smtp relay via port 25

georgelza

georgelza

Expert Member
Joined
Sep 13, 2004
Messages
1,073
Reaction score
81
Location
Johannesburg/Alberton
hi all.

My alarm system is based on Paradox, as such I have a IP150, that I've integrated via PAI with Home assistant, works like a charm
But what the IP150 was still doing is sending me arm/disarm notifications and when a zone was triggered, emails of the events.

the OS on the IP150, can\t be updated as that will brake PAI.

I'm looking for a port 25 SMTP relay, thats not using TLS etc...

or... can I maybe run a relay myself ? that will forward email to my gmail account ? I have Home assistant as said, I've not found a SMTP add-on, I also have a TrueNAS where I can run a jail if anyone is aware on one?

G
 
You're looking at doing an SMTP Relay aka SMTP Proxy Server
 
I’m not sure if you want to stop the mail or help the mail?

If you want to stop it just block the port. Boom, job done.
 
Most ISPs block SMTP outbound to prevent spammers hosting spam servers on their lines. That said, most ISPs also have an SMTP server you can reach and relay through. However your gmail will prob mark it as spam since you don’t have valid reverse MX records, DKIM,SPF etc.
 
georgelza said:
hi all.

My alarm system is based on Paradox, as such I have a IP150, that I've integrated via PAI with Home assistant, works like a charm
But what the IP150 was still doing is sending me arm/disarm notifications and when a zone was triggered, emails of the events.

the OS on the IP150, can\t be updated as that will brake PAI.

I'm looking for a port 25 SMTP relay, thats not using TLS etc...

or... can I maybe run a relay myself ? that will forward email to my gmail account ? I have Home assistant as said, I've not found a SMTP add-on, I also have a TrueNAS where I can run a jail if anyone is aware on one?

G
Click to expand...
You can easily add an SMTP relay yourself at home using something like Postfix, either in a jail on TrueNAS, or even a raspberry pi. Not sure why you would want to bypass security (like TLS) because being security you would surely want to have secured messages. The problem is that the IP ranges allocated by your ISP are in all probability untrusted by the world and seen as spammers, especially (as mentioned by @neoprema ) especially when they lack valid reverse, DKM or SPF, even your firewall's smarthost would be untrusted. You would probably be better off sending it directly to a known SMTP provider. Then again, it's SMTP, which is inherently insecure. What other options do you have to trigger messages? Somehow I don't see great reliability in a time-sensitive message sent from a local device, across the world to a email server, and all the way back again to your mobile phone to alert you of a compromised zone. There must be a better way.
 
RonSwanson said:
You can easily add an SMTP relay yourself at home using something like Postfix, either in a jail on TrueNAS, or even a raspberry pi. Not sure why you would want to bypass security (like TLS) because being security you would surely want to have secured messages. The problem is that the IP ranges allocated by your ISP are in all probability untrusted by the world and seen as spammers, especially (as mentioned by @neoprema ) especially when they lack valid reverse, DKM or SPF, even your firewall's smarthost would be untrusted. You would probably be better off sending it directly to a known SMTP provider. Then again, it's SMTP, which is inherently insecure. What other options do you have to trigger messages? Somehow I don't see great reliability in a time-sensitive message sent from a local device, across the world to a email server, and all the way back again to your mobile phone to alert you of a compromised zone. There must be a better way.
Click to expand...
it's that I want to bypass it, the app thats sending the emails, the IP150 on the Paradox does not cater for TLS, otherwise this would not be a problem.
At this stage there is not a better option... only way I can notification out of the IP150 for now is this...
thanks.
G
 
georgelza said:
it's that I want to bypass it, the app thats sending the emails, the IP150 on the Paradox does not cater for TLS, otherwise this would not be a problem.
At this stage there is not a better option... only way I can notification out of the IP150 for now is this...
thanks.
G
Click to expand...
You could run an unauthenticated SMTP relay within your local network which then relays out through an authenticated smarthost. That would allow your device to connect on the local network on port 25 with no auth but then your connection outbound could be authenticated and encrypted.

In addition to the options @RonSwanson suggested, you could also spin up a Docker container with an SMTP relay very quickly if you are running Docker in your environment.
 
