Subject: plain and login not working

From: RYAN vAN GINNEKEN <[email-masked]>
Date: Wed, 18 Aug 2004 15:59:54 -0600

This is a thread i started in postfix users but think it would be on 
topic at this group too.

The output of my telnet session is like below and contains NO!!!!! entry 
for PLAIN or LOGIN. Please keep reading this mail as i have answered all 
of the questions asked by Paterick.
EHLO computerking.ca
250-mail1.computerking.ca
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-XVERP
250 8BITMIME

> * RYAN vAN GINNEKEN <[email-masked]> [040818 01:49]:
>  
>
>> I am using postfix version 2.0.0.18 with tls and sasl2 on freebsd
>> stable 4.9 using  cyrus-sasl/saslauthd version 2.1.1.19  have
>> configured the my /user/local/lib/sasl2 dir to contain only
>> Sendmail.conf   liblogin.so     libplain.a      libplain.so.2
>> liblogin.a      liblogin.so.2   libplain.so     smptd.conf
>>   
>
>
> OK.
>
>  
>
>> and my smtpd.conf file has this configuration
>>
>> # This sets smtpd to authenticate using the saslauthd daemon.
>> pwcheck_method:saslauthd
>> # This allows only plain and login as the authentication mechanisms.
>> mech_list: plain login
>>   
>
>
> OK. Maybe you add a space after the ":" to pwcheck_method:saslauthd.
> One never knows with SASL ...
>
>  
>
I added a space stopped and started saslauthd using this command
/usr/local/etc/rc.d/saslauthd.sh start
/usr/local/etc/rc.d/saslauthd.sh start
then stopped and started postfix using
postfix stop
postfix start
still get the errors

Aug 18 15:06:43 v22 postfix/smtpd[32801]: warning: 
unknown[209.115.173.22]: SASL PLAIN authentication failed
Aug 18 15:06:44 v22 postfix/smtpd[32801]: warning: 
unknown[209.115.173.22]: SASL LOGIN authentication failed

>> Seems simple enough however when i try to logon to my SMTP server i 
>> get the following errors.
>> Aug 17 17:07:07 v22 postfix/smtpd[2643]: warning: 
>> unknown[209.115.173.22]: SASL PLAIN authentication failed
>> Aug 17 17:07:08 v22 postfix/smtpd[2643]: warning: 
>> unknown[209.115.173.22]: SASL LOGIN authentication failed
>>   
>
>
> OK.
>
>  
>
>> Is there a log i can check for sasl errors somewhere or do i need to
>>   
>
>
> SASL logs to auth.*, check your syslog configuration if it catches this.
>
>  
>
I do not see any errors in my syslog however when i do a saslauthd -a 
shadow -d i get stuff like below in my syslog does that mean that the 
logs are working?

Aug 18 15:21:38 v22 saslauthd[33214]: set_auth_mech   : unknown 
authentication mechanism: shadow

>> change my permissions on the passwd file any help would be
>> appreciated.    
>
>
> Which passwd file? You have configured Postfix for client-side as well
> as fpr server-side SMTP AUTH. Client-side introduces
> /etc/postfix/sasl_passwd. Are talking about this 'passwd' or are we
> talking about /etc/passwd. If you mean /etc/passwd then you don't need
> to change permissions. saslauthd is run started by root:root, so
> permissions should be no problem.
>
>  
>
Yes I what to use /etc/passwd to authenticate to postfix as far as 
Client-side stuff do i need it?? what would it be used for.  I just need 
to be able to authenticate to postfix remotely and from within my 
internal network.

