1

I have been trying to setup MX in my server and was able to get the IMAP part working under SSL using Dovecot, however I can't get the SMTP part working using Dovecot as the SASL Authentication.

When I telnet example.com 587, the ehlo gives me the following:

250-example.com
250-PIPELINING
250-SIZE 30720000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

There is not authentication in the ehlo, however if I do the ehlo over openssl s_client -starttls smtp -connect example.com:587, I get the following:

250-example.com
250-PIPELINING
250-SIZE 30720000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

And the plain login, using the base64 of '\0username\0password', returns OK. I think the problem here is not the SASL as the users get authenticated and the problem is in the connection, but I have no idea what can cause such a problem. Since my recipient restrictions don't allow non SASL authenticated users to pass, default telnet gives me an error. How can I add SASL to the default non STARTTLS connection, so I can use it with my mailing client?

Here is my main.cf:

## SASL
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes

## SSL/TLS
smtpd_tls_received_header = yes
smtpd_tls_auth_only = yes
smtpd_tls_cert_file=/etc/postfix/ssl/smtpd.cert
smtpd_tls_key_file=/etc/postfix/ssl/smtpd.key
smtpd_tls_ask_ccert = yes
smtpd_use_tls=yes
smtp_use_tls=yes
smtpd_tls_log_level = 2
smtp_tls_note_starttls_offer = yes
smtpd_tls_session_cache_timeout = 3600s
smtp_tls_protocols = SSLv3, TLSv1
tls_random_source = dev:/dev/urandom

message_size_limit = 30720000
smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, 
    reject_invalid_hostname, permit

smtpd_sender_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_sender, 
    reject_unknown_sender_domain, reject_unauth_pipelining, permit

smtpd_recipient_restrictions = reject_unauth_pipelining, 
    permit_mynetworks, reject_non_fqdn_recipient, 
    reject_unknown_recipient_domain, reject_unauth_destination, permit

smtpd_data_restrictions = reject_unauth_pipelining

smtpd_sender_restrictions = reject_unknown_sender_domain

mydestination = localhost, example.com
mynetworks = 127.0.0.0/8
inet_interfaces = all

virtual_transport = lmtp:unix:private/dovecot-lmtp

virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_alias_maps = mysql:/etc/postfix/mysql/virtual_alias_maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql/virtual_domain_maps.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf
  • EDIT: Made the previous question more specific.*

  • UPDATE: I installed roundcube and send the mail through the client and it worked, however, I still cannot get the authentication to work with an external server.

  • UPDATE #2: I found these lines in my log file when trying to connect to the server over SSL at port 587

    warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
    connect from 93.88.82.66
    SSL_accept error from 93.88.82.66: lost connection
    lost connection after STARTTLS from 93.88.82.66
    disconnect from 93.88.82.66
    
  • UPDATE #3: It worked after I restarted postfix and dovecot (not reload)

  • I suggest to ask (2) and (3) as different questions. You will get much more and better answers. – peterh Aug 12 '14 at 7:52
  • Ok can I change this question completely. I have fixed the problem, the '\' were what was causing the problem. – Gasim Aug 12 '14 at 8:20
  • 1
    The problem is that people doesn't really like to give incomplete answers -> only people will answer who know the answer for all of your, totally different questions. In your place I simply deleted (2) and (3) and asked them as different questions. If you do that, you generates more activity on the site as well, which will be rewarded for you: if you have 3 questions, there is 3 times more possibility to upvote you. :-) – peterh Aug 12 '14 at 8:23
  • 1
    Makes sense, I am going to edit this question now :D – Gasim Aug 12 '14 at 8:26
4

I know this is not really answering your question, but:

Don't.

Use your mail client with STARTTLS instead, which, as you say, works fine with your server. It is not a good idea to send credentials over an unencrypted connection.

You don't state the reason why you want to do unencrypted SMTP authentication at all, so I can only guess — if you have a mail client that cannot do STARTTLS (or, alternatively, TLS connect from the beginning, a.k.a. SMTPS, to port 465), you should work on securing the client side, not on weakening your server side.

  • I think the problem is with my postfix not with my client as I because every other STARTTLS based email server works without any problems (even the ones created by postfix). I don't want to lower the security, I just want to make the current security actually work. Please check out the UPDATE #2 in my post – Gasim Aug 12 '14 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.