5

I have mail server Postfix+Saslauth. I configure multiple instance for Postfix:

postfix

postfix-out

and two instances for saslauth:

saslauthd

saslauthd-out

Setting saslauthd is for authenticating Postfix service and saslauthd-out for another instance of it.

For creating second instance of sasl I do it this way:

cp /etc/default/saslauthd /etc/default/saslauthd-out

With this configuration : :~# vim /etc/default/saslauthd-out

 DESC="SASL Authentication Daemon postfix-out"
 NAME="saslauthd-out"
 MECHANISMS="pam"
 OPTIONS="-c -m /var/spool/postfix-out/var/run/saslauthd-out"

In configuration of postfix-out (/etc/postfix-out/sasl/smtp.conf):

  pwcheck_method: saslauthd-out

and for postfix (/etc/postfix/sasl/smtp.conf):

  pwcheck_method: saslauthd

and when I restart saslauth every thing is OK ,

when I try to connect smtp server (postfix) every thing is OK , and Authentication was successfull, but in smtp server (postfix-out) , connect to smtp is OK, but it can't authenticate and this error has occurred:

:~# telnet mail2.example.com 25 
Trying 111.222.333.444...
Connected to mail2.example.com.
Escape character is '^]'. 
220 mail2.example.com ESMTP Postfix (@@DISTRO@@) 
auth plain YWdoc2EAYWdoc2hhbGRvcmFu 
535 5.7.8 Error: authentication failed: no mechanism available

Logs :

Nov 30 09:17:47 mail4 postfix-out/smtpd[4361]: connect from unknown[111.222.333.444]
Nov 30 09:17:58 mail4 postfix-out/smtpd[4361]: warning: SASL authentication problem: unknown password verifier 
Nov 30 09:17:58 mail4 postfix-out/smtpd[4361]: warning: SASL authentication failure: Password verification failed
Nov 30 09:17:58 mail4 postfix-out/smtpd[4361]: warning: unknown[111.222.333.444]: SASL plain authentication failed: no mechanism available
Nov 30 09:18:04 mail4 postfix-out/smtpd[4361]: disconnect from unknown[111.222.333.444]

what is the problem?

  • What's in your logfiles? – etagenklo Nov 30 '13 at 12:05
  • Log file added.(mail.log) – superuser Nov 30 '13 at 14:23
  • 1
    Hmm, the password verifier should be the value of pwcheck_method, so your error message unknown password verifier means postfix can't connect to the saslauthd-out socket. Did you create a symlink to /var/run/saslauthd-out ? – etagenklo Nov 30 '13 at 20:29
  • Yes , I create symlink /var/run/saslauthd-out with /var/spool/postfix-out/var/run/saslauthd-out . – superuser Nov 30 '13 at 22:29
1

pwcheck_method is a configuration option for the Cyrus SASL library. Possible values are auxprop, saslauthd, pwcheck and authdaemond. saslauthd-out is not supported here. You configuration needs to be like this

/etc/default/saslauthd-out:

DESC="SASL Authentication Daemon postfix-out"
NAME="saslauthd-out"
MECHANISMS="pam"
OPTIONS="-c -m /var/spool/postfix-out/var/run/saslauthd-out"

/etc/postfix-out/sasl/smtp.conf:

pwcheck_method: saslauthd
saslauthd_path: /var/spool/postfix-out/var/run/saslauthd-out/mux

somewhere in /etc/postfix-out/main.cf:

smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtp 
smtpd_sasl_type = cyrus
cyrus_sasl_config_path = /etc/postfix-out/sasl

I just setup a VM with that configuration and it works.

/var/spool/postfix-out/var/run/saslauthd-out has to exist, although personally i would prefer it to be more like /var/spool/postfix-out/saslauthd-out. But that is your decision.

  • When I do that ,this error has occurred : 535 5.7.8 Error: authentication failed: generic failure ,,with this log : Dec 1 02:26:40 mail postfix-out/smtpd[12858]: warning: SASL authentication failure: cannot connect to saslauthd server: No such file or directory ,,Dec 1 02:26:40 mail4 postfix-out/smtpd[12858]: warning: SASL authentication failure: Password verification failed ,,Dec 1 02:26:40 mail postfix-out/smtpd[12858]: warning: unknown[ip]: SASL plain authentication failed: generic failure – superuser Dec 1 '13 at 7:27
  • That is probably because of your symlink from /var/run/saslauthd-out to /var/spool/postfix-out/var/run/saslauthd-out. Stop saslauthd-out remove the symlink and start saslauthd-out. If your /var/run is tmpfs, it's gone after the next reboot anyways. – lsmooth Dec 1 '13 at 10:17
  • 1
    I just updated my answer to include all the configuration needed. – lsmooth Dec 1 '13 at 10:34
  • 2
    What I mean is the symlink is unnecessary. You already told saslauthd-out to put everything in /var/spool/postfix-out/var/run/saslauthd-out using -m switch. It will contain mux, mux.accept and the pid-file (saslauthd.pid) but all libsasl needs is the (full) path to mux and it gets that location from saslauthd_path in smtp.conf. – lsmooth Dec 1 '13 at 13:16
  • 1
    I added too more config-lines for main.cf, please add those. – lsmooth Dec 2 '13 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.