[Postfixbuch-users] SMTP-Auth SQL
Patrick Ben Koetter
p at state-of-mind.de
Mo Jul 18 22:04:11 CEST 2005
* Silvio Siefke <listen at silviosiefke.de>:
> saslfinger - postfix Cyrus sasl configuration Mo Jul 18 12:02:07 CEST 2005
> version: 0.9.9.1
> mode: server-side SMTP AUTH
>
> -- basics --
> Postfix: 2.1.5
> System: Debian GNU/Linux testing/unstable \n \l
>
> -- smtpd is linked to --
> libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0x401a0000)
>
> -- active SMTP AUTH and TLS parameters for smtpd --
> broken_sasl_auth_clients = yes
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_local_domain =
> smtpd_sasl_security_options = noanonymous
> smtpd_tls_cert_file = /etc/postfix/smtpd.cert
> smtpd_tls_key_file = /etc/postfix/smtpd.key
> smtpd_use_tls = no
>
>
> -- listing of /usr/lib/sasl2 --
> insgesamt 952
> drwxr-xr-x 2 root root 4096 2005-07-18 09:38 .
> drwxr-xr-x 45 root root 12288 2005-07-11 15:30 ..
> -rw-r--r-- 1 root root 13488 2004-10-16 23:02 libanonymous.a
> -rw-r--r-- 1 root root 851 2004-10-16 23:02 libanonymous.la
> -rw-r--r-- 1 root root 13824 2004-10-16 23:02 libanonymous.so
> -rw-r--r-- 1 root root 13824 2004-10-16 23:02 libanonymous.so.2
> -rw-r--r-- 1 root root 13824 2004-10-16 23:02 libanonymous.so.2.0.19
> -rw-r--r-- 1 root root 16298 2004-10-16 23:02 libcrammd5.a
> -rw-r--r-- 1 root root 837 2004-10-16 23:02 libcrammd5.la
> -rw-r--r-- 1 root root 16180 2004-10-16 23:02 libcrammd5.so
> -rw-r--r-- 1 root root 16180 2004-10-16 23:02 libcrammd5.so.2
> -rw-r--r-- 1 root root 16180 2004-10-16 23:02 libcrammd5.so.2.0.19
> -rw-r--r-- 1 root root 47516 2004-10-16 23:02 libdigestmd5.a
> -rw-r--r-- 1 root root 860 2004-10-16 23:02 libdigestmd5.la
> -rw-r--r-- 1 root root 43944 2004-10-16 23:02 libdigestmd5.so
> -rw-r--r-- 1 root root 43944 2004-10-16 23:02 libdigestmd5.so.2
> -rw-r--r-- 1 root root 43944 2004-10-16 23:02 libdigestmd5.so.2.0.19
> -rw-r--r-- 1 root root 13726 2004-10-16 23:02 liblogin.a
> -rw-r--r-- 1 root root 831 2004-10-16 23:02 liblogin.la
> -rw-r--r-- 1 root root 14028 2004-10-16 23:02 liblogin.so
> -rw-r--r-- 1 root root 14028 2004-10-16 23:02 liblogin.so.2
> -rw-r--r-- 1 root root 14028 2004-10-16 23:02 liblogin.so.2.0.19
> -rw-r--r-- 1 root root 31248 2004-10-16 23:02 libntlm.a
> -rw-r--r-- 1 root root 825 2004-10-16 23:02 libntlm.la
> -rw-r--r-- 1 root root 30660 2004-10-16 23:02 libntlm.so
> -rw-r--r-- 1 root root 30660 2004-10-16 23:02 libntlm.so.2
> -rw-r--r-- 1 root root 30660 2004-10-16 23:02 libntlm.so.2.0.19
> -rw-r--r-- 1 root root 20142 2004-10-16 23:02 libotp.a
> -rw-r--r-- 1 root root 825 2004-10-16 23:02 libotp.la
> -rw-r--r-- 1 root root 43184 2004-10-16 23:02 libotp.so
> -rw-r--r-- 1 root root 43184 2004-10-16 23:02 libotp.so.2
> -rw-r--r-- 1 root root 43184 2004-10-16 23:02 libotp.so.2.0.19
> -rw-r--r-- 1 root root 13886 2004-10-16 23:02 libplain.a
> -rw-r--r-- 1 root root 831 2004-10-16 23:02 libplain.la
> -rw-r--r-- 1 root root 14096 2004-10-16 23:02 libplain.so
> -rw-r--r-- 1 root root 14096 2004-10-16 23:02 libplain.so.2
> -rw-r--r-- 1 root root 14096 2004-10-16 23:02 libplain.so.2.0.19
> -rw-r--r-- 1 root root 21798 2004-10-16 23:02 libsasldb.a
> -rw-r--r-- 1 root root 852 2004-10-16 23:02 libsasldb.la
> -rw-r--r-- 1 root root 18692 2004-10-16 23:02 libsasldb.so
> -rw-r--r-- 1 root root 18692 2004-10-16 23:02 libsasldb.so.2
