NGINX forwarding SMTP auth credentials to next server? - nginx

Question

Using NGINX SMTP relay capabilities as described here, to proxy a commercial SMTP server, effectively "white-labelling" the relay address (including cert) while preserving authentication.
Configured NGINX as follows:
mail {
server_name smtp.proxy.mydomain.net;
auth_http 127.0.0.1:9000/auth;
proxy_pass_error_message on;
xclient off;
smtp_capabilities "8BITMIME" "STARTTLS" "PIPELINING" "ENHANCEDSTATUSCODES";
starttls on;
ssl_certificate /etc/letsencrypt/live/smtp.proxy.mydomain.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/smtp.proxy.mydomain.net/privkey.pem;
ssl_protocols TLSv1.2;
ssl_session_cache shared:SSL:10m;
server {
listen 587;
protocol smtp;
smtp_auth login plain;
}
}
The cert is being used by NGINX when the client requests STARTTLS, and the client (in my case swaks) sends the AUTH LOGIN credentials to NGINX.
NGINX then calls the mail_auth_http_module OK. I have a simple Python Flask app that returns headers indicating auth is always accepted, and the server address. You can see the auth server's response to a curl request here:
$ curl -v localhost:9000/auth
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 9000 (#0)
> GET /auth HTTP/1.1
> Host: localhost:9000
> User-Agent: curl/7.61.1
> Accept: */*
>
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Content-Type: text/html; charset=utf-8
< Content-Length: 2
< Auth-Status: OK
< Auth-Server: 52.214.232.65
< Auth-Port: 587
< Server: Werkzeug/0.15.2 Python/3.6.8
< Date: Tue, 07 May 2019 23:10:29 GMT
<
* Closing connection 0
NGINX is then attempting onward delivery to the server, as expected. I can see it's hitting the correct server endpoint.
Unfortunately in my case, the server requires (and will always require) the same login credentials to be presented, as the client originally gave. At this point the delivery fails with a "5.7.1 Authorization required", as NGINX is not supplying them onward.
I suspect that NGINX assumes that, because it has called the auth module, the server will not require further credentials, and therefore does not supply them.
Is there a way to get NGINX to "pass through" the Auth credentials to the server?

Answer 1

Since nginx 1.19.4 the SMTP native backend auth is supported (SMTP AUTH).
See: http://nginx.org/en/docs/mail/ngx_mail_proxy_module.html#proxy_smtp_auth
You can enable backend auth with the proxy_smtp_auth on; directive.
For example:
server {
server_name smtp.company.com;
listen 587;
protocol smtp;
proxy_smtp_auth on; # <- enable native SMTP AUTH
smtp_auth plain login cram-md5;
starttls on;
}

Answer 2

According to nginx mail list nginx doesn't pass AUTH command to backend for SMTP.
There's a nginx patch to do this for Postfix, but it's not official.
Alternatively you can try to use this openresty solution.