postfix with sasl2, mysql

[alex black]

Hi all,

I've gone on a postfix odyssey without much success. :) I emailed norbert

There's already a maybe fixed backported postfix with sasl2 support,
check the mailinglist archive from the last days.

I did, here:

http://lists.backports.org/pipermail/backports/2004-April/000490.html

I saw the deb line, and added it without modifications to
/etc/apt/sources.list

deb http://www.backports.org/temp/postfix/ ./

It _looked_ right, but I should insert a caveat here: I'm an experienced
linux user, but not so experienced with debian and the particulars of apt.
So I installed postfix from what what looked (almost certainly was) that
temp directory on backports, and as the simulated run said, tls was removed.
(see below for a detailed log)

Of course SSL stopped working immediately (which is fine, since SSL without
MySQL auth isn't much use to me... I need both).

I tried to install tls. I can see the package in the temp directory. But it
wouldn't go because of libsasl2.!

Figured that maybe it was because ./ in that previous deb line was blocking
all other package attempts. So I commented it out:

#deb http://www.backports.org/temp/postfix/ ./

Still, nothing.
So I googled:

http://packages.debian.org/unstable/libs/libsasl2

Ugh, it's in unstable... So... Do I install libsasl2 from unstable?

Or...?

At that point I decided to stop and mail this list instead of banging my
head against the wall. I have postfix installed from norbert's temp debs, no
tls, does have mysql. I'm using courier's authdaemon for virtual mail
domains. I want to be able to use authenticated SMTP over SSL with virtual
users...

Should I install TLS?
If so, how? (given that I tried and it didn't work)
Should I install libsasl2 (would seem so!) - if so, how (i.e. From where?)
Should I configure authentication for SMTP through PAM? Or?

Maybe, one day, there will be a "virtmail" package for debian that will
install easily and do _only_ pop3-ssl, imap-ssl, smtp-ssl/sasl against mysql
or ldap ... Ahh...

Thanks for any help, and I hope this message is useful to people searching
the web :)

_a


log below:


==========================================================
***@ziji root> apt-get --simulate install postfix
Reading Package Lists... Done
Building Dependency Tree... Done
The following extra packages will be installed:
postfix-mysql
The following packages will be REMOVED:
postfix-tls
2 packages upgraded, 0 newly installed, 1 to remove and 66 not upgraded.
Remv postfix-tls (2.0.19-0.backports.org.3 www.backports.org)
Inst postfix-mysql (2.0.19-0.backports.org.3 www.backports.org) []
Inst postfix (2.0.19-0.backports.org.3 www.backports.org)
Conf postfix (2.0.19-0.backports.org.3 www.backports.org)
Conf postfix-mysql (2.0.19-0.backports.org.3 www.backports.org)
==========================================================

Ok, looks good, go:

==========================================================
***@ziji root> apt-get install postfix
Reading Package Lists... Done
Building Dependency Tree... Done
The following extra packages will be installed:
postfix-mysql
The following packages will be REMOVED:
postfix-tls
2 packages upgraded, 0 newly installed, 1 to remove and 66 not upgraded.
Need to get 645kB of archives. After unpacking 352kB will be freed.
Do you want to continue? [Y/n] Y
Get:1 http://www.backports.org ./ postfix-mysql 2.0.19-0.backports.org.3
[29.0kB]
Get:2 http://www.backports.org ./ postfix 2.0.19-0.backports.org.3 [616kB]
Fetched 645kB in 2s (257kB/s)
Preconfiguring packages ...
(Reading database ... 30457 files and directories currently installed.)
Removing postfix-tls ...
dpkg - warning: while removing postfix-tls, directory `/etc/postfix/sasl'
not empty so not removed.
Removing `diversion of /usr/lib/postfix/lmtp to
/usr/lib/postfix/lmtp.postfix by postfix-tls'
Removing `diversion of /usr/lib/postfix/smtp to
/usr/lib/postfix/smtp.postfix by postfix-tls'
Removing `diversion of /usr/lib/postfix/smtpd to
/usr/lib/postfix/smtpd.postfix by postfix-tls'
(Reading database ... 30454 files and directories currently installed.)
Preparing to replace postfix-mysql 2.0.19-0.backports.org.2 (using
.../postfix-mysql_2.0.19-0.backports.org.3_i386.deb) ...
Unpacking replacement postfix-mysql ...
Preparing to replace postfix 2.0.19-0.backports.org.2 (using
.../postfix_2.0.19-0.backports.org.3_i386.deb) ...
Stopping mail transport agent: Postfix.
Leaving `diversion of /usr/share/man/man8/smtpd.8.gz to
/usr/share/man/man8/smtpd.real.8.gz by postfix'
Unpacking replacement postfix ...
Setting up postfix (2.0.19-0.backports.org.3) ...