> -rw-r--r-- 1 root root 18692 2004-10-16 23:02 libsasldb.so.2.0.19
> -rw-r--r-- 1 root root 22168 2004-10-16 23:02 libsql.a
> -rw-r--r-- 1 root root 874 2004-10-16 23:02 libsql.la
> -rw-r--r-- 1 root root 22132 2004-10-16 23:02 libsql.so
> -rw-r--r-- 1 root root 22132 2004-10-16 23:02 libsql.so.2
> -rw-r--r-- 1 root root 22132 2004-10-16 23:02 libsql.so.2.0.19
> -rw-r--r-- 1 root root 236 2005-07-18 09:38 smtpd.conf
>
>
>
>
> -- content of /usr/lib/sasl2/smtpd.conf --
Die kannste rauswerfen, weil das Debian Postfix package in /etc/postfix/sasl
nach der smtpd.con sucht. Wenn Du Postfix selber gebaut hast, dann allerdings
isr das die Richtige.
> -- content of /etc/postfix/sasl/smtpd.conf --
> pwcheck_method: auxprop
> auxprop_plugin: sql
> sql_engine: mysql
> mech_list: PLAIN LOGIN
Kannst Du mit auxprop:sql erweitern:
mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5
> sql_hostnames: 127.0.0.1
> sql_user: --- replaced ---
> sql_passwd: --- replaced ---
> sql_database: postfix
> sql_select: SELECT password FROM mailbox WHERE username = '%u@%r'
>
>
> -- active services in /etc/postfix/master.cf --
> # service type private unpriv chroot wakeup maxproc command + args
> # (yes) (yes) (yes) (never) (100)
> smtp inet n - n - - smtpd
> 127.0.0.1:10025 inet n - n - - smtpd -o
> content_filter=
> pickup fifo n - - 60 1 pickup
> cleanup unix n - - - 0 cleanup
> qmgr fifo n - - 300 1 qmgr
> rewrite unix - - - - - trivial-rewrite
> bounce unix - - - - 0 bounce
> defer unix - - - - 0 bounce
> trace unix - - - - 0 bounce
> verify unix - - - - 1 verify
> flush unix n - - 1000? 0 flush
> proxymap unix - - n - - proxymap
> smtp unix - - - - - smtp
> smtp-amavis unix - - n - 2 smtp
> -o smtp_data_done_timeout=1800
> -o disable_dns_lookups=yes
> relay unix - - - - - smtp
> showq unix n - - - - showq
> error unix - - - - - error
> local unix - n n - - local
> virtual unix - n n - - virtual
> lmtp unix - - n - - lmtp
> anvil unix - - n - 1 anvil
> maildrop unix - n n - - pipe
> flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
> uucp unix - n n - - pipe
> flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
> ($recipient)
> ifmail unix - n n - - pipe
> flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
> bsmtp unix - n n - - pipe
> flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -d -t$nexthop -f$sender
> $recipient
> scalemail-backend unix - n n - 2 pipe
> flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
> ${nexthop} ${user} ${extension}
>
> -- mechanisms on localhost --
> 250-AUTH LOGIN PLAIN
> 250-AUTH=LOGIN PLAIN
>
> -- end of saslfinger output --
Das sieht eigentlich alles ganz gut aus. Hast Du die Möglichkeit mit den
utilites "server" und "client" von SASL ohne Postfix einen Authentifizierung
zu testen? Was sagt denn Dein auth.* log; SASL loggt nach auth.*.
Wenn Du das noch nicht in /etc/syslog.conf eingerichtet hast, dann mach das
erst mal, probiere SMTP AUTH und check mal was im Log steht.
Außerdem: Wie hast Du denn die Passwörter in MySQL abgelegt? Ohne patch kann
SASL beispielsweise keine ge-cryteten Paswörter in MySQL lesen...
p at rick
--
The Book of Postfix
<http://www.postfix-book.com>
SMTP AUTH debug utility:
<http://postfix.state-of-mind.de/patrick.koetter/saslfinger/>
Mehr Informationen über die Mailingliste Postfixbuch-users