Questions tagged [sasl]
Simple Authentication and Security Layer (SASL) is a framework for authentication and data security in Internet protocols.
271 questions
0 votes
0 answers
12 views
Postfix + Cyrus SASL (sasldb2) auth fails (535 5.7.8)
I'm implementing Postfix + Cyrus SASL abd facing an issue: Postfix with Cyrus SASL (sasldb2) auth fails with "535 5.7.8 Error: authentication failed", what happened? /etc/postfix/main.cf ...
0 votes
0 answers
39 views
User credentials exposed from sasl database
I have created a user using: saslpasswd2 -c secureuser While running strings /etc/sasldb2 , it exposes password as string in plain text. Config file /etc/sasl2/memcached.conf has PLAIN mechanism. Is ...
0 votes
0 answers
336 views
How can I solve POSTFIX SASL Invalid authentication mechanism error while sending emails from Outlook?
I have a problem with my Postfix/Dovecot mail server authentication when using a mail client such as Outlook. I can add an account to the client app, and it is successful connecting to the Inbox, but ...
0 votes
1 answer
354 views
SASL authentication 250-AUTH PLAIN LOGIN is missing
On my Ubuntu 22.04 server I've installed dovecot to use an SASL authentication mechanism with postfix. In the /etc/dovecot/conf.d/10-master.conf file: service auth { unix_listener /var/spool/...
0 votes
0 answers
93 views
saslauthd: how to stop (brute force) authentications attempts on port 25?
I have saslauthd working correctly on port smtps, users can send emails where ever they are. I also have a firewall rule allowing access to SMTPS only from certain countries. However I constantly see ...
0 votes
0 answers
152 views
SVN / SASL authentication error: failed to init cipher 'rc4'
im trying to update an old project via SVN and get this: SASL authentication error: SASL(-1): generic failure: internal error: failed to init cipher 'rc4' openssl tells me RC4 is disabled by default ...
1 vote
0 answers
471 views
FreeIPA ldap GSSAPI mechanism no longer works for Kerberos
I upgraded my FreeIPA server on Rocky 9 and the GSSAPI mechanism for Kerberos no longer works. I'm getting error 49, invalid credentials. In the /var/log/sssd/sssd_caps.int.log it shows: * (2024-...
0 votes
1 answer
407 views
Outlook timeout when adding IMAP account (dovecot, postfix)
I am adding a Postfix /dovecot mail server in Outlook 2016. It works on my phone and I can successfully authenticate using: doveadm auth test user pass postconf -n alias_database = hash:/etc/aliases ...
0 votes
1 answer
110 views
Can authentication with a relay be disabled for a specific address in smtp_sasl_password_maps?
Some email hosters are jerks. No matter your blacklist standing, SPK, DKIM, or DMARC, they will block your emails. To deal with that, I've set up a relay using sender_dependent_relayhost_maps. There ...
1 vote
1 answer
386 views
Can postfix enforce reject_unknown_helo_hostname before permit_sasl_authenticated?
I have a working postfix 3.5 relay where the config includes: smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname, permit smtpd_helo_required=yes ...
0 votes
0 answers
307 views
Postfix/Dovecot fails to send emails "SASL PLAIN authentication failed" - no further message
I have been all around the houses trying to configure Postfix and Dovecot so I can send through my domain from Gmail, which as far as I know is simply Gmail acting as a regular SMTP client talking to ...
0 votes
1 answer
741 views
Postfix - SASL Cyrus saslauthd authentication failed
Goal: Configure smtpd to authenticate connections by using postfix, cyrus, saslauthd, pam and mysql. Investigation Authentication via courier-pop3 & courier-imap using mysql works saslauthd ...
1 vote
0 answers
202 views
Sasl connection refused
i am trying to run a selfhosted mailserver using postfix and dovecot. firstly i configured only postfix without dovecot and that worked fine but i wanted to use a mail client so i installed dovecot to ...
0 votes
1 answer
772 views
Postfix / sasldb : "authentication failure"
I'm not a postfix expert... I'm having an authentication problem with posfix 3.5 on debian 11.8. I've added a test user : # saslpasswd2 -c test Password: test Using swaks to test authentication to ...
1 vote
0 answers
802 views
Configuring cyrus to use oauth2 via keycloak with ldap backend?
We are using cyrus (and exim) as a long-running mail server. The requirement to store passwords in email programs seems to be a security risk to me. I would like to move auth behind something like ...
-1 votes
2 answers
2k views
Postfix smtpd and smtp restrictions (client, sender, recipient) first restriction that matches wins very ILLOGICAL for brute force attacks
if I have a list of restrictions for: smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rhsbl_helo dbl.spamhaus.org, reject_rhsbl_reverse_client dbl.spamhaus....
