Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a very strange issue! SASL does not work properly, as it does not accept plain-text passwords (like Outlook sends them)

Oct  2 10:35:09 srf cyrus/imap[4119]: accepted connection
Oct  2 10:35:09 srf cyrus/imap[4119]: badlogin: [217.XX.XXX.140] plaintext user@domain.com SASL(-1): generic failure: checkpass failed

Now I switch to "Encrypted password" in Thunderbird. I have the same issue as Outlook above on Thunderbird if I turn on "Plain Password"):

Oct  2 10:40:40 srf cyrus/imap[14644]: accepted connection
Oct  2 10:40:41 srf cyrus/imap[14622]: login: [217.XX.XXX.140] user@domain.com CRAM-MD5 User logged in

Same with Postfix:

Without

Oct  2 10:42:48 srf postfix/smtpd[17980]: connect from unknown[217.XX.XXX.140]
Oct  2 10:42:48 srf postfix/smtpd[17980]: warning: SASL authentication failure: cannot connect to saslauthd server: Permission denied
Oct  2 10:42:48 srf postfix/smtpd[17980]: warning: SASL authentication failure: Password verification failed
Oct  2 10:42:48 srf postfix/smtpd[17980]: warning: unknown[217.XX.XXX.140]: SASL PLAIN authentication failed: generic failure

With "Encrypted password":

Oct  2 10:45:27 srf postfix/smtpd[21872]: connect from unknown[217.XX.XXX.140]
Oct  2 10:45:28 srf postfix/smtpd[21872]: 50B3A332AAB: client=unknown[217.XX.XXX.140], sasl_method=CRAM-MD5, sasl_username=user@domain.com
Oct  2 10:45:28 srf postfix/cleanup[21899]: 50B3A332AAB: message-id=<506FG87C.3080207@domain.com>
Oct  2 10:45:28 srf postfix/qmgr[6181]: 50B3A332AAB: from=<user@domain.com>, size=398, nrcpt=1 (queue active)
Oct  2 10:45:28 srf postfix/smtpd[21872]: disconnect from unknown[217.XX.XXX.140]

Config:

/etc/imapd.conf:sasl_mech_list:LOGIN PLAIN CRAM-MD5 

and

/etc/postfix/sasl/smtpd.conf:mech_list: LOGIN PLAIN CRAM-MD5

I have no idea where to dig. Please advise.

share|improve this question

1 Answer 1

For postfix, the default is to disallow PLAIN AUTH over unencrypted connections.

You really don't want to alter that - either use LOGIN authentication or (better) switch to TLS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.