AUTH Error

/opt/kumomta/sbin/kcli trace-smtp-server
After running this trace command here are some of the logs that were displayed.

Note- example.com is setup on KumoMTA and is an acting relay server .

[178.X.X.X:5870->172.X.X.X:25] 0ns === Connected 2024-07-20 09:31:08.2566 UTC
[178.X.X.X:5870->172.X.X.X:25] 0ns === conn_meta hostname=“example.com
[178.X.X.X:5870->172.X.X.X:25] 0ns === conn_meta received_from=“178.X.X>X:5870”
[178.X.X.X:5870->172.X.X.X:25] 0ns === conn_meta received_via=“172.X.X.X:25”
[178.X.X.X:5870->172.X.X.X:25] 0ns === conn_meta reception_protocol=“ESMTP”
[178.X.X.X:5870->172.X.X.X:25] 36µs ← 220 example.com KumoMTA
[178.X.X.X:5870->172.X.X.X:25] 86ms → EHLO 10.X.X.X
[178.X.X.X:5870->172.X.X.X:25] 86ms === smtp_server_ehlo: Ok
[178.X.X.X:5870->172.X.X.X:25] 86ms ← 250-example.com Aloha 52.X.X.X
[178.X.X.X:5870->172.X.X.X:25] 86ms ← 250-PIPELINING
[178.X.X.X:5870->172.X.X.X:25] 86ms ← 250-ENHANCEDSTATUSCODES
[178.X.X.X:5870->172.X.X.X:25] 86ms ← 250 STARTTLS
[178.X.X.X:5870->172.X.X.X:25] 174ms → AUTH LOGIN
[178.X.X.X:5870->172.X.X.X:25] 174ms ← 504 5.5.4 AUTH {sasl_mech} not supported
[178.X.X.X:5870->172.X.X.X:25] 261ms === ERROR: Peer Disconnected
[178.X.X.X:5870->172.X.X.X:25] 261ms === Closed

Here are the logs in the main server (Postfix):-

Jul 20 09:29:44 mail postfix/smtp[41496]: warning: example.com[52.X.X.X]:25 offered no supported AUTH mechanisms: ‘PLAIN’
Jul 20 09:29:44 mail postfix/smtp[41496]: 4WR0fK1rQrz201C: to=example@gmail.com, relay=example.com[52.X.X.X]:25, delay=2256, delays=2255/0.08/0.05/0.02, dsn=4.3.0, status=deferred (host example.com[52.X.X.X] said: 421 4.3.0 example.com technical difficulties (in reply to end of DATA command))

From what I can gather from this is that-
The server example.com only offers the PLAIN authentication mechanism. However, my main mail server uses AUTH LOGIN, which is not supported.

Hey there @helpful-emu, thanks for posting. Please read the “Troubleshooting” and “How to Ask for Help” buttons below. If you would like a 1:1 support session from the KumoMTA team, details are at the “Book a Support Session” button below.

No AUTH without TLS first.

We have enabled TLS already on both the servers.

The client issues an AUTH, it did not issue a STARTTLS

Here are the full logs of one smtp session
Logs (5.3 KB)

The log provided was enough, the client did not start TLS and AUTH without TLS is insecure.