0 votes
0 answers
302 views
postfix secure & insecure connections
I have configured postfix SMTP server for mail sending only with below configurations, I've used cyrus-sasl to authenticate with openLDAP, I want to achieve SMTP port 25 to use insecure connections ...
1 vote
0 answers
457 views
Why am I getting Sasl errors when trying to authenticate to SES with Postifx?
I am getting these two errors in my mail logs: Aug 25 22:51:23 ns1 postfix/smtpd[246267]: warning: unknown[94.156.102.101]: SASL LOGIN authentication failed: authentication failure Aug 25 22:55:22 ns1 ...
0 votes
0 answers
119 views
SASL authorisation and hostname to access the server
I have a working postfix mail server. It is registered under two DNS names: mail.xxxx.de and xxxx.no-ip.org. I use SASL via dovecot for relay authorisation. It works flawless when the client uses the ...
0 votes
1 answer
2k views
535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
I have Postfix installed on a Fedora 38 box with the following: $ grep smtp_ main.cf smtp_sasl_auth_enable = yes smtp_sasl_type = cyrus smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd ...
0 votes
1 answer
850 views
Why is my client server unable to send emails over port 587 while a telnet connection to my mail server is possible?
Host cannot send mail over relay host with port 587. I have two servers. One mail server and one server that uses the mail server as a relay host. The client server should send over Port 587. A telnet ...
1 vote
1 answer
173 views
NetBSD + openLDAP + SASL
I try to set up a connection to a openLDAP server running on NetBSD 10 via TLS and SASL. When I try ldapsreach -Y EXTERNAL I get ldapsearch: not compiled with SASL support and ldd /usr/bin/ldapsearch ...
0 votes
1 answer
3k views
openLDAP / Sasl - ldap_sasl_interactive_bind_s: Local error (-2)
I configure openldap with sasl bind. Trying connect: # ldapsearch -v -H ldaps:// -Y PLAIN -U [email protected] But getting error: ldap_sasl_interactive_bind_s: Local error (-2) I create a config ...
1 vote
1 answer
5k views
Fail2Ban - Posfix-SASL not working
i have a problem that my fail2ban will not ban sasl authentications against my postfix. This is an example log entry from /var/log/syslog: Jul 31 13:42:21 v50428 postfix/smtps/smtpd[635398]: warning: ...
1 vote
4 answers
1k views
Postfix with Dovecot on Ubuntu 20.04 postfix/mail fatal: no sasl authentication mechanisms
Here's the output of doveconf -n: # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.17.5-x86_64-linode154 x86_64 Ubuntu 20.04.4 LTS # Hostname: mail....
2 votes
0 answers
389 views
Postfix SASL error: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
My use case is to use my own mail server to send emails from CCTV NVRs to overcome the daily limits imposed by GMail. The NVR has an option to setup authentication. The config worked for whitelisted ...
0 votes
1 answer
283 views
Postfix / Dovecot SASL authentication only working on primary domain
I have had a postfix server running flawlessly for three months now. Users log in to the server in their respective mail clients by connecting to mail.mydomain.com (with SSL) and there's never been ...
0 votes
1 answer
2k views
Can PAM be used with Postfix and Dovecot SASL?
I have set up Postfix to use Dovecot SASL with PAM and Unix users, and Dovecot LDA (LMTP) for local mailbox storage. After some testing, turns out incoming mail gets declined with the reason: Error: ...
1 vote
1 answer
1k views
How does SASL know to read config from /etc/postfix/sasl?
I've set up Postfix to authenticate with SASL on a Ubuntu based system. I've done this by following along with some recipes, but mostly readying a lot of the docs. One bit that works, but which I don'...
0 votes
1 answer
3k views
Postfix: reject_sender_login_mismatch not working
I want to use the following configuration for Postfix: smtpd_relay_restrictions = permit_mynetworks reject_sender_login_mismatch permit_sasl_authenticated defer_unauth_destination, ...
2 votes
1 answer
2k views
Postfix sasl_password file and MX resolution
Thanks to @AlexD idea, we'll implement the following transport table in order to simulate a IP failover using the DNS MX resolution (postfix 3.3) Relay for 2 domains, exemple[12].com exemple1.com ...
1 vote
2 answers
2k views
How does Sendmail figure out where SASL is listening?
I'm trying to get SMTP-AUTH working on a Mint Linux 20.2 machine, and I'm having trouble getting authentication to happen. I have installed Cyrus sasl2, and apparently configured it properly - ...
1 vote
0 answers
4k views
Postfix unable to authenticate with Microsoft Exchange (No credentials were supplied)
I want to setup postfix on my nagios server to relay emails to our Microsoft Exchange server and I am running into issues with authenticating with Microsoft Exchange. Specifically I am getting this ...
