SMTP authentication with postfix using sasl
Hi I'm trying to get postfix working with smtp authentication using sasl.
I have the following packages installed: cyrus-sasl-saslauthd-2.1.21-18.4 cyrus-sasl-devel-2.1.21-18.4 cyrus-sasl-plain-2.1.21-18.4 cyrus-sasl-2.1.21-18.4 I have recompiled postfix by doing the following: <postfix src dir># make tidy blah blah blah <postfix src dir># make makefiles CCARGS="-DUSE_SASL_AUTH -I/usr/include/sasl" AUXLIBS="-L/usr/lib -lsasl2" (I have checked these are the correct dir's) blah blah blah <postfix src dir># postfix stop <postfix src dir># make install blah blah blah (and all seems okay to this point) I then add the following lines to the /etc/postfix/main.cf file smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination Then I start postfix again and to test, I try telnet the localhost on port 25 so I can run an ehlo command and see if AUTH is there. But, when I do this it just hangs. Soooooooooooo I checked the logs and it can't spawn the smtp daemon (as below): Mar 18 23:30:35 mailserver postfix/smtpd[3680]: warning: unsupported SASL server implementation: cyrus Mar 18 23:30:35 mailserver postfix/smtpd[3680]: fatal: SASL per-process initialization failed Mar 18 23:30:36 mailserver postfix/master[3528]: warning: process /usr/libexec/postfix/smtpd pid 3680 exit status 1 Mar 18 23:30:36 mailserver postfix/master[3528]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling I am having this same problem in both FC6 and Suse Enterprise 10. Any ideas? The CBT I am following for this shows this up and running (with suse) |
You probably need to add -DUSE_CYRUS_SASL as per the SASL readme. What does
Code:
postconf -a |
Thanks Berhanie, you were right... Managed to get SASL running now!
Unfortunately though, I can't get a remote client to authenticate now. After I recompiled postfix and got it working with sasl in the corrent manner, I did the following: # vi /usr/lib/sasl2/smtpd.conf pwcheck_method: saslauthd mech_list: plain login <write + quit> # service saslauthd start Starting... # postfix reload (for good measure) Reloading... # Now again according to the CBT I am using and the postfix documentation, this should just work for plain authentication when somebody tries to relay using smtp. But its not :( When I try authenticate, it doesn't accept my username/password as stated in the /etc/passwd and /etc/shadow files... The logs show the following when I try send an email from remote client using outlook/thunderbird. Mar 20 00:39:46 mailserver postfix/smtpd[14793]: connect from 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123] Mar 20 00:39:46 mailserver postfix/smtpd[14793]: warning: 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123]: SASL LOGIN authentication failed: authentication failure Mar 20 00:39:46 mailserver postfix/smtpd[14793]: lost connection after AUTH from 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123] Mar 20 00:39:46 mailserver postfix/smtpd[14793]: disconnect from 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123] Have I missed a step along the way here? As I said, i am trying to authenticate using the username and password in the /etc/passwd and /etc/shadow files. All the relevant firewall ports are open. I am definetely using the right password :-) |
Also I don't know if this is relevant but when I try send an email using Thunderbird as apposed to Outlook... My log records are slightly different, see below:
Mar 20 16:33:27 mailserver postfix/smtpd[22618]: connect from 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123] Mar 20 16:33:35 mailserver postfix/smtpd[22618]: warning: SASL authentication failure: Password verification failed Mar 20 16:33:35 mailserver postfix/smtpd[22618]: warning: 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123]: SASL PLAIN authentication failed: authentication failure Mar 20 16:33:35 mailserver postfix/smtpd[22618]: warning: 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123]: SASL LOGIN authentication failed: authentication failure I'm obviously doing something blatently wrong here because I've got this exact same problem in FC6 and Suse Enterprise 10. So somebody please... Call me stupid and tell me what I'm doing wrong :-) Guy |
For saslauthd to check the shadow file, it needs to be called with '-a shadow'. On redhat, you can do it with MECH=shadow in /etc/sysconfig/saslauthd. By default, it's MECH=pam, which may end up doing the same thing, depending on your pam config. Also, you can set FLAGS=-d in the same file to turn on debugging.
|
Did you start saslauthd? Certainly on RH systems it runs as a service
|
Berhanie, I've managed to get sasluthd runing with -a shadow.
