Am Mo, den 13.09.2004 schrieb Michele Ferritto um 0:13: > Ok....I agree with that but the login plain mechanism is offered anyway, > why Outlook don't work? Because what the Sendmail announces as supported AUTH MECHs does not say that it really works. It is important to not simply accept log files to grow but to intensively inspect them, listen to what they are saying. In your case the central voice is "AUTH failure (LOGIN): no mechanism available (-4) SASL(-4): no mechanism available: checkpass failed" I feel that is nothing cryptic (like error messages on Win32 commonly are). It is SASL saying "no mechanism available". The short form: - with pwcheck_method:auxprop you can do DIGEST-MD5, CRAM-MD5 and PLAIN - with pwcheck_method:saslauthd you can do PLAIN and LOGIN See: http://acs-wiki.andrew.cmu.edu/twiki/bin/view/Cyrus/CyrusSaslComponents > The STARTTLS is a good idea (I've just modified the relatives path in > sendmail.mc to point at the correct cert repository and the STARTTLS works) Good. From point of security this is essential. There is actually no need to let auth data fly in plain format through any net which can then be easily sniffed by potential attackers. I suggest you set in sendmail.mc define(`confAUTH_OPTIONS', `A p')dnl to enforce STARTTLS for LOGIN and PLAIN and TRUST_AUTH_MECH(`LOGIN PLAIN')dnl define(`confAUTH_MECHANISMS', `LOGIN PLAIN')dnl to only offer those MECHs you can offer using the saslauthd. You are then safe with each client. > Michele Ferritto Alexander -- Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13 Fedora GNU/Linux Core 2 (Tettnang) kernel 2.6.8-1.521smp Serendipity 03:05:58 up 14 days, 22 users, load average: 0.03, 0.20, 0.19
Attachment:
signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil
