2

I'm getting

(delivery temporarily suspended: SASL authentication failed; server myserver.com[xxx.xxx.xxx.x] said: 535 5.7.3 Authentication unsuccessful)
when I try to relay mail from Postfix 2.5.5-1.1 on Debian Lenny box to Exchange 2010.

I think I tried all possible combinations but I'm definitely missing something. Here is relevant part of main.cf:

broken_sasl_auth_clients = yes
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_pix_workarounds =
smtp_sasl_type = cyrus
smtp_always_send_ehlo = yes
relayhost = myserver.com

And I got libsasl2-modules installed. Anybody managed to successfully relay mail between Postfix and Exchange? Oh, and I already double-checked if password is right.

2 Answers 2

1

The Exchange Server will offer GSSAPI (Kerberos) but it seems that Cyrus SASL providing authentication service to Postfix was not configured to handle GSSAPI.

man 5 postconf | less +/^smtp_sasl_mechanism_filter

this will tell you what you need to set smtp_sasl_mechanism_filter to in order to get this to authenticate properly.

3
  • So if I'm right i should have smtp_sasl_mechanism_filter = gssapi but then i'm getting postfix/smtp[3196]: warning: myserver.com[xxx.xxx.xxx.x]:25 offered no supported AUTH mechanisms: 'NTLM'
    – helcim
    Oct 8, 2010 at 13:46
  • that would sugggest that the MS Exchange Server is setup with other auth mech - can you please check which auth is turned on with MS Exchange server or follow the guide at support.microsoft.com/kb/239869 to setup NTLM(GSSAPI) with MS Exchange server.
    – Khushil
    Oct 8, 2010 at 16:41
  • you could also try smtp_sasl_mechanism_filter = !gssapi, !ntlm, static:rest
    – Khushil
    Oct 8, 2010 at 18:54
1

It seems, that they've broken their AUTH LOGIN implementation. I've been put to this unfortunate situation as well. There's what I've found:

in smtp conversation, when postfix tries to do the login auth:

250 OK
AUTH LOGIN
334 VXNlcm5hbWU6

there's a \0 (binary zero) at the end of the Username: string which I suppose shouldn't be there, anyway by adding \0 (binary zero) to the end of username & password before base64-ing them and sending to exchange, I was able to login successfully, however how to tell postfix to append \0 at the end of the login & password I do not know.

# echo -e 'username\0' | base64
abcdefg
# echo -e 'password\0' | base64
hijklmno

250 OK
AUTH LOGIN
334 VXNlcm5hbWU6
abcdefg
334 UGFzc3dvcmQ6
hijklmno
235 2.7.0 Authentication successful.
1
  • That's extraordinary news! Anybody else can confirm that?
    – helcim
    Feb 24, 2011 at 7:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .