Curl error 56 received http code 503 from proxy after connect

Saslauth Failed (curl_easy_perform error)

Problem

IMAP/POP clients get a password pop-up window and are not able to send and receive any e-mails. When using the correct username and password, the following authentication error in /var/log/zimbra.log file is observed :

Nov 28 15:06:57 mbox1 saslauthd[45799]: auth_zimbra: ztest@xxxxxx.com auth failed: curl_easy_perform: error(56): Received HTTP code 503 from proxy after
CONNECT
Nov 28 15:06:57 mbox1 saslauthd[45799]: do_auth         : auth failure: [user=ztest@xxxx.com] [service=smtp] [realm=xxxx.in] [mech=zimbra] [rea
son=Unknown]
Nov 28 15:06:57 mbox1 postfix/smtpd[18938]: warning: unknown[10.0.7.162]: SASL LOGIN authentication failed: authentication failure
Nov 28 15:06:57 mbox1 postfix/smtpd[18938]: lost connection after AUTH from unknown[10.0.7.162]

Solution

Check if any additional forward proxy is enabled (like Nginx or Squid)

Run following command to check the additional proxy:

# env | grep -i proxy

Run the following command to check saslauth with the mailbox node. The same curl command works in the backend during saslauth.

$ curl -X POST -u zimbra.user2@example.com:test@123 -d 'authType=sasl' https://mbox1.example.com:7073/service/admin/soap/ -k

Remove additional proxy and restart the MTA service to invalidate the old saslauth connection which was established.

$ zmmtactl restart

Why does this issue occur?

When saslauth happens on MTA server, it checks ZCS saslauthd lookup server on port 7073 which is a mailbox server. If a local forward proxy is configured, this request will be handled by this proxy. Since this proxy doesn’t know where to forward this request to, it shows HTTP 503 and 502 errors.

How SASL works

SASL is not a protocol but is a framework that can be used with protocols such as SMTP. For each protocol that uses SASL, there will be a specification as to how the protocol uses SASL. This means that SASL can be used with a wide range of protocols, and can be adapted to the details of how any specific protocols work.

The basic operation of SASL is straightforward. The server provides a list of supported authentication mechanisms, and then the client says which one will be used (based on the client’s capabilities and security requirements).

Protocols that contain SASL support include:

• LDAP (Internet Standard Lightweight Directory Access Protocol)
• SMTP (Internet Standard Simple Message Transfer Protocol)
• POP3 (Internet Standard Post Office Protocol v3)
• IMAP (Internet Standard Internet Mail Access Protocol)
• XMPP: Extensible Messaging and Presence Protocol
• Isode’s SOM (Switch Operations and Management) Protocol

This external link contains more information about SASL.

Submitted by: Gopal Singh Bhandari

I am having my CentOS 6.5 installed with Puppet Entrprise 3.3.

The dashboard is running fine.

Now I want to add a puppet agent on another CentOS 6.5 box.

Since both are same OS type, Following the guidelines available in puppet docs site https://docs.puppetlabs.com/pe/latest/install_agents.html, I run the following

curl -k https://<mymasterserverFQDN>:8140/packages/current/install.bash | sudo bash

But I receive the error

% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                             Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (56) Received HTTP code 503 from proxy after CONNECT

I checked my master server iptables.I have added rule for 8140 port and did sudo service iptables save.

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:8140 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   

The supposed to be agent box can resolve the master server hostname, the ping responds properly.

I have tried to run curl by additionally providing the proxy address (using -x [protocol://proxy:port] (login credentials not needed), as I am actually behind proxy, but not sure how that will effect this installation here.
But no benefit.

Also tried with

curl -k https://<mymasterserverFQDN>:8140/packages/current/el-6-x86_64.bash | sudo bash

but no result.

I can see the install.bash/el-6-x86_64.bash exists /opt/puppet/packages/public/current in the master server [It was a standard monolitic installation, I did not do anything funky with it]

Can anyone please help me out on this. I searched in net but not getting much information on this error.

Reply/Update #1

Hi Zordache,
Thanks for looking into.

I see the same error messege. I am trying to make use of wireshark/tcpdump to see if those tools help someway to understand the problem.

curl -k https://<mymasterserverFQDN>:8140/packages/current/el-6-x86_64.bash | sudo bash
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 
curl: (56) Received HTTP code 503 from proxy after CONNECT 

I did not touch the install.bash. One thought though, I was playing with puppestmaster.conf file to make a different server as CA server. Can that effect the install.bash. My understanding was installation will create trouble but an agent run might cause down the line.

UPDATE 2014-10-24

The following command if I use, it runs fine.

sudo curl -k https://<mymasterserverFQDN>:8140/packages/current/el-6-x86_64.bash | sudo bash