get_verify: 0
get_peer: 0x0
Oct 08 15:22:42 domains.com sm-mta[5256]: STARTTLS=server,
relay=[xx.xx.xx.xx], version=TLSv1.3, verify=NOT,
cipher=TLS_AES_128_GCM_SHA256, bits=128/128
Oct 08 15:22:42 domains.com sm-mta[5256]: STARTTLS=server,
cert-subject=, cert-issuer=, verifymsg=ok
Oct 08 15:22:42 domains.com sm-mta[5256]: AUTH warning: no mechanisms
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAX005256: <-- EHLO
[192.168.10.104]
Oct 08 15:22:42 domains.com sm-mta[5256]: poststats:
/var/lib/sendmail/sendmail.st: No such file or directory
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: ---
250-domains.com Hello [xx.xx.xx.xx], pleased to meet you
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: ---
250-ENHANCEDSTATUSCODES
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 250-PIPELINING
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 250-EXPN
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 250-VERB
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 250-8BITMIME
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 250-SIZE
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 250-DSN
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 250-DELIVERBY
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 250 HELP
Oct 08 15:22:42 domains.com sm-mta[5256]: STARTTLS=read, info: fds=8/4,
err=2
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: <-- MAIL
FROM:<test@domains.com> BODY=8BITMIME SIZE=401
Oct 08 15:22:42 domains.com sm-mta[5256]: 398FMeAY005256: --- 530 5.7.0
Authentication required
Oct 08 15:22:42 domains.com sm-mta[5256]: STARTTLS=read, info: fds=8/4,
err=2
Oct 08 15:22:45 domains.com sm-mta[5256]: 398FMeAY005256: --- 421 4.4.1
domains.com Lost input channel from [xx.xx.xx.xx]
Oct 08 15:22:45 domains.com sm-mta[5256]: 398FMeAY005256: lost input
channel from [xx.xx.xx.xx] to MSP-v4 after mail
Oct 08 15:22:45 domains.com sm-mta[5256]: poststats:
/var/lib/sendmail/sendmail.st: No such file or directory
O

--

Knute Johnson

I found the problem. When Debian installed sendmail or sasl2-bin it
left off one of the dependencies: libsasl2-modules. It's working fine now.

Thanks for looking.

--

Knute Johnson

Am 08.10.2023 um 10:48:50 Uhr schrieb Knute Johnson:

> I found the problem. When Debian installed sendmail or sasl2-bin it
> left off one of the dependencies: libsasl2-modules. It's working
> fine now.

m@srv1:~$ apt -s remove libsasl2-modules
[...]
The following packages will be REMOVED:
cyrus-admin cyrus-common cyrus-imapd libsasl2-modules

Seems only the Cyrus stuff depends on it.
Do you think it should be a hard dependency for sasl2-bin or at least
recommended?

On 10/8/23 14:21, Marco Moock wrote:
> Am 08.10.2023 um 10:48:50 Uhr schrieb Knute Johnson:
>
>> I found the problem. When Debian installed sendmail or sasl2-bin it
>> left off one of the dependencies: libsasl2-modules. It's working
>> fine now.
>
> m@srv1:~$ apt -s remove libsasl2-modules
> [...]
> The following packages will be REMOVED:
> cyrus-admin cyrus-common cyrus-imapd libsasl2-modules
>
> Seems only the Cyrus stuff depends on it.
> Do you think it should be a hard dependency for sasl2-bin or at least
> recommended?
>

When I installed sendmail and sasl2-bin the package libsasl2-modules-db
was installed but not libsasl2-modules. I don't know if it should have
been but sendmail doesn't work right without it. This was a couple of
days work to figure out what was missing.

--

Knute Johnson

Am 08.10.2023 um 17:50:19 Uhr schrieb Knute Johnson:

> When I installed sendmail and sasl2-bin the package
> libsasl2-modules-db was installed but not libsasl2-modules. I don't
> know if it should have been but sendmail doesn't work right without
> it. This was a couple of days work to figure out what was missing.

