# NGiNX does not pass SMTP AUTH command to server?

**URL:** <https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290>\
**Category:** NGINX\
**Created:** [February 28, 2010, 10:03am UTC](https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290 "2010-02-28T10:03:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andree\_Leidenfrost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/59ef9b/32.png) [@Andree\_Leidenfrost](https://www.ruby-forum.com/u/Andree_Leidenfrost)\
**Post date:** [February 28, 2010, 10:03am UTC](https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290/1 "2010-02-28T10:03:06Z")

</div>

Dear all,

I am by no means an experienced nginx user, but I have nginx working for  
HTTP & IMAP and am now trying to add SMTP to the mix.

I require authentication for the SMTP server and am experiencing a  
problem in that the first AUTH command that comes from the client does  
not get passed through to the server by nginx; only the second one does.  
Here is a telnet session to illustrate (an email client like Thunderbird  
would of course not send the second AUTH command):

> telnet aurichvm04 465  
> Trying 192.168.1.154…  
> Connected to aurichvm04.ostfriesland.  
> Escape character is ‘^]’.  
> 220 aurichvm04 ESMTP ready  
> AUTH PLAIN \<base64 encoded user & password\>  
> 235 2.0.0 OK  
> AUTH PLAIN \<base64 encoded user & password\>  
> 235 2.7.0 Authentication successful

According to wireshark, rather than sending the AUTH command the first  
time, nginx just sends a HELO command. The second time the AUTH command  
is issued by the client, nginx passes it through (as I would expect it  
to do the first time round).

I include my nginx.conf and sites-availabe/default below. I am using the  
current Debian unstable package (0.7.65-1). My server is Postfix.

I few notes on the config:

- I am using a trivial authentication server.
- I have turned ssl off for test purposes.
- I have turned xclient off because Postfix does not accept the xclient  
login attribute. (I don’t believe it is required?)

If you could help that would be great!

Thanks a lot & best regards,  
Andree

–8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<–  
nginx.conf:

user www-data;  
worker\_processes 1;

error\_log /var/log/nginx/error.log;  
pid /var/run/nginx.pid;

events {  
worker\_connections 1024;  
}

http {  
include /etc/nginx/mime.types;

```
 access_log /var/log/nginx/access.log;

 sendfile on;

 keepalive_timeout 65;
 tcp_nodelay on;

 gzip on;
 gzip_disable "MSIE [1-6]\.(?!.*SV1)";

 include /etc/nginx/conf.d/*.conf;
 include /etc/nginx/sites-enabled/*;

```

}

mail {  
ssl off;

ssl\_certificate  
/etc/ssl/certs/aurichvm04.ostfriesland\_cert.pem;

ssl\_certificate\_key  
/etc/ssl/private/aurichvm04.ostfriesland\_key.pem;  
ssl\_session\_timeout 5m;

```
 server {
        listen aurichvm04.ostfriesland:993;
        protocol imap;

        imap_capabilities "IMAP4rev1" "SORT" "THREAD=REFERENCES"

```

“MULTIAPPEND” “UNSELECT” “LITERAL+” “IDLE” “CHILDREN” “NAMESPACE”

```
        proxy on;
        auth_http 127.0.0.1:9000/auth-imap/;
        }

 server {
        listen aurichvm04.ostfriesland:465;
        protocol smtp;

        smtp_capabilities "SIZE 10240000" "VRFY" "ETRN"

```

“ENHANCEDSTATUSCODES” “8BITMIME” “DSN” “AUTH PLAIN LOGIN”

```
        proxy on;
        xclient off;
        auth_http 127.0.0.1:9000/auth-smtp/;
        }

```

}

–8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<----8\<–  
sites-available/default:

server {  
listen localhost:9000;

```
   access_log /var/log/nginx/localhost_AUTH.access.log;

   location = /auth-imap/ {
            add_header Auth-Status OK;
            add_header Auth-Server 192.168.1.152;
            add_header Auth-Port 143;

            empty_gif;
   }

   location = /auth-smtp/ {
            add_header Auth-Status OK;
            add_header Auth-Server 192.168.1.152;
            add_header Auth-Port 25;

            empty_gif;
   }

```

}

server {  
listen 443;  
server\_name aurichvm04.ostfriesland;

```
   ssl on;

```

ssl\_certificate  
/etc/ssl/certs/aurichvm04.ostfriesland\_cert.pem;

ssl\_certificate\_key  
/etc/ssl/private/aurichvm04.ostfriesland\_key.pem;  
ssl\_session\_timeout 5m;

access\_log  
/var/log/nginx/aurichvm04.ostfriesland\_HTTPS.access.log;

```
   location / {
            proxy_pass http://emden3:8080;
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For

```

$proxy\_add\_x\_forwarded\_for;  
}  
}

---

<div class="post-metadata">

**Author:** ![Andree\_Leidenfrost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/59ef9b/32.png) [@Andree\_Leidenfrost](https://www.ruby-forum.com/u/Andree_Leidenfrost)\
**Post date:** [February 28, 2010, 10:49am UTC](https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290/2 "2010-02-28T10:49:55Z")

</div>

Hello!

