Cyrus SASL and Postfix : is it really reading my config files?

"Joel Snyder" <[email protected]> Mon, 20 Mar 2023 14:04:48 -0400
Newsgroups gmane.comp.security.cyrus.sasl
Message-ID <[email protected]>
--16793354881.fD77.936583
Date: Mon, 20 Mar 2023 14:04:48 -0400
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Folks:

I'm trying to use Cyrus SASL as the SASL library for Postfix (v3.5.9) on a =
Rocky Linux 9.1 system.=C2=A0 The Cyrus library that Rocky installed is 2.1=
.27-20 (via Anaconda at system installation).=C2=A0=20

I'm a little hampered because the documentation seems to be in transition, =
and a lot of information (such as where configuration files for services ar=
e) is outdated, but not everywhere.=C2=A0=20

Because this is a small deployment, I have elected to use sasldb and the au=
xprop for a plaintext password database---seemed the simplest approach for =
a community of about 4 users, not all of which are in the /etc/passwd or /e=
tc/shadow file anyway.=C2=A0

As I understand it, Postfix will be asking Cyrus SASL to read the "smtpd.co=
nf" file (because my Postfix config parameter "smtpd_sasl_path" is set to s=
mtpd).=C2=A0 However, I'm not sure that this is really happening.=C2=A0 In =
particular, I have set logging to be 7 (highest level defined in sasl.h) an=
d I don't see any additional logging going on.=C2=A0=20

I'm also trying to enable the MD5 challenge/response authentication methods=
---whether this is legal or not for sasldb is unclear from the documentatio=
n---and adding them to the mech_list doesn't seem to be propagating into Po=
stfix.

Here's my /etc/sasl2/smtpd.conf file:

#/jms/ changed to auxprop to force plaintext file locally
pwcheck_method: auxprop
auxprop_plugin: sasldb
#sasldb_path: <path to sasldb file> (default according to docs is /etc/sasl=
db2)
sasldb_path: /etc/sasl2/sasldb2
#sasldb_mapsize: <size in bytes> (default 1M)
#sasldb_maxreaders: <max threads> (default 128)
log_level: 7
mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5

Is there some other documentation I can consult (other than 'use the source=
, Luke') to figure out whether I'm even going down the right path here?=C2=
=A0=20

Thanks,

Joel Snyder

------------------------------------------
Cyrus: SASL
Permalink: https://cyrus.topicbox.com/groups/sasl/T683dd361f06eb5d3-Mf9ce0a=
80fb07bec10a8823e2
Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription

--16793354881.fD77.936583
Date: Mon, 20 Mar 2023 14:04:48 -0400
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html><html><html><body><div>Folks:<br /></div><div><br /></div><div>I&#39;=
m trying to use Cyrus SASL as the SASL library for Postfix (v3.5.9) on a Ro=
cky Linux 9.1 system.&nbsp; The Cyrus library that Rocky installed is 2.1.2=
7-20 (via Anaconda at system installation).&nbsp; <br /></div><div><br /></=
div><div>I&#39;m a little hampered because the documentation seems to be in=
 transition, and a lot of information (such as where configuration files fo=
r services are) is outdated, but not everywhere.&nbsp; <br /></div><div><br=
 /></div><div>Because this is a small deployment, I have elected to use sas=
ldb and the auxprop for a plaintext password database---seemed the simplest=
 approach for a community of about 4 users, not all of which are in the /et=
c/passwd or /etc/shadow file anyway.&nbsp;<br /></div><div><br /></div><div=
>As I understand it, Postfix will be asking Cyrus SASL to read the &quot;sm=
tpd.conf&quot; file (because my Postfix config parameter &quot;smtpd_sasl_p=
ath&quot; is set to smtpd).&nbsp; However, I&#39;m not sure that this is re=
ally happening.&nbsp; In particular, I have set logging to be 7 (highest le=
vel defined in sasl.h) and I don&#39;t see any additional logging going on.=
&nbsp; <br /></div><div><br /></div><div>I&#39;m also trying to enable the =
MD5 challenge/response authentication methods---whether this is legal or no=
t for sasldb is unclear from the documentation---and adding them to the mec=
h_list doesn&#39;t seem to be propagating into Postfix.<br /></div><div><br=
 /></div><div>Here&#39;s my /etc/sasl2/smtpd.conf file:<br /></div><div><br=
 /></div><div>#/jms/ changed to auxprop to force plaintext file locally<br =
/></div><div>pwcheck_method: auxprop<br /></div><div>auxprop_plugin: sasldb=
<br /></div><div>#sasldb_path: &lt;path to sasldb file&gt; (default accordi=
ng to docs is /etc/sasldb2)<br /></div><div>sasldb_path: /etc/sasl2/sasldb2=
<br /></div><div>#sasldb_mapsize: &lt;size in bytes&gt; (default 1M)<br /><=
/div><div>#sasldb_maxreaders: &lt;max threads&gt; (default 128)<br /></div>=
<div>log_level: 7<br /></div><div>mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD=
5<br /></div><div><br /></div><div>Is there some other documentation I can =
consult (other than &#39;use the source, Luke&#39;) to figure out whether I=
&#39;m even going down the right path here?&nbsp; <br /></div><div><br /></=
div><div>Thanks,<br /></div><div><br /></div><div>Joel Snyder<br /></div><d=
iv><br /></div><div id=3D"topicbox-footer" style=3D"margin:10px 0 0;border-=
top:1px solid #ddd;border-color:rgba(0,0,0,.15);padding:7px 0;">

<strong><a href=3D"https://cyrus.topicbox.com/latest" style=3D"color:inheri=
t;text-decoration:none">Cyrus</a></strong>
  / SASL / see
<a href=3D"https://cyrus.topicbox.com/groups/sasl">discussions</a>
  +
<a href=3D"https://cyrus.topicbox.com/groups/sasl/members">participants</a>
  +
<a href=3D"https://cyrus.topicbox.com/groups/sasl/subscription">delivery&nb=
sp;options</a>
<a href=3D"https://cyrus.topicbox.com/groups/sasl/T683dd361f06eb5d3-Mf9ce0a=
80fb07bec10a8823e2" style=3D"float:right">Permalink</a>
</div>
</body></html></html></html>=

--16793354881.fD77.936583--