Tag Info

Hot answers tagged

6

you have smtpd_recipient_restrictions twice, and the last one is the one being used and it does not have permit_sasl_authenticated


6

The giveaway is here: -- active services in /etc/postfix/master.cf -- # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes) (never) (100) smtp inet n - - - - smtpd submission inet n - - - - smtpd The smtpd process on the submission ...


5

Define another failregex (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:.*)$ I tested this regex with fail2ban-regex and is working.


5

postconf -a and postconf -A tell you what sasl plugin types are available. I would assume those would return errors or empty lists if sasl support was not enabled at build time (though possibly not). You could also check the output of ldd /path/to/postfix and see if it links to a sasl library or not (though it might be possible for postfix to be built with ...


4

Had the same problems like above only on debian squeeze after a dist-upgrade. After hours of config, restart and reinstalling madness I gave following "svn.conf" a try: pwcheck_method: saslauthd #auxprop_plugin: ldap mech_list: plain login cram-md5 digest-md5 IMO, "mech_list: plain" should be enough. the other mechs are overlefts from previous tryouts. ...


4

It's clear to me that the password from mail@xxxxxx.tld has been stolen and someone authenticated on your postfix using this account and password. You could limit the number of messages sent from an user using the anvil process from postfix, as example: smtpd_client_message_rate_limit=100 With this option in main.cf you can limit 100 messages/per client ...


4

Ah-ha! Installing the libsasl2-modules package solved the problem.


4

Postfix can run in a chroot (by default in /var/spool/postfix) or not. If it is, it will try to open /var/spool/postfix/var/run/saslauthd/mux for sasl authentication. If it's not, it will try to open /var/run/saslauthd/mux It seems that, for some reason, your postfix instance was running in a chroot, and it's not anymore. It's odd, but that's what I guess ...


4

You could change the reject_code for your submission listener to 450, so it is not a permanent reject but a defer. check_sender_auth = defer_if_reject reject_authenticated_sender_login_mismatch, permit_sasl_authenticated, reject See http://www.postfix.org/postconf.5.html#defer_if_reject for details. Unfortunately, this is not simple to ...


4

yes it is possible. I guess you are using libpam-mysql. There is an option you can set named crypt. auth optional pam_mysql.so user=username passwd=password verbose=0 db=thedb table=user usercolumn=userName passwdcolumn=userPassword crypt=3 account required pam_mysql.so user=username passwd=password verbose=0 db=thedb table=user ...


3

smtpd_receipient_restrictions are matched from left-to-right, first match wins. You want smtpd_recipient_restrictions = permit_sasl_authenticated, reject http://www.postfix.org/SMTPD_ACCESS_README.html


3

SASL and GSSAPI are frameworks that various authentication providers can be plugged into. People wishing to use Kerberos authentication in an app that supports SASL or GSSAPI need only to provide the appropriate Kerberos plugin, rather than rewrite the app with Kerberos-specific code.


3

auxprop can't deal with encrypted passwords, you should use PAM authentication mechanism and pam_mysql plugin.


3

postfix can be configured to use dovecot for SASL authentication, so you might be better off starting the other way around and figuring out if you can get Dovecot to process these hashes. Keep in mind that hashes are designed not to be "decrypted". When someone wants to log in, the application takes the original salt, the password the user provides and ...


3

Postfix currently supports only two SASL authentication methods. One of the is Dovecot, which you don't want. The other is Cyrus, which is about as close to what you want as it's possible to get without rewriting Postfix. It does involve running a separate authentication daemon (saslauthd), but the authentication file is easy to edit and update. The basics ...


3

Your server is not an open relay. It is set up to allow three different types of mail: Mail from anybody on the internet to addresses within your own domain Mail that originates on your own mailserver (e.g. notices from cron jobs and the like), to anybody on the internet Mail that comes from an authenticated connection to anybody on the internet If the ...


