Hot answers tagged

33

You can have saslauthd installed but not have any mechanisms installed. It's quite frustrating and poor error-proofing, IMO. "no applicable SASL mechanisms" literally means it can't find any of its mechanisms. On a Fedora-based system you'd need to install the cyrus-sasl-plain package if you want to use the 'PLAIN' auth mechanisms (i.e. SMTP/STARTTLS). ...


27

Running sudo yum install cyrus-sasl cyrus-sasl-lib cyrus-sasl-plain helped me on Amazon AWS server.


15

Postfix currently supports only two SASL authentication methods. One of the is Dovecot, which you don't want. The other is Cyrus, which is about as close to what you want as it's possible to get without rewriting Postfix. It does involve running a separate authentication daemon (saslauthd), but the authentication file is easy to edit and update. The basics ...


9

I was able to prevent this by setting up SSL and requiring auth attempts over SSL only with smtpd_tls_auth_only = yes This doesn't present the AUTH option to the remote client after EHLO and so the spammers/hackers give up because establishing a SSL connection is too much time. They work a numbers game. Now instead it hangs up when they try AUTH and I get ...


9

As you can see, there's no smtpd_sasl_path in our output of postconf -n Why? The answer is easy. Because there's no smtpd_sasl_path set. Have a look at your first snippet: There's a typo in it. You wrote smptd_sasl_path = private/auth -- but there's a difference between smtpd and smptd. Because Postfix doesn't have informations where to find the socket, ...


8

Are you perhaps missing the symlink from /var/run/saslauthd to /var/spool/postfix/var/run/saslauthd? From my working system: root@mail:/etc/postfix/sasl# ls -la /var/run/saslauthd lrwxrwxrwx 1 root root 36 Dec 31 2010 /var/run/saslauthd -> /var/spool/postfix/var/run/saslauthd


8

If you have fail2ban installed you can enable sasl (or sometimes called postfix-sasl) in your jail.local (or jail.d) and that should make the annoyances go away. ## for me this is in /etc/fail2ban/jail.d/defaults-debian.conf [postfix] enabled = true [postfix-sasl] enabled = true


8

You probably just need to add -r to your saslauthd OPTIONS= stanza. From the man pages -r Combine the realm with the login (with an ’@’ sign in between). e.g. login: "foo" realm: "bar" will get passed as login: "foo@bar". Note that the realm will still be passed, which may lead to unexpected behavior.


8

postconf -a and postconf -A tell you what sasl plugin types are available. I would assume those would return errors or empty lists if sasl support was not enabled at build time (though possibly not). You could also check the output of ldd /path/to/postfix and see if it links to a sasl library or not (though it might be possible for postfix to be built with ...


7

Your server is not an open relay. It is set up to allow three different types of mail: Mail from anybody on the internet to addresses within your own domain Mail that originates on your own mailserver (e.g. notices from cron jobs and the like), to anybody on the internet Mail that comes from an authenticated connection to anybody on the internet If the ...


6

There are at least two ways of finding the user name(s) being tried. Logging SMTP transactions with Postfix If you know which host(s) your strange connections are coming from, you can enable verbose debugging for them by specifying a debug_peer_list in /etc/postfix/main.cf: debug_peer_list = 192.0.2.1 This will yield, among other things, a message like ...


6

the solution was very simple, the SASL daemon was down. /etc/init.d/saslauthd start Some hacker managed to shut it down again and again so eventually I had closed it completely.


6

This feature was available to postfix version 2.11. You can use check_sasl_access parameter to enforce restrictions based on SASL username. Of course you need to put it above permit_sasl_authenticated. Please refer to man 5 postconf for complete documentation. Example configuration, taken from Postfix SASL Howto # main.cf smtpd_relay_restrictions = .....


6

In case you couldn't solve this error yet, my setup is 99% similar to yours except it uses Ubuntu, and I had all configured as per it but just pointing to GMAIL SMTP endpoint. Do take a look at this thread --> https://www.howtoforge.com/community/threads/solved-problem-with-outgoing-mail-from-server.53920/ It turned out to be a missing library in my ...


5

Looks like postfix always looks in the chroot'ed location for saslauthd even though its configured to NOT use the chroot environment for its services. I found this blog post most helpful, even though it's from 2005! http://www.jimmy.co.at/weblog/?p=52 postfix does a chroot so it can’t communicate with saslauthd. This is the tricky part: rm -r /var/...