0 votes
1 answer
2k views
postfix/sasl/pam (mysql) auth error
I've followed tutorial on http://flurdy.com/docs/postfix/ to set up an email server, and most of it works (after switching from Courier to Dovecot). Just not sending email through SMTP. Sending with ...
1 vote
0 answers
524 views
Postfix Can't Receive Internet Email - warning: SASL: Connect to /var/spool/postfix/private/auth failed
Using CentOS 8, I've setup dovecot and postfix and tested that: I can sign in as an authenticated user Read email (IMAP) Send email to the same/different account on the server Send email outbound, to ...
1 vote
1 answer
309 views
Trouble enabling mail_crypt in dovecot / SASL authentication failed
dovecot --version 2.3.4.1 (f79e8e7e4) Ok, I tried to enable mail-crypt but it's being weird. I'm using https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/#ec-key. I ran: cd $HOME openssl ...
3 votes
1 answer
6k views
Getting SENDMAIL (as a client) to use AUTH LOGIN
I am trying to use SENDMAIL (v8.15) on a Pi in my network to just forward mails to my SendGrid account. This is needed because my legacy webcams on my network cannot use the very long password ...
1 vote
2 answers
963 views
Dovecot not authenticating clients in mail server with postfix cyrus(for sasl authentication) and dovecot in centos 7
As I built a mailserver I have another question in process that I haven't been able to find in google so I am expecting I will get a answer here. The update is I created a mailserver with postfix ...
0 votes
1 answer
513 views
mysql not authenticating with cyrus for postfix athentication
So i have been building a mail server and i have setted up postfix and a database now what i want is that cyrus should authenticate my users of mail server from a database i have setted up a database ...
1 vote
4 answers
5k views
Postfix + sasldb issue (solved as of Mar 2021)
PS(SOLVED: Solution for Alpine Linux as of Mar 2021, the fix in cyrus-sasl 2.1.27-r12 is in edge branch. 3.13 only has cyrus-sasl 2.1.27-r10. PS: I know there are similar posts but they are very dated ...
0 votes
1 answer
887 views
Postfix: How to malware & spam scan outgoing SMTP SASL auth users?
Although I have found two answers to this, I can't work out how to actually implement them, and at least one of them doesn't actually answer the question. So if anyone has any experience to share I'd ...
0 votes
1 answer
510 views
Postfix SASL authentication via Dovecot - Can I use the SASL login name in my postfix sql queries?
I have a mailserver with postfix, dovecot and mysql running on Debian buster. Everythings works fine so far, but I would like to setup a scenario where the login name for SASL auth is different from ...
0 votes
0 answers
610 views
Demanding SASL authentication on port 25 rejects all of my incomming email
I am using this chunk of code inside /etc/postfix/master.cf to force people to securely "subimt" email through port 465 which uses protocol SMTPS. SMTPS supports mandatory TLS which I use to ...
0 votes
2 answers
970 views
Postfix fails on incoming SMTP from remote MTAs for local delivery
I am transferring MTA to newer servers running Ubuntu 20.04 LTS. SMTPS is working well thus permitting clients to send mails after authentication. However, when sending mails from remote MTAs for ...
3 votes
1 answer
4k views
configure saslauthd with PAM
I'm trying to configure saslauthd with PAM. I created a user test with password test using useradd and passwd and I checked that I can login with su - test. [arch@vps-5220ce87 ~]$ systemctl status ...
0 votes
1 answer
279 views
Using "postfix" user for "dovecot"
I set the Postfix so that my mailboxes (maildir format) for my virtual users are set like this: ┌───┐ │ # │ root > myserver > ~ └─┬─┘ └─> ls -l /var/mail/ total 4 drwxr-sr-x 5 postfix ...
0 votes
1 answer
787 views
OpenLDAP cn=config database access blocked
I use OpenLDAP 2.4.54 with Alpine. Here is my ldap configuration $ sudo slapcat -n0 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-...
2 votes
1 answer
20k views
Why do I get "Server not found in Kerberos database" using testsaslauthd?
I'm trying to setup Kerberos auth over SASL using OpenLDAP. As I understand it, I need a host keytab in /etc/krb5.keytab from the KDC I'm using and then {SASL}user@realm in the given user's LDAP ...
0 votes
1 answer
858 views
Postfix + SASL SQLite gives auxprop error on CentOS 7
I am receiving an unknown password verifier(s) auxprop error when trying to use SQLite for SASL authentication in Postfix on CentOS 7. It seems that the SQLite SQL engine is not found. Contents of /...
0 votes
2 answers
797 views
Can't determine the principal used to LDAP syncrepl GSSAPI
I've configured two openldap fully functional in HA (syncrepl mode provider - slave). After testing that simple bind syncrepl works flawlessly, I'm trying to deploy from scratch using only GSSAPI to ...