error: authentification failed: bad protocol / cancel

[email protected] Fri, 4 Mar 2022 03:48:20 -0500
Newsgroups gmane.comp.security.cyrus.sasl
Message-ID <[email protected]> 
--16463837001.dFeEc32C.25455
Date: Fri, 4 Mar 2022 03:48:20 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi,

I try to configure postfix relay in kubernetes on Alpine using saslauthd.

Dockerfiel:
FROM alpine:3.15

RUN apk update && \
    apk add --no-cache postfix \
      libsasl \
      cyrus-sasl \
      cyrus-sasl-login \
      cyrus-sasl-plain \
      openssl \
      shadow \
      ca-certificates \
      bash \
      rsyslog \
      supervisor && \
      /usr/bin/newaliases && \
      cp /etc/passwd /etc/passwd_orig && \
      # Clean up
      (rm "/tmp/"* 2>/dev/null || true) && (rm -rf /var/cache/apk/* 2>/dev/=
null || true)

EXPOSE 25

COPY ./configs/supervisord.conf /etc/supervisor/supervisord.conf

supervisord.conf:
[supervisord]
nodaemon=3Dtrue
logfile=3D/var/log/supervisord.log
logfile_maxbytes=3D0

[program:rsyslog]
command=3D/usr/sbin/rsyslogd -n

[program:postfix]
command=3D/usr/libexec/postfix/master -c /etc/postfix -d

[program:saslauthd]
command=3D/usr/sbin/saslauthd -a shadow
startsecs=3D0

server config settings are:

cat /etc/default/saslauthd
MECHANISMS=3D"shadow"

cat /etc/postfix/sasl/smtpd.conf
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

cat /etc/postfix/mail.cf
compatibility_level =3D 2
queue_directory =3D /var/spool/postfix
command_directory =3D /usr/sbin
daemon_directory =3D /usr/libexec/postfix
data_directory =3D /var/lib/postfix
mail_owner =3D postfix
unknown_local_recipient_reject_code =3D 550
debug_peer_level =3D 2
debugger_command =3D
PATH=3D/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path =3D /usr/sbin/sendmail
newaliases_path =3D /usr/bin/newaliases
mailq_path =3D /usr/bin/mailq
setgid_group =3D postdrop
html_directory =3D no
manpage_directory =3D /usr/share/man
sample_directory =3D /etc/postfix
readme_directory =3D /usr/share/doc/postfix/readme
inet_protocols =3D ipv4
meta_directory =3D /etc/postfix
shlib_directory =3D /usr/lib/postfix
biff =3D no
append_dot_mydomain =3D no
broken_sasl_auth_clients =3D yes
inet_interfaces =3D all
mailbox_size_limit =3D 0
mydestination =3D localhost
mydomain =3D example.com
myhostname =3D server.example.com
myorigin =3D server.example.com
relayhost =3D relayhostDNS
smtp_fallback_relay =3D relayhostDNS
smtp_sasl_auth_enable =3D yes
smtp_sasl_password_maps =3D lmdb:/etc/postfix/sasl_passwd
smtp_sasl_security_options =3D noanonymous

smtpd_recipient_restrictions =3D
  permit_mynetworks,
  permit_sasl_authenticated,
  check_relay_domains
smtpd_sasl_auth_enable =3D yes
smtpd_sasl_local_domain =3D server.example.com
cyrus_sasl_config_path =3D /etc/postfix/sasl
smtpd_sasl_path =3D smtpd
smtpd_sasl_security_options =3D noanonymous

cat /etc/postfix/sasl_passwd
relayhostDNS relayUser:relayPassword

After specify the
base64-encoded form of \0username\0password I use telnet to check connect a=
nd authentification.

AUTH LOGIN authentification wokrs correctly but AUTH PLATN not. I got error=
 from my telnet client:
535 5.7.8 Error: authentification failed: bad protocol / cancel

and next logs from server side:
2022-03-04T08:07:49.626134+00:00 mailrelay-0 postfix/smtpd[56]: warning: SA=
SL authentication failure: Can only find author/en (no password)
2022-03-04T08:07:49.626159+00:00 mailrelay-0 postfix/smtpd[56]: warning: 10=
-244-20-10.openvpn.openvpn.svc.cluster.local[10.244.20.10]: SASL PLAIN auth=
entication failed: bad protocol / cancel