5

chroot is defnitely the reason, however for my case, copying to /var/spool/postfix/etc did not work. So I just got rid of chroot and that works for me. n order to do that you will need to edit /etc/postfix/master.cf locate the following line: smtp inet n - - - - smtpd and modify it as follows: smtp inet n -...


5

(New user, can't post comment reply to sebix. Also removed all links.) For modern installations (such as Ubuntu 16.04) that use Postfix as an SMTP client with SASL-auth to a remote server (e.g. like shown on the Debian wiki), it might indeed be needed to specify smtp_sasl_security_options = noanonymous What this does, however, is remove the noplaintext ...


5

buggy for configuring virtual mailboxes with Maildir protocol I'm using Dovecot LMTP for delivery to Maildir boxes and don't have any problems. I'd like to provide SMTP authentication access introducing SASL with dovecot as IMAP server The easier way is to authenticate SMTP users through Dovecot, so you don't need to configure SASL authentication in ...


5

For enable SASL when receiving email via smtpd, you need to put this parameter smtpd_sasl_auth_enable = yes For enable SASL when sending email via smtp, you need to put this parameter smtp_sasl_auth_enable = yes In your postconf output above, you only put smtp_sasl_auth_enable not smtpd_sasl_auth_enable. That's why postfix complain with error Error: ...


5

My recipe is for OpenLDAP to check directly /etc/sasldb2. First step: ensure the /etc/sasldb2 is owned by slapd user. Next step: have slapd not to look for credentials in directory tree, which is done as following: dn: cn=config changetype: modify replace: olcSaslAuxprops olcSaslAuxprops: sasldb Later, you will also need a olcAuthzRegexp rule, but in ...


4

this solved it for me (on centos 7 not default, was OK on older Centos versions) yum install cyrus-sasl{,-plain} service postfix restart


4

Had the same problems like above only on debian squeeze after a dist-upgrade. After hours of config, restart and reinstalling madness I gave following "svn.conf" a try: pwcheck_method: saslauthd #auxprop_plugin: ldap mech_list: plain login cram-md5 digest-md5 IMO, "mech_list: plain" should be enough. the other mechs are overlefts from previous tryouts. ...


4

Another way to synchronize the sasldb2 file to postfix's default chroot jail is to add a hard link to it: ln /etc/sasldb2 /var/spool/postfix/etc/ Note that a symlink wont work because symlinks cant be accessed from inside the jail but hard links can. This has the advantage over simply copying the file because future new users and password changes will be ...


4

in master.cf I uncomment smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING on iptables allow port 465 and now is function Postfix over SSL is not using port 25?


4

In the end I was not able to get saslauthd to output any better debug information, but in case it helps anyone else here is the process I followed to resolve my problem. First I started saslauthd with strace, like this: # strace -f saslauthd -d -a ldap I could then see all the system calls being made by saslauthd. It looked as though it was failing during ...


4

It's clear to me that the password from mail@xxxxxx.tld has been stolen and someone authenticated on your postfix using this account and password. You could limit the number of messages sent from an user using the anvil process from postfix, as example: smtpd_client_message_rate_limit=100 With this option in main.cf you can limit 100 messages/per client ...


4

Tell saslauthd to create its socket within postfix' chroot jail via its -m option, e.g. -m /var/spool/postfix/var/run/saslauthd. On my Ubuntu i appended this line to /etc/default/saslauthd: OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd" and then i did service saslauthd stop mkdir -p /var/spool/postfix/var/run mv /var/run/saslauthd /var/spool/...


4

Without access to the running config, you'll have to stop slapd and edit the configuration offline. stop slapd: service slapd stop dump the config database to a text file: slapcat -F /etc/ldap/slapd.d -b cn=config -l config.ldif move the existing config database out of the way: mv /etc/ldap/slapd.d{,.old} make a new, empty config database: mkdir /etc/ldap/...


4

I brought someone in and, after a bit of examination and testing, we added smtp_sasl_mechanism_filter = login to main.cf. That cleared it up. He explained it forces postfix to do the AUTH LOGIN (that I was doing manually while testing through telnet). smtp_sasl_mechanism_filter doc I watched with tail -F /var/log/mail.log and the emails were going out. ...


4

...I eventually figured out that the file ownership and permissions details have changed. And, I made a small error in the configuration files, too. As many software packages do, the new scheme installs with examples that include many comments and commented out lines that prompt you to get the configuration you want. However, there was no line like this in ...


Only top voted, non community-wiki answers of a minimum length are eligible