Re: sasl fails

Alexander Dalloz wrote:

Am Mi, den 24.08.2005 schrieb Anne Ramey um 20:40:

I just cannot seem to get my smtp auth working. I've read, and re-read the sasl_readme with no luck...I've followed those instructions. It appears that sasl is trying to use sasldb2 (which it's not supposed to, I'm trying to use pam). I'm running on fedora core 3. Someone on the postfix list replied and said I can't use pwcheck_method: saslauthd on FC3...is that true? I need to use pam/my passwd/shadow info for smtp auth, so if that is true, what is the work around? Many thanks.

It isn't true. Of course you can use saslauthd.

Thanks for replying...that's what I thought

[root@hedwig readme]# ps aux|grep sasl

root 29058 0.0 0.0 19912 844 ? Ss 13:14 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam root 29059 0.0 0.0 20984 1264 ? S 13:14 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam root 29060 0.0 0.0 19912 844 ? S 13:14 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam root 29061 0.0 0.0 19912 844 ? S 13:14 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam root 29062 0.0 0.0 19912 844 ? S 13:14 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam

root     29295  0.0  0.0 42400  668 pts/4    R+   13:59   0:00 grep sasl

Proper. PAM here means you let PAM call system accounts, I guess.

[root@hedwig readme]# testsaslauthd -u anner -p mypass
0: OK "Success."

Looks good.

[root@hedwig readme]# cat /usr/lib/sasl2/smtpd.conf
pwcheck_method: saslauthd

If you don't offer MD5 mechs because of your auth backend, then exclude
them. Add

mech_list: plain login

to smtpd.conf.

I did, but it doesn't seem to have made any difference...
-- content of /usr/lib/sasl2/smtpd.conf --
pwcheck_method: saslauthd
mech_list: plain login

-- mechanisms on localhost --
250-AUTH CRAM-MD5 GSSAPI NTLM PLAIN DIGEST-MD5 LOGIN
250-AUTH=CRAM-MD5 GSSAPI NTLM PLAIN DIGEST-MD5 LOGIN

logs of an attempt:

Aug 24 16:45:39 daredevil last message repeated 4 times

Aug 24 16:45:39 daredevil last message repeated 5 times

[root@hedwig readme]# postconf -n

[ ... ]

permit_sasl_authenticated, reject
smtpd_sasl_auth_enable = yes
transport_maps = mysql:/etc/postfix/transport.cf
unknown_local_recipient_reject_code = 550
virtual_alias_maps = mysql:/etc/postfix/virtual.cf

You should add

smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

Required is

smtpd_sasl_local_domain =

For use with saslauthd leave it empty.

Had those first but removed them in testing.  Now I have:
-- active SMTP AUTH and TLS parameters for smtpd --
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous

When I try and use it with a standard mail client I get:

Aug 24 13:53:52 daredevil postfix/smtpd[29286]: connect from h27.83.213.151.ip.alltel.net[151.213.83.27] Aug 24 13:53:56 daredevil postfix/smtpd[29286]: warning: SASL authentication problem: unable to open Berkeley db /etc/sasldb2: No such file or directory

The client tries an MD5 mech as you offer it (see below). But as you use PAM
and probably system accounts you can't use MD5. So as I told you above remove
MD5 mechs.

Aug 24 13:53:56 daredevil postfix/smtpd[29286]: warning: SASL authentication problem: unable to open Berkeley db /etc/sasldb2: No such file or directory Aug 24 13:53:56 daredevil postfix/smtpd[29286]: warning: SASL authentication failure: no secret in database Aug 24 13:53:56 daredevil postfix/smtpd[29286]: warning: h27.83.213.151.ip.alltel.net[151.213.83.27]: SASL CRAM-MD5 authentication failed Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL authentication problem: unable to open Berkeley db /etc/sasldb2: No such file or directory Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL authentication problem: unable to open Berkeley db /etc/sasldb2: No such file or directory Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL authentication failure: no secret in database Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: h27.83.213.151.ip.alltel.net[151.213.83.27]: SASL NTLM authentication failed Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL authentication problem: unable to open Berkeley db /etc/sasldb2: No such file or directory

Aug 24 13:53:57 daredevil last message repeated 4 times

Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL authentication failure: Password verification failed

The client tries the mechs you offer but which are not valid from your setup.

Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: h27.83.213.151.ip.alltel.net[151.213.83.27]: SASL PLAIN authentication failed Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL authentication problem: unable to open Berkeley db /etc/sasldb2: No such file or directory

Aug 24 13:53:57 daredevil last message repeated 5 times

Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: h27.83.213.151.ip.alltel.net[151.213.83.27]: SASL LOGIN authentication failed

PLAIN and LOGIN fail too.

When I try through telnet, my telnet session looks like this:
[anner:~] anner% telnet 66.45.100.233 25
Trying 66.45.100.233...
Connected to 66.45.100.233.
Escape character is '^]'.
220 hedwig.blast.com ESMTP Postfix
EHLO anner.blast.com
250-hedwig.blast.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH CRAM-MD5 GSSAPI NTLM PLAIN DIGEST-MD5 LOGIN
250 8BITMIME
AUTH PLAIN myEncodedUser&Pass
535 Error: authentication failed

It would be more helpful if you would create a test account and show real test data.
That would show us which format your user has (realm or not).

[root@hedwig readme]# saslfinger -s
saslfinger - postfix Cyrus sasl configuration Wed Aug 24 14:02:36 EDT 2005
version: 0.9.9.1
mode: server-side SMTP AUTH

-- basics --
Postfix: 2.2.5

Is that pasted or typed manually? The latest FC3 Postfix version is postfix-2.1.5-5.i386.rpm.

System: Fedora Core release 3 (Heidelberg)

-- smtpd is linked to --
        libsasl2.so.2 => /usr/lib64/libsasl2.so.2 (0x0000003c6db00000)

-- active SMTP AUTH and TLS parameters for smtpd --
smtpd_sasl_auth_enable = yes

[...]

-- end of saslfinger output --

Anne

Alexander

Anne