authelia: GMail smtp notification incorrectly detects TLS support
I’ve tried to figure out what the actual problem is here but can’t say exactly where the cause is but I have SMTP notifications turned on and I’m using the gmail smtp-relay server over TLS on port 587 with an app password. When my authelia container is first created and I visit my auth page and click the link to register or the link to send an email for a password reset it almost always comes back with an error stating There was a problem initiating the registration process. In the docker logs it shows
level=info msg="Logging severity set to debug"
level=debug msg="Notifier SMTP client initializing TLS configuration"
level=info msg="Authelia is listening for non-TLS connections on 0.0.0.0:9091"
level=info msg="Access to https://mydomain.tld/ is not authorized to user , redirecting to https://auth.mydomain.tld?rd=https%3A%2F%2Fmydomain.tld%2F" method=GET path=/api/verify remote_ip=192.168.1.128
level=info msg="Access to https://stats.mydomain.tld/ is not authorized to user , redirecting to https://auth.mydomain.tld?rd=https%3A%2F%2Fstats.mydomain.tld%2F" method=GET path=/api/verify remote_ip=192.168.1.128
level=debug msg="Credentials validation of user myuser is ok" method=POST path=/api/firstfactor remote_ip=192.168.1.128
level=debug msg="Mark authentication attempt made by user myuser" method=POST path=/api/firstfactor remote_ip=192.168.1.128
level=debug msg="Required level for the URL https://stats.mydomain.tld/ is 2" method=POST path=/api/firstfactor remote_ip=192.168.1.128
level=warning msg="https://stats.mydomain.tld/ requires 2FA, cannot be redirected yet" method=POST path=/api/firstfactor remote_ip=192.168.1.128
level=debug msg="Sending an email to user myuser (myuser@email.com) to confirm identity for registering a device." method=POST path=/api/secondfactor/totp/identity/start remote_ip=192.168.1.128
level=debug msg="Notifier SMTP client attempting connection to smtp-relay.email.com:587"
level=debug msg="Notifier SMTP client connected successfully"
level=warning msg="Notifier SMTP client encountered error during cleanup: EOF"
level=error msg="Notifier SMTP server does not support TLS and it is required by default (see documentation if you want to disable this highly recommended requirement)" method=POST path=/api/secondfactor/totp/identity/start remote_ip=192.168.1.128 stack="github.com/authelia/authelia/internal/middlewares/authelia_context.go:64 (*AutheliaCtx).Error\ngithub.com/authelia/authelia/internal/middlewares/identity_verification.go:86 IdentityVerificationStart.func1\ngithub.com/authelia/authelia/internal/middlewares/require_first_factor.go:15 RequireFirstFactor.func1\ngithub.com/authelia/authelia/internal/middlewares/authelia_context.go:49 AutheliaMiddleware.func1.1\ngithub.com/fasthttp/router@v1.2.2/router.go:348 (*Router).Handler\ngithub.com/authelia/authelia/internal/middlewares/log_request.go:14 LogRequestMiddleware.func1\ngithub.com/valyala/fasthttp@v1.14.0/server.go:2162 (*Server).serveConn\ngithub.com/valyala/fasthttp@v1.14.0/workerpool.go:223 (*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.14.0/workerpool.go:195 (*workerPool).getCh.func1\nruntime/asm_amd64.s:1373 goexit"
I’m running version 4.20 of Authelia and this only happens once or twice the very first time I try and reset a password or register a device after the container is created. After the initial failure or two, it works and sends the email without even needing to restart the container or navigate away from the page
existing Authelia configuration
host: 0.0.0.0
port: 9091
log_level: debug
jwt_secret: "super-secret"
default_redirection_url: https://mydomain.tld
totp:
issuer: mydomain
authentication_backend:
file:
path: /config/users.yml
password:
algorithm: argon2id
iterations: 1
salt_length: 16
parallelism: 8
memory: 1024
access_control:
default_policy: deny
rules:
- domain: "auth.mydomain.tld"
policy: bypass
- domain:
- www.mydomain.tld
- mydomain.tld
resources:
- "^/plugins/images/favicon/site.webmanifest$"
policy: bypass
- domain:
- request.mydomain.tld
- watch.mydomain.tld
- www.mydomain.tld
- mydomain.tld
subject: group:users
policy: two_factor
- domain: "*.mydomain.tld"
subject: group:admins
policy: two_factor
session:
name: mydomain_session
secret: "super-long-secret"
expiration: 7200
inactivity: 3600
domain: mydomain.tld
remember_me_duration: 1M
regulation:
max_retries: 3
find_time: 2m
ban_time: 12h
storage:
local:
path: /config/db.sqlite3
notifier:
disable_startup_check: true
smtp:
username: myuser@mydomain.tld
password: google app password
host: smtp-relay.gmail.com
port: 587
sender: no-reply@mydomain.tld
subject: "[2FA] {title}"
disable_require_tls: false
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Comments: 24 (19 by maintainers)
Makes sense, probably would be helpful with the helm chart. It’s still in beta and people seem to regularly have issues. Thanks for the clarification!
@nightah The different is that
smtp-relay.gmail.comis a true smtp relay which allows you to send emails as someone else. For example, if I want to send an email to all my users asno-reply@mydomain.comI can do this withsmtp-relay.gmail.combut not withsmtp.gmail.com. With smtp.gmail.com I would need to send the email from my actual email address. Google also imposes more requirements and security aroundsmtp-relay.gmail.comthan it does withsmtp.gmail.comsince it’s a relay. Does that make sense?EDIT: so for a temporary workaround, smtp.gmail.com will work but it exposes your real email address to your recipients so it’s not ideal but does work
@wouterbouvy @nightah As a workaround for now, until this gets added, you can use the following postfix docker configuration. All it does is forward your mail from Authelia to gmail (gsuite) with the correct hostname. I’ve tested this and it works.
And in the Authelia configuration.yml you would put this for the notifier
@akusei good find regarding the Google SMTP Relay limitation, for the record here’s an article with more detail including the following extract:
I think your suggestion is a sane one @akusei, perhaps we should just default to sending
os.Hostname()which in the case of Docker will be a randomly generated hostname and can be also customised with thehostnameoption too. This should also carry a sane default for non-Docker based deployments. Thoughts @james-d-elliott?I also still have this same problem and diverted to smtp.gmail.com instead of smtp-relay.gmail.com as a workaround. Great find on the localhost @akusei
@james-d-elliott This may need to be re-opened. Or would you prefer I create a new ticket?
Turns out this is still a problem for gmail SMTP relay but I think I’ve figured out what the issue is. It appears Authelia is sending
localhostas the hostname for the SMTPEHLOandHELOcommands. Google doesn’t like this at all. I was able to reproduce the issue with an smtp command line testing tool and the issue was fixed when I told the tool to use my actual hostname/domain that google recognizes. Here’s a tcpdump of the traffic coming from Authelia going to the smtp relay.It’s not pretty to look at, sorry. If you can read through that, you’ll see Authelia sending
localhost. Is there a way to change what hostname Authelia will send? I tried settinghostnameon the container but that doesn’t work.