>> Here is a posconf -n output if that helps anyone help me thank you in 
>> advance.
>>
>> v22.computerking.ca > /usr/local/lib/sasl2 $postconf -n
>> alias_database = hash:/etc/aliases
>> alias_maps = hash:/etc/aliases
>> broken_sasl_auth_clients = yes
>>   
>
>
> OK.
>
>  
>
>> command_directory = /usr/local/sbin
>> config_directory = /usr/local/etc/postfix
>> daemon_directory = /usr/local/libexec/postfix
>> debug_peer_level = 2
>> home_mailbox = IMAPdir/INBOX/
>> inet_interfaces = all
>> mail_owner = postfix
>> mailq_path = /usr/local/bin/mailq
>> manpage_directory = /usr/local/man
>> mydestination = $myhostname, localhost.$mydomain $mydomain
>> mydomain = computerking.ca
>> myhostname = mail1.computerking.ca
>> mynetworks_style = subnet
>> myorigin = $mydomain
>> newaliases_path = /usr/local/bin/newaliases
>> queue_directory = /var/spool/postfix
>> readme_directory = no
>> relay_domains = $mydestination, shoemasters.computerking.ca, highcoup.ca
>> sample_directory = /usr/local/etc/postfix
>> sendmail_path = /usr/local/sbin/sendmail
>> setgid_group = maildrop
>> smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
>>   
>
>
> If you want to offer server-side SMTP AUTH, you don't need
> smtp_sasl_password_maps; they are for the smtp daemon (client-side)
>
>  
>
What ??? i will comment out this feature for now do not quite understand 
what this is used for

>> smtp_tls_loglevel = 2
>> smtp_tls_note_starttls_offer = yes
>> smtp_use_tls = yes
>> smtpd_recipient_restrictions = permit_mx_backup          
>
>
> Turn off smtp_use_tls while you test SASL; TLS settings can influence
> the behaviour of SASL.
>
>  
>
I turned it off

>> permit_sasl_authenticated,        permit_mynetworks,        
>> reject_unauth_destination
>> smtpd_sasl_auth_enable = yes
>>   
>
>
> OK.
>
>  
>
>> smtpd_sasl_local_domain =
>>   
>
>
> OK.
>
>  
>
>> smtpd_sasl_security_options = noanonymous
>>   
>
>
> OK.
>
>  
>
>> smtpd_sender_restrictions = permit_mx_backup        
>> permit_sasl_authenticated,        permit_mynetworks,        
>> reject_unauth_destination
>>   
>
>
> OK.
>
>  
>
>> smtpd_tls_CAfile = /usr/local/sslcerts/cacert.pem
>> smtpd_tls_auth_only = yes
>> smtpd_tls_cert_file = /usr/local/sslcerts/certs/mail-cert.pem
>> smtpd_tls_key_file = /usr/local/sslcerts/certs/mail-key.pem
>> smtpd_tls_loglevel = 2
>> smtpd_tls_received_header = yes
>> smtpd_tls_session_cache_timeout = 3600s
>> smtpd_use_tls = yes
>>   
>
>
> Turn off smtpd_use_tls while you test SASL; TLS settings can influence
> the behaviour of SASL.
>
>  
>
I turned it off restarted postfix set my email client to not use tls for 
SMTP and now i get this in my logs and my client will not connect to the 
server.
Aug 18 15:28:50 v22 postfix/smtpd[33429]: connect from 
v22001.computerking.ca[192.168.0.1]
Aug 18 15:28:56 v22 postfix/smtpd[33429]: lost connection after EHLO 
from v22001.computerking.ca[192.168.0.1]
Aug 18 15:28:56 v22 postfix/smtpd[33429]: disconnect from 
v22001.computerking.ca[192.168.0.1]

>> soft_bounce = no
>> tls_random_source = dev:/dev/urandom
>> unknown_local_recipient_reject_code = 450
>> virtual_alias_domains = sculpturaldesign.ca
>> virtual_alias_maps = hash:/usr/local/etc/postfix/virtual
>>   
>
>
> So far so good...
>
> How do you run saslauthd?
>  
>
using the saslauthd script in the rc.d dir
/usr/local/etc/rc.d/saslauthd.sh start

> Where does saslauthd put its socket?
>  
>
not sure how do i find out???