Please tell me what could be the problem.
Thank you.
------------------------------------------
Cyrus: SASL
Permalink: https://cyrus.topicbox.com/groups/sasl/Td4ec5f3a98565638-M451f86=
db933f5d2a47db38d9
Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription

--16463837001.dFeEc32C.25455
Date: Fri, 4 Mar 2022 03:48:20 -0500
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html><html><html><body><div>Hi,<br /></div><div><br /></div><div>I try to =
configure postfix relay in kubernetes on Alpine using saslauthd.<br /></div=
><div><br /></div><div>Dockerfiel:<br /></div><pre style=3D"margin:7px 0;bo=
rder-radius:3px;border:1px solid #ccc;padding:7px 10px;background:#f6f6f6;f=
ont-family:menlo,consolas,monospace;font-size:90%;white-space:pre-wrap;word=
-wrap:break-word;overflow-wrap:break-word;">FROM alpine:3.15

RUN apk update &amp;&amp; \
    apk add --no-cache postfix \
      libsasl \
      cyrus-sasl \
      cyrus-sasl-login \
      cyrus-sasl-plain \
      openssl \
      shadow \
      ca-certificates \
      bash \
      rsyslog \
      supervisor &amp;&amp; \
      /usr/bin/newaliases &amp;&amp; \
      cp /etc/passwd /etc/passwd_orig &amp;&amp; \
      # Clean up
      (rm &quot;/tmp/&quot;* 2&gt;/dev/null || true) &amp;&amp; (rm -rf /va=
r/cache/apk/* 2&gt;/dev/null || true)

EXPOSE 25

COPY ./configs/supervisord.conf /etc/supervisor/supervisord.conf<br /></pre=
><div><br /></div><div>supervisord.conf:<br /></div><pre style=3D"margin:7p=
x 0;border-radius:3px;border:1px solid #ccc;padding:7px 10px;background:#f6=
f6f6;font-family:menlo,consolas,monospace;font-size:90%;white-space:pre-wra=
p;word-wrap:break-word;overflow-wrap:break-word;">[supervisord]
nodaemon=3Dtrue
logfile=3D/var/log/supervisord.log
logfile_maxbytes=3D0

[program:rsyslog]
command=3D/usr/sbin/rsyslogd -n

[program:postfix]
command=3D/usr/libexec/postfix/master -c /etc/postfix -d

[program:saslauthd]
command=3D/usr/sbin/saslauthd -a shadow
startsecs=3D0<br /></pre><div><br /></div><div>server config settings are:<=
br /></div><div><br /></div><div>cat /etc/default/saslauthd<br /></div><div=
><code style=3D"border-radius:3px;border:1px solid #ccc;padding:1px 3px;bac=
kground:#f6f6f6;font-family:menlo,consolas,monospace;font-size:90%;">MECHAN=
ISMS=3D&quot;shadow&quot;</code><br /></div><div><br /></div><div>cat /etc/=
postfix/sasl/smtpd.conf<br /></div><pre style=3D"margin:7px 0;border-radius=
:3px;border:1px solid #ccc;padding:7px 10px;background:#f6f6f6;font-family:=
menlo,consolas,monospace;font-size:90%;white-space:pre-wrap;word-wrap:break=
-word;overflow-wrap:break-word;">pwcheck_method: saslauthd
mech_list: PLAIN LOGIN<br /></pre><div><br /></div><div>cat /etc/postfix/ma=
il.cf<br /></div><pre style=3D"margin:7px 0;border-radius:3px;border:1px so=
lid #ccc;padding:7px 10px;background:#f6f6f6;font-family:menlo,consolas,mon=
ospace;font-size:90%;white-space:pre-wrap;word-wrap:break-word;overflow-wra=
p:break-word;">compatibility_level =3D 2
queue_directory =3D /var/spool/postfix
command_directory =3D /usr/sbin
daemon_directory =3D /usr/libexec/postfix
data_directory =3D /var/lib/postfix
mail_owner =3D postfix
unknown_local_recipient_reject_code =3D 550
debug_peer_level =3D 2
debugger_command =3D
PATH=3D/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id &amp; sleep 5
sendmail_path =3D /usr/sbin/sendmail
newaliases_path =3D /usr/bin/newaliases
mailq_path =3D /usr/bin/mailq
setgid_group =3D postdrop
html_directory =3D no
manpage_directory =3D /usr/share/man
sample_directory =3D /etc/postfix
readme_directory =3D /usr/share/doc/postfix/readme
inet_protocols =3D ipv4
meta_directory =3D /etc/postfix
shlib_directory =3D /usr/lib/postfix
biff =3D no
append_dot_mydomain =3D no
broken_sasl_auth_clients =3D yes
inet_interfaces =3D all
mailbox_size_limit =3D 0
mydestination =3D localhost
mydomain =3D example.com
myhostname =3D server.example.com
myorigin =3D server.example.com
relayhost =3D relayhostDNS
smtp_fallback_relay =3D relayhostDNS
smtp_sasl_auth_enable =3D yes
smtp_sasl_password_maps =3D lmdb:/etc/postfix/sasl_passwd
smtp_sasl_security_options =3D noanonymous

