SASL Authentication Failure & Postfix

Andreas Winkelmann ml at awinkelmann.de
Sun Sep 24 15:41:25 EDT 2006


Am Sunday 24 September 2006 20:34 schrieb Gerard:

> > Show your Postfix-Configuration. "postconf -n" and master.cf (without
> > Comments).
>
> ***** postconf -n *****
>
> broken_sasl_auth_clients = yes
> command_directory = /usr/local/sbin
> config_directory = /usr/local/etc/postfix
> content_filter = scan:[127.0.0.1]:10025
> daemon_directory = /usr/local/libexec/postfix
> debug_peer_level = 2
> disable_dns_lookups = yes
> html_directory = no
> mailbox_command = /usr/local/libexec/dovecot/deliver
> mailq_path = /usr/local/bin/mailq
> manpage_directory = /usr/local/man
> mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
> mail.$mydomain, www.$mydomain, ftp.$mydomain mynetworks_style = class
> myorigin = $mydomain
> newaliases_path = /usr/local/bin/newaliases
> readme_directory = no
> relayhost = smtp.gmail.com
> sample_directory = /usr/local/etc/postfix
> sender_dependent_relayhost_maps = hash:/usr/local/etc/postfix/sd_rely
> sendmail_path = /usr/local/sbin/sendmail
> setgid_group = maildrop
> smtp_enforce_tls = yes
> smtp_generic_maps = hash:/usr/local/etc/postfix/generic
> smtp_sasl_auth_enable = yes
> smtp_sasl_password_maps = hash:/usr/local/etc/postfix/sasl_passwd
> smtp_sasl_path = smtp
> smtp_sasl_security_options = noanonymous, noplaintext
> smtp_sasl_tls_security_options = noanonymous
> smtp_sender_dependent_authentication = yes
> smtp_tls_CAfile = /usr/local/etc/postfix/certs/cacert.pem
> smtp_tls_cert_file = /usr/local/etc/postfix/certs/postfix-cert.pem
> smtp_tls_key_file = /usr/local/etc/postfix/certs/postfix-key.pem
> smtp_tls_loglevel = 0
> smtp_tls_per_site = hash:/usr/local/etc/postfix/tls_per_site
> smtp_tls_session_cache_database = btree:/var/run/smtp_tls_session_cache
> smtp_use_tls = yes
> smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
> smtpd_recipient_restrictions = permit_mynetworks,
> permit_sasl_authenticated, reject_unauth_destination smtpd_sasl_auth_enable
> = yes
> smtpd_sasl_authenticated_header = yes
> smtpd_sasl_exceptions_networks = 127.0.0.0/8
> smtpd_sasl_local_domain = $myhostname
> smtpd_tls_CAfile = /usr/local/etc/postfix/certs/cacert.pem
> smtpd_tls_cert_file = /usr/local/etc/postfix/certs/postfix-cert.pem
> smtpd_tls_key_file = /usr/local/etc/postfix/certs/postfix-key.pem
> smtpd_tls_session_cache_database = btree:/var/smtpd_tls_session_cache
> smtpd_use_tls = yes
> transport_maps = hash:/usr/local/etc/postfix/transport
> unknown_local_recipient_reject_code = 550
>
>
> ***** master.cf *****
>
> #
> # Postfix master process configuration file.  For details on the format
> # of the file, see the master(5) manual page (command: "man 5 master").
> #
> #
> ==========================================================================
> # service type  private unpriv  chroot  wakeup  maxproc command + args #   
>            (yes)   (yes)   (yes)   (never) (100)
> #
> ==========================================================================
> smtp	inet	n       -       n       -       -       smtpd
> 587	inet	n	-	n	-	-	smtpd
> #
> #submission inet n       -       n       -       -       smtpd
> #  -o smtpd_enforce_tls=yes
> #  -o smtpd_sasl_auth_enable=yes
> #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> #smtps     inet  n       -       n       -       -       smtpd
> #  -o smtpd_tls_wrappermode=yes
> #  -o smtpd_sasl_auth_enable=yes
> #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> #628      inet  n       -       n       -       -       qmqpd
> pickup    fifo  n       -       n       60      1       pickup
> cleanup   unix  n       -       n       -       0       cleanup
> qmgr      fifo  n       -       n       300     1       qmgr
> #qmgr     fifo  n       -       n       300     1       oqmgr
> tlsmgr    unix  -       -       n       1000?   1       tlsmgr
> rewrite   unix  -       -       n       -       -       trivial-rewrite
> bounce    unix  -       -       n       -       0       bounce
> defer     unix  -       -       n       -       0       bounce
> trace     unix  -       -       n       -       0       bounce
> verify    unix  -       -       n       -       1       verify
> flush     unix  n       -       n       1000?   0       flush
> proxymap  unix  -       -       n       -       -       proxymap
> smtp      unix  -       -       n       -       -       smtp
> # When relaying mail as backup MX, disable fallback_relay to avoid MX loops
> relay     unix  -       -       n       -       -       smtp
> 	-o fallback_relay=
> #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
> 	-o smtp_generic_maps=
> showq     unix  n       -       n       -       -       showq
> error     unix  -       -       n       -       -       error
> discard   unix  -       -       n       -       -       discard
> local     unix  -       n       n       -       -       local
> virtual   unix  -       n       n       -       -       virtual
> lmtp      unix  -       -       n       -       -       lmtp
> anvil     unix  -       -       n       -       1       anvil
> scache	  unix	-	-	n	-	1	scache
> #
> ## ==================================================================
> # Added by me for ClamSMTP
> # AV scan filter (used by content_filter)
> scan      unix  -       -       n       -       16      smtp
>         -o smtp_send_xforward_command=yes
> 	-o smtp_enforce_tls=no
	-o smtp_sasl_auth_enable=no

