Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

following the link here: http://flurdy.com/docs/postfix/ with posfix, courier, MySql, and sasl gave me a web server that has imap functionality working fine but when i go to log into the server to send a message using the same user id and password for connecting the the imap server it rejects my login to the smtp server. If i do not specify a login for the outgoing mail server then it will send the message just fine. the error in postfix's log is:

Jul  6 17:26:10 Sj-Linux postfix/smtpd[19139]: connect from unknown[10.0.0.50]

Jul  6 17:26:10 Sj-Linux postfix/smtpd[19139]: warning: SASL authentication failure: unable to canonify user and get auxprops

Jul  6 17:26:10 Sj-Linux postfix/smtpd[19139]: warning: unknown[10.0.0.50]: SASL DIGEST-MD5 authentication failed: no mechanism available

Jul  6 17:26:10 Sj-Linux postfix/smtpd[19139]: warning: unknown[10.0.0.50]: SASL LOGIN authentication failed: no mechanism available

Ive checked all usernames and passwords for mysql. what could be going wrong?

edit:

here is some other information:

installed libraires for postfix, courier and sasl:

aptitude install postfix postfix-mysql
aptitude install libsasl2-modules libsasl2-modules-sql libgsasl7 libauthen-sasl-cyrus-perl sasl2-bin libpam-mysql
aptitude install courier-base courier-authdaemon courier-authlib-mysql courier-imap courier-imap-ssl courier-ssl

and here is my /etc/postfix/main.cf

myorigin = domain.com

smtpd_banner = $myhostname ESMTP $mail_name
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

#myhostname = my hostname

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
local_recipient_maps =
mydestination =
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
mynetworks_style = host

# how long if undelivered before sending warning update to sender
delay_warning_time = 4h
# will it be a permanent error or temporary
unknown_local_recipient_reject_code = 450
# how long to keep message on queue before return as failed.
# some have 3 days, I have 16 days as I am backup server for some people
# whom go on holiday with their server switched off.
maximal_queue_lifetime = 7d
# max and min time in seconds between retries if connection failed
minimal_backoff_time = 1000s
maximal_backoff_time = 8000s
# how long to wait when servers connect before receiving rest of data
smtp_helo_timeout = 60s
# how many address can be used in one message.
# effective stopper to mass spammers, accidental copy in whole address list
# but may restrict intentional mail shots.
# but may restrict intentional mail shots.
smtpd_recipient_limit = 16
# how many error before back off.
smtpd_soft_error_limit = 3
# how many max errors before blocking it.
smtpd_hard_error_limit = 12

# Requirements for the HELO statement
smtpd_helo_restrictions = permit_mynetworks, permit
# Requirements for the sender details
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit
# Requirements for the connecting server
smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client dnsbl.njabl.org
# Requirement for the recipient address
smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, permit
smtpd_data_restrictions = reject_unauth_pipelining

# require proper helo at connections
smtpd_helo_required = yes
# waste spammers time before rejecting them
smtpd_delay_reject = yes
disable_vrfy_command = yes

# not sure of the difference of the next two
# but they are needed for local aliasing
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases
# this specifies where the virtual mailbox folders will be located
virtual_mailbox_base = /var/spool/mail/virtual
# this is for the mailbox location for each user
virtual_mailbox_maps = mysql:/etc/postfix/mysql_mailbox.cf
# and this is for aliases
virtual_alias_maps = mysql:/etc/postfix/mysql_alias.cf
# and this is for domain lookups
virtual_mailbox_domains = mysql:/etc/postfix/mysql_domains.cf
# this is how to connect to the domains (all virtual, but the option is there)
# not used yet
# transport_maps = mysql:/etc/postfix/mysql_transport.cf

virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

# SASL
smtpd_sasl_auth_enable = yes
# If your potential clients use Outlook Express or other older clients
# this needs to be set to yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
share|improve this question

2 Answers 2

I've stumbled on a problem that seems very similar to this. The solution was to modify slightly the smtpd.conf file (located in /etc/postfix/sasl).

Indeed, there are two errors in the flurdy.com tutorial :

Original version :

pwcheck_method: saslauthd 
mech_list: plain login cram-md5 digest-md5 
log_level: 7 
allow_plaintext: true 
auxprop_plugin: mysql  # <-----
sql_engine: mysql 
sql_hostnames: 127.0.0.1 
sql_user: mail 
sql_passw: mailPASSWORD  # <----
sql_database: maildb 
sql_select: select crypt from users where id='%u@%r' and enabled = 1

Corrected :

pwcheck_method: saslauthd 
mech_list: plain login cram-md5 digest-md5 
log_level: 7 
allow_plaintext: true 
auxprop_plugin: sql # <--- sql instead of mysql
sql_engine: mysql 
sql_hostnames: 127.0.0.1 
sql_user: mail 
sql_passwd: mailPASSWORD # <---- sql_passwd instead of sql_passw
sql_database: maildb 
sql_select: select crypt from users where id='%u@%r' and enabled = 1

Hope that will answer your problem

share|improve this answer
    
+1 Nice find, got me up and running! –  Zac Nov 20 '12 at 1:45

This symptom shows that your postfix setup is not able to use the SASL libraries in a sane manner.

Check that you have available the SASL mechanism library corresponding to whatever mechanisms you are using (e.g., plain). For example in CentOS 5 this is accomplished by installing separate packages (e.g., if you're using Cyrus SASL then you would need the package named cyrus-sasl-plain in order to use the plain mechanism). With that in place you should have matching SASL parameters in postfix's configuration. See "man 5 postconf" to get all the details about it.

If it still doesn't work you might want to expand your question by grepping the ^smtp.*sasl parameters from your /etc/postfix/main.cf .

share|improve this answer
    
OK, so on ubuntu i would need to install all of these mechs: mech_list: plain login cram-md5 digest-md5 so: apt-get install cyrus-sasl-plain cyrus-sasl-login cyrus-sasl-cram-md5 cyrus-sasl-digest-md5 –  Nat45928 Jul 7 '12 at 19:12
    
i just tried using that ^ and the libries could not be found. i updated the main post with more info –  Nat45928 Jul 7 '12 at 19:24
    
As written from Joechip on CentOS6 : yum install cyrus-sasl-plain.x86_64 solved this Problem on the PLAIN LOGIN mechanism Problem..! –  user139677 Oct 4 '12 at 17:49
    
Just ran into this on an Office 365 migration, postfix was having trouble authenticating over SASL. Solution was "yum install cyrus-sasl-lib cyrus-sasl-plain cyrus-sasl-md5" to make sure both PLAIN and MD5 mechanisms were available. –  tgharold Apr 25 at 13:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.