0

I'm currently trying working on a project to update an existing postfix deployment. I'm having issues with authenticating users against smtp.

The primary issue I have is that our postfix users database is fully qualified (email@domain.com). However when attempting to authenticate with AUTH PLAIN, the @ symbol and everything up to the . is truncated. If I test a user account with testsaslauth, I get a successful result.

The second issue I have is actually understanding which where the saslauth and pam services are using their respective mysql configurations. I've read a number of articles on how to set this up, but I'm not clear if I need one, the other, or both of these configurations.

Below is all of the relevant configuration/logging I can immediately think to post (Note: system, domain, and user names have been sanitized):

OS Version:

mose@postfix ~ $ cat /etc/redhat-release 
CentOS Linux release 7.4.1708 (Core)

Postfix Version:

mose@postfix ~ $ postconf -v | grep 'mail_version = '
postconf: $smtpd_tls_security_level in main.cf validates smtpd_tls_security_level=value in master.cf:submission.inet
mail_version = 2.10.1

Successful test of credentials from cli:

mose@postfix ~ $ testsaslauthd -u mose@example.com -p password -s smtp
0: OK "Success."

Failed authentication via telnet:

mose@postfix ~ $ openssl s_client -starttls smtp -crlf -connect postfix.example.com:587
<SSL Output truncated for brevity>
EHLO example.com
250-postfix.example.com
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-AUTH PLAIN LOGIN CRAM-MD5 DIGEST-MD5
250-AUTH=PLAIN LOGIN CRAM-MD5 DIGEST-MD5
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
AUTH PLAIN bW9zZS5jb20AbW9zZS5jb20AcGFzc3dvcmQ=
535 5.7.8 Error: authentication failed: authentication failure

Logging, note that I am passing my username as mose@example.com, however the mysql lookup shows it as 'mose.com@example.com':

mose@postfix ~ $ sudo tail /var/log/secure
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option verbose is set to "1"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.host is set to "localhost"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.database is set to "postfix"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.db_user is set to "mysql"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.db_passwd is set to "password"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.password_crypt is set to "1"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.table is set to "mailboxes"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.where_clause is set to "status = 1"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.user_column is set to "login"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - option users.password_column is set to "password"
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_sm_authenticate() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_open_db() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_open_db() returning 0.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_check_passwd() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_format_string() called
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_quick_escape() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - SELECT password FROM mailboxes WHERE login = 'mose.com@example.com' AND (status = 1)
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - SELECT returned no result.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_check_passwd() returning 1.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_sql_log() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_sql_log() returning 0.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_converse() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_open_db() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_check_passwd() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_format_string() called
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_quick_escape() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - SELECT password FROM mailboxes WHERE login = 'mose.com@example.com' AND (status = 1)
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - SELECT returned no result.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_check_passwd() returning 1.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_sql_log() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_sql_log() returning 0.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_sm_authenticate() returning 10.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_release_ctx() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_destroy_ctx() called.
Jan 16 17:53:42 postfix saslauthd[7437]: pam_mysql - pam_mysql_close_db() called.

SASLAuthD is configured to use PAM:

mose@postfix ~ $ sudo grep -v \# /etc/sysconfig/saslauthd
SOCKETDIR=/run/saslauthd
MECH=pam
FLAGS="-r"

SMTPD is configured to use MySQL plugin:

mose@postfix ~ $ ll /etc/postfix/sasl/smtpd.conf
lrwxrwxrwx 1 root root 21 Jan 11 17:24 /etc/postfix/sasl/smtpd.conf -> /etc/sasl2/smtpd.conf

mose@postfix ~ $ sudo cat /etc/sasl2/smtpd.conf
pwcheck_method: saslauthd
mech_list: plain login cram-md5 digest-md5
allow_plaintext: true
auxprop_plugin: sql
sql_engine: mysql
sql_hostnames: localhost
sql_user: mysql 
sql_passwd: password 
sql_database: postfix
sql_verbose: yes
sql_select: select password from mailboxes where login = '%u@%r' and status='1'
sql_usessl: no
log_level: 3

PAM is configured to use MySQL:

mose@postfix ~ $ sudo cat /etc/pam.d/smtp
#%PAM-1.0
auth       required     pam_nologin.so
auth       sufficient   pam_mysql.so config_file=/etc/postfix/mysql/pam.conf
account    sufficient   pam_mysql.so config_file=/etc/postfix/mysql/pam.conf
password   required     pam_deny.so

mose@postfix ~ $ sudo cat /etc/postfix/mysql/pam.conf
verbose = 1;
users.host = localhost;
users.database = postfix;
users.db_user = mysql;
users.db_passwd = password;
users.password_crypt = 1;
users.table = postfix_mailboxes;
users.where_clause = status = 1;
users.user_column = login;
users.password_column = password;

