Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Running debian 6, I believe I've enabled everything correctly, followed various guides to double check as I've been working on this for 3 days now. I've tested both dovecot and postfix with telnet and they work as best as I can tell, however I'm not getting the expected SASL support response when using smtp. I don't really know how to troubleshoot it further than that.

Also fwiw I noticed that dovecot -n outputs mode as set to 432 where as it's actually set to 0660 in dovecot.conf, any idea why this is, might this be related?

dovecot.conf

# 1.2.15: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-238.9.1.el5.028stab089.1 x86_64 Debian 6.0.4 
log_timestamp: %Y-%m-%d %H:%M:%S 
protocols: imap imaps pop3 pop3s
login_dir: /var/run/dovecot/login
login_executable(default): /usr/lib/dovecot/imap-login
login_executable(imap): /usr/lib/dovecot/imap-login
login_executable(pop3): /usr/lib/dovecot/pop3-login
mail_privileged_group: mail
mail_location: mbox:~/mail:INBOX=/var/mail/%u
mbox_write_locks: fcntl dotlock
mail_executable(default): /usr/lib/dovecot/imap
mail_executable(imap): /usr/lib/dovecot/imap
mail_executable(pop3): /usr/lib/dovecot/pop3
mail_plugin_dir(default): /usr/lib/dovecot/modules/imap
mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap
mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3
auth default:
  mechanisms: plain login
  passdb:
    driver: pam
  userdb:
    driver: passwd
  socket:
    type: listen
    client:
      path: /var/spool/postfix/private/auth
      mode: 432
      user: postfix
      group: postfix

main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = fresno.thinkitrva.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = thinkitrva.com
mydestination = thinkitrva.com, fresno.thinkitrva.com, localhost.thinkitrva.com, localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
relay_domains = thinkitrva.com

smtpd_sasl_type = dovecot
# Can be an absolute path, or relative to $queue_directory
# Debian/Ubuntu users: Postfix is setup by default to run chrooted, so it is best to leave it as-is below
smtpd_sasl_path = private/auth
# and the common settings to enable SASL:
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
#anti-spam: smpt restrictions
smtpd_recipient_restrictions = reject_invalid_hostname,
        reject_unknown_recipient_domain,
        reject_unauth_destination,
        reject_rbl_client sbl.spamhaus.org,
        permit_mynetworks,
        permit_sals_authenticated

smtpd_helo_restrictions = reject_invalid_helo_hostname,
        reject_non_fqdn_helo_hostname,
        reject_unknown_helo_hostname

smtpd_client_restrictions = reject_rbl_client dnsbl.sorbs.net
share|improve this question
    
For one thing, you can check logs. Both Dovecot and Postfix do output lines to syslog when they do authentication. As for the socket mode appearing in decimal instead of octal in the dovecot -n output, there's no problem there. –  Celada Feb 28 '12 at 19:13

1 Answer 1

You should never run just SASL on a public server.

Either enable both TLS and SASL for incoming mail, or - better - configure the commented-out submission listener in master.cf, and tell people to use that.

Please refer to the excellent documentation for further details.

share|improve this answer
    
I was not planning to, but I first have to setup SASL before TLS so if I cannot get SASL working no point moving to TLS, no? The postfix documentation is the primary thing I was following, along with the linked dovecot documentation (in the postfix article). –  kryptobs2000 Mar 1 '12 at 0:22
    
"Have to"? No. You can enable both at the same time, with a fixed set of configuration parameters. –  adaptr Mar 1 '12 at 8:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.