2

I brought someone in and, after a bit of examination and testing, we added smtp_sasl_mechanism_filter = login to main.cf. That cleared it up. He explained it forces postfix to do the AUTH LOGIN (that I was doing manually while testing through telnet). smtp_sasl_mechanism_filter doc I watched with tail -F /var/log/mail.log and the emails were going out. ...


2

Your smtpd_recipient_restrictions are not strict enough. If this machine is not a MX, but a MSA/MTA then you'll probably want to end with reject. Example MSA/MTA setting: smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject This will accept mail from authenticated users and the addresses listed in mynetworks and reject all ...


2

Well, from what I see in your posted configuration you never set Dovecot's auth_mechanisms = plain login, thus the default of auth_mechanisms = plain is used. Try updating that setting and restarting Dovecot, afterwards re-check the output of doveconf -n. Your auth socket settings seem correct to me, Postfix should be able to do SASL authentication against ...


2

I Solved it! It took a lot of debugging, but everything works again with the following settings: In /etc/postfix/smtpd.conf: pwcheck_method: saslauthd saslauthd_path: /run/saslauthd/mux mech_list: PLAIN LOGIN # DO NOT SPECIFY THE AUX_PROP PLUGIN!! #auxprop_plugin: ldapdb In /etc/saslauthd.conf: ... ldap_auth_method: bind #ldap_filter: (mail=%u) ...


2

Google does something special, when you authenticate your from and source headers are re-written as if you were writing the email from your gmail webmail. If you want to have a smarthost, either buy one or just send out of your server (assuming it is either a VPS or on a business class internet line) or create your own.


2

You probably just need to add -r to your saslauthd OPTIONS= stanza. From the man pages -r Combine the realm with the login (with an ’@’ sign in between). e.g. login: "foo" realm: "bar" will get passed as login: "foo@bar". Note that the realm will still be passed, which may lead to unexpected behavior.


2

Postfix restriction classes can return three answers, OK, REJECT or DUNNO, usually they have (OK, DUNNO) or (REJECT, DUNNO), because of the way that postfix functions. DENY and OK mean the rest of the checks are ignored, DUNNO means go on to the next check. So, in your case, permit_mynetworks or permit_sasl_authenticated are returning OK, so it does not ...


2

saslauthd can handle only PLAIN and LOGIN authentication methods but you have disabled plaintext with smtpd_sasl_security_options. Also you have typo in your config - smtpd_sasl_path statement is duplicated, it seems first one should be typed as smtpd_sasl_type instead. Check http://www.postfix.org/SASL_README.html for additional details.


2

The SASL authenticators are only included in exim4-daemon-heavy, including the Dovecot SASL authenticator. More information on that here.


2

The version of Sendmail on my Solaris 10 9/10 box is 8.14.4+Sun. It has also been linked with SASL: $ ldd /usr/sbin/sendmail|grep sasl libsasl.so.1 => /usr/lib/libsasl.so.1 In the stock sendmail.cf: # SMTP AUTH flags #O AuthOptions So yes, it looks like it is supported but you'll need to enable it in the configuration. UPDATE As @AndyM ...


2

Out of all the maddening things... It turns out my ISP is likely silently blocking outbound SMTP on my network at home. Unbelievable. Sorry for the useless question now. Just a cautionary tale it seems...


2

It looks like the clue is right here: untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certificate Authority you need to get the equifax cert and add it to your list of trusted CA certs. I think that these are available here: http://www.geotrust.com/resources/root-certificates/


2

If you don't want to authenticate with Kerberos, you need to tell the OpenLDAP tools that by using the -x command line option. From the man page for ldapsearch: -x Use simple authentication instead of SASL. When using -x, you will also need -D, to specify your bind DN, and you will need to provide the password via either -W (to prompt for the ...


2

This seems to be a reported bug in samba's winbind, although it was saslauthd which complained. Here is the bug report: https://bugzilla.samba.org/show_bug.cgi?id=7265 A workaround, until this is released, is to restart winbind and saslauthd every few days (in a cron).



Only top voted, non community-wiki answers of a minimum length are eligible