OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Postfix/ MySQL/ SASL (!)

From: Aaron P. Martinez (mlproficuous.com)
Date: Wed Apr 07 2004 - 16:23:30 CDT


On Wed, 2004-04-07 at 15:30, schwarzkonto wrote:
> Hi, I'm trying to install ...
> - Postfix (postfix-2.1-RC1-20040331)
> - Mysql (mysql-3.23.58-1.9)
> - SASl2 (cyrus-sasl-2.1.18-1)=20
> ...on a Redhat 9 OS.
>
> Did anyone of you do that yet? The problem is the SMTP -
> saslauthentification.
> If it is activated (smtpd_sasl_auth_enable =3D yes) I'm not able to
> connect the SMTP-port (telnet localhost 25) anymore.
>
> -------- telnet localhost 25 ------------------
> [rootlocalhost log]# telnet localhost 25
> Trying 127.0.0.1...
> Connected to localhost.
> Escape character is '^]'.
> Connection closed by foreign host.
> ----------------------------------------------
>
> If you look at the network traffic with ethereal you see, that there are
> no other connections from the server to the client. It simply quits the
> telnet session...
> If it is deactivated, everything works fine.=20
>
> If you have any ideas what could be wrong please let me know `cause I got
> no clue at the moment...
>
> Thanks a lot!, Philipp.
>
> Here some files, that might be interesting to look at:
>
> ---------------------------------------/var/log/messages ----------------=
> Apr 7 18:11:56 localhost authdaemond.pgsql: authdaemon: modules=3D"authm=
> ysql
> authpam", daemons=3D5
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: sql_select option missing
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: auxpropfunc error nomechan=
> ism
> available
> -------------------------------------------------------------------------=
> --
>
> ------------------------/var/log/maillog ----------------------
> Apr 7 18:12:35 localhost postfix/smtpd[2020]: smtpd_sasl_initialize:
> SASLconfig file is smtpd.conf
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: match_string:
> fast_flush_domains ~? debug_peer_list
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: match_string:
> fast_flush_domains ~? fast_flush_domains
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: attr_clnt_create:
> transport=3Dlocal endpoint=3Dprivate/anvil
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: watchdog_create: 0x808fb00
> 18000
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: watchdog_stop: 0x808fb00
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: watchdog_start: 0x808fb00
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: connection established
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: master_notify: status 0
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: name_mask: resource
> Apr 7 18:12:37 localhost postfix/smtpd[2020]: name_mask: software
> Apr 7 18:12:37 localhost postfix/master[2016]: warning: process
> /usr/libexec/postfix/smtpd pid 2020 killed by signal 11
> Apr 7 18:12:37 localhost postfix/master[2016]: warning:
> /usr/libexec/postfix/smtpd: bad command startup - throttling
> -------------------------------------------------------------------------=
> ---
>
> ---------------------------------------/etc/postfix/main.cf -------------=
> ---
>
> queue_directory =3D /var/spool/postfix
> command_directory =3D /usr/sbin
> daemon_directory =3D /usr/libexec/postfix
> mail_owner =3D postfix
> myhostname =3D mail.domain.tld
> mydomain =3D domain.tld
> myorigin =3D $mydomain
> mydestination =3D $mydomain, $myhostname, localhost.$mydomain, localhost
> unknown_local_recipient_reject_code =3D 550
> sendmail_path =3D /usr/sbin/sendmail
> newaliases_path =3D /usr/bin/newaliases
> mailq_path =3D /usr/bin/mailq
> setgid_group =3D postfix
> manpage_directory =3D /usr/local/man
> sample_directory =3D /etc/postfix
> virtual_alias_maps =3D
> mysql:/usr/local/etc/postfix/mysql_virtual_alias_maps.cf
> virtual_gid_maps =3D static:1001
> virtual_mailbox_base =3D /usr/local/virtual
> virtual_mailbox_domains =3D
> mysql:/usr/local/etc/postfix/mysql_virtual_domain_maps.cf
> virtual_mailbox_maps =3D
> mysql:/usr/local/etc/postfix/mysql_virtual_mailbox_maps.cf
> virtual_mailbox_limit =3D 51200000
> virtual_minimum_uid =3D 1001
> virtual_transport =3D virtual
> virtual_uid_maps =3D static:1001
> #SASL
> broken_sasl_auth_clients =3D yes
> smtpd_recipient_restrictions =3D
> permit_mynetworks,
> permit_sasl_authenticated,
> reject_non_fqdn_hostname,
> reject_non_fqdn_sender,
> reject_non_fqdn_recipient,
> reject_unauth_destination,
> reject_unauth_pipelining,
> reject_invalid_hostname,
> reject_rbl_client opm.blitzed.org,
> reject_rbl_client list.dsbl.org,
> reject_rbl_client proxies.relays.monkeys.com,
> reject_rbl_client relays.ordb.org,
> reject_rbl_client bl.spamcop.net,
> reject_rbl_client sbl.spamhaus.org
> smtpd_sender_restrictions =3D check_sender_access
> mysql:/usr/local/etc/postfix/mysql-sender.cf
> smtpd_client_restrictions =3D check_client_access
> mysql:/usr/local/etc/postfix/mysql-client.cf
> smtpd_sasl_auth_enable =3D yes
> smtpd_sasl_local_domain =3D $myhostname
> smtpd_sasl_security_options =3D noanonymous
> smtpd_sasl_application_name =3D smtpd
> -------------------------------------------------------------------------=
> ---
>
>
> ----------------------------------------/etc/postfix/master.cf ----------=
> ---
> # service type private unpriv chroot wakeup maxproc command + args
> # (yes) (yes) (yes) (never) (100)
> smtp inet n - n - - smtpd -v -D
when i started postfix w/the -D option it kills the smtpd process. I
removed it and the logging worked great i saw the sasl authentication
attempt along with the decoding of the username and password that my MUA
was supplying.

