zimbra saslauthd not working/zimbra smtp authenticaion using zimbra ldap not working

SarahGurung · 10-26-2015, 05:23 AM

Hello,
I recently installed zimbra Release 8.6.0_GA_1153.RHEL7_64_20141215151110 RHEL7_64 on Centos 7. Its multiple installation environment where zimbra ldap is installed on different server and zimbra mta on another. As of now we aren't using the zimbra mail store. And i have connected our current mail store with the zimbra ldap. That seem to be working perfectly fine. Zimbra smtp is working perfectly fine with tls on both port 25 and 587 without nay authentication. But the moment i put on the authentication it doesnt work. Zimbra ldap isn't authenticating the users. Error:

Code:

auth_zimbra: not initialized saslauthd[22140]: do_auth : 
auth failure: [user=test@mydomain.com] [service=smtp] 
[realm=mydomain.com] [mech=zimbra] [reason=auth_zimbra not initiailzed]

I strongly feel the issue is with the Zimbra MTA configuration. Do i need to change anything in zimbra saslauthd.conf.in file and what should be the zimbra_url?

TB0ne · 10-26-2015, 07:46 AM

Quote:

Originally Posted by SarahGurung

Hello,
I recently installed zimbra Release 8.6.0_GA_1153.RHEL7_64_20141215151110 RHEL7_64 on Centos 7. Its multiple installation environment where zimbra ldap is installed on different server and zimbra mta on another. As of now we aren't using the zimbra mail store. And i have connected our current mail store with the zimbra ldap. That seem to be working perfectly fine. Zimbra smtp is working perfectly fine with tls on both port 25 and 587 without nay authentication. But the moment i put on the authentication it doesnt work. Zimbra ldap isn't authenticating the users. Error:

Code:

auth_zimbra: not initialized saslauthd[22140]: do_auth : 
auth failure: [user=test@mydomain.com] [service=smtp] 
[realm=mydomain.com] [mech=zimbra] [reason=auth_zimbra not initiailzed]

I strongly feel the issue is with the Zimbra MTA configuration. Do i need to change anything in zimbra saslauthd.conf.in file and what should be the zimbra_url?

Then if you 'strongly feel' that way, why didn't you check the zimbra documentation for such things?
https://wiki.zimbra.com/wiki/Outgoin...Authentication
https://wiki.zimbra.com/wiki/SMTP_Auth_Problems

Especially after being here for four years, and asking similar questions in the past:
http://www.linuxquestions.org/questi...ls-4175551218/
http://www.linuxquestions.org/questi...ap-4175504681/
http://www.linuxquestions.org/questi...se-4175506977/

SarahGurung · 10-26-2015, 10:26 AM

Hello,

Thank You for your resposne.. Don't know if your were being nice r rude. Thank You anyway.

Well i know i have done that before and is still running but the scenario is different. Previously it as openldap and postfix. This time it's zimbra ldap with zimbra mta.

And about the link that yu gave, i have tried all of that but none seems to be working and about the MtaAuthHost that is mentioned in the link, it doesn't work with zimbra 8.6.0. That has been improved.i Tried that too Would be glad if you could help me more on this.I tried all the links and when i couldn't fin any solution i asked here thinking someone find be having some idea but you were sort of rude..haha.

Thank You.Hope i get a solution..

TB0ne · 10-26-2015, 11:05 AM

Quote:

Originally Posted by SarahGurung

Hello,
Thank You for your resposne.. Don't know if your were being nice r rude. Thank You anyway.

Well i know i have done that before and is still running but the scenario is different. Previously it as openldap and postfix. This time it's zimbra ldap with zimbra mta.

...which makes little difference, since it's still LDAP with an MTA.

Quote:

And about the link that yu gave, i have tried all of that but none seems to be working and about the MtaAuthHost that is mentioned in the link, it doesn't work with zimbra 8.6.0. That has been improved.i Tried that too Would be glad if you could help me more on this.I tried all the links and when i couldn't fin any solution i asked here thinking someone find be having some idea but you were sort of rude..haha.

Thank You.Hope i get a solution..

Read the LQ Rules..you need to spell your words out. And saying "none seems to be working", tells us absolutely nothing about what, exactly, you did, and what the results were. Unless you provide actual details/errors/etc., there is nothing we can do to help you. If you feel that people are 'rude' when they point out you've not shown much effort of your own, and don't provide details, that's too bad. Based on your posting history, and after being here for four years, you should know how to ask a question.

Again, putting "LDAP" into the search box on the Zimbra forums pulls up lots:
https://wiki.zimbra.com/wiki/LDAP

There is even an entire section on dealing with LDAP and SSL.

SarahGurung · 10-26-2015, 11:37 AM

Sorry about it...Have stuck here for weeks that's why.

Well i went through the links you have sent and found this link: https://wiki.zimbra.com/wiki/SMTP_Auth_Problems useful one. I followed the instructions there but still my zimbra smtp authentication int working. Well like i said before, i have done multi-node installation were zimbra mta and zimbra ldap(for authentication) are on different servers.

