saslauth configuration question

[Dan White]

On 01/14/13 19:39 +0000, Charles Bradshaw wrote:
>I am considering switching my smptd from sendmail to postfix, but I am a
>little confused.
>
>The following snip from http://www.postfix.org/SASL_README.html
>
>"
>/etc/sasl2/smtpd.conf:
>    pwcheck_method: saslauthd
>    mech_list: PLAIN LOGIN
>
>Do not specify any other mechanisms in mech_list than PLAIN or LOGIN when
>using saslauthd! It can only handle these two mechanisms, and authentication
>will fail if clients are allowed to choose other mechanisms.
>"
>
>Appears to be wrong! I have the sasl2 configuration:
>
>/etc/sasl2/Sendmail.conf:
>    pwcheck_method: saslauthd
>    mech_list: DIGEST-MD5 PLAIN
>
>>> DEFINITELY WORKING <<
>
>Admittedly, I am using sendmail and not postfix so perhaps I have a miss
>configuartion somewhere. The server in question is using /etc/salsdb with some
>test users NOT having accounts on the server and the debug dialogs clearly
>show that DIGEST-MD5 is being used.
>
>The above quote, cut and paste from the readme, contains a clear enough
>statement, except for the grammer, ie the word "other" missing  between the
>words "mech_list" and "than". But:
>
>I'm confused because I have a solid, tested, working example which contradicts
>the postfix readme.
>
>Is the operation of Sendmail.conf somehow different to smtpd.conf?
>
>Further on the readme does say:
>
>/etc/sasl2/smtpd.conf:
>    pwcheck_method: auxprop
>    auxprop_plugin: sasldb
>    mech_list: CRAM-MD5 PLAIN
>
>Which also works.
>
>Is there a rational explanation or do I just put it down to a ghost in the
>machine?

What saslauthd backend are you using?

Typically saslauthd is not used when you store users in sasldb. It can be
used with sasldb if compiled to do so, and chosen with '-a sasldb'. If your
users are stored within sasldb, you should be doing 'pwcheck_method:
auxprop', instead of running saslauthd, to save yourself some overhead.

pwcheck_method only affects PLAIN and LOGIN authentications. shared-secret
mechanisms such as DIGEST-MD5 will use your auxprop configuration (such as
sasldb) to authenticate the user.

For an overview, see:

http://www.cyrussasl.org/docs/cyrus-sasl/2.1.25/components.php

-- 
Dan White