OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: smtp_sasl_password_maps

From: Anne Wilson (cannewilsongooglemail.com)
Date: Thu Mar 20 2008 - 06:23:34 CDT


On Wednesday 19 March 2008 17:49, mouss wrote:
> Anne Wilson wrote:
> >
> > I don't have a 'queue' directory under /var/spool/.
>
> arghh! it's /var/spool/postfix/private/dovecot-auth. I was thinking
> "queue_directory" too hard...
>
> in your dovecot.conf, you should have something like (look at the
> "client" section):
>
> auth default {
> ...
>
>
> socket listen {
> master {
> path = /var/run/dovecot/auth-master
> mode = 0660
> user = root
> group = mailbox
> }
>
> client {
> path = /var/spool/postfix/private/dovecot-auth
> mode = 0660
> user = postfix
> group = postfix
> }
> }
> }
>
It was there, but the path line was not correct. I have corrected that and
now the socket is produced. What's more, I managed to send a test message
with this configuration, which is going to make life a lot easier :-)

> > I tried telnet again:
> >
Now I see

250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN

which is more encouraging. It also approved a PLAIN authentication, though
not a LOGIN one - perhaps you wouldn't expect it to on the same
base64-encoded password?

So - it looks as though one big hurdle is over. Now it looks as though I have
an SELinux problem. Everyone tells me that running in permissive mode
doesn't stop anything working, just logs it. All I know is that I have

avc: denied { connectto } for comm="smtpd" egid=89 euid=89
exe="/usr/libexec/postfix/smtpd" exit=0 fsgid=89 fsuid=89 gid=89 items=0
path="/var/spool/postfix/private/dovecot-auth" pid=24820
scontext=system_u:system_r:postfix_smtpd_t:s0 sgid=89
subj=system_u:system_r:postfix_smtpd_t:s0 suid=89 tclass=unix_stream_socket
tcontext=user_u:system_r:initrc_t:s0 tty=(none) uid=89

I'll have to work out what to do next :-( Certainly this message appears to
refer to my attempt to log in to the groupware account from a client box.

Thanks for the help so far. You've been very patient :-)

Anne