Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hi I've set up a mail server according to this guide :

http://andrewpuschak.com/dokuwiki/doku.php?id=centos_6_email_server

When I telnet mydomain.com 25 and use the AUTH command it returns:

Error: authentication not enabled

Trying to login via outlook returns an unknown error and when I send an e-mail to an adress I get an relay access denied error.

mxtoolbox however tells me everything is set up ok.

share|improve this question
1  
If you have checked through the linked document and are sure you have followed it correctly then you should contact it's author and help them correct it. –  Iain Dec 15 '13 at 19:21

3 Answers 3

There is two different things.

1: SSL/TLS support

2: authentication

The are independent, i.e. it is possible to have one of them, and missing the other. Of course it is much better, if authentication happens only over an already encrypted channel.

Probably your postfix haven't the second (the auth), only the TLS.

Authentication on postfix happends through the sasl authentication daemon, which also needs to be configured.

mxtoolbox says everything is O.K., because it doesn't check the auth, only the encryption.

share|improve this answer
    
I'm using dovecots tls support and smtp_sasl_auth_enable = yes in the postfix config –  Frank Astin Dec 15 '13 at 18:18
    
And this: smtpd_sasl_path = smtpd? –  Peter Horvath Dec 15 '13 at 18:21
    
it's set to smtpd_sasl_path = private/auth –  Frank Astin Dec 15 '13 at 18:23
    
How do I debug this? I can't find anything in the mail log. –  Frank Astin Dec 15 '13 at 18:28
    
Then you need to debug, what happens between sasl and postfix. Last time I did this, it wasn't simple. First you need be sure, that sasl is ok. You said, you have a dovecot, and that it works, thus it is probable. Sasl is communicating with dovecot through a unix pipe, so you need strace them, watching what they communicate through this pipe, and also checking the sasld log. –  Peter Horvath Dec 15 '13 at 18:28

As you don't see anything in your postfix log, at least postfix must be configured incorrectly.

First, confirm that Dovecot is configured (in dovecot.conf) with something like:

auth default {
    mechanisms = plain login
    passdb pam {
    }
    userdb passwd {
    }
    user = root
    socket listen {
      client {
        path = /var/spool/postfix/private/auth
        mode = 0660
        user = postfix
        group = postfix
      }
    }
}

Confirm the following in your postfix main.cf:

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = permit_sasl_authenticated`

and in master.cf, make sure that your submission port offers the SASL service. You can put this in your smtp service for auth on port 25, but this is unusual. You should also put it in your smtps service for encrypted access:

submission inet n - - - - smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject
share|improve this answer

You're using the wrong port.

Authenticated outgoing email is on port 587, not port 25.

share|improve this answer
    
I don't get anything when I try to telnet to 587 . –  Frank Astin Dec 15 '13 at 18:39
    
Then you have seriously screwed up your configuration somehow. Post your master.cf and check your firewall. –  Michael Hampton Dec 15 '13 at 19:25
1  
Authenticated outgoing email can be done on port 25, it's just quite common to only do it on the submission port which is 587. But there is no RFC or other requirement to have it only on port 25. –  Quetza Dec 16 '13 at 1:05
    
Yes, everything can be done on port 25 after a STARTTLS command, just as on port 587. There is a third port number, it is 467(?), on this only SSL communication can go. It is effectively the SMTP version of HTTPS. But these port numbers are about encryption, and not about authentication. Authentication can be done on SMTP many years ago, and it can happen over encrypted and just as on unencrypted channel. It is only our wish, that we (as sysadms) don't want authentication on unencrypted channel because security, theoretically it were possible. –  Peter Horvath Dec 20 '13 at 12:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.