email cannot get sent: unrecognized challenge #791

Originally created by @joergmschulz on GitHub (Sep 2, 2020).

Subject of the issue

I try to setup / send email.
The server seems to be reached, but the log returns:

[2020-09-02 14:43:45.461][request][INFO] POST /admin/test/smtp/
bitwarden           | [2020-09-02 14:43:45.560][error][ERROR] SmtpError.
bitwarden           | [CAUSE] Client(
bitwarden           |     "Unrecognized challenge",
bitwarden           | )
bitwarden           | [2020-09-02 14:43:45.562][response][INFO] POST /admin/test/smtp (test_smtp) => 400 Bad Request

Your environment

image: bitwardenrs/server-postgresql:latest

Install method: docker-compose

Steps to reproduce

Expected behaviour

email should be sent

Actual behaviour

error 400

Originally created by @joergmschulz on GitHub (Sep 2, 2020).  ### Subject of the issue I try to setup / send email. The server seems to be reached, but the log returns: ``` [2020-09-02 14:43:45.461][request][INFO] POST /admin/test/smtp/ bitwarden | [2020-09-02 14:43:45.560][error][ERROR] SmtpError. bitwarden | [CAUSE] Client( bitwarden | "Unrecognized challenge", bitwarden | ) bitwarden | [2020-09-02 14:43:45.562][response][INFO] POST /admin/test/smtp (test_smtp) => 400 Bad Request ``` ### Your environment  `image: bitwardenrs/server-postgresql:latest` * Install method: docker-compose ### Steps to reproduce  ### Expected behaviour email should be sent ### Actual behaviour error 400

GiteaMirror closed this issue

GiteaMirror commented

@BlackDex commented on GitHub (Sep 3, 2020):

Could you give some more details on your config without password and username?

So what are the settings you have for email?

@BlackDex commented on GitHub (Sep 3, 2020): Could you give some more details on your config without password and username? So what are the settings you have for email?

GiteaMirror commented

@joergmschulz commented on GitHub (Sep 3, 2020):

  "_enable_smtp": true,
  "smtp_host": "m.mmmmmmm.de",
  "smtp_ssl": true,
  "smtp_explicit_tls": false,
  "smtp_port": 587,
  "smtp_from": "help@mmmmmmmmm.de",
  "smtp_from_name": "Bitwarden_RS",
  "smtp_username": "help@mmmmmmmmmm.de",
  "smtp_password": "pppppppppp",
  "smtp_auth_mechanism": "login",
  "smtp_timeout": 15,
  "helo_name": "bitwarden.mmmmmmmm.de",

Things that didn't change the situation:

use other ports like 25, 465
dis/enable tls
use another tls1.3 enabled email server (I don't have a 1.2 one)
disable authentication
use a completely different provider
enter different values in the smtp_auth_mechanism field

@joergmschulz commented on GitHub (Sep 3, 2020): ``` "_enable_smtp": true, "smtp_host": "m.mmmmmmm.de", "smtp_ssl": true, "smtp_explicit_tls": false, "smtp_port": 587, "smtp_from": "help@mmmmmmmmm.de", "smtp_from_name": "Bitwarden_RS", "smtp_username": "help@mmmmmmmmmm.de", "smtp_password": "pppppppppp", "smtp_auth_mechanism": "login", "smtp_timeout": 15, "helo_name": "bitwarden.mmmmmmmm.de", ``` Things that didn't change the situation: - use other ports like 25, 465 - dis/enable tls - use another tls1.3 enabled email server (I don't have a 1.2 one) - disable authentication - use a completely different provider - enter different values in the smtp_auth_mechanism field

GiteaMirror commented

@BlackDex commented on GitHub (Sep 7, 2020):

@joergmschulz I think you need to change the "smtp_auth_mechanism" to be "Plain" instead of "login", if you really need the "login" mechanism, then i think i also need to have an uppercase L, so "Login".

Please try if that solves your issue.

@BlackDex commented on GitHub (Sep 7, 2020): @joergmschulz I think you need to change the "smtp_auth_mechanism" to be "Plain" instead of "login", if you really need the "login" mechanism, then i think i also need to have an uppercase L, so "Login". Please try if that solves your issue.

GiteaMirror commented

@joergmschulz commented on GitHub (Sep 7, 2020):

yes, this has been among the things I have tested. Plain, login, Login, plain. But neither worked.

@joergmschulz commented on GitHub (Sep 7, 2020): yes, this has been among the things I have tested. Plain, login, Login, plain. But neither worked.