# ps -ax | grep sasl 29100 pts/2 T 0:00 /bin/sh /sbin/service saslauthd restart 29105 pts/2 Z 0:00 [saslauthd] <defunct> 29113 pts/2 T 0:00 /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/saslauthd -m /var/run/saslauthd -a shadow -d 29114 ? Z 0:00 [saslauthd] <defunct> 29370 pts/2 T 0:00 /bin/sh /sbin/service saslauthd start 29375 pts/2 Z 0:00 [saslauthd] <defunct> 29378 pts/2 T 0:00 /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/saslauthd -m /var/run/saslauthd -a shadow -d 29379 ? Z 0:00 [saslauthd] <defunct> 29463 pts/2 T 0:00 /bin/sh /sbin/service saslauthd stop 29468 pts/2 Z 0:00 [saslauthd] <defunct> 29539 ? Ss 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a shadow 29540 ? S 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a shadow 29541 ? S 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a shadow 29542 ? S 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a shadow 29544 ? S 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a shadow 29552 pts/2 R+ 0:00 grep sasl # I thought this would get it working. But when I try authenticate... It yields the same problem as before. Also, when I add FLAGS=-d to the /etc/sysconfig/saslauthd file, it messes the service up and won't start, restart, stop or anything. |
Quote:
|
Ok, I went through the steps on a CentOS 4 system, which I hope is similar enough to your setup. Here are details.
/etc/sysconfig/saslauthd: Code:
SOCKETDIR=/var/run/saslauthd Code:
... Code:
[machine ~]# testsaslauthd -u berhanie -p bigsecret |
Hi again Berhanie... thanks for spending the time with me on this.
My config files match and my tests yield the following. [root@mailserver ~]# testsaslauthd -u guy -psuperbigsecret 0: NO "authentication failed" [root@mailserver ~]# echo -ne \0guy\0superbigsecret | openssl enc -base64 LKNkad89293d99lsiio1== [root@mailserver ~]# telnet localhost 25 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. 220 mailserver.linux.mydomain.com ESMTP Postfix ehlo localhost 250-mailserver.linux.mydomain.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-AUTH LOGIN PLAIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN AUTH PLAIN LKNkad89293d99lsiio1== 535 5.7.8 Error: authentication failed: bad protocol / cancel When run in -d mode, the original console which I left running didn't do anything when running these tests. Just stayed on the restarting process screen. I also run the test auth tests without -d. |
Woooooohooooo, I've managed to obtain some working'ness. I've managed to get SMTP authentication using sasl to work with my suse installation. All the latest testing/attempts had been done with FC but with suse, the changes work! See below:
Mar 22 01:34:51 mailserver postfix/smtpd[11065]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled Mar 22 01:34:51 mailserver postfix/smtpd[11065]: connect from 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123] Mar 22 01:34:51 mailserver postfix/smtpd[11065]: 61A6CF824D: client=123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123], sasl_method=PLAIN, sasl_username=guy Mar 22 01:34:51 mailserver postfix/cleanup[11069]: 61A6CF824D: message-id=<47E46279.7070208@linux.mydomain.com> Mar 22 01:34:51 mailserver postfix/qmgr[10984]: 61A6CF824D: from=<guy@linux.mydomain.com>, size=592, nrcpt=1 (queue active) Mar 22 01:34:51 mailserver postfix/smtpd[11065]: disconnect from 123-123-123-123.cable.ubr10.blah.ISPprovider.co.uk[123.123.123.123] Mar 22 01:34:51 mailserver postfix/smtp[11070]: 61A6CF824D: to=<guy@myotheremail.com>, relay=smtp.myrelay.co.uk[123.123.456.456]:25, delay=0.14, delays=0.02/0.01/0.08/0.04, dsn=2.0.0, status=sent (250 OK id=1Jcscn-000594-US) Mar 22 01:34:51 mailserver postfix/qmgr[10984]: 61A6CF824D: removed Just thought I'd share some working logs for a change! :-) Now although this works, the following test still fails: mailserver:~ # echo -ne \0guy\0superbigsecret | openssl enc -base64 HGUwijx82djkBLAHf90== mailserver:~ # telnet localhost 25 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 mailserver.linux.mydomain.com ESMTP Postfix ehlo localhost 250-mailserver.linux.mydomain.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN AUTH PLAIN HGUwijx82djkBLAHf90== 535 5.7.8 Error: authentication failed: bad protocol / cancel But, the other one works... mailserver:~ # testsaslauthd -u guy -psuperbigsecret 0: OK "Success." Strange huh? What's even stranger is this exact same setup doesn't work in FC6 :-( Anyway, thank you for your help Berhanie - couldn't have got this working on my own!!! |
You need to use quotes around the user/password string:
Code:
echo -ne '\0guy\0superbigsecret' |
Yey! Well spotted Berhanie, that test works now also :-)
Any ideas why this isn't working in FC6? Shall I just conclude that its an imcompatiability? |
Quote:
By the way, why did you have to compile postfix? Isn't the Fedora rpm already compiled against the cyrus libraries? |
I didn't use a postfix RPM as I wanted to demonstrate it being installed from source for the purposes of my university of project. Thus, I had to recompile to allow the use of Cyrus SASL.
|
All times are GMT -5. The time now is 04:16 AM. |