Mailer Error back, now with CSRF Token Issue

jlaroche

Hey guys.

So I was originally having an issue with Mailer Errors (see this forum post: https://forum.osticket.com/d/96383-resolved-mail-error). I changed my gmail SMTP info from smtp-relay.gmail.com to smtp.gmil.com and the issue seemed to go away, but now it is back. Exact error message below (redacted info of course):

Unable to email via SMTP:smtp.gmail.com:587 [helpdesk@REDACTED.edu] Failed to set sender: helpdesk@REDACTED.edu [SMTP: Failed to write to socket: not connected (code: -1, response: )]

Additionally, we are now getting Invalid CRSF Token errors... Exact error below (redacted of course):

Invalid CSRF token [385a1537ce6597c261595115b2645fb208de4e59] at https://helpdesk.REDACTED.edu:443/scp/lists.php?id=1

NOTE:
5 days ago I upgraded OSTicket from 1.12.3 to 1.12.5, then immediately jumped from 1.12.5 to 1.14.1.

jlaroche

More details can be found here: https://stackoverflow.com/questions/59136473/osticket-1-14-1-genrating-mailer-error-and-csrf-token-issues

Please help. We can't deploy OSTicket company-wide until this is solved!

jlaroche

Oh comon. Not a single resonse in 8 days 🙁 ?

ntozier

The only thing I can think of is that CentOS has SELinux enabled by default. It could be blocking your connection, and mucking up the csrf tokens.

Did you read the docs for using gmail?
https://docs.osticket.com/en/latest/Getting%20Started/Email%20Settings.html

jlaroche

ntozier
Thanks for your reply. Yes, I've read that document thoroughly. I also 100% have SELinux disabled on my CentOS VM running osTicket. And to be even more sure I just double-checked and ran "getenforce" on my box and got back "Disabled".

KevinTheJedi

I'm able to use smtp.gmail.com with 587 just fine on many installations including v1.14.1. Do you have LessSecureApps enabled for the email as well as DisplayUnlockCAPTCHA? If not both of these have to be enabled in order for Gmail to work correctly.

Cheers.

jlaroche

KevinTheJedi

Thanks for your reply. LessSecureApps s definitely enabled, but I'm not sure about the DisplayUnlockCAPTCHA.

I just logged into the account used in my osTicket, then navigated to accounts.google.com/DisplayUnlockCAPTCHA and clicked on the button to enable account access.

I'll monitor my dashboard to see if any other mailer errors or mail fetch issues arise.

KevinTheJedi

@jlaroche

Typically it makes you sign back in on the application after enabling displayunlock so go to your email in osTicket and re-save the credentials to ensure it saves successfully. Then ensure smtp works via email diagnostics.

Cheers.

jlaroche

KevinTheJedi

Yup, did all that. I'll monitor the System Logs to see if anything else comes up.

jlaroche

Also, so you all know:

I have a feeling the CSRF Token issue is related to the "LDAP Authentication and Lookup" plugin we are using. I redownloaded the phar file for this plugin from the osTicket website (thinking maybe there was a new version) and replaced the one we have installed. Unfortunately, we had another short spat of CSRF Token errors in the System Logs.

Finally, I spoke to Google technical support about this just to see if there could be anything on their end causing these mailer issues. They looked at everything - including the mail settings setup in osTicket. Unfortunately, they concluded that there isn't anything on their end causing the issues.

jlaroche

I'm tempted to just roll out osTicket across our company regardless of these issues. We are still receiving and sending emails, and agents are able to log in. I'm not seeing any detrimental behavior as a result of these System Log warnings.

What do you guys think?

I can also provide any other logs from my system, but some guidance on which ones could be useful and how to retrieve them would be helpful.

jlaroche

Also, in addition to the "Mailer Error" messages in the logs, there are "Mail Fetch Failure Alert" messages.

When I hover over these they say the following:

Mail Fetch Failure Alert

osTicket is having trouble fetching emails from the following mail account: User: helpdesk@REDACTED.edu Host: imap.gmail.com Error: No such host as imap.gmail.com 5 consecutive errors. Maximum of 5 allowed This could be connection issues related to the mail server. Next delayed login attempt in aprox. 10 minutes https://helpdesk.lan.REDACTED.edu
Log Date: Monday, December 2, 2019 at 2:11 AM IP Address:

ntozier

jlaroche No such host as imap.gmail.com

This sound like an issue with DNS on your server.

mod_chroot or mod_security (or SELinux but you already checked that) could be the culprit.

jlaroche

ntozier Ok. What exactly should I do?

I ran yum install mod_security mod_security_crs and my CentOS 7 system installed yum install mod_security and mod_security_crs.

I'm not familiar with mod_chroot.

ntozier

I do not run Apache and have never used those modules. You would need to read the documentation for those modules or google how to use them. I wasn't saying to install them, I was saying that if they were installed they may be causing you issues.

jlaroche

I took a look at our DNS server and noticed that the reverse DNS was pointing to the IP address of our previous DNS server. Fixed that. It could have contributed to this issue.