Strange Problem with SMTP-Auth on Cisco ESA (Async-OS: 14.2.3-027)

[Hallowelt]

Dear all,

while debugging SMTP-Authentication-Problems I notice the following strange behaviour:

connecting with "openssl s_client -connect server.name:587 -starttls smtp"

Trying username "Anton" (Base64 = QW50b24=)

---------------
AUTH LOGIN
334 VXNlcm5hbWU6
QW50b24=
DONE
---------------
-> ESA closes connection unexpectedly

Trying Username "A" (QQ==)
--------------------------
auth login
334 VXNlcm5hbWU6
QQ==
DONE
--------------------------
Same error (unexpected close) as above
Trying username "D" (RA==)
--------------------------
auth login
334 VXNlcm5hbWU6
RA==
334 UGFzc3dvcmQ6
RA==
535 #5.7.0 Authentication failed
--------------------------
-> That's the expected behaviour, as the user does not exist

Further tests show, that usernames beginning with (@,A,B,C) giving an encoded Base64-String starting with "Q" lead to the same erroneous behaviour.
The same happens, when trying to authenticate with a password starting in cleartext with (@,A,B,C)

Any idea?

Thanks,
Harald

[stkandpa]

Hey Hallowelt,

As this seems to be a specific problem with you environment, I will suggest you to open a TAC case with Cisco and the team will help you resolve it. 

Adding the methods to open a case(You can use any one of them):

1.  Go to the TAC website > My support > Open/View Cases > Open New Case ;

2.  Send an email to tac@cisco.com and make sure you include your CCO login;

3.  Call them;

Regards

Stuti Kandpal

-----------------------------------------
If you find my reply solved your question or issue, kindly click the 'Accept as Solution' button and vote it as helpful.

You can also learn more about Cisco Secure Email through our live Ask the Experts (ATXs) session. Check out this ATXs Resources [https://community.cisco.com/t5/security-knowledge-base/cisco-endpoint-security-ask-the-experts-resources/ta-p/4394492] to view the latest schedule for upcoming sessions, as well as the useful references, e.g. online guides, FAQs
-----------------------------------------