On Sun, Feb 28, 2010 at 08:02:19PM +1100, Andree Leidenfrost wrote:

[…]

> According to wireshark, rather than sending the AUTH command the first  
> time, nginx just sends a HELO command. The second time the AUTH command

Yes, nginx doesn’t pass AUTH command to backend for SMTP. You  
should configure backend to accept mail from nginx without  
authentication.

[…]

> I few notes on the config:
> 
> - I am using a trivial authentication server.
> - I have turned ssl off for test purposes.
> - I have turned xclient off because Postfix does not accept the xclient  
> login attribute. (I don’t believe it is required?)

You need postfix patched to work with nginx’s xclient on.  
Patch is here:

> **[Патч к Postfix \[Citrin's site\]](http://www.citrin.ru/nginx:xclient-login-patch)**

Maxim D.

---

<div class="post-metadata">

**Author:** ![Andree\_Leidenfrost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/59ef9b/32.png) [@Andree\_Leidenfrost](https://www.ruby-forum.com/u/Andree_Leidenfrost)\
**Post date:** [February 28, 2010, 12:19pm UTC](https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290/3 "2010-02-28T12:19:27Z")

</div>

Hi Maxim,

Thank you for your turbo-swift reply and your explanations!

NGiNX authenticates fine for IMAP and POP3. Is it not somewhat  
inconsistent that it does not authenticate for SMTP? Especially as it  
seems to work the second time??? If the SMTP server can take care of  
authentication in the first place, would it not be a good thing to  
utilise this rather than relying on an additional authentication  
mechanism?

Has the patch you mention actually been put in front of the Postfix  
people? I have no idea what RFCs may exist for this xclient stuff (and I  
have not really been able to find anything definitive on this on the  
internet), but changing the code of an MTA is something that would not  
happen on a whim, I guess?

Thanks again & best regards,  
Andree

---

<div class="post-metadata">

**Author:** ![Andree\_Leidenfrost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/59ef9b/32.png) [@Andree\_Leidenfrost](https://www.ruby-forum.com/u/Andree_Leidenfrost)\
**Post date:** [February 28, 2010, 1:41pm UTC](https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290/4 "2010-02-28T13:41:58Z")

</div>

Hello!

On Sun, Feb 28, 2010 at 10:18:59PM +1100, Andree Leidenfrost wrote:

> NGiNX authenticates fine for IMAP and POP3. Is it not somewhat  
> inconsistent that it does not authenticate for SMTP? Especially as it  
> seems to work the second time??? If the SMTP server can take care of  
> authentication in the first place, would it not be a good thing to  
> utilise this rather than relying on an additional authentication  
> mechanism?

It is believed that there is no need to re-authenticate against  
smtp backend as it doesn’t provide any additional value (unlike  
POP3 and IMAP where it’s required to obtain access to specific  
mailbox).

> Has the patch you mention actually been put in front of the Postfix  
> people?

AFAIK, no. But I may be wrong, I’m not the author of the patch  
in question.

> I have no idea what RFCs may exist for this xclient stuff (and I  
> have not really been able to find anything definitive on this on the  
> internet),

XCLIENT was originally implemented in Postfix, and there is no  
RFC. There is also patch for Exim to support it (developed by  
Vsevolod Stakhov, [cebka.pp.ru](http://cebka.pp.ru); the patch was made for nginx and  
supports LOGIN attribute).

[…]

Maxim D.

p.s. Please do not top-post. Thank you.

---

<div class="post-metadata">

**Author:** ![Andree\_Leidenfrost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/59ef9b/32.png) [@Andree\_Leidenfrost](https://www.ruby-forum.com/u/Andree_Leidenfrost)\
**Post date:** [February 28, 2010, 2:05pm UTC](https://www.ruby-forum.com/t/nginx-does-not-pass-smtp-auth-command-to-server/184290/5 "2010-02-28T14:05:23Z")

</div>

Hi Maxim!

On Sun, 2010-02-28 at 15:41 +0300, Maxim D. wrote:

> It is believed that there is no need to re-authenticate against  
> smtp backend as it doesn’t provide any additional value (unlike  
> POP3 and IMAP where it’s required to obtain access to specific  
> mailbox).

I for once would like to use the SMTP backend for authentication. 😉  
(This is why I use a static/primitive http\_auth server.) NGiNX seems to  
be able to pass the AUTH command through the second time, so on  
principle, I suppose, this could also work the first time? (You decide  
whether this is worthwhile to support by NGiNX.)

As a side note, I would really appreciate to be able to securely  
communicate to any of the backends via SSL from NGiNX, be that POP3,  
IMAP or SMTP or whatever - it’s letters versus postcards even within  
organisations - I like the privacy of letters.

> XCLIENT was originally implemented in Postfix, and there is no  
> RFC. There is also patch for Exim to support it (developed by  
> Vsevolod Stakhov, [cebka.pp.ru](http://cebka.pp.ru); the patch was made for nginx and  
> supports LOGIN attribute).

Thank you! If this is a Postfix thing in the first place, the Postfix  
people should really be talked to, I guess? Not much point having a  
patch that may never make it into upstream Postfix (unless you operate  
in an environment where components are hand-patched all the time)?

> […]
> 
> Maxim D.
> 
> p.s. Please do not top-post. Thank you.

Thanks a lot & best regards,  
Andree