[Fixed] Config options for local SMTP / Postfix Server

[RamShadow]

Hey,

I'm running an actual (1.25.0) vaultwarden installation and had tried to configure SMTP.

After some tests and some troubleshooting I have seen that there is no configuration option and in the code no "path" for
sending email without authentication and without certificates with an smtp server.

The smtp server is running on the same machine and trusts the local machine and all services that are running on the local machine so there is no need for TLS and Authentication.

lettre (The smtp library for rust) has the possibility to be used without auth and tls.

Is there a possibility to add this in the future?

Thanks for your work, you are doing a great job.

Cheers
Lex / RamShadow

PS I can read rust but have not the knowledge to write it by myself in the quality that I want

[BlackDex]

Just configure it without ssl, set SMTP_SECURITY=off and you are done.

[BlackDex]

Also see: https://github.com/dani-garcia/vaultwarden/wiki/SMTP-Configuration

[RamShadow]

Hi, thanks for your answer.

yes, I tried this, but then I'm getting the error that there is no compatible authentication mechanism was found... :

[vaultwarden::mail][ERROR] SMTP Client error: internal client error: No compatible authentication mechanism was found

and yes there is in the EHLO response no authentication mechanism, the server has the default postfix config where not authentication is configured:

[lettre::transport::smtp::client::connection][DEBUG] server localhost with {EightBitMime, StartTls, SmtpUtfEight}
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>250-VRFY<CRLF>250-ETRN<CRLF>250-STARTTLS<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-8BITMIME<CRLF>250-DSN<CRLF>250-SMTPUTF8<CRLF>250 CHUNKING<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>250-VRFY<CRLF>250-ETRN<CRLF>250-STARTTLS<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-8BITMIME<CRLF>250-DSN<CRLF>250-SMTPUTF8<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>250-VRFY<CRLF>250-ETRN<CRLF>250-STARTTLS<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-8BITMIME<CRLF>250-DSN<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>250-VRFY<CRLF>250-ETRN<CRLF>250-STARTTLS<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-8BITMIME<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>250-VRFY<CRLF>250-ETRN<CRLF>250-STARTTLS<CRLF>250-ENHANCEDSTATUSCODES<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>250-VRFY<CRLF>250-ETRN<CRLF>250-STARTTLS<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>250-VRFY<CRLF>250-ETRN<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>250-VRFY<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>250-SIZE 10240000<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>250-PIPELINING<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 250-localhost<CRLF>
[lettre::transport::smtp::client::connection][DEBUG] << 220 localhost ESMTP Postfix (Debian/GNU)<CRLF>

[Masgalor]

Just to get this right, your local mailserver does not expect TLS but it does expact login credentials, correct?

If that is the case you need to explicitly set an auth-mechanism, because there is no default value if you disable TLS.

## Defaults for SSL is "Plain" and "Login" and nothing for Non-SSL connections.
## Possible values: ["Plain", "Login", "Xoauth2"].
## Multiple options need to be separated by a comma ','.
# SMTP_AUTH_MECHANISM="Plain"

[RamShadow]

The mailserver does not expect TLS but will do if the application needs to and does not expect authentication
There is no authentication needed, so in the ehlo answer from the server is no possible authentication listed.

What makes me thinking is, I have set SMTP_SECURITY=off but there is in the first line of logging StartTls shown: server localhost with {EightBitMime, StartTls, SmtpUtfEight}

[Masgalor]

Got it.

I have to admit that I am still on 1.24.0 so maybe the functionaly changed with 1.25.0.
But I am running a very similar setup where no TLS or authentication is used and never had any problems with that.

My smtp configuration looks like this.

SMTP_HOST=smtp.masgalor
SMTP_FROM=<mailaddress>
SMTP_FROM_NAME='Masgalor-Network Vaultwarden'
SMTP_PORT=25
SMTP_SSL=false

I will update to 1.25.0 in the coming days, so I can report back if something breaks with the new version.

[Masgalor]

I updated my testsystem to 1.25.0 this morning and it is still working without any problems.
So I can say, the functionality you want is there, it is just not working on your system for one reason or another.

Changed smtp configuration

SMTP_HOST=smtp.masgalor
SMTP_FROM=<mailaddress>
SMTP_FROM_NAME='Masgalor-Network Vaultwarden'
SMTP_PORT=25
SMTP_SECURITY=off

My advice would be to to set SMTP_SECURITY=offand figure out why vaultwarden feels the need to authenticate to your mailserver.
Can you send unauthenticated mails via telnet?
Maybe your are missing permit_mynetworks in one of your rulesets.

[RamShadow]

Interesting,
I have dropped my old config,
dropped the old docker-compose file,
set up booth new with the old data directory and it is running smtp now.

Thanks all for the help!