Hot answers tagged

9

Ah-ha! Installing the libsasl2-modules package solved the problem.


7

you have smtpd_recipient_restrictions twice, and the last one is the one being used and it does not have permit_sasl_authenticated


7

The giveaway is here: -- active services in /etc/postfix/master.cf -- # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes) (never) (100) smtp inet n - - - - smtpd submission inet n - - - - smtpd The smtpd process on the submission ...


7

Postfix can run in a chroot (by default in /var/spool/postfix) or not. If it is, it will try to open /var/spool/postfix/var/run/saslauthd/mux for sasl authentication. If it's not, it will try to open /var/run/saslauthd/mux It seems that, for some reason, your postfix instance was running in a chroot, and it's not anymore. It's odd, but that's what I guess ...


6

You probably just need to add -r to your saslauthd OPTIONS= stanza. From the man pages -r Combine the realm with the login (with an ’@’ sign in between). e.g. login: "foo" realm: "bar" will get passed as login: "foo@bar". Note that the realm will still be passed, which may lead to unexpected behavior.


6

You can have saslauthd installed but not have any mechanisms installed. It's quite frustrating and poor error-proofing, IMO. "no applicable SASL mechanisms" literally means it can't find any of its mechanisms. On a Fedora-based system you'd need to install the cyrus-sasl-plain package if you want to use the 'PLAIN' auth mechanisms (i.e. SMTP/STARTTLS). ...


6

Define another failregex (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:.*)$ I tested this regex with fail2ban-regex and is working.


5

You could change the reject_code for your submission listener to 450, so it is not a permanent reject but a defer. check_sender_auth = defer_if_reject reject_authenticated_sender_login_mismatch, permit_sasl_authenticated, reject See http://www.postfix.org/postconf.5.html#defer_if_reject for details. Unfortunately, this is not simple to ...


5

postconf -a and postconf -A tell you what sasl plugin types are available. I would assume those would return errors or empty lists if sasl support was not enabled at build time (though possibly not). You could also check the output of ldd /path/to/postfix and see if it links to a sasl library or not (though it might be possible for postfix to be built with ...


5

Postfix currently supports only two SASL authentication methods. One of the is Dovecot, which you don't want. The other is Cyrus, which is about as close to what you want as it's possible to get without rewriting Postfix. It does involve running a separate authentication daemon (saslauthd), but the authentication file is easy to edit and update. The basics ...


5

As you can see, there's no smtpd_sasl_path in our output of postconf -n Why? The answer is easy. Because there's no smtpd_sasl_path set. Have a look at your first snippet: There's a typo in it. You wrote smptd_sasl_path = private/auth -- but there's a difference between smtpd and smptd. Because Postfix doesn't have informations where to find the socket, ...


5

This feature was available to postfix version 2.11. You can use check_sasl_access parameter to enforce restrictions based on SASL username. Of course you need to put it above permit_sasl_authenticated. Please refer to man 5 postconf for complete documentation. Example configuration, taken from Postfix SASL Howto # main.cf smtpd_relay_restrictions = ...


4

It's clear to me that the password from mail@xxxxxx.tld has been stolen and someone authenticated on your postfix using this account and password. You could limit the number of messages sent from an user using the anvil process from postfix, as example: smtpd_client_message_rate_limit=100 With this option in main.cf you can limit 100 messages/per client ...


4

Had the same problems like above only on debian squeeze after a dist-upgrade. After hours of config, restart and reinstalling madness I gave following "svn.conf" a try: pwcheck_method: saslauthd #auxprop_plugin: ldap mech_list: plain login cram-md5 digest-md5 IMO, "mech_list: plain" should be enough. the other mechs are overlefts from previous tryouts. ...


4

Well, from what I see in your posted configuration you never set Dovecot's auth_mechanisms = plain login, thus the default of auth_mechanisms = plain is used. Try updating that setting and restarting Dovecot, afterwards re-check the output of doveconf -n. Your auth socket settings seem correct to me, Postfix should be able to do SASL authentication against ...


