Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have postfix and dovecot on a machine and I don't want anonymous sasl.

This is my main.cf

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

(As you see I'm not using smtpd_sasl_security_options = noanonymous)

In dovecot I don't have anonymous as auth_mechanisms as I don't want it:

auth_mechanisms = plain login

Is there any point in having smtpd_sasl_security_options = noanonymous in postfix as well?

Don't these two settings sort of overlap?

share|improve this question

2 Answers 2

No, they don't overlap. Postfix can use the SASL authentication mechanisms provided by Dovecot, but it doesn't use Dovecot's configuration. In Postfix you configure authentication for SMTP, in Dovecot you configure authentication for IMAP and/or POP3.

And yes, you probably should use smtpd_sasl_security_options = noanonymous.

share|improve this answer
    
Can you confirm if I got it right? 1) If I send an email from a MUA, it's sent to Postfix which does SMTP authentication (smtpd_sasl_security_options comes into play, auth_mechanisms doesn't) and, if successful, delivers. 2) If I get an email on the MUA, I got it after Dovecot POP/IMAP authentication (auth_mechanisms comes into play, smtpd_sasl_security_options doesn't) –  wlf Sep 12 '12 at 11:15
    
That's correct. –  Ansgar Wiechers Sep 12 '12 at 11:43
    
Ansgar can you take a look at my answer below? Thanks for your answer but I'm still not 100% with you. –  wlf Sep 12 '12 at 12:30

I still don't understand.

1) According to the above configuration,

when I RECEIVE via MUA(Thunderbird) the process is:

MUA(Thunderbird) -> (POP/IMAP protocol) -> Dovecot's SASL -> new emails downloaded by MUA(Thunderbird)

when I SEND via MUA(Thunderbird) the process is:

MUA(Thunderbird) -> (SMTP protocol) -> MTA(Postfix) -> Dovecot's SASL (because of smtpd_sasl_type = dovecot) -> new email sent with MTA(Postfix)

2) As Dovecot's SASL is being used I guess all the directives in 10-auth.conf are and among these there is auth_mechanisms.

It looks to me as though when I SEND via MUA, because postfix comes first:

smtpd_sasl_security_options = noanonymous

is run first.

Then Dovecot's SASL comes and so:

auth_mechanisms = plain login

It looks to me as though smtpd_sasl_security_options = noanonymous is not really necessary because later on I only allow "plain" and "login". Can you see what I mean?

share|improve this answer
    
Patrick Koetter has written a HOWTO on SASL authentication. It's about Cyrus, but the relevant parts should apply to Dovecot as well. Chapter 12 should have the information you want. –  Ansgar Wiechers Sep 12 '12 at 19:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.