Tag Info

Hot answers tagged

5

postconf -a and postconf -A tell you what sasl plugin types are available. I would assume those would return errors or empty lists if sasl support was not enabled at build time (though possibly not). You could also check the output of ldd /path/to/postfix and see if it links to a sasl library or not (though it might be possible for postfix to be built with ...


4

You could change the reject_code for your submission listener to 450, so it is not a permanent reject but a defer. check_sender_auth = defer_if_reject reject_authenticated_sender_login_mismatch, permit_sasl_authenticated, reject See http://www.postfix.org/postconf.5.html#defer_if_reject for details. Unfortunately, this is not simple to ...


4

Had the same problems like above only on debian squeeze after a dist-upgrade. After hours of config, restart and reinstalling madness I gave following "svn.conf" a try: pwcheck_method: saslauthd #auxprop_plugin: ldap mech_list: plain login cram-md5 digest-md5 IMO, "mech_list: plain" should be enough. the other mechs are overlefts from previous tryouts. ...


4

Postfix can run in a chroot (by default in /var/spool/postfix) or not. If it is, it will try to open /var/spool/postfix/var/run/saslauthd/mux for sasl authentication. If it's not, it will try to open /var/run/saslauthd/mux It seems that, for some reason, your postfix instance was running in a chroot, and it's not anymore. It's odd, but that's what I guess ...


3

The giveaway is here: -- active services in /etc/postfix/master.cf -- # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes) (never) (100) smtp inet n - - - - smtpd submission inet n - - - - smtpd The smtpd process on the submission ...


3

Postfix currently supports only two SASL authentication methods. One of the is Dovecot, which you don't want. The other is Cyrus, which is about as close to what you want as it's possible to get without rewriting Postfix. It does involve running a separate authentication daemon (saslauthd), but the authentication file is easy to edit and update. The basics ...


3

Your server is not an open relay. It is set up to allow three different types of mail: Mail from anybody on the internet to addresses within your own domain Mail that originates on your own mailserver (e.g. notices from cron jobs and the like), to anybody on the internet Mail that comes from an authenticated connection to anybody on the internet If the ...


3

yes it is possible. I guess you are using libpam-mysql. There is an option you can set named crypt. auth optional pam_mysql.so user=username passwd=password verbose=0 db=thedb table=user usercolumn=userName passwdcolumn=userPassword crypt=3 account required pam_mysql.so user=username passwd=password verbose=0 db=thedb table=user ...


3

smtpd_receipient_restrictions are matched from left-to-right, first match wins. You want smtpd_recipient_restrictions = permit_sasl_authenticated, reject http://www.postfix.org/SMTPD_ACCESS_README.html


3

postfix can be configured to use dovecot for SASL authentication, so you might be better off starting the other way around and figuring out if you can get Dovecot to process these hashes. Keep in mind that hashes are designed not to be "decrypted". When someone wants to log in, the application takes the original salt, the password the user provides and ...


2

For things that are not unique (that is, replicated services, performing exactly the same duties) I usually share one common server principal. This works well if external entities see the same domain name for instance, as it maintains that illusion. It also means that if a user switches from instance-1 to instance-49 they won't have to perform another ...


2

smtp_recipient_restrictions are evaluated in order. You probably want something that at least starts like this: smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks And then proceed to either reject all (if you are only sending mail and never receiving mail on this server) or reject ...


2

It looks like the clue is right here: untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certificate Authority you need to get the equifax cert and add it to your list of trusted CA certs. I think that these are available here: http://www.geotrust.com/resources/root-certificates/


2

This seems to be a reported bug in samba's winbind, although it was saslauthd which complained. Here is the bug report: https://bugzilla.samba.org/show_bug.cgi?id=7265 A workaround, until this is released, is to restart winbind and saslauthd every few days (in a cron).


2

SASL stands for Simple Authentication and Security Layer; it's a framework that allows developers to implement different authentication mechanisms, and allows clients and servers to negotiate a mutually acceptable mechanism for each connection (rather than hard-coding or pre-configuring them). GSSAPI stands for Generic Security Services Application Program ...


2

If you want the SMTP connection from your MTA to mailhost.zen.co.uk to be SASL auth'd, you want the smtp_sasl_* parameters, not the smtpd_sasl_* parameters. The latter is for when you're the receiving MTA, while the former are for when you're connecting to another MTA, as you appear to want to do here.


