I think it would be best to leave the protocol used to the user.

Could you please elaborate a bit on this suggestion?

A similar issue reported several months ago: ZBX-10627.

A similar issue reported several months ago: ZBX-10627.

Sure, I've seen it. While I agree that SSL23_GET_SERVER_HELLO:unknown protocol is not necessarily caused by a bug in zabbix in all cases, the linked StackOverflow thread is not helpful at all, considering I (or the reporter of ZBX-10627) can't do anything about the O365 SSL configuration.

Could you please elaborate a bit on this suggestion

Essentialy, instead of Zabbix choosing whether to prepend smtp or smtps in send_email_curl(), give this option to the user.
So that for the media type SMTP server field all these would be valid:

smtp://smtp.office365.com
smtps://smtp.office365.com
smtp.office365.com

When you do curl smtp://smtp.office365.com:587 -v --ssl, it connects to the server (which speaks plain SMTP) and then issues a STARTTLS command. So it is a plain connection by default, which is then augmented to encrypted. So it seems wrong to use "SSL/TLS" as "Connection security" in media settings and "STARTTLS" should be used instead. Could you please try that?

Tried it.
Sorry, last time I didn't check the log properly, when I connect with STARTTLS the actual erorr is Login denied.
Digging a bit deeper I found this in the log :

 13414:20160802:090913.939 > EHLO xxx.com
 13414:20160802:090913.942 < 250-BL2PR20CA0022.outlook.office365.com Hello [xxx]
 13414:20160802:090913.942 < 250-SIZE 157286400
 13414:20160802:090913.942 < 250-PIPELINING
 13414:20160802:090913.942 < 250-DSN
 13414:20160802:090913.942 < 250-ENHANCEDSTATUSCODES
 13414:20160802:090913.942 < 250-AUTH LOGIN
 13414:20160802:090913.942 < 250-8BITMIME
 13414:20160802:090913.942 < 250-BINARYMIME
 13414:20160802:090913.942 < 250 CHUNKING
 13414:20160802:090913.942 * No known authentication mechanisms supported!
 13414:20160802:090913.942 * Closing connection 0
 13414:20160802:090913.942 * SSLv3, TLS alert, Client hello (1):
 13414:20160802:090913.942 Login denied:
 13414:20160802:090913.942 End of send_email():FAIL

So the actual reason for this not working is that only AUTH PLAIN is supported by zabbix.

Sorry for misleading this for a bit.

EDIT: Are there plans for adding AUTH LOGIN as an option for SMTP?

Are there plans for adding AUTH LOGIN as an option for SMTP?

There has been no request for additional SMTP authentication options until now.

Do you have a possibility to recompile Zabbix server? If you replace "AUTH=PLAIN" with "AUTH=*", does it start working?

Request for AUTH LOGIN support has just been filed in ZBXNEXT-3367.

Hi,

I tried to recompile Zabbix server with modified email.c and after that it works fine!
I replaced "AUTH=PLAIN" with "AUTH=*" as you mentioned.

Could you make this modification as default to the next version?

Thanks!

And what about if I installed from packages and not compiled by my own?

I installed Zabbix from package at first and I faced this issue in that configuration. So I had to compile it from source with that little modification.
It would be nice if we can see this correction in the official version.

I just added a patch to ZBXNEXT-3367. Hopefully it, or a cleaner version of it, will get integrated into a future version.

Server side fixed in development branch svn://svn.zabbix.com/branches/dev/ZBX-11042 revision r71721.

Backed out my own changes and applied changes mentioned in https://support.zabbix.com/browse/ZBX-11042?focusedCommentId=237382&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-237382 to Zabbix 3.4.0. Can confirm that email works with Office 365 afterwards.

Fixed in:

• pre-3.0.11rc1 r72219,
• pre-3.2.8rc1 r72220,
• pre-3.4.2rc1 r72221,
• pre-4.0.0alpha1 (trunk) r72223.

(5) [D] Because of (3) https://www.zabbix.com/documentation/3.0/manual/config/notifications/media/email needs to be updated.

martins-v It looks as though this phrase: CURLOPT_LOGIN_OPTIONS is set to “AUTH=PLAIN” should be changed for versions starting with 3.0.11, 3.2.8, 3.4.2. Do you have any suggestions regarding the possible wording?

glebs.ivanovskis Really nice catch! I would say

Username and password - sets two options below and implies “AUTH=*” leaving the choice of authentication mechanism to cURL

martins-v Yes, description of the old behaviour will have to stay. The new behaviour will be added as 'since version...'.

martins-v Since we've retained reference to the old naming, I've decided not to change the original screenshots for 3.0, 3.2. Other than that, the new descriptions have been added for 3.0, 3.2, 3.4. RESOLVED

glebs.ivanovskis Is it intentional that only 3.4 docs received new screenshot? Other than that
CLOSED

(6) [D] I think that https://www.zabbix.com/documentation/3.0/manual/installation/upgrade_notes_3011 should mention that before this change Zabbix was requiring PLAIN authentication mechanism and now libcurl may decide on it's own which mechanism among supported by SMTP server to choose. With parameters Zabbix passes to libcurl it effectively means choosing between PLAIN and LOGIN on most occasions. This is enough to enable Zabbix operation with Office 365 and should be enough for Gmail provided that "less secure apps" are allowed.

martins-v Added for 3.0.11. Please review.

glebs.ivanovskis Looks good! Regarding "less secure apps" we can point users to Google Support but I don't know where would be the most suitable place for it. Would be odd to write Zabbix and Gmail integration guide in Upgrade notes.

martins-v Thanks, also added to:

• Upgrade notes for 3.2.8
• Upgrade notes for 3.4.2

RESOLVED

glebs.ivanovskis Cool!
CLOSED