> pickup fifo n - n 60 1 pickup
> cleanup unix n - n - 0 cleanup
> qmgr fifo n - n 300 1 qmgr
> rewrite unix - - n - - trivial-rewrite
> bounce unix - - n - 0 bounce
> defer unix - - n - 0 bounce
> trace unix - - n - 0 bounce
> verify unix - - n - 1 verify
> flush unix n - n 1000? 0 flush
> proxymap unix - - n - - proxymap
> smtp unix - - n - - smtp
> relay unix - - n - - smtp
> showq unix n - n - - showq
> error unix - - n - - error
> local unix - n n - - local
> virtual unix - n n - - virtual
> lmtp unix - - n - - lmtp
> anvil unix - - n - 1 anvil
> old-cyrus unix - n n - - pipe
> flags=3DR user=3Dcyrus argv=3D/cyrus/bin/deliver -e -m ${extension} ${u=
> ser}
> cyrus unix - n n - - pipe
> user=3Dcyrus argv=3D/cyrus/bin/deliver -e -r ${sender} -m ${extension} =
> ${user}
> uucp unix - n n - - pipe
> flags=3DFqhu user=3Duucp argv=3Duux -r -n -z -a$sender - $nexthop!rmail
> ($recipient)
> ifmail unix - n n - - pipe
> flags=3DF user=3Dftn argv=3D/usr/lib/ifmail/ifmail -r $nexthop ($recipi=
> ent)
> bsmtp unix - n n - - pipe
> flags=3DFq. user=3Dfoo argv=3D/usr/local/sbin/bsmtp -f $sender $nexthop
> $recipient
> -------------------------------------------------------------------------=
> ---
>
>
> -------------------------------------/usr/lib/sasl2/smtp.conf------------=
> ---
> sasl_pwcheck_method: auxprop
>
> sasl_auxprop_plugin: sql login crammd6 digestmd5
>
> mysql_hostnames: localhost
> mysql_user: postfix
> mysql_passwd: postfix
> mysql_database: postfix
> mysql_statement: SELECT password FROM mailbox WHERE username =3D '%u%r'
> mysql_verbose: yes
> -------------------------------------------------------------------------=
> ---
>
>
> --------ls /usr/lib/sasl2-------------------------------------------
> libanonymous.a libdigestmd5.so.2.0.18 libsasldb.a
> libanonymous.la libgssapiv2.a libsasldb.=
> la
> libanonymous.so liblogin.a libsasldb=
> .so
> libanonymous.so.2 liblogin.la libsasldb.so=
> .2
> libanonymous.so.2.0.18 liblogin.so libsasldb.so.2.0.18
> libcrammd5.a liblogin.so.2
> libsql.a
> libcrammd5.la liblogin.so.2.0.18
> libsql.la
> libcrammd5.so libntlm.a
> libsql.so.2
> libcrammd5.so.2 libotp.a libsql.so.2.0.=
> 18
> libcrammd5.so.2.0.18 libplain.a smtpd.conf
> libdigestmd5.a libplain.la smtpd_old.co=
> nf
> libdigestmd5.la libplain.so smtpd_v2.con=
> f
> libdigestmd5.so libplain.so.2 libdigestmd5.so.2
> libplain.so.2.0.18
> ---------------------------------------------------------------------

Aaron