> What does 'saslauthd -a shadow -d' give as ouput?
>  
>
v22.computerking.ca > /usr/local/lib/sasl2 #saslauthd -a shadow -d
saslauthd[33214] :set_auth_mech   : unknown authentication mechanism: 
shadow
v22.computerking.ca > /usr/local/lib/sasl2 #saslauthd -a plain -d
saslauthd[33215] :set_auth_mech   : unknown authentication mechanism: plain
v22.computerking.ca > /usr/local/lib/sasl2 #saslauthd -a login -d
saslauthd[33228] :set_auth_mech   : unknown authentication mechanism: login

yikes that seems like it might be a problem

> Look for run_path.  
what??

> Can postfix access this $run_path directory?
>  
>
what??

> What do you use as authentication backend i.e. the source of your
> usernames and passwords?
>  
>
I what to use /etc/passwd

> Can you authenticate without Postfix using 'testsaslauthd'?
>  
>
v22.computerking.ca > /usr/local/lib/sasl2 #testsaslauthd
su: testsaslauthd: command not found

I also did a locate testsaslauthd and it did not find anything

> p@rick

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 19 Aug 2004 07:46:53 +0200

At 11:59 PM 8/18/2004, RYAN vAN GINNEKEN wrote:
>This is a thread i started in postfix users but think it would be on topic at this group too.

Not sure why you think this topic is appropriate for this list.
This list is for undertaking the work of the IETF SASL Working
Group, a work chartered to engineer SASL technical specifications.
So, unless you have a issue with a particular technical
specification which we are charged to engineer, the discussion
should likely be held on lists specific to SASL implementations
you are experience problems with.

Regards, Kurt
IETF SASL WG co-chair

>The output of my telnet session is like below and contains NO!!!!! entry for PLAIN or LOGIN. Please keep reading this mail as i have answered all of the questions asked by Paterick.
>EHLO computerking.ca
>Aug 18 15:06:43 v22 postfix/smtpd[32801]: warning: unknown[209.115.173.22]: SASL PLAIN authentication failed
>Aug 18 15:06:44 v22 postfix/smtpd[32801]: warning: unknown[209.115.173.22]: SASL LOGIN authentication failed
>
>
>>>Seems simple enough however when i try to logon to my SMTP server i get the following errors.
>>>Aug 17 17:07:07 v22 postfix/smtpd[2643]: warning: unknown[209.115.173.22]: SASL PLAIN authentication failed
>>>Aug 17 17:07:08 v22 postfix/smtpd[2643]: warning: unknown[209.115.173.22]: SASL LOGIN authentication failed
>>>  
>>
>>
>>OK.
>>
>> 
>>
>I do not see any errors in my syslog however when i do a saslauthd -a shadow -d i get stuff like below in my syslog does that mean that the logs are working?
>
>Aug 18 15:21:38 v22 saslauthd[33214]: set_auth_mech   : unknown authentication mechanism: shadow
>
>Yes I what to use /etc/passwd to authenticate to postfix as far as Client-side stuff do i need it?? what would it be used for.  I just need to be able to authenticate to postfix remotely and from within my internal network.
>
>>>Here is a posconf -n output if that helps anyone help me thank you in advance.
>>>
>What ??? i will comment out this feature for now do not quite understand what this is used for
>
>>>smtp_tls_loglevel = 2
>I turned it off restarted postfix set my email client to not use tls for SMTP and now i get this in my logs and my client will not connect to the server.
>Aug 18 15:28:50 v22 postfix/smtpd[33429]: connect from v22001.computerking.ca[192.168.0.1]
>Aug 18 15:28:56 v22 postfix/smtpd[33429]: lost connection after EHLO from v22001.computerking.ca[192.168.0.1]
>Aug 18 15:28:56 v22 postfix/smtpd[33429]: disconnect from v22001.computerking.ca[192.168.0.1]
>
>>>soft_bounce = no
>saslauthd[33214] :set_auth_mech   : unknown authentication mechanism: shadow

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 19 Aug 2004 07:46:53 +0200

Regards, Kurt
IETF SASL WG co-chair