OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: postfix + sasl problem

From: Benjamin Zwittnig (benjamin.zwittnigarnes.si)
Date: Wed Sep 05 2007 - 10:05:03 CDT


Patrick Ben Koetter wrote:
> * Benjamin Zwittnig <benjamin.zwittnigarnes.si>:
>
>> Without -o smtpd_sasl_auth_enable=yes submission works like a normal
>> smtp channel:
>>
>> # telnet localhost 587
>> Trying 127.0.0.1...
>> Connected to localhost.localdomain (127.0.0.1).
>> Escape character is '^]'.
>> 220 mail.xx.yy ESMTP Postfix
>> ehlo localhost
>> 250-mail.xx.yy
>> 250-PIPELINING
>> 250-SIZE 13534336
>> 250-VRFY
>> 250-ETRN
>> 250-ENHANCEDSTATUSCODES
>> 250-8BITMIME
>> 250 DSN
>> quit
>> 221 2.0.0 Bye
>> Connection closed by foreign host.
>>
>>
>>>> I have found something else in the log files:
>>>>
>>>> Sep 5 09:31:25 mail postfix/master[9958]: warning: process
>>>> /opt/postfix/sbin/smtpd pid 8126 exit status 1
>>>> Sep 5 09:31:25 mail postfix/master[9958]: warning:
>>>> /opt/postfix/sbin/smtpd: bad command startup -- throttling
>>>>
>>>>
>>> Quite likely a result of the bad security parameter.
>>>
>>>
>>>
>>>
>>>>>>>> In the postfix log there are only two lines indicating
>>>>>>>> the problem:
>>>>>>>>
>>>>>>>> Sep 4 13:55:01 mail postfix/smtpd[6149]: warning: SASL
>>>>>>>> per-connection security setup; invalid parameter supplied
>>>>>>>> Sep 4 13:55:01 mail postfix/smtpd[6149]: fatal: SASL per-connection
>>>>>>>> initialization failed
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>> I've searched the source code for the error messages and it seems to me -
>>>>> I am not a programmer - that the message "invalid parameter supplied"
>>>>> stems from the SASL library returning the error in xsasl_cyrus_server.c.
>>>>>
>>>>
>>>>
>>>>> However I don't remember ever having seen this before, so its probably
>>>>> better to get somebody to deal with your problem who knows to interpret
>>>>> the code.
>>>>>
>>>>>
>>>> I can send you strace of the smtpd process. The sasl libraries are CentOS
>>>> default libraries which come with the system.
>>>>
>>>>
>>> Yes, please do so. You did build Postfix yourself? Did you throw the
>>> switch to add Cyrus SASL? What was your build statement?
>>>
>>>
>>>
>> $ make makefiles CCARGS="-DUSE_TLS -DUSE_SASL_AUTH -DUSE_CYRUS_SASL
>> -DHAS_MYSQL -I/opt/mysql/include/mysql" AUXLIBS="-L/opt/mysql/lib/mysql
>> -lssl -lcrypto -lsasl2 -lmysqlclient -lz -lm"
>>
>> Strace is on http://www2.arnes.si/~bzwitt/smtpd-strace
>>
>
> I don't see any errors. Did you trace a crash or regular behaviour?
>

This is trace of a 'crash'. Today I tried with fresh install of CentOS
4.5 and a clean
install of postfix 2.4.5 with no success (the same error).

# uname -a
Linux zvoniki.arnes.si 2.6.9-55.ELsmp #1 SMP Wed May 2 14:28:44 EDT 2007
i686 athlon i386 GNU/Linux

Regards,

Benjamin