Do you think it should be listed in recommended in the Debian package
system?
Then you should file a report here:
https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=yes&src=cyrus-sasl2

On 10/9/23 01:14, Marco Moock wrote:
> Am 08.10.2023 um 17:50:19 Uhr schrieb Knute Johnson:
>
>> When I installed sendmail and sasl2-bin the package
>> libsasl2-modules-db was installed but not libsasl2-modules. I don't
>> know if it should have been but sendmail doesn't work right without
>> it. This was a couple of days work to figure out what was missing.
>
> Do you think it should be listed in recommended in the Debian package
> system?
> Then you should file a report here:
> https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=yes&src=cyrus-sasl2
>

I did find this:

knute@knute-XPS-8700:~$ apt-cache depends show sendmail
sendmail
Depends: sendmail-base
Depends: sendmail-bin
Depends: sendmail-cf
Depends: sensible-mda
Suggests: sendmail-doc
Suggests: rmail

knute@knute-XPS-8700:~$ apt-cache depends show sasl2-bin
sasl2-bin
PreDepends: init-system-helpers
Depends: db-util
Depends: libsasl2-2
Depends: lsb-base
sysvinit-utils:i386
sysvinit-utils
|Depends: debconf
Depends: <debconf-2.0>
cdebconf
debconf
Depends: <perl:any>
perl:i386
perl
Depends: libc6
Depends: libcrypt1
Depends: libdb5.3
Depends: libkrb5-3
Depends: libldap2
Depends: libpam0g
Depends: libssl3

knute@knute-XPS-8700:~$ apt-cache depends show libsasl2-2
libsasl2-2
Depends: libsasl2-modules-db
Depends: libc6
Recommends: libsasl2-modules
Replaces: <libsasl2>

sasl2-bin depends on libsasl2-2, libsasl2-2 depends on
libsasl2-modules-db and recommends libsasl2-modules.

It turns out that my other Debian computers all had libsasl2-modules
installed and so I never came accross this problem before.

--

Knute Johnson

Am 09.10.2023 um 11:43:05 Uhr schrieb Knute Johnson:

> It turns out that my other Debian computers all had libsasl2-modules
> installed and so I never came accross this problem before.

Did you use --no-install-recommends?

On 10/9/23 13:57, Marco Moock wrote:
> Am 09.10.2023 um 11:43:05 Uhr schrieb Knute Johnson:
>
>> It turns out that my other Debian computers all had libsasl2-modules
>> installed and so I never came accross this problem before.
>
> Did you use --no-install-recommends?
>

No I didn't. I didn't know that option existed.

--

Knute Johnson

Am 09.10.2023 um 14:37:59 Uhr schrieb Knute Johnson:

> No I didn't. I didn't know that option existed.

Please check if any file in /etc/apt contains

APT::Install-Recommends "0";

On 10/9/23 15:06, Marco Moock wrote:
> Am 09.10.2023 um 14:37:59 Uhr schrieb Knute Johnson:
>
>> No I didn't. I didn't know that option existed.
>
> Please check if any file in /etc/apt contains
>
> APT::Install-Recommends "0";
>

I looked through these files and did not find it:

root@knute:/etc/apt# locate apt
/etc/apt
/etc/apt/apt.conf.d
/etc/apt/apt.conf.d/01autoremove
/etc/apt/apt.conf.d/20auto-upgrades
/etc/apt/apt.conf.d/20listchanges
/etc/apt/apt.conf.d/50unattended-upgrades
/etc/apt/apt.conf.d/70debconf
/etc/apt/auth.conf.d
/etc/apt/keyrings
/etc/apt/listchanges.conf
/etc/apt/listchanges.conf.d
/etc/apt/mirrors
/etc/apt/mirrors/debian-security.list
/etc/apt/mirrors/debian.list
/etc/apt/preferences.d
/etc/apt/sources.list
/etc/apt/sources.list.d
/etc/apt/sources.list.d/debian.sources
/etc/apt/trusted.gpg.d
/etc/apt/trusted.gpg.d/debian-archive-bookworm-automatic.asc
/etc/apt/trusted.gpg.d/debian-archive-bookworm-security-automatic.asc
/etc/apt/trusted.gpg.d/debian-archive-bookworm-stable.asc
/etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.asc
/etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.asc
/etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.asc
/etc/apt/trusted.gpg.d/debian-archive-buster-automatic.asc
/etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.asc
/etc/apt/trusted.gpg.d/debian-archive-buster-stable.asc

--

Knute Johnson