Full postfix config dump:

mose@postfix ~ $ sudo postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
disable_vrfy_command = yes
html_directory = no
inet_interfaces = $myhostname, localhost, 10.100.0.11
inet_protocols = ipv4
local_recipient_maps =
mail_owner = postfix
mailbox_command = procmail -a "$EXTENSION"
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination =
mydomain = example.com
myhostname = postfix.example.com
mynetworks = 127.0.0.0/8, 10.100.0.0/24
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen/access.cidr
postscreen_bare_newline_action = enforce
postscreen_bare_newline_enable = no
postscreen_blacklist_action = drop
postscreen_dnsbl_action = enforce
postscreen_dnsbl_reply_map = pcre:$config_directory/postscreen_dnsbl_reply_map.pcre
postscreen_dnsbl_sites = zen.spamhaus.org*3 b.barracudacentral.org*2 bl.spameatingmonkey.net*2 bl.spamcop.net dnsbl.sorbs.net psbl.surriel.com bl.mailspike.net
postscreen_dnsbl_threshold = 3
postscreen_greet_action = enforce
postscreen_greet_banner = $myhostname [POSTSCREEN] ESMTP $mail_name
postscreen_non_smtp_command_enable = no
postscreen_pipelining_enable = no
postscreen_whitelist_interfaces = static:all
proxy_read_maps = $virtual_mailbox_maps $virtual_alias_maps $virtual_mailbox_domains #$transport_maps
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
relay_domains =
relayhost =
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_helo_timeout = 5
smtp_host_lookup = native
smtp_sasl_auth_enable = yes
smtpd_banner = $myhostname [SMTPD] ESMTP $mail_name
smtpd_delay_reject = no
smtpd_error_sleep_time = 30
smtpd_hard_error_limit = 20
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = cyrus
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_soft_error_limit = 10
smtpd_tls_CAfile = /etc/postfix/gd_bundle-g2-g1.crt
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
smtpd_tls_session_cache_timeout = 10800s
strict_rfc821_envelopes = yes
tls_random_exchange_name = /var/lib/postfix/prng_exch
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql/autoreply.cf, proxy:mysql:/etc/postfix/mysql/aliases.cf, proxy:mysql:/etc/postfix/mysql/groups.cf
virtual_gid_maps = static:101
virtual_mailbox_base = /
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql/domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql/mailboxes.cf
virtual_minimum_uid = 110532
virtual_uid_maps = static:110532

I can see where I can define the user format in the SASLAuth mysql settings(%u@%r), but I haven't seen any docs on pam_mysql that support the same.

Any help is appreciated.

Edit: I stumbled across someone who had a similar issue, after making the changes he recommended, however the username is still not coming in properly...

pam_mysql documentation

I also checked my settings against this article, the only difference I can see is that the pam_mysql I have is from the following repo: http://repo.iotti.biz/CentOS/$releasever

mose@postfix ~ $ sudo yum info pam_mysql --enablerepo=lux
Loaded plugins: fastestmirror, langpacks, product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
Loading mirror speeds from cached hostfile
 * base: mirrors.lga7.us.voxel.net
 * extras: mirror.cs.pitt.edu
 * updates: mirror.cogentco.com
Installed Packages
Name        : pam_mysql
Arch        : x86_64
Epoch       : 1
Version     : 0.8.1
Release     : 0.22.el7.lux
Size        : 96 k
Repo        : installed
From repo   : lux
Summary     : PAM module for auth UNIX users using MySQL data base
URL         : http://sf.net/projects/pam-mysql/
License     : GPLv2+
Description : Pam_mysql aims to provide a backend neutral means of authenticating
            : users against an MySQL database.
  • I'm using postfix with mysql-backed virtual users - the authentication is handled by dovecot querying the db, and postfix's smtpd_sasl_type is set to =dovecot in both main.cf and master.cf. Dovecot has a mysql extension config, which runs the following - default_pass_scheme = SHA256-CRYPT password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; to determine if a user is authenticated. – ivanivan Jan 16 '18 at 22:26
0

I added "-r -c" to flags. Also found that the @ symbol was not being escaped properly while testing. Everything is working as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.