Saslauthd multi instance for postfix smtp authentication

email-serverpostfixsaslauthdsmtp

I have mail server Postfix+Saslauth.
I configure multiple instance for Postfix:

postfix

postfix-out

and two instances for saslauth:

saslauthd

saslauthd-out

Setting saslauthd is for authenticating Postfix service and saslauthd-out for another instance of it.

For creating second instance of sasl I do it this way:

cp /etc/default/saslauthd /etc/default/saslauthd-out

With this configuration :
:~# vim /etc/default/saslauthd-out

 DESC="SASL Authentication Daemon postfix-out"
 NAME="saslauthd-out"
 MECHANISMS="pam"
 OPTIONS="-c -m /var/spool/postfix-out/var/run/saslauthd-out"

In configuration of postfix-out (/etc/postfix-out/sasl/smtp.conf):

  pwcheck_method: saslauthd-out

and for postfix (/etc/postfix/sasl/smtp.conf):

  pwcheck_method: saslauthd

and when I restart saslauth every thing is OK ,

when I try to connect smtp server (postfix) every thing is OK , and Authentication was successfull, but in smtp server (postfix-out) , connect to smtp is OK, but it can't authenticate and this error has occurred:

:~# telnet mail2.example.com 25 
Trying 111.222.333.444...
Connected to mail2.example.com.
Escape character is '^]'. 
220 mail2.example.com ESMTP Postfix (@@DISTRO@@) 
auth plain YWdoc2EAYWdoc2hhbGRvcmFu 
535 5.7.8 Error: authentication failed: no mechanism available

Logs :

Nov 30 09:17:47 mail4 postfix-out/smtpd[4361]: connect from unknown[111.222.333.444]
Nov 30 09:17:58 mail4 postfix-out/smtpd[4361]: warning: SASL authentication problem: unknown password verifier 
Nov 30 09:17:58 mail4 postfix-out/smtpd[4361]: warning: SASL authentication failure: Password verification failed
Nov 30 09:17:58 mail4 postfix-out/smtpd[4361]: warning: unknown[111.222.333.444]: SASL plain authentication failed: no mechanism available
Nov 30 09:18:04 mail4 postfix-out/smtpd[4361]: disconnect from unknown[111.222.333.444]

what is the problem?

Best Answer

pwcheck_method is a configuration option for the Cyrus SASL library. Possible values are auxprop, saslauthd, pwcheck and authdaemond. saslauthd-out is not supported here. You configuration needs to be like this

/etc/default/saslauthd-out:

DESC="SASL Authentication Daemon postfix-out"
NAME="saslauthd-out"
MECHANISMS="pam"
OPTIONS="-c -m /var/spool/postfix-out/var/run/saslauthd-out"

/etc/postfix-out/sasl/smtp.conf:

pwcheck_method: saslauthd
saslauthd_path: /var/spool/postfix-out/var/run/saslauthd-out/mux

somewhere in /etc/postfix-out/main.cf:

smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtp 
smtpd_sasl_type = cyrus
cyrus_sasl_config_path = /etc/postfix-out/sasl

I just setup a VM with that configuration and it works.

/var/spool/postfix-out/var/run/saslauthd-out has to exist, although personally i would prefer it to be more like /var/spool/postfix-out/saslauthd-out. But that is your decision.

Related Topic