Newbie lament on SASL authentication with Postscript...

[Bernard T. Higonnet]

On 07/07/11 16:57, Dan White wrote:
> On 07/07/11 11:01 +0200, Bernard T. Higonnet wrote:
>> I am building a new mail server to replace an existing FreeBSD
>> 8.1/Postfix/CourierIMAP/SQWebwail mail server that seems to be working
>> OK so far. It, and its predecessors, have been working for years.
>>
>> But I want to make a new server (on another machine) that uses the
>> most recent software, has SMTP user authentication (and maybe some
>> other less important bells and whistles), and permit me to keep the
>> old server for backup.
>>
>> So I want to add SMTP user authentication to Postfix. Since Postfix's
>> main interest in life is email and not authentication as such, it uses
>> SASL from the Cyrus guys. Since Cyrus' main interest in life is
>> authentication, and not databases as such, it uses MySQL from the
>> MySQL guys. This is GOOD, in the spirit of Newton's remark "If I have
>> seen further it is by standing on the shoulders of giants."
>
>> 1) mail clients logging into postfix mail server
>> 2) postfix communicating (logging in?) to Cyrus SASL
>> 3) Cyrus logging in to MySQL
>> 4) and somewhere, Courier authdaemon is doing stuff
>
>> PS I'll be happy with PLAIN LOGIN for now...
>
> You'll want to grab Patrick Koetter's saslfinger, which may be
> distributed with your OS's sasl packages, or can be download via a google
> search. It will help trouble shoot your Postfix and SASL configuration.
>
> smtptest is a good SMTP AUTH testing tool, which is distributed as part of
> the Cyrus IMAP distribution.
>
> There are several different approaches, depending on your needs.
>
> Probably the most straight forward approach is to use the sql auxprop
> plugin. You can find sasl documentation at:
>
> http://www.cyrusimap.org/docs/cyrus-sasl/2.1.23/options.php
>
> and a Postfix usage example at:
>
> http://www.postfix.org/SASL_README.html
>
> /etc/sasl2/smtpd.conf:
> pwcheck_method: auxprop
> auxprop_plugin: sql
> mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5 NTLM
> sql_engine: pgsql
> sql_hostnames: 127.0.0.1, 192.0.2.1
> sql_user: username
> sql_passwd: secret
> sql_database: dbname
> sql_select: SELECT password FROM users WHERE user = '%u'@'%r'
>
> You'll want to change 'sql_engine: pgsql' to 'sql_engine: mysql'.
>
> A requirement of this approach is that your passwords will need to be
> stored in plain text (unhashed) within your MySQL database.
>
> Another approach, if you have courier authdaemon already working, is:
>
> /etc/sasl2/smtpd.conf
> pwcheck_method: authdaemond
> authdaemond_path: <path_to_authdaemon_socket>
> mech_list: PLAIN LOGIN
>
> If you have Postfix chrooted, then your path_to_authdaemon_socket might be
> a little tricky. For testing, you might disable any chroot configuration
> (in master.cf).
>
> Another approach would be to use saslauthd with PAM, which depends on
> having a MySQL PAM module installed and configured:
>
> /etc/sasl2/smtpd.conf
> pwcheck_method: saslauthd
> saslauthd_path: <path_to_saslauthd_mux>
> mech_list: PLAIN LOGIN
>
> The same warning about running Postfix chrooted applies to the saslauthd
> mux path.
>
> You would then start saslauthd with a '-a pam' command line option, after
> which you'll need to configure PAM/MySQL.

It's very kind of you to ignore the rant part of my rant!

I have made some progress thanks to saslfinger.

Just in case other people read this, I found 
http://postfix.state-of-mind.de/patrick.koetter/smtpauth/ while looking 
for saslfinger and I've found that helpful.

As of this moment, Postfix is willing to do this:

250-AUTH NTLM LOGIN GSSAPI CRAM-MD5
250-AUTH=NTLM LOGIN GSSAPI CRAM-MD5

which perplexes me since in smtpd.conf I say

mech_list: PLAIN LOGIN

but that's my task for this morning!

Thanks again
Bernard Higonnet