Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I configured my mail server which uses Postfix and Courier. Everything works except for the authentication when sending mail via my Postfix server(running on port 587) which has StartTLS enabled and uses SASLAuthentication with virtual domains and maps.


When I try to connect with my e-mail client to send a message I get the following messages to show up in /var/log/mail.log:

postfix/smtpd[5108]: connect from ip[]
postfix/smtpd[5108]: Anonymous TLS connection established from[]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)
postfix/smtpd[5108]: warning:[]: SASL CRAM-MD5 authentication failed: authentication failure
postfix/smtpd[5108]: disconnect from[]



smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = no
smtpd_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_cert_file = /etc/ssl/private/domain_com.crt
smtpd_tls_key_file = /etc/ssl/private/domain.key
smtpd_tls_CAfile = /etc/ssl/private/
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
broken_sasl_auth_clients = yes
smtpd_sasl_path = smtpd
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_loglevel = 1
tls_random_source = dev:/dev/urandom
myhostname =
virtual_mailbox_domains = /etc/postfix/virtual_domains
virtual_mailbox_base = /home/vmail
virtual_mailbox_maps = hash:/etc/postfix/virtual_maps
virtual_minimum_uid = 100
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
myorigin =
mydestination =,, , localhost
smtpd_helo_restrictions = reject_invalid_helo_hostname,
smtpd_client_restrictions = reject_rbl_client
smtpd_sasl_local_domain = 
smtpd_sasl_authenticated_header = yes
smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
home_mailbox = Maildir/
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous noplaintext 
smtpd_recipient_restrictions = reject_unauth_destination permit_sasl_authenticated
smtpd_tls_security_level = encrypt
smtpd_tls_loglevel = 1
smtpd_tls_auth_only = no


DESC="SASL Authentication Daemon"
OPTIONS="-c -r -m /var/spool/postfix/var/run/saslauthd"


ls /etc/postfix/sasl/:


ls /etc/postfix/:  postfix-files  postfix-script  post-install  sasl  smtpd.conf  virtual.db  virtual_domains  virtual_maps  virtual_maps.db

ls /etc/courier/:

authdaemonrc  imapd  imapd.cnf  imapd-ssl  shared  userdb  userdb.dat  userdb.lock  userdbshadow.dat


  • The whole authentication with userdb for the courier server via imaps works perfectly fine. So there has to be some problem with my postfix configuration.


  1. How can I fix my configuration, to make the authentication function.
  2. Is it possible to debug the SASLAuthentication, it only tells me if it's successful or not, but not that for example the username can't be found.

If you need any more information, please don't hesitate to ask. If you notice something weird about my configuration or if you have any suggestions for improvement also please let me know. Thank you very much. Any help is greatly appreciate it.

share|improve this question
These lines are messed up: mydestination =,, , localhost and you're missing something after that line as well. Also, try setting smtpd_tls_security_level to may and see if the error remains.. – NickW Jul 9 '13 at 13:09
BTW, you may not have the libraries installed for the method you need, try doing a yum install cyrus-sasl-* – NickW Jul 9 '13 at 13:20
I have the following sasl packages installed: cyrus-sasl2-dbg,cyrus-sasl2-mit-dbg,libgsasl7,libqca2-plugin-cyrus-sasl,libsasl‌​2-2:amd64,libsasl2-modules:amd64,libsasl2-modules-,ssapi-mit:amd64,sasl2-bin I changed the mydestination to: mydestination = localhost Still have the same error message. Rebooted the whole server to be sure that all services were reloaded. – Martin Jul 9 '13 at 13:47
have a look and see if there is something like cyrus-sasl2-md5 available to install.. – NickW Jul 9 '13 at 13:50
Did you see in your there is an extra comma in mydestination? – NickW Jul 9 '13 at 13:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.