GiteaMirror commented

@BlackDex commented on GitHub (Sep 16, 2020):

I made some changes so it now supports multiple authentication mechanisms. You could try to add both plain and login comma separated. It now also have a bit update mail library which could help a bit.

@BlackDex commented on GitHub (Sep 16, 2020): I made some changes so it now supports multiple authentication mechanisms. You could try to add both plain and login comma separated. It now also have a bit update mail library which could help a bit.

GiteaMirror commented

@joergmschulz commented on GitHub (Sep 17, 2020):

Has this change found its way into the docker image or should I build from master?

@joergmschulz commented on GitHub (Sep 17, 2020): Has this change found its way into the docker image or should I build from master?

GiteaMirror commented

@BlackDex commented on GitHub (Sep 17, 2020):

@joergmschulz this is in the latest version when using the testing tag

@BlackDex commented on GitHub (Sep 17, 2020): @joergmschulz this is in the latest version when using the testing tag

GiteaMirror commented

@joergmschulz commented on GitHub (Sep 17, 2020):

have now built from master; the format of the error message improved, but the content is left unchanged.

@joergmschulz commented on GitHub (Sep 17, 2020): have now built from master; the format of the error message improved, but the content is left unchanged. <img width="422" alt="grafik" src="https://user-images.githubusercontent.com/6523646/93452322-9256ae00-f8d8-11ea-8a0f-e2f9d118f214.png">

GiteaMirror commented

@BlackDex commented on GitHub (Sep 19, 2020):

@joergmschulz i have checked the code and this error only happens during the following.

Using the Login auth mechanism
The server responds with some kind of challenge it doesn't recognize.

So what happens during the LOGIN auth method is the following.

Client connects to mail-server
Client sends ehlo command
Server responds with its features (250-XX)
Client checks which 250-AUTH features and if a match, it will continue.
Client sends which auth it's going to use AUTH LOGIN
Server sends a response 334 VXNlcm5hbWU6

And there is where it goes wrong.
The value right after 334 here is a base64 encoded string which contains Username: in this case.
For some reason the server you connect to responds with something the mail-library doesn't understand.

You could try to do this manually and see what the server returns.
The 334 responses are where the library is tripping on and returning the the error you see.

To try it your self do the following.

# Run for starttls either port 25 or 587
openssl s_client -starttls smtp -crlf -connect m.mmmmmmm.de:587
# Run for SSL connection normally port 465
openssl s_client -crlf -connect m.mmmmmmm.de:465

This will start a console where you can type and press enter to send that command.
Enter the following commands right after each other.

EHLO my.domain.tld
AUTH LOGIN

And now wait what will return.
It could also be that the Password part is giving the issue, that normally follows after you have entered your username.

Also, checkout one of these two sites for example to help you test it manually:
https://www.ndchost.com/wiki/mail/test-smtp-auth-telnet
http://www.xglobe.com/knowledgebase/mail/test-smtp-authentication-with-telnet/

@BlackDex commented on GitHub (Sep 19, 2020): @joergmschulz i have checked the code and this error only happens during the following. 1. Using the Login auth mechanism 2. The server responds with some kind of challenge it doesn't recognize. So what happens during the LOGIN auth method is the following. 1. Client connects to mail-server 2. Client sends `ehlo` command 3. Server responds with its features (`250-XX`) 4. Client checks which `250-AUTH` features and if a match, it will continue. 5. Client sends which auth it's going to use `AUTH LOGIN` 6. Server sends a response `334 VXNlcm5hbWU6` And there is where it goes wrong. The value right after 334 here is a base64 encoded string which contains `Username:` in this case. For some reason the server you connect to responds with something the mail-library doesn't understand. You could try to do this manually and see what the server returns. The `334` responses are where the library is tripping on and returning the the error you see. To try it your self do the following. ```bash # Run for starttls either port 25 or 587 openssl s_client -starttls smtp -crlf -connect m.mmmmmmm.de:587 # Run for SSL connection normally port 465 openssl s_client -crlf -connect m.mmmmmmm.de:465 ``` This will start a console where you can type and press enter to send that command. Enter the following commands right after each other. ```bash EHLO my.domain.tld AUTH LOGIN ``` And now wait what will return. It could also be that the Password part is giving the issue, that normally follows after you have entered your username. Also, checkout one of these two sites for example to help you test it manually: https://www.ndchost.com/wiki/mail/test-smtp-auth-telnet http://www.xglobe.com/knowledgebase/mail/test-smtp-authentication-with-telnet/

GiteaMirror commented