Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently I configured my mail server which uses Postfix and Courier. Everything works except for the authentication when sending mail via my Postfix server(running on port 587) which has StartTLS enabled and uses SASLAuthentication with virtual domains and maps.

Logs

When I try to connect with my e-mail client to send a message I get the following messages to show up in /var/log/mail.log:

postfix/smtpd[5108]: connect from ip domain.com[xxx.xxx.xxx.xxx]
postfix/smtpd[5108]: Anonymous TLS connection established from domain.com[xxx.xxx.xxx.xxx]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)
postfix/smtpd[5108]: warning: domain.com[xxx.xxx.xxx.xxx]: SASL CRAM-MD5 authentication failed: authentication failure
postfix/smtpd[5108]: disconnect from domain.com[xxx.xxx.xxx.xxx]

Configuration

/etc/postfix/main.cf:

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = no
smtpd_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_cert_file = /etc/ssl/private/domain_com.crt
smtpd_tls_key_file = /etc/ssl/private/domain.key
smtpd_tls_CAfile = /etc/ssl/private/certificates.ca-bundle
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
broken_sasl_auth_clients = yes
smtpd_sasl_path = smtpd
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_loglevel = 1
tls_random_source = dev:/dev/urandom
myhostname = domain.com
virtual_mailbox_domains = /etc/postfix/virtual_domains
virtual_mailbox_base = /home/vmail
virtual_mailbox_maps = hash:/etc/postfix/virtual_maps
virtual_minimum_uid = 100
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
myorigin = domain.com
mydestination = domain.com, localhost.com, , localhost
        reject_unknown_recipient_domain,
        reject_unauth_destination,
        reject_rbl_client sbl.spamhaus.org,
        permit
smtpd_helo_restrictions = reject_invalid_helo_hostname,
        reject_non_fqdn_helo_hostname,
        reject_unknown_helo_hostname
smtpd_client_restrictions = reject_rbl_client dnsbl.sorbs.net
smtpd_sasl_local_domain = 
smtpd_sasl_authenticated_header = yes
smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
home_mailbox = Maildir/
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous noplaintext 
smtpd_recipient_restrictions = reject_unauth_destination permit_sasl_authenticated
smtpd_tls_security_level = encrypt
smtpd_tls_loglevel = 1
smtpd_tls_auth_only = no

/etc/default/saslauthd:

START=yes
PWDIR="/var/spool/postfix/var/run/saslauthd"
PARAMS="-m ${PWDIR}"
PIDFILE="${PWDIR}/saslauthd.pid"
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="rimap"
MECH_OPTIONS="127.0.0.1"
THREADS=5
OPTIONS="-c -r -m /var/spool/postfix/var/run/saslauthd"

Directories

ls /etc/postfix/sasl/:

(empty)

ls /etc/postfix/:

dynamicmaps.cf  main.cf  master.cf  postfix-files  postfix-script  post-install  sasl  smtpd.conf  virtual.db  virtual_domains  virtual_maps  virtual_maps.db

ls /etc/courier/:

authdaemonrc  imapd  imapd.cnf  imapd-ssl  shared  userdb  userdb.dat  userdb.lock  userdbshadow.dat

Notes

  • The whole authentication with userdb for the courier server via imaps works perfectly fine. So there has to be some problem with my postfix configuration.

Questions

  1. How can I fix my configuration, to make the authentication function.
  2. Is it possible to debug the SASLAuthentication, it only tells me if it's successful or not, but not that for example the username can't be found.

If you need any more information, please don't hesitate to ask. If you notice something weird about my configuration or if you have any suggestions for improvement also please let me know. Thank you very much. Any help is greatly appreciate it.

share|improve this question
    
These lines are messed up: mydestination = domain.com, localhost.com, , localhost and you're missing something after that line as well. Also, try setting smtpd_tls_security_level to may and see if the error remains.. –  NickW Jul 9 '13 at 13:09
    
BTW, you may not have the libraries installed for the method you need, try doing a yum install cyrus-sasl-* –  NickW Jul 9 '13 at 13:20
    
I have the following sasl packages installed: cyrus-sasl2-dbg,cyrus-sasl2-mit-dbg,libgsasl7,libqca2-plugin-cyrus-sasl,libsasl‌​2-2:amd64,libsasl2-modules:amd64,libsasl2-modules-,ssapi-mit:amd64,sasl2-bin I changed the mydestination to: mydestination = domain.com localhost Still have the same error message. Rebooted the whole server to be sure that all services were reloaded. –  Misha Rogalla Jul 9 '13 at 13:47
    
have a look and see if there is something like cyrus-sasl2-md5 available to install.. –  NickW Jul 9 '13 at 13:50
    
Did you see in your main.cf there is an extra comma in mydestination? –  NickW Jul 9 '13 at 13:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.