Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello I have a Postfix setup with Dovecot and MySql. The server is running Debian Squeeze. The MySql server is a slave that has data pushed to it from a primary (postfix) mail server(running a different os). The emails are stored on a replicated GlusterFS volume.

I am able to check email using thunderbird over IMAP. However, SMTP requests fail. After turning on query logs for the MySql server I have noticed that no query statement is executed to retrieve the user information when an SMTP client tries to authenticate. I'd like to know what I'm doing wrong or what the next troubleshooting steps are. I'm about to pull my hair out. Below is some log and configuration data that I thought would be relevant. You're help is much obliged.

The file /var/log/mail.log shows

Oct 11 14:54:16 mailbox2 postfix/smtpd[25017]: connect from unknown[]
Oct 11 14:54:19 mailbox2 postfix/smtpd[25017]: warning: unknown[]: SASL PLAIN     authentication failed: 
Oct 11 14:54:25 mailbox2 postfix/smtpd[25017]: warning: unknown[]: SASL LOGIN authentication failed: VXNlcm5hbWU6
Oct 11 14:55:48 mailbox2 postfix/smtpd[25017]: warning: unknown[]: SASL PLAIN authentication failed: VXNlcm5hbWU6
Oct 11 14:55:54 mailbox2 postfix/smtpd[25017]: warning: unknown[]: SASL LOGIN   authentication failed: VXNlcm5hbWU6
Oct 11 14:55:57 mailbox2 postfix/smtpd[25017]: disconnect from unknown[]

This is my dovecot.conf file

log_timestamp = "%Y-%m-%d %H:%M:%S "
mail_location = maildir:/var/mail/virtual/%d/%n/
auth_mechanisms = plain login
disable_plaintext_auth = no

namespace {
  inbox = yes
  location =
  prefix = INBOX.
  separator = .
  type = private
passdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
protocols = imap pop3
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  unix_listener auth-master {
    mode = 0600
    user = postfix
  user = root
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
userdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
protocol lda {
  auth_socket_path = /var/run/dovecot/auth-master
  mail_plugins = sieve
  postmaster_address =
protocol pop3 {
  pop3_uidl_format = %08Xu%08Xv

Here is my dovecot-mysql.conf file:

connect = host= dbname=postfix user=postfix password=ffjM2MYAqQtAzRHX
driver = mysql
default_pass_scheme = MD5-CRYPT
password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active='1'
user_query = SELECT CONCAT('/var/mail/virtual/', maildir) AS home, 1001 AS uid, 109 AS gid, CONCAT('*:messages=10000:bytes=',quota) as quota_rule, 'Trash:ignore' AS quota_rule2 FROM mailbox WHERE username = '%u' AND active='1'

Here is my output from 'postconf -n':

append_dot_mydomain = no
biff = no
bounce_template_file = /etc/postfix/
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
delay_warning_time = 0h
dovecot_destination_recipient_limit = 1
inet_interfaces = all
local_recipient_maps = $virtual_mailbox_maps
local_transport = virtual
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
maximal_queue_lifetime = 1d
message_size_limit = 25600000
mydestination =,,, localhost
myhostname =
mynetworks = [::ffff:]/104 [::1]/128
myorigin = /etc/mailname
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
readme_directory = no
recipient_delimiter = +
relay_domains =
relayhost =
smtp_connect_timeout = 10
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_client_message_rate_limit = 50
smtpd_client_recipient_rate_limit = 500
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks
smtpd_delay_reject = yes
smtpd_discard_ehlo_keyword_address_maps = hash:/etc/postfix/discard_ehlo
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, permit
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
transport_maps = hash:/etc/postfix/transport
virtual_alias_maps = proxy:mysql:/etc/postfix/sql/, proxy:mysql:/etc/postfix/sql/, proxy:mysql:/etc/postfix/sql/
virtual_gid_maps = static:1001
virtual_mailbox_base = /var/mail/virtual/
virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/
virtual_mailbox_maps = proxy:mysql:/etc/postfix/sql/, proxy:mysql:/etc/postfix/sql/
virtual_transport = dovecot
virtual_uid_maps = static:1001
share|improve this question
I'm not sure, but shouldn't the maillog show the username instead of the password. Maybe there is a setup error on the client side? – Thomas Berger Oct 12 '12 at 19:27
Thunderbird can do IMAP fine. I doubt it's a client side problem. Also that would not explain why I do not see a SQL query being issued in the query logs. – borncamp Oct 16 '12 at 19:54
Well I'll be. Turns out you were right. After testing via telnet I was able to send a mail out. In thunderbird I didn't have a 'description' for my smtp server. For some odd reason after adding that it worked fine. I appreciate your suggestion. – borncamp Oct 16 '12 at 21:14

VXNlcm5hbWU6 is base64 encoded for "Username:" string e.g.:

$ perl -MMIME::Base64 -e 'print decode_base64("VXNlcm5hbWU6") . "\n";'
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.