Smtp works without the authentication but with authentication it doesn't. When i followed the link you gave i got the following error:

Code:

localhost saslauthd[14223]: url 'https://mydomain.com:0/service/soap/' will not be used for (at least) 600 seconds
localhost saslauthd[14223]: Authentication cycle re-elected url https://mydomain.com:0/service/soap/, giving up ...
localhost saslauthd[14223]: auth_zimbra: test@mydomain.com auth failed: curl_easy_perform: error(7): Failed to connect to mydomain.com port 0: Connection refused
localhost saslauthd[14223]: do_auth: auth failure: [user=test@mydomain.com] [service=smtp] [realm=mydomain.com] [mech=zimbra] [reason=Unknown]
Oct 26 22:16:55 localhost postfix/submission/smtpd[14995]: warning: SASL authentication failure: Password verification failed

Output of zmprov getServer mydomain.com | grep Auth

this is the zimbra mta server)

Code:

zimbraAuthTokenNotificationInterval: 60000
zimbraLowestSupportedAuthVersion: 2
zimbraMtaAuthEnabled: TRUE
zimbraMtaAuthHost: mydomain.com
zimbraMtaAuthTarget: FALSE
zimbraMtaAuthURL: https://mydomain.com:0/service/soap/
zimbraMtaBrokenSaslAuthClients: yes
zimbraMtaSaslAuthEnable: yes
zimbraMtaSmtpSaslAuthEnable: no
zimbraMtaSmtpdSaslAuthenticatedHeader: no
zimbraMtaTlsAuthOnly: TRUE
zimbraShareNotificationMtaAuthRequired: FALSE

If there is anything more that you want me to post, please let me know. My saslauthd.conf.in file in /opt/zimbra/conf/ contains the following:

Code:

zimbra_url: https://mydomain.com:443/service/soap/
zimbra_cert_file: /opt/zimbra/conf/smtpd.crt
zimbra_cert_check: off

and smtpd.conf file contains:

Code:

#
# This is conf/sasl2/smtpd.conf
#
log_level: 3
pwcheck_method: saslauthd
mech_list: LOGIN PLAIN
#saslauthd_path: /opt/zimbra/cyrus-sasl/state/mux

Thank You.

TB0ne · 10-26-2015, 12:08 PM

Quote:

Originally Posted by SarahGurung

Sorry about it...Have stuck here for weeks that's why.

With so much information easily available, I don't see how anyone could be stuck for weeks.

Quote:

Well i went through the links you have sent and found this link: https://wiki.zimbra.com/wiki/SMTP_Auth_Problems useful one. I followed the instructions there but still my zimbra smtp authentication int working. Well like i said before, i have done multi-node installation were zimbra mta and zimbra ldap(for authentication) are on different servers.

..which doesn't matter at all.

Quote:

Smtp works without the authentication but with authentication it doesn't. When i followed the link you gave i got the following error:

Code:

localhost saslauthd[14223]: url 'https://mydomain.com:0/service/soap/' will not be used for (at least) 600 seconds
localhost saslauthd[14223]: Authentication cycle re-elected url https://mydomain.com:0/service/soap/, giving up ...
localhost saslauthd[14223]: auth_zimbra: test@mydomain.com auth failed: curl_easy_perform: error(7): Failed to connect to mydomain.com port 0: Connection refused
localhost saslauthd[14223]: do_auth: auth failure: [user=test@mydomain.com] [service=smtp] [realm=mydomain.com] [mech=zimbra] [reason=Unknown]
Oct 26 22:16:55 localhost postfix/submission/smtpd[14995]: warning: SASL authentication failure: Password verification failed

Did you read the error?? First, it says it's connecting to port 0, which is wrong. Secondly, have you just tried to put that URL into a web browser, and see if it works? Firewalls/iptables blocking things?? These are basic troubleshooting steps, which you don't indicate that you've tried in the 'weeks' you've been working on this.

Quote:

Output of zmprov getServer mydomain.com | grep Auth

this is the zimbra mta server)
If there is anything more that you want me to post, please let me know. My saslauthd.conf.in file in /opt/zimbra/conf/ contains the following:

Again, you don't appear to be doing much research.

The complete docs for the saslauthd.conf file are:
https://wiki.zimbra.com/wiki/Authent...lauthd.conf.in

This very question asked(and answered) on the Zimbra forum:
https://community.zimbra.com/collabo...1886/t/1138739

You also appear to have some sasl options set to "NO" in your config.

SarahGurung · 10-26-2015, 10:24 PM

Hello,

I know it's simple ut somehow things aren't working on my end. i have already gone through the link that you have sent and tried too bt still the same error. And yes i have those ports open in the iptables. And ya i the port is zero there because when i gave MtaAuthHost as per ur previous link, the url was created automaticlaly and i am required to put that url in the saslauthd.conf.in fine in zimbra_url file.

Do i need to change the port then? i tried changing it to 443 also still same problem and ya it doesn't open in browser either.

Thanks for your time.

TB0ne · 10-27-2015, 07:35 AM

Quote:

Originally Posted by SarahGurung

Hello,

I know it's simple ut somehow things aren't working on my end. i have already gone through the link that you have sent and tried too bt still the same error. And yes i have those ports open in the iptables. And ya i the port is zero there because when i gave MtaAuthHost as per ur previous link, the url was created automaticlaly and i am required to put that url in the saslauthd.conf.in fine in zimbra_url file.

Do i need to change the port then? i tried changing it to 443 also still same problem and ya it doesn't open in browser either.

AGAIN, you need to SPELL OUT YOUR WORDS...again, read the LQ rules about text speak, and not using it.

You need to change the port, and you need to follow the instructions on the site. Doesn't get much simpler.

SarahGurung · 10-27-2015, 10:12 AM

Hello,

Sorry about the texts. I did not re check the post so did not realize about the mistake.

And yes i did try changing port to a different one like the one in the link but still got the same error. Moreover url in the zimbra_url(in saslauthd.conf.in file) can be changed but the url in zimbraMtaAuthUrl is a auto generated one so i cannot change on that part.