Cyrus SASL and Postfix : is it really reading my config files?
"Joel Snyder" <[email protected]> Mon, 20 Mar 2023 14:04:48 -0400
| Newsgroups | gmane.comp.security.cyrus.sasl |
|---|---|
| Message-ID | <[email protected]> |
--16793354881.fD77.936583 Date: Mon, 20 Mar 2023 14:04:48 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Folks: I'm trying to use Cyrus SASL as the SASL library for Postfix (v3.5.9) on a = Rocky Linux 9.1 system.=C2=A0 The Cyrus library that Rocky installed is 2.1= .27-20 (via Anaconda at system installation).=C2=A0=20 I'm a little hampered because the documentation seems to be in transition, = and a lot of information (such as where configuration files for services ar= e) is outdated, but not everywhere.=C2=A0=20 Because this is a small deployment, I have elected to use sasldb and the au= xprop for a plaintext password database---seemed the simplest approach for = a community of about 4 users, not all of which are in the /etc/passwd or /e= tc/shadow file anyway.=C2=A0 As I understand it, Postfix will be asking Cyrus SASL to read the "smtpd.co= nf" file (because my Postfix config parameter "smtpd_sasl_path" is set to s= mtpd).=C2=A0 However, I'm not sure that this is really happening.=C2=A0 In = particular, I have set logging to be 7 (highest level defined in sasl.h) an= d I don't see any additional logging going on.=C2=A0=20 I'm also trying to enable the MD5 challenge/response authentication methods= ---whether this is legal or not for sasldb is unclear from the documentatio= n---and adding them to the mech_list doesn't seem to be propagating into Po= stfix. Here's my /etc/sasl2/smtpd.conf file: #/jms/ changed to auxprop to force plaintext file locally pwcheck_method: auxprop auxprop_plugin: sasldb #sasldb_path: <path to sasldb file> (default according to docs is /etc/sasl= db2) sasldb_path: /etc/sasl2/sasldb2 #sasldb_mapsize: <size in bytes> (default 1M) #sasldb_maxreaders: <max threads> (default 128) log_level: 7 mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5 Is there some other documentation I can consult (other than 'use the source= , Luke') to figure out whether I'm even going down the right path here?=C2= =A0=20 Thanks, Joel Snyder ------------------------------------------ Cyrus: SASL Permalink: https://cyrus.topicbox.com/groups/sasl/T683dd361f06eb5d3-Mf9ce0a= 80fb07bec10a8823e2 Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription --16793354881.fD77.936583 Date: Mon, 20 Mar 2023 14:04:48 -0400 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE html> <html><html><html><body><div>Folks:<br /></div><div><br /></div><div>I'= m trying to use Cyrus SASL as the SASL library for Postfix (v3.5.9) on a Ro= cky Linux 9.1 system. The Cyrus library that Rocky installed is 2.1.2= 7-20 (via Anaconda at system installation). <br /></div><div><br /></= div><div>I'm a little hampered because the documentation seems to be in= transition, and a lot of information (such as where configuration files fo= r services are) is outdated, but not everywhere. <br /></div><div><br= /></div><div>Because this is a small deployment, I have elected to use sas= ldb and the auxprop for a plaintext password database---seemed the simplest= approach for a community of about 4 users, not all of which are in the /et= c/passwd or /etc/shadow file anyway. <br /></div><div><br /></div><div= >As I understand it, Postfix will be asking Cyrus SASL to read the "sm= tpd.conf" file (because my Postfix config parameter "smtpd_sasl_p= ath" is set to smtpd). However, I'm not sure that this is re= ally happening. In particular, I have set logging to be 7 (highest le= vel defined in sasl.h) and I don't see any additional logging going on.= <br /></div><div><br /></div><div>I'm also trying to enable the = MD5 challenge/response authentication methods---whether this is legal or no= t for sasldb is unclear from the documentation---and adding them to the mec= h_list doesn't seem to be propagating into Postfix.<br /></div><div><br= /></div><div>Here's my /etc/sasl2/smtpd.conf file:<br /></div><div><br= /></div><div>#/jms/ changed to auxprop to force plaintext file locally<br = /></div><div>pwcheck_method: auxprop<br /></div><div>auxprop_plugin: sasldb= <br /></div><div>#sasldb_path: <path to sasldb file> (default accordi= ng to docs is /etc/sasldb2)<br /></div><div>sasldb_path: /etc/sasl2/sasldb2= <br /></div><div>#sasldb_mapsize: <size in bytes> (default 1M)<br /><= /div><div>#sasldb_maxreaders: <max threads> (default 128)<br /></div>= <div>log_level: 7<br /></div><div>mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD= 5<br /></div><div><br /></div><div>Is there some other documentation I can = consult (other than 'use the source, Luke') to figure out whether I= 'm even going down the right path here? <br /></div><div><br /></= div><div>Thanks,<br /></div><div><br /></div><div>Joel Snyder<br /></div><d= iv><br /></div><div id=3D"topicbox-footer" style=3D"margin:10px 0 0;border-= top:1px solid #ddd;border-color:rgba(0,0,0,.15);padding:7px 0;"> <strong><a href=3D"https://cyrus.topicbox.com/latest" style=3D"color:inheri= t;text-decoration:none">Cyrus</a></strong> / SASL / see <a href=3D"https://cyrus.topicbox.com/groups/sasl">discussions</a> + <a href=3D"https://cyrus.topicbox.com/groups/sasl/members">participants</a> + <a href=3D"https://cyrus.topicbox.com/groups/sasl/subscription">delivery&nb= sp;options</a> <a href=3D"https://cyrus.topicbox.com/groups/sasl/T683dd361f06eb5d3-Mf9ce0a= 80fb07bec10a8823e2" style=3D"float:right">Permalink</a> </div> </body></html></html></html>= --16793354881.fD77.936583--