Subject: Authenticated SMTP using CYRUS SASL and MD5 crypted password on MySQL

From: "Rocco Scappatura" <[email-masked]>
Date: Tue, 10 Jun 2008 11:22:23 +0200

Hello,

I'm configuring SMTP authenticated service in Postifix. I have installed
CYRUS SASL libraries 2.1.22 and rebuilded Postfix with CYRUS SASL
support:

# find /usr -name 'libsasl*.*'
/usr/local/lib/sasl2/libsasldb.so.2.0.22
/usr/local/lib/sasl2/libsasldb.so.2
/usr/local/lib/sasl2/libsasldb.so
/usr/local/lib/sasl2/libsasldb.la
/usr/local/lib/libsasl2.so.2.0.22
/usr/local/lib/libsasl2.so.2
/usr/local/lib/libsasl2.so
/usr/local/lib/libsasl2.la

Note that I'm using Postfix+MySQL and that password are stored in
mailbox table in MD5 format.

I've configured SMTP for CYRUS SASL:

# smtpd.conf
pwcheck_method: auxprop
auxprop_plugin: sql
mech_list: plain login

sql_engine: mysql
sql_hostnames: 127.0.0.1
sql_user: postfix
sql_passwd: ****
sql_database: postfix
sql_format: crypt
sql_select: select password from mailbox where name='%u' or
username='%u'
sql_verbose: yes

But I still cant authenticate for authenticated SMTP:

 # telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 av7.sttspa.it
ehlo sttspa.it
250-av7.sttspa.it
250-PIPELINING
250-SIZE 35840000
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
AUTH PLAIN AGRlYnVnAGRlYnVn
535 5.7.8 Error: authentication failed: authentication failure

I'm sure that I'm wrong in something, but I can't understand what:

Jun 10 11:00:26 av7 postfix/smtpd[26270]: warning: SASL authentication
failure: Password veri fication failed
Jun 10 11:00:26 av7 postfix/smtpd[26270]: warning: localhost[127.0.0.1]:
SASL PLAIN authentic ation failed: authentication failure

Any hint is apprecciated.

Tnx,

rocsca

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 10 Jun 2008 16:56:51 +0200

Rocco Scappatura wrote:

> password are stored in mailbox table in MD5 format.

I've no idea what that is, is it the weird format 
starting with $apr1$ or $1$ ?  With AUTH PLAIN 
<off topic="sasl"> and AUTH LOGIN </off> you get
or send passwords as plain text, as the name says.

> 535 5.7.8 Error: authentication failed: authentication failure

The server isn't supposed to offer PLAIN outside of 
TLS, and if it offers PLAIN anyway the client isn't
supposed to use it.  

<off topic="sasl"> Try AUTH LOGIN </off>, see also
<http://www.technoids.org/saslmech.html>.  If that
also fails the issue might be your "MD5 format" (?)

Maybe test the part after the third "$" instead of
"debug" for the $apr1$whatever$wannabecrypt format.

 Frank

---

From: "Rocco Scappatura" <[email-masked]>
Date: Tue, 10 Jun 2008 18:06:23 +0200

> I've no idea what that is, is it the weird format starting 
> with $apr1$ or $1$ ?  With AUTH PLAIN <off topic="sasl"> and 
> AUTH LOGIN </off> you get or send passwords as plain text, as 
> the name says.
> 

OK. Then, is the any way to tell to CYRUS that the password are stored
on a table of a MySQL DB in MD5 format (Base64)?

> The server isn't supposed to offer PLAIN outside of TLS, and 
> if it offers PLAIN anyway the client isn't supposed to use it.  
> 
> <http://www.technoids.org/saslmech.html>.  If that also fails 
> the issue might be your "MD5 format" (?)
> 
> Maybe test the part after the third "$" instead of "debug" 
> for the $apr1$whatever$wannabecrypt format.
> 
>  Frank
> 
>

---

From: Kurt Zeilenga <[email-masked]>
Date: Tue, 10 Jun 2008 09:12:49 -0700

The ietf-sasl mailing list is for discussions concerning the  
standardization of SASL and other work of the IETF SASL Working  
Group.  Discussions specific to any particular implementation of SASL,  
such as Cyrus SASL, are more appropriately directed to a support forum  
for that implementation.  There is a Cyrus SASL forum available at:
    http://lists.andrew.cmu.edu/mailman/listinfo/cyrus-sasl

Regards, Kurt (IETF SASL WG co-chair)

---

From: "Rocco Scappatura" <[email-masked]>
Date: Tue, 10 Jun 2008 18:14:38 +0200

> standardization of SASL and other work of the IETF SASL 
> Working Group.  Discussions specific to any particular 
> implementation of SASL, such as Cyrus SASL, are more 
> appropriately directed to a support forum for that 
> implementation.  There is a Cyrus SASL forum available at:
Thanks,

sorry.

rocsca