4

auxprop can't deal with encrypted passwords, you should use PAM authentication mechanism and pam_mysql plugin.


4

We were able to trace the username by using Dovecot itself. In the config we enabled verbose auth logging using auth_verbose = yes This put the information in /etc/dovecot/info.log


4

postfix can be configured to use dovecot for SASL authentication, so you might be better off starting the other way around and figuring out if you can get Dovecot to process these hashes. Keep in mind that hashes are designed not to be "decrypted". When someone wants to log in, the application takes the original salt, the password the user provides and ...


4

The SASL authenticators are only included in exim4-daemon-heavy, including the Dovecot SASL authenticator. More information on that here.


4

yes it is possible. I guess you are using libpam-mysql. There is an option you can set named crypt. auth optional pam_mysql.so user=username passwd=password verbose=0 db=thedb table=user usercolumn=userName passwdcolumn=userPassword crypt=3 account required pam_mysql.so user=username passwd=password verbose=0 db=thedb table=user ...


4

SASL stands for Simple Authentication and Security Layer; it's a framework that allows developers to implement different authentication mechanisms, and allows clients and servers to negotiate a mutually acceptable mechanism for each connection (rather than hard-coding or pre-configuring them). GSSAPI stands for Generic Security Services Application Program ...


4

buggy for configuring virtual mailboxes with Maildir protocol I'm using Dovecot LMTP for delivery to Maildir boxes and don't have any problems. I'd like to provide SMTP authentication access introducing SASL with dovecot as IMAP server The easier way is to authenticate SMTP users through Dovecot, so you don't need to configure SASL authentication ...


3

My recipe is for OpenLDAP to check directly /etc/sasldb2. First step: ensure the /etc/sasldb2 is owned by slapd user. Next step: have slapd not to look for credentials in directory tree, which is done as following: dn: cn=config changetype: modify replace: olcSaslAuxprops olcSaslAuxprops: sasldb Later, you will also need a olcAuthzRegexp rule, but in ...


3

Some documentation is more verbose [1]: -u domain (default: system FQDN hostname) Use domain to set user domain property (realm). SASL can be used for authenticating users with different realms (domains, FQDN, servers ...). You can think of it as an email address, which consist of user and domain. This is required to cover some authentication methods ...


3

You need to know the differences of smtpd and smtp in postfix. In short, smtpd was SMTP server that receive the email and smtp was SMTP client that send the email. Based on the article linked above, you need to adding three parameters into main.cf smtp_sasl_auth_enable=yes smtp_sasl_password_maps=hash:/etc/postfix/sasl_passwd smtp_sasl_security_options ...


3

For enable SASL when receiving email via smtpd, you need to put this parameter smtpd_sasl_auth_enable = yes For enable SASL when sending email via smtp, you need to put this parameter smtp_sasl_auth_enable = yes In your postconf output above, you only put smtp_sasl_auth_enable not smtpd_sasl_auth_enable. That's why postfix complain with error ...


3

smtpd_receipient_restrictions are matched from left-to-right, first match wins. You want smtpd_recipient_restrictions = permit_sasl_authenticated, reject http://www.postfix.org/SMTPD_ACCESS_README.html


3

SASL and GSSAPI are frameworks that various authentication providers can be plugged into. People wishing to use Kerberos authentication in an app that supports SASL or GSSAPI need only to provide the appropriate Kerberos plugin, rather than rewrite the app with Kerberos-specific code.


3

To relay mail from a client, use submission, not plain SMTP. You should configure postfix to reject submission on port 25 (port 25 is only for MTA <-> MTA relay). See the commented submission example in master.cf for details; clients should connect to port 587 (submission) using STARTTLS and LOGIN authentication. All other mail may be rejected on ...


3

saslauthd can handle only PLAIN and LOGIN authentication methods but you have disabled plaintext with smtpd_sasl_security_options. Also you have typo in your config - smtpd_sasl_path statement is duplicated, it seems first one should be typed as smtpd_sasl_type instead. Check http://www.postfix.org/SASL_README.html for additional details.



Only top voted, non community-wiki answers of a minimum length are eligible