InvisibleJim said:
You could run an unauthenticated SMTP relay within your local network which then relays out through an authenticated smarthost. That would allow your device to connect on the local network on port 25 with no auth but then your connection outbound could be authenticated and encrypted.

In addition to the options @RonSwanson suggested, you could also spin up a Docker container with an SMTP relay very quickly if you are running Docker in your environment.
Click to expand...
thinking this might be what I end having to do...

I've found a Mailserver add on for HA. thinking to set that up, use that and then have that forward to the wider email world. new ground... None of Ron's suggestions is going to work. As said it's old, I can't change the code, enable new features, sending email notification is the only way the IP150 can notify me of events.

G
 
... no worries... I still want to figure email out, either get a mail server installed on my home assistant and / or TrueNAS.

But for now for these messages I've installed Pushover on the wives and my phone,
The (IP150 makes events visible, which is consumed by PAI and then published on various MQTT topics),

I've configured a NodeRed flow that consumes the MQTT topic/s and then push a notification via Pushover.
Just have to figure out which topics I need to all monitor.
 
I've got a cloudflare based domain, going to see if they might host a useable smtp server, I've got pushover now working, but the emails was a nice record that I could go back to, lying there in a dedicated folder. especially when security company is "slow" to response...

G
 
If I recall, had a look at socketlabs, they demand a contact email other than gmail... well thats all I have, that, hotmail and yahoo.

This is personal so can't use work address.

G

Pixies said:
They do give you SMTP. I use them.
Maybe buy a cheap domain?
R15 a month including email.
Otherwise just get the domain and use socketlabs. Domains are R30 a year these days.
Click to expand...
 
don't want to know many systems gmail broke by this move.
even my node red client is failing.
just tryning to find solution that does not require to throw more money at it, all these R15's do end adding up... and well have a domain already, it's becoming like that drawer where you throw the pens from conferences, gets full and messy.

G
 
They totally disabled that that "enable insecure apps" the last week.

G

Pixies said:
I'm curious on the gmail issue. Does the old 'enable insecure apps' in gmail not solve it? If I recall it has to do with the receiving end more, but perhaps I'm misunderstanding the use case.

Less secure apps & your Google Account - Google Account Help

Starting January 2025, less secure apps, third-party apps, or devices that have you sign in with only your username and password will no longer be supported for Google Workspace accounts. For exact
support.google.com support.google.com
Click to expand...
 
georgelza said:
They totally disabled that that "enable insecure apps" the last week.

G
Click to expand...
Microsoft will be doing the same soon with M365 - currently blocking legacy protocols in your tenant is a security best practice as they can be used to bypass MFA if an account password is compromised.

Pretty good reason but a bit of a pain if you have an app that needs IMAP, POP or SMTP and the developers haven't upgraded it to support modern authentication methods.
 
InvisibleJim said:
Microsoft will be doing the same soon with M365 - currently blocking legacy protocols in your tenant is a security best practice as they can be used to bypass MFA if an account password is compromised.

Pretty good reason but a bit of a pain if you have an app that needs IMAP, POP or SMTP and the developers haven't upgraded it to support modern authentication methods.
Click to expand...
there are thousands of app that simply can't be made to work... this akin to Y2k amount of changes.

G
 
InvisibleJim said:
You could run an unauthenticated SMTP relay within your local network which then relays out through an authenticated smarthost. That would allow your device to connect on the local network on port 25 with no auth but then your connection outbound could be authenticated and encrypted.

In addition to the options @RonSwanson suggested, you could also spin up a Docker container with an SMTP relay very quickly if you are running Docker in your environment.
Click to expand...
Postfix in docker is the way to go IMO.

Super simple (even if not using docker compose):
Code: 
docker run -d --name postfix -p "25:25"  \
       -e SMTP_SERVER=smtp.bar.com \
       -e [email protected] \
       -e SMTP_PASSWORD=XXXXXXXX \
       -e SERVER_HOSTNAME=helpdesk.mycompany.com \
       juanluisbaptiste/postfix

If you don’t care about the email being sent, you can even run smtp4dev in docker (or not) and access everything via the web interface
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X