smtpd_recipient_restrictions =3D
  permit_mynetworks,
  permit_sasl_authenticated,
  check_relay_domains
smtpd_sasl_auth_enable =3D yes
smtpd_sasl_local_domain =3D server.example.com
cyrus_sasl_config_path =3D /etc/postfix/sasl
smtpd_sasl_path =3D smtpd
smtpd_sasl_security_options =3D noanonymous<br /></pre><div><br /></div><di=
v>cat /etc/postfix/sasl_passwd<br /></div><div><code style=3D"border-radius=
:3px;border:1px solid #ccc;padding:1px 3px;background:#f6f6f6;font-family:m=
enlo,consolas,monospace;font-size:90%;">relayhostDNS relayUser:relayPasswor=
d</code><br /></div><div><br /></div><div>After specify the
base64-encoded form of <code>\0username\0password I use telnet to check con=
nect and authentification.</code><br /></div><div><br /></div><div>AUTH LOG=
IN authentification wokrs correctly but AUTH PLATN not. I got error from my=
 telnet client:<br /></div><div><code style=3D"border-radius:3px;border:1px=
 solid #ccc;padding:1px 3px;background:#f6f6f6;font-family:menlo,consolas,m=
onospace;font-size:90%;">535 5.7.8 Error: authentification failed: bad prot=
ocol / cancel</code><br /></div><div><br /></div><div>and next logs from se=
rver side:<br /></div><pre style=3D"margin:7px 0;border-radius:3px;border:1=
px solid #ccc;padding:7px 10px;background:#f6f6f6;font-family:menlo,consola=
s,monospace;font-size:90%;white-space:pre-wrap;word-wrap:break-word;overflo=
w-wrap:break-word;">2022-03-04T08:07:49.626134+00:00 mailrelay-0 postfix/sm=
tpd[56]: warning: SASL authentication failure: Can only find author/en (no =
password)
2022-03-04T08:07:49.626159+00:00 mailrelay-0 postfix/smtpd[56]: warning: 10=
-244-20-10.openvpn.openvpn.svc.cluster.local[10.244.20.10]: SASL PLAIN auth=
entication failed: bad protocol / cancel<br /></pre><div><br /></div><div><=
span class=3D"VIiyi" lang=3D"en"><span class=3D"JLqJ4b ChMk0b"><span>Please=
 tell me what could be the problem.</span></span></span><br /></div><div><s=
pan class=3D"VIiyi" lang=3D"en"><span class=3D"JLqJ4b ChMk0b"><span>Thank y=
ou.</span></span></span><br /></div><div id=3D"topicbox-footer" style=3D"ma=
rgin:10px 0 0;border-top:1px solid #ddd;border-color:rgba(0,0,0,.15);paddin=
g:7px 0;">

<strong><a href=3D"https://cyrus.topicbox.com/latest" style=3D"color:inheri=
t;text-decoration:none">Cyrus</a></strong>
  / SASL / see
<a href=3D"https://cyrus.topicbox.com/groups/sasl">discussions</a>
  +
<a href=3D"https://cyrus.topicbox.com/groups/sasl/members">participants</a>
  +
<a href=3D"https://cyrus.topicbox.com/groups/sasl/subscription">delivery&nb=
sp;options</a>
<a href=3D"https://cyrus.topicbox.com/groups/sasl/Td4ec5f3a98565638-M451f86=
db933f5d2a47db38d9" style=3D"float:right">Permalink</a>
</div>
</body></html></html></html>=

--16463837001.dFeEc32C.25455--