Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I used this guide to set up my mail server, and everything is working flawlessly, except there does not seem to be any smtp authentication. Have no idea what is going on since there is nothing in the mail.log, or mail.err that indicates anything. Hoping there is someone here who can help me out.

This is what happens when I run the telnet command (I swapped out the domain and email addressed).

telnet pro.domain.org 25
Trying 50.576.3.15...
Connected to mail.domain.org.
Escape character is '^]'.
220 pro.domain.org ESMTP Postfix (Ubuntu)
ehlo example.com
250-pro.domain.org
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from: <chris@gmail.com>
250 2.1.0 Ok
rcpt to: <chris@domain.org>
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
asd
.
250 2.0.0 Ok: queued as 7C0F8D620
quit
221 2.0.0 Bye
Connection closed by foreign host.

Here is the postconf -n output

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
always_bcc = chris@domain.org
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
inet_interfaces = all
mailbox_size_limit = 0
mydestination = localhost
myhostname = pro.domain.org
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost =
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/dovecot.pem
smtpd_tls_key_file = /etc/ssl/private/dovecot.pem
smtpd_use_tls = yes
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp

Here is the postconf -a output

cyrus
dovecot

Here is the dovecot -n output

# 2.0.19: /etc/dovecot/dovecot.conf
# OS: Linux 3.9.2-x86_64-linode32 x86_64 Ubuntu 12.04.2 LTS ext3
auth_mechanisms = plain login
mail_location = maildir:/var/mail/vhosts/%d/%n
mail_privileged_group = mail
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
protocols = imap pop3 lmtp
service auth-worker {
  user = vmail
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
  }
  user = dovecot
}
service imap-login {
  inet_listener imap {
    port = 0
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 0
  }
}
ssl = required
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
userdb {
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
  driver = static
}

It seems that dovecot is indeed creating the socket

ls -la /var/spool/postfix/private/auth
srw-rw-rw- 1 postfix postfix 0 May 22 23:10 /var/spool/postfix/private/auth

Any ideas on what to do now?

share|improve this question
    
What you want to use for authentication? SASL,PAM? Post saslfinger output if you want to use SASL. –  kockiren May 23 '13 at 6:47
    
@kockiren Thx for the reply, I'm using Dovecot for auth. Is there some other config that I should be posting as well? –  Errol Fitzgerald May 23 '13 at 6:52
    
Postfix dont use dovecot for auth, you must configure sasl. Can you login to dovecot imap? –  kockiren May 23 '13 at 6:58

2 Answers 2

up vote 0 down vote accepted

You configuration uses smtpd_tls_auth_only = yes, which it should, as this disallows sending of passwords in the clear. However, it means that AUTH is only available over encrypted channels. You should test with

openssl s_client -connect smtp.example.com:25 -starttls smtp -CApath /etc/ssl/certs/
share|improve this answer

Looking at your dovecot config, you've got:

unix_listener /var/spool/postfix/private/auth {
  group = postfix
  mode = 0666
  user = postfix

According to the documentation at postfix, you should have a socket listen rather than a unix_listener - if you're doing unix_listener you should also have a TCP socket. So your dovecot.conf should instead contain this:

   socket listen {
     client {
       path = /var/spool/postfix/private/auth
       mode = 0660
       user = postfix
       group = postfix
     }
   }

After doing this, restart both dovecot and postfix. If it still doesn't work, check your postfix logs (usually /var/log/mail.log) and post any information from there as an edit in your original question.

Original answer, not applicable as per comments

You're sending the email to a recipient address that's listed in $mydomain, and you've configured the mailserver to always accept those mails.

To test the authentication, you need to connect from a network that's not listed in $mynetwork and send the mail to a recipient who is not listed as an allowed recipent domain.

(If, in fact, you were actually doing the test the correct way, it would be a whole lot easier to figure out if you didn't munge half the information you're doing.)

share|improve this answer
    
But the ehlo Command should show the LOGIN Mechs, also from permited Networks. –  kockiren May 23 '13 at 7:01
    
Thanks for the help. I've been testing this from my home computer, and I've tried sending to another gmail address, and the email still goes through. I guess I have an open relay on my hands here. –  Errol Fitzgerald May 23 '13 at 7:13
    
This is the problem with hiding information from the people you're asking for help - it's a lot harder to give you the right answer. –  Jenny D May 23 '13 at 7:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.