Re: sasl fails

From: Alexander Dalloz (ad+lists_at_uni-x.org)
Date: 08/24/05

Next message: Lovell McIlwain: "Re: unable to uninstall wine rpm"

Previous message: Mjumbe Poe: "Re: yum libraries error"
In reply to: Anne Ramey: "sasl fails"
Next in thread: Anne Ramey: "Re: sasl fails"
Reply: Anne Ramey: "Re: sasl fails"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

To: For users of Fedora Core releases <fedora-list@redhat.com>
Date: Wed, 24 Aug 2005 22:05:55 +0200

Am Mi, den 24.08.2005 schrieb Anne Ramey um 20:40:

> I just cannot seem to get my smtp auth working. I've read, and re-read
> the sasl_readme with no luck...I've followed those instructions. It
> appears that sasl is trying to use sasldb2 (which it's not supposed to,
> I'm trying to use pam). I'm running on fedora core 3. Someone on the
> postfix list replied and said I can't use pwcheck_method: saslauthd on
> FC3...is that true? I need to use pam/my passwd/shadow info for smtp
> auth, so if that is true, what is the work around? Many thanks.

It isn't true. Of course you can use saslauthd.

> [root@hedwig readme]# ps aux|grep sasl
> root 29058 0.0 0.0 19912 844 ? Ss 13:14 0:00
> /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
> root 29059 0.0 0.0 20984 1264 ? S 13:14 0:00
> /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
> root 29060 0.0 0.0 19912 844 ? S 13:14 0:00
> /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
> root 29061 0.0 0.0 19912 844 ? S 13:14 0:00
> /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
> root 29062 0.0 0.0 19912 844 ? S 13:14 0:00
> /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
> root 29295 0.0 0.0 42400 668 pts/4 R+ 13:59 0:00 grep sasl

Proper. PAM here means you let PAM call system accounts, I guess.

> [root@hedwig readme]# testsaslauthd -u anner -p mypass
> 0: OK "Success."

Looks good.

> [root@hedwig readme]# cat /usr/lib/sasl2/smtpd.conf
> pwcheck_method: saslauthd
If you don't offer MD5 mechs because of your auth backend, then exclude
them. Add

mech_list: plain login

to smtpd.conf.

> [root@hedwig readme]# postconf -n
[ ... ]
> permit_sasl_authenticated, reject
> smtpd_sasl_auth_enable = yes
> transport_maps = mysql:/etc/postfix/transport.cf
> unknown_local_recipient_reject_code = 550
> virtual_alias_maps = mysql:/etc/postfix/virtual.cf

You should add

smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

Required is

smtpd_sasl_local_domain =

For use with saslauthd leave it empty.

> When I try and use it with a standard mail client I get:
> Aug 24 13:53:52 daredevil postfix/smtpd[29286]: connect from
> h27.83.213.151.ip.alltel.net[151.213.83.27]
> Aug 24 13:53:56 daredevil postfix/smtpd[29286]: warning: SASL
> authentication problem: unable to open Berkeley db /etc/sasldb2: No such
> file or directory

The client tries an MD5 mech as you offer it (see below). But as you use PAM
and probably system accounts you can't use MD5. So as I told you above remove
MD5 mechs.

> Aug 24 13:53:56 daredevil postfix/smtpd[29286]: warning: SASL
> authentication problem: unable to open Berkeley db /etc/sasldb2: No such
> file or directory
> Aug 24 13:53:56 daredevil postfix/smtpd[29286]: warning: SASL
> authentication failure: no secret in database
> Aug 24 13:53:56 daredevil postfix/smtpd[29286]: warning:
> h27.83.213.151.ip.alltel.net[151.213.83.27]: SASL CRAM-MD5
> authentication failed
> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL
> authentication problem: unable to open Berkeley db /etc/sasldb2: No such
> file or directory
> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL
> authentication problem: unable to open Berkeley db /etc/sasldb2: No such
> file or directory
> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL
> authentication failure: no secret in database
> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning:
> h27.83.213.151.ip.alltel.net[151.213.83.27]: SASL NTLM authentication failed
> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL
> authentication problem: unable to open Berkeley db /etc/sasldb2: No such
> file or directory
> Aug 24 13:53:57 daredevil last message repeated 4 times
> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL
> authentication failure: Password verification failed

The client tries the mechs you offer but which are not valid from your setup.

> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning:
> h27.83.213.151.ip.alltel.net[151.213.83.27]: SASL PLAIN authentication
> failed
> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning: SASL
> authentication problem: unable to open Berkeley db /etc/sasldb2: No such
> file or directory
> Aug 24 13:53:57 daredevil last message repeated 5 times
> Aug 24 13:53:57 daredevil postfix/smtpd[29286]: warning:
> h27.83.213.151.ip.alltel.net[151.213.83.27]: SASL LOGIN authentication
> failed

PLAIN and LOGIN fail too.

> When I try through telnet, my telnet session looks like this:
> [anner:~] anner% telnet 66.45.100.233 25
> Trying 66.45.100.233...
> Connected to 66.45.100.233.
> Escape character is '^]'.
> 220 hedwig.blast.com ESMTP Postfix
> EHLO anner.blast.com
> 250-hedwig.blast.com
> 250-PIPELINING
> 250-SIZE 10240000
> 250-VRFY
> 250-ETRN
> 250-AUTH CRAM-MD5 GSSAPI NTLM PLAIN DIGEST-MD5 LOGIN
> 250 8BITMIME
> AUTH PLAIN myEncodedUser&Pass
> 535 Error: authentication failed

It would be more helpful if you would create a test account and show real test data.
That would show us which format your user has (realm or not).

> [root@hedwig readme]# saslfinger -s
> saslfinger - postfix Cyrus sasl configuration Wed Aug 24 14:02:36 EDT 2005
> version: 0.9.9.1
> mode: server-side SMTP AUTH
>
> -- basics --
> Postfix: 2.2.5

Is that pasted or typed manually? The latest FC3 Postfix version is postfix-2.1.5-5.i386.rpm.

> System: Fedora Core release 3 (Heidelberg)
>
> -- smtpd is linked to --
> libsasl2.so.2 => /usr/lib64/libsasl2.so.2 (0x0000003c6db00000)
>
> -- active SMTP AUTH and TLS parameters for smtpd --
> smtpd_sasl_auth_enable = yes
>
>
> -- listing of /usr/lib/sasl --

That does not matter: this is SASL version 1(.5).