2

I haven't followed this guide, so I don't know if it's up to date and accurate, but here goes: Authenticating with SASL Also, you don't need to use private/public keys (unless you have a corporate policy or something) to do authentication with SVN. You can just use the built-in password prompt of the svn client and use the option to cache the password if ...


2

I investigated this option a little bit: From the side of SASL, you can use the PLAIN mechanism to authenticate against system accounts. The best option is probably PAM and saslauthd. But "shared secret" mechanisms are not possible (unless your system account password are stored in clear). From the side of Subversion, the SASL notes of 1.6.4 list under the ...


2

saslauthd can handle only PLAIN and LOGIN authentication methods but you have disabled plaintext with smtpd_sasl_security_options. Also you have typo in your config - smtpd_sasl_path statement is duplicated, it seems first one should be typed as smtpd_sasl_type instead. Check http://www.postfix.org/SASL_README.html for additional details.


2

The version of Sendmail on my Solaris 10 9/10 box is 8.14.4+Sun. It has also been linked with SASL: $ ldd /usr/sbin/sendmail|grep sasl libsasl.so.1 => /usr/lib/libsasl.so.1 In the stock sendmail.cf: # SMTP AUTH flags #O AuthOptions So yes, it looks like it is supported but you'll need to enable it in the configuration. UPDATE As @AndyM ...


2

Since you only explicitly permit SASL authenticated users, if the user is not authenticated the next restriction in line is checked - which is mynetworks, which happens to match. So, entirely due to your rule ordering non-auth clients are allowed from your trusted networks. Instead, consider setting it up like this: smtpd_client_restrictions = ...


2

If your output is blank, then you have a Postfix server which lacks SASL support at all. Now you have different options to go from here: Look if your BSD provides Posfix packages with SASL support. Probably with extension packages? Compile your own Postfix with SASL support. Look if you find packages on the Internet that are compatible with your BSD ...


2

To relay mail from a client, use submission, not plain SMTP. You should configure postfix to reject submission on port 25 (port 25 is only for MTA <-> MTA relay). See the commented submission example in master.cf for details; clients should connect to port 587 (submission) using STARTTLS and LOGIN authentication. All other mail may be rejected on ...


2

I've stumbled on a problem that seems very similar to this. The solution was to modify slightly the smtpd.conf file (located in /etc/postfix/sasl). Indeed, there are two errors in the flurdy.com tutorial : Original version : pwcheck_method: saslauthd mech_list: plain login cram-md5 digest-md5 log_level: 7 allow_plaintext: true auxprop_plugin: mysql ...


2

Your smtpd_recipient_restrictions are not strict enough. If this machine is not a MX, but a MSA/MTA then you'll probably want to end with reject. Example MSA/MTA setting: smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject This will accept mail from authenticated users and the addresses listed in mynetworks and reject all ...


2

(1) In /etc/sasl2/svn.conf you can set a log level for saslauthd like: log_level: 7 In sasl.h I found: #define SASL_LOG_NONE 0 /* don't log anything */ #define SASL_LOG_ERR 1 /* log unusual errors (default) */ #define SASL_LOG_FAIL 2 /* log all authentication failures */ #define SASL_LOG_WARN 3 /* log non-fatal warnings */ #define ...


2

We can probably troubleshoot this with a few questions: Is dovecot running? Can you authenticate to it with an IMAP/POP client? Is there a socket available at /var/spool/postfix/private/auth? Is the socket readable/writeable by the postfix user? If the answer to any of these questions is 'No', we have found your problem. If the answers are all 'Yes', ...


2

Every time I've encountered a similar problem with saslauthd (and when everything else has been double-checked), it has been about directory/file permissions. Check each and every step of this /var/spool/postfix/var/run/saslauthd path to make sure saslauthd actually can get there.


2

Well, from what I see in your posted configuration you never set Dovecot's auth_mechanisms = plain login, thus the default of auth_mechanisms = plain is used. Try updating that setting and restarting Dovecot, afterwards re-check the output of doveconf -n. Your auth socket settings seem correct to me, Postfix should be able to do SASL authentication against ...


2

Google does something special, when you authenticate your from and source headers are re-written as if you were writing the email from your gmail webmail. If you want to have a smarthost, either buy one or just send out of your server (assuming it is either a VPS or on a business class internet line) or create your own.



Only top voted, non community-wiki answers of a minimum length are eligible