0

I'm moving a mail server from one CentOS 6 to another. I use sendmail with sasl pam authentication. When I try to send mail it fails because the user is not authenticated and the mail client does not require password. All the configurations files are the same on both new and old servers. I tested this with telnet (new server):

# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 new.mldb.org ESMTP Sendmail 8.14.4/8.14.4; Wed, 4 Feb 2015 14:05:18 +0100
ehlo localhost
250-new.mldb.org Hello localhost.localdomain [127.0.0.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-STARTTLS
250-DELIVERBY
250 HELP

old server:

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mldb.org ESMTP Sendmail 8.14.4/8.14.4; Wed, 4 Feb 2015 16:07:23 +0200
ehlo localhost
250-mldb.org Hello localhost [127.0.0.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH LOGIN PLAIN
250-STARTTLS
250-DELIVERBY
250 HELP

this line 250-AUTH LOGIN PLAIN is missing on the new server.

Here are parts of sendmail config:

define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl
define(`confSERVER_CERT', `/etc/pki/tls/certs/sendmail.pem')dnl
define(`confSERVER_KEY', `/etc/pki/tls/certs/sendmail.pem')dnl
FEATURE(`access_db', `hash -T<TMPF> -o /etc/mail/access.db')dnl
DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA')dnl
DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl

I tested sasl using this command

# testsaslauthd -s smtp -u <user> -p <password>
0: OK "Success."

other files that I've checked:

# cat /etc/sasl2/Sendmail.conf
pwcheck_method:saslauthd
saslauthd_path:/var/run/saslauthd
mech_list: LOGIN PLAIN

# cat /etc/pam.d/smtp
#%PAM-1.0
auth       include      password-auth
account    include      password-auth

# cat /etc/sysconfig/saslauthd
SOCKETDIR=/var/run/saslauthd
MECH=pam
FLAGS=

when I try to send a mail I get this in log:

# tail /var/log/maillog
Feb  4 15:17:38 new sendmail[12070]: STARTTLS=server, relay=*******.spectrumnet.bg [****], version=TLSv1/SSLv3, verify=NO, cipher=DHE-RSA-AES256-SHA, bits=256/256
Feb  4 15:17:38 new sendmail[12070]: t14EHba9012070: ruleset=check_rcpt, arg1=<****@mail.bg>, relay=*****.spectrumnet.bg [**********], reject=550 5.7.1 <****@mail.bg>... Relaying denied. Proper authentication required.
Feb  4 15:17:40 new sendmail[12070]: t14EHba9012070: from=<*****@*****.eu>, size=422, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=*******.spectrumnet.bg [******]

after I change anything /etc/mail I run "make"

What should be the reason sendmail not to offer auth?

UPDATE

The main reason that sendmail did not require auth was that I didn't have this packet installed: cyrus-sasl-plain

I installed it and now the mail client asks for password, but password always fails.

More from configurations: # grep TrustAuthMech sendmail.cf C{TrustAuthMech}EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN R$* $| $={TrustAuthMech} $# RELAY # grep AuthMechanisms sendmail.cf O AuthMechanisms=EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN

  • I had this problem and installing cyrus-sasl-plain fixed it for me. Thanks for the tip! Auth works for me now. Unless you specifically need those other auth mechanisms, try removing EXTERNAL DIGEST-MD5 CRAM-MD5 and leave only LOGIN PLAIN. If your connection is TLS then PLAIN should be sufficient. – IanB Feb 11 '16 at 5:38
1

Your sendmail.mc looks ok. Apart from stopping and starting sendmail again (which I would guess you have already done). I would look at the actual configuration file which would be called sendmail.cf.

Make sure you see the lines:

C{TrustAuthMech}DIGEST-MD5 CRAM-MD5 LOGIN PLAIN

and

# list of authentication mechanisms
O AuthMechanisms=DIGEST-MD5 CRAM-MD5 LOGIN PLAIN

If LOGIN PLAIN is not there then your 'make' is not generating the .cf file from the .mc file.

  • yes, I do restart sendmail everytime. see the question for sendmail.cf contents. – NickSoft Feb 4 '15 at 14:49
1

Well it seams that the only problem was that I didn't have package cyrus-sasl-plain installed on the new server. After restarting all services (saslauthd and sendmail) and also the mail client sending and authenticating worked fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.