postfix SSL - SASL LOGIN authentication failed: generic failure

grambldouch · 09-26-2012, 06:32 AM

Hello, i have installed postfix with sasl authentication and i have this problem,
when i setup connection on port 25 with STARTTLS, everything is ok

Code:

Sep 26 13:50:49 mail postfix/smtpd[10594]: connect from unknown[x.x.x.x]
Sep 26 13:50:49 mail postfix/smtpd[10594]: setting up TLS connection from unknown[x.x.x.x]
Sep 26 13:50:49 mail postfix/smtpd[10594]: Anonymous TLS connection established from unknown[x.x.x.x]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Sep 26 13:50:49 mail postfix/smtpd[10594]: 763C460C11: client=unknown[x.x.x.x], sasl_method=PLAIN, sasl_username=test

but when i setup connection on port 465 with SSL/TLS i got this error message

Code:

Sep 26 13:39:57 mail postfix/smtpd[11102]: connect from unknown[x.x.x.x]
Sep 26 13:39:57 mail postfix/smtpd[11102]: setting up TLS connection from unknown[x.x.x.x]
Sep 26 13:39:57 mail postfix/smtpd[11102]: Anonymous TLS connection established from unknown[x.x.x.x]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Sep 26 13:39:58 mail postfix/smtpd[11102]: warning: SASL authentication failure: cannot connect to saslauthd server: No such file or directory
Sep 26 13:39:58 mail postfix/smtpd[11102]: warning: SASL authentication failure: Password verification failed
Sep 26 13:39:58 mail postfix/smtpd[11102]: warning: unknown[x.x.x.x]: SASL PLAIN authentication failed: generic failure
Sep 26 13:39:58 mail postfix/smtpd[11102]: warning: SASL authentication failure: cannot connect to saslauthd server: No such file or directory
Sep 26 13:39:58 mail postfix/smtpd[11102]: warning: unknown[x.x.x.x]: SASL LOGIN authentication failed: generic failure

mail.cf

Code:

smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_tls_key_file = /etc/postfix/tls/smtpd.key
smtpd_tls_cert_file = /etc/postfix/tls/smtpd.crt
smtpd_tls_CAfile = /etc/postfix/tls/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = mail.domain.com
broken_sasl_auth_clients = yes

postfix/sasl/smtpd.conf

Code:

log_level: 3
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

saslauthd.conf

Code:

START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="pam"
MECH_OPTIONS=""
THREADS=5
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"

pam.d/smtp.conf

Code:

auth    sufficient      /lib64/security/pam_mysql.so user=postfix passwd=password host=127.0.0.1 db=postfix table=postfix_users usercolumn=email passwdcolumn=crypt crypt=1 md5=1 verbose=false
auth    required        /lib64/security/pam_mysql.so

account sufficient      /lib64/security/pam_mysql.so user=postfix passwd=password host=127.0.0.1 db=postfix table=postfix_users usercolumn=email passwdcolumn=crypt crypt=1 md5=1 verbose=false
account required        /lib64/security/pam_mysql.so

modonnell · 03-21-2014, 08:50 AM

Authentication to Verizon/FiOS on port 465 requires SSL (apparently not present in Postfix) and is possible via stunnel. Install and configure stunnel to answer on some local port. My config file:

Code:

[smtp-tls-wrapper]
accept  = 11125
client  = yes
connect = smtp.verizon.net:465

...and then rig Postfix to connect to Verizon/FiOS via that SSL tunnel instead of directly:

Code:

relayhost=[127.0.0.1]:11125

I'll note that although this works for me I do see random authentication failures from time to time such that mailq shows stuck messages requiring that I say "postqueue -f" to retry delivery attempts for those messages, which seem always to succeed, so I don't know what the problem is... >-/

--Michael O'Donnell