From: Ian Hunter (ihunterhunterweb.net)
Date: Tue Jul 20 2004 - 09:16:11 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> > testsaslauthd -u <username> -p <password> -s smtp
> >
> > ...works fine, even if I "su postfix" and then run it. (Couldn't get
> > pam working that way, switched to shadow, works fine as shadow)
> >
> > However, when I connect to smtpd (with Outlook Express, ack! phht!),
> > I see absolutely no activity from "saslauthd -d -a shadow" (and I see
> > all kinds of messages when I connect from testsaslauthd) and Outlook
> > keeps prompting me for my username and password.
>
> Usually this indicates that saslauthd and smtpd don't meet at the sasl
> socket.

That's what I thought. I just don't know how to troubleshoot it.

> How do you start saslauthd?

service saslauthd start, the actual command winds up looking like

/usr/sbin/saslauthd -m /var/run/saslauthd -a shadow -V

I stuck the -V in there in hopes of seeing some clue in the logs. Problem
is, I can't find anything in the logs after it starts up. The only
interesting thing I see in the logs is in /var/log/messages, when I try to
authenticate via smtpd:

Jul 20 09:55:08 charlie postfix/smtpd[12106]: unable to dlopen
/usr/lib/sasl/libgssapiv2.so: /usr/lib/sasl/libgssapiv2.so: undefined
symbol: GSS_C_NT_HOSTBASED_SERVICE

But I'm using shadow, and I've seen references to people getting that error
and still being able to authenticate.

> Where does it create the socket?

Per the command above, it winds up in the /var/run/saslauthd directory

> What are the permissions for that directory? Can postfix access it?

Yup, postfix can access it, and in fact, the postfix account can
successfully execute testsaslauthd.

> Can you show a telnet to localhost with EHLO foo to see the AUTH
> announcement?

Sure:

[rootcharlie sasl2]# telnet localhost 4025
Trying 127.0.0.1...
Connected to charlie (127.0.0.1).
Escape character is '^]'.
220 mail.hunterweb.net ESMTP Postfix
EHLO foo
250-mail.hunterweb.net
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250 8BITMIME

> Can you run 'postfinger' to give us debug info for your
> setup?

[rootcharlie sasl2]# postfinger
postfinger - postfix configuration on Tue Jul 20 10:03:22 EDT 2004
version: 1.29

--System Parameters--
mail_version = 2.1.4
hostname = charlie
uname = Linux charlie 2.4.20-24.9 #1 Mon Dec 1 11:35:51 EST 2003 i686 i686
i386 GNU/Linux

--Packaging information--
looks like this postfix comes from RPM package:
postfix-2.1.4-3.sasl1.tls.rh9

--main.cf non-default parameters--
alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
broken_sasl_auth_clients = yes
html_directory = /usr/share/doc/postfix-2.1.4-documentation/html
luser_relay = postmaster
mailbox_command = /usr/bin/procmail
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
masquerade_domains = $mydomain
mydestination = $mydomain
mydomain = [doesn't matter]
myhostname = [doesn't matter]
mynetworks = [doesn't matter]
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
readme_directory = /usr/share/doc/postfix-2.1.4-documentation/readme
sample_directory = /usr/share/doc/postfix-1.1.12/samples
sendmail_path = /usr/sbin/sendmail.postfix
unknown_local_recipient_reject_code = 450

--master.cf--
smtp inet n - n - - smtpd
4025 inet n - n - - smtpd -o
smtpd_recipient_restrictions=$smtpd2_recipient_restrictions -o
smtpd_sasl_auth_enable=$smtpd2_sasl_auth_enable -o
broken_sasl_auth_clients=yes
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
showq unix n - n - - showq
error unix - - n - - error
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
maildrop unix - n n - - pipe
  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
old-cyrus unix - n n - - pipe
  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
cyrus unix - n n - - pipe
  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
uucp unix - n n - - pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail.postfix
($recipient)
ifmail unix - n n - - pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
  flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop
$recipient

-- end of postfinger output --

> Can I write on sentence that doesn't end with a question mark?

I'm seen them from you before, so I'm guessing "yes." :)

Here's a really good example of what's happening, soup to nuts:

--snip--
[rootcharlie root]# useradd sasltest
[rootcharlie root]# passwd sasltest
Changing password for user sasltest.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
[rootcharlie root]# testsaslauthd -u sasltest -p sasltest -s smtp
0: OK "Success."
[rootcharlie root]# su postfix
bash-2.05b$ testsaslauthd -u sasltest -p sasltest -s smtp
0: OK "Success."
bash-2.05b$ exit
exit
[rootcharlie root]# cat saslauth.pl
#!/usr/bin/perl -w

use MIME::Base64;

print "Username: ";
chomp($username=<>);
print "Password: ";
chomp($password=<>);

print encode_base64("$username\0$username\0$password");

[rootcharlie root]# ./saslauth.pl
Username: sasltest
Password: sasltest
c2FzbHRlc3QAc2FzbHRlc3QAc2FzbHRlc3Q=
[rootcharlie root]# telnet localhost 4025
Trying 127.0.0.1...
Connected to charlie (127.0.0.1).
Escape character is '^]'.
220 mail.hunterweb.net ESMTP Postfix
EHLO foo
250-mail.hunterweb.net
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250 8BITMIME
AUTH PLAIN c2FzbHRlc3QAc2FzbHRlc3QAc2FzbHRlc3Q=
535 Error: authentication failed
quit
221 Bye
Connection closed by foreign host.
[rootcharlie root]# echo Doh!
Doh!
[rootcharlie root]#

--snip---

See, auth works fine as root and postfix, but via stmpd it barfs, and
there's NOTHING in the logs from saslauth itself; smtpd whines about unable
to dlopen /usr/lib/sasl/libgssapiv2.so: /usr/lib/sasl/libgssapiv2.so:
undefined symbol: GSS_C_NT_HOSTBASED_SERVICE but that's it.

Argh!!

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]