From owner-freebsd-questions@FreeBSD.ORG Tue Aug 8 14:52:24 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 449F116A4DA for ; Tue, 8 Aug 2006 14:52:24 +0000 (UTC) (envelope-from ggroth@gregs-garage.com) Received: from mail.gregs-garage.com (h-64-105-8-34.chcgilgm.covad.net [64.105.8.34]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3E82143D66 for ; Tue, 8 Aug 2006 14:52:21 +0000 (GMT) (envelope-from ggroth@gregs-garage.com) Received: from [10.10.10.124] (localhost.gregs-garage.com [127.0.0.1]) by mail.gregs-garage.com (Postfix) with ESMTP id EFF92114035 for ; Tue, 8 Aug 2006 09:52:31 -0500 (CDT) Message-ID: <44D8A5F8.40509@gregs-garage.com> Date: Tue, 08 Aug 2006 09:55:52 -0500 From: Greg Groth User-Agent: Thunderbird 1.5.0.5 (Windows/20060719) MIME-Version: 1.0 To: freebsd-questions@freebsd.org References: <20060808101410.6387.GERARD@seibercom.net> In-Reply-To: <20060808101410.6387.GERARD@seibercom.net> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: Postfix & SASL Authentication X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Aug 2006 14:52:24 -0000 On 8/8/2006 9:20 AM, Gerard Seibert wrote: > FreeBSD 6.1 STABLE > > I have SASL and Postfix installed and for the most part they seem to > work all right together. However, there is one small problem. > > When attempting to send a message from one of the PC's on the network, > actually any PC on the network except for the one with Postfix installed > on it, this error message is inserted into the maillog file. > > Aug 8 10:11:32 scorpio postfix/smtpd[1310]: connect from boss.seibercom.net[192.168.0.4] > Aug 8 10:11:32 scorpio postfix/smtpd[1310]: warning: SASL authentication failure: no user in db > Aug 8 10:11:32 scorpio postfix/smtpd[1310]: 859B9BD6C: client=boss.seibercom.net[192.168.0.4], sasl_method=LOGIN, sasl_username=gerard@seibercom.net > > All of the users are authenticated. Exactly what is it referring to and how do I correct it? The mail does get relayed however, so it is not a fatal warning. > > Which version of SASL? v1 or v2? The following is based on ym experience with v2, and I don't know if it applies to v1 or not. As far as the message in you log file, it's attempting to authenticate, but it's not connecting to the user database to verify the user. More than likely it's allowing you to send mail from the local server because you have Postfix configured to allow it to relay mail from localhost, and that this is allowing you to send the email even though authentication is failing. To determine which authentication methods Postfix will accept, telnet to localhost on port 25 and issue a EHLO: mail# telnet localhost 25 Trying ::1... Connected to localhost.domain.com. Escape character is '^]'. 220 mail.domain.com ESMTP Postfix EHLO localhost 250-mail.domain.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-AUTH NTLM LOGIN PLAIN GSSAPI DIGEST-MD5 CRAM-MD5 250-AUTH=NTLM LOGIN PLAIN GSSAPI DIGEST-MD5 CRAM-MD5 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN In this instance, the AUTH line dictates which authentication mechanisms Postfix will accept. In this case: NTLM LOGIN PLAIN GSSAPI DIGEST-MD5 CRAM-MD5 Check your /usr/local/lib/sasl2/smtpd.conf file and make sure that you have the correct auth mechanism listed. For plain text login that's verified against your existing users, your smtpd.conf file would read as follows: pwcheck_method: saslauthd This will verify against your existing user accounts. There are other methods, such as pwcheck_method: sasldb, that will verify against SASL's own password database, which I've never used. Make sure that you have saslauthd running (which it appears you do). Issue the following: # /usr/local/sbin/testsaslauthd -u username -p password 0: OK "Success." If saslauthd is operating correctly, you'll recieve the OK "Success." If not, your problem is with saslauthd. If your AUTH line does not list the right AUTH mechanism, the problem is with Postfix. For instance, if you're trying to use SMTP-AUTH from a client on your network, and have pwcheck_method: saslauthd defined in your smtpd.conf file, you have to have PLAIN LOGIN appear in the AUTH line when telnetting. Best regards, Greg Groth