But this is already answered in postfix-users.

> #	-o content_filter=scan:[127.0.0.1]:10025
>
> # For injecting mail back into postfix from the filter
> 127.0.0.1:10026 inet  n -       n       -       16      smtpd
>         -o content_filter=
>         -o
> receive_override_options=no_unknown_recipient_checks,no_header_body_checks
> -o smtpd_helo_restrictions=
>         -o smtpd_client_restrictions=
>         -o smtpd_sender_restrictions=
>         -o smtpd_recipient_restrictions=permit_mynetworks,reject
>         -o mynetworks_style=class
>         -o smtpd_authorized_xforward_hosts=127.0.0.0/8
> #
> # ====================================================================
> # Interfaces to non-Postfix software. Be sure to examine the manual
> # pages of the non-Postfix software to find out what options it wants.
> #
> # Many of the following services use the Postfix pipe(8) delivery
> # agent.  See the pipe(8) man page for information about ${recipient}
> # and other message envelope options.
> # ====================================================================
> #
> # maildrop. See the Postfix MAILDROP_README file for details.
> # Also specify in main.cf: maildrop_destination_recipient_limit=1
> #
> maildrop  unix  -       n       n       -       -       pipe
>   flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
> #
> # The Cyrus deliver program has changed incompatibly, multiple times.
> #
> old-cyrus unix  -       n       n       -       -       pipe
>   flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
> # Cyrus 2.1.5 (Amos Gouaux)
> # Also specify in main.cf: cyrus_destination_recipient_limit=1
> cyrus     unix  -       n       n       -       -       pipe
>   user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension}
> ${user} #
> # See the Postfix UUCP_README file for configuration details.
> #
> uucp      unix  -       n       n       -       -       pipe
>   flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
> ($recipient) #
> # Other external delivery methods.
> #
> ifmail    unix  -       n       n       -       -       pipe
>   flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
> bsmtp     unix  -       n       n       -       -       pipe
>   flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop
> $recipient #

-- 
	Andreas


More information about the Cyrus-sasl mailing list