> -- listing of /usr/lib/sasl2 --
> total 3052
> drwxr-xr-x 2 root root 4096 Aug 24 09:47 .
> drwxr-xr-x 94 root root 65536 Aug 24 09:53 ..
> -rwxr-xr-x 1 root root 875 Oct 7 2004 libanonymous.la
> -rwxr-xr-x 1 root root 12820 Oct 7 2004 libanonymous.so
> -rwxr-xr-x 1 root root 12820 Oct 7 2004 libanonymous.so.2
> -rwxr-xr-x 1 root root 12820 Oct 7 2004 libanonymous.so.2.0.19
> -rwxr-xr-x 1 root root 863 Oct 7 2004 libcrammd5.la
> -rwxr-xr-x 1 root root 15216 Oct 7 2004 libcrammd5.so
> -rwxr-xr-x 1 root root 15216 Oct 7 2004 libcrammd5.so.2
> -rwxr-xr-x 1 root root 15216 Oct 7 2004 libcrammd5.so.2.0.19
>
> -rwxr-xr-x 1 root root 884 Oct 7 2004 libdigestmd5.la
> -rwxr-xr-x 1 root root 42964 Oct 7 2004 libdigestmd5.so
> -rwxr-xr-x 1 root root 42964 Oct 7 2004 libdigestmd5.so.2
> -rwxr-xr-x 1 root root 42964 Oct 7 2004 libdigestmd5.so.2.0.19
> -rwxr-xr-x 1 root root 911 Oct 7 2004 libgssapiv2.la
> -rwxr-xr-x 1 root root 22292 Oct 7 2004 libgssapiv2.so
> -rwxr-xr-x 1 root root 22292 Oct 7 2004 libgssapiv2.so.2
> -rwxr-xr-x 1 root root 22292 Oct 7 2004 libgssapiv2.so.2.0.19
> -rwxr-xr-x 1 root root 851 Oct 7 2004 liblogin.la
> -rwxr-xr-x 1 root root 13296 Oct 7 2004 liblogin.so
> -rwxr-xr-x 1 root root 13296 Oct 7 2004 liblogin.so.2
> -rwxr-xr-x 1 root root 13296 Oct 7 2004 liblogin.so.2.0.19
> -rwxr-xr-x 1 root root 854 Oct 7 2004 libntlm.la
> -rwxr-xr-x 1 root root 29104 Oct 7 2004 libntlm.so
> -rwxr-xr-x 1 root root 29104 Oct 7 2004 libntlm.so.2
> -rwxr-xr-x 1 root root 29104 Oct 7 2004 libntlm.so.2.0.19
> -rwxr-xr-x 1 root root 851 Oct 7 2004 libplain.la
> -rwxr-xr-x 1 root root 13360 Oct 7 2004 libplain.so
> -rwxr-xr-x 1 root root 13360 Oct 7 2004 libplain.so.2
> -rwxr-xr-x 1 root root 13360 Oct 7 2004 libplain.so.2.0.19
> -rwxr-xr-x 1 root root 931 Oct 7 2004 libsasldb.la
> -rwxr-xr-x 1 root root 784960 Oct 7 2004 libsasldb.so
> -rwxr-xr-x 1 root root 784960 Oct 7 2004 libsasldb.so.2
> -rwxr-xr-x 1 root root 784960 Oct 7 2004 libsasldb.so.2.0.19
> -rw-r--r-- 1 root root 26 Aug 24 09:46 smtpd.conf

The required libs are installed.

> -- content of /usr/lib/sasl/smtpd.conf --
> pwcheck_method: saslauthd
> saslauthd_version: 2

Again SASL version 1.

> -- mechanisms on localhost --
> 250-AUTH CRAM-MD5 GSSAPI NTLM PLAIN DIGEST-MD5 LOGIN

Do not offer auth mechs which aren't provided by your auth backend.

> -- end of saslfinger output --

> Anne

Alexander

-- 
Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.35_FC2smp 
Serendipity 22:01:02 up 2 days, 18:44, load average: 0.15, 0.10, 0.12

-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list

application/pgp-signature attachment: Dies ist ein digital signierter Nachrichtenteil

Next message: Lovell McIlwain: "Re: unable to uninstall wine rpm"

Previous message: Mjumbe Poe: "Re: yum libraries error"
In reply to: Anne Ramey: "sasl fails"
Next in thread: Anne Ramey: "Re: sasl fails"
Reply: Anne Ramey: "Re: sasl fails"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Relevant Pages

Re: passwordless root login
... |> Then the login program won't even ask for a password. ... |> simply edit its pam file. ... | working at some point--I think the pam stuff has changed a bit. ... appliation asks pam if the auth is valid, pam will say "no" if auth is ...
(Debian-User)
Re: Users without a password?
... PAM is the authentication model employed in Ubuntu. ... to edit the PAM file that specifies how authentication should work with GDM. ... auth requisite pam_nologin.so ... @include common-auth ...
(Ubuntu)
sshd open to everyone if PAM auth sufficient
... I was playing with PAM, ... I changed the auth from "required" to "sufficient" ... configuration file for ssh. ... Apr 9 18:46:48 pigbox sshd: Accepted password for root from ...
(comp.security.ssh)
Re: sshd open to everyone if PAM auth sufficient
... I changed the auth from "required" to "sufficient" ... ](in order to add - later - other PAM modules) in the PAM ... ]configuration file for ssh. ... If it fails, then it is ignored, and the other items ...
(comp.security.ssh)
Re: tracking down failed logins
... While going through my daily logs I have noticed that pam is ... unknown: 7728 Time ... Username: Ned, Authentication failure ...
(Fedora)