Postfix configuration was not changed. If you need to make changes, edit
/etc/postfix/main.cf (and others) as needed. To view Postfix configuration
values, see postconf(1).

After modifying main.cf, be sure to run '/etc/init.d/postfix reload'.

Running newaliases
postalias: warning: /etc/aliases.db: duplicate entry: "news"
Starting mail transport agent: Postfix.

Setting up postfix-mysql (2.0.19-0.backports.org.3) ...
==========================================================

So, TLS was nuked, ssl stops working as expected. Mail still works though!
:) Reinstall TLS?

==========================================================
***@ziji root> apt-get install postfix-tls
Reading Package Lists... Done
Building Dependency Tree... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.

Since you only requested a single operation it is extremely likely that
the package is simply not installable and a bug report against
that package should be filed.
The following information may help to resolve the situation:

Sorry, but the following packages have unmet dependencies:
postfix-tls: Depends: libsasl2 (>= 2.1.18) but it is not installable
E: Sorry, broken packages
==========================================================
Okee... Just for yuks try and install libsasl2 (which I thought I had?)

==========================================================
***@ziji root> apt-get install libsasl2
Reading Package Lists... Done
Building Dependency Tree... Done
Package libsasl2 has no available version, but exists in the database.
This typically means that the package was mentioned in a dependency and
never uploaded, has been obsoleted or is not available with the contents
of sources.list
E: Package libsasl2 has no installation candidate
==========================================================

[Norbert Tretkowski]

Post by alex black
Ugh, it's in unstable... So... Do I install libsasl2 from unstable?

No, just use this line in your sources.list:

deb http://www.backports.or/debian woody cyrus-sasl2

Norbert

[alex black]

Ok,

I have now successfully installed

libsasl2
postfix-tls (from the temp area)

SSL does appear to work, but now *(sort of as expected)* - sasl fails with
"no mechanisms"

So... how do you configure them? I've tried :)

I'm trying to use pam with mysql through saslauthd.

When I try to send mail, the connection stalls on Login attempt.

Apr 15 12:48:23 ziji postfix/smtpd[18367]: fatal: no SASL authentication
mechanisms
Apr 15 12:48:23 ziji postfix/smtpd[18368]: fatal: no SASL authentication
mechanisms

So I tried:

testsaslauthd -u '***@example.com' -p 'mypass' -s smtp
0: NO "authentication failed"

tail auth.log

Apr 15 12:49:50 ziji saslauthd[12060]: DEBUG: auth_pam: pam_authenticate
failed: Permission denied
Apr 15 12:49:50 ziji saslauthd[12060]: do_auth : auth failure:
[user=***@turingstudio.com] [service=smtp] [realm=] [mech=pam]
[reason=PAM auth error]

Permission denied to what? :) To the user for authentication, or to the
database for pam trying to login... Etc.

cd /var/spool/postfix/etc/pam.d/
cat smtp

auth required pam_mysql.so user=myuser passwd=mypass host=localhost
db=postfix table=mailbox usercolumn=username passwdcolumn=password crypt=1

account sufficient pam_mysql.so user=myuser passwd=mypass host=localhost
db=postfix table=mailbox usercolumn=username passwdcolumn=password crypt=1


I know this connection info and table info is correct because I tested it:

use postfix
desc mailbox;

+-------------+--------------+------+-----+---------------------+-------+
| Field | Type | Null | Key | Default | Extra |
+-------------+--------------+------+-----+---------------------+-------+
| username | varchar(255) | | PRI | | |
| password | varchar(255) | | | | |
| name | varchar(255) | | | | |
| maildir | varchar(255) | | | | |
| domain | varchar(255) | | | | |
| create_date | datetime | | | 0000-00-00 00:00:00 | |
| change_date | datetime | | | 0000-00-00 00:00:00 | |
| active | tinyint(4) | | | 1 | |
+-------------+--------------+------+-----+---------------------+-------+

This is the schema used by authdaemond (for virtual users).

So.........

I'm at a loss here. Does PAM log somewhere I don't know about?

Can I even test PAM independently? (seems ridiculous that I couldn't!)

Any help much appreciated.
This is by far the most frustrating installation on unix I have ever
experienced. A lot of this setup is really, _really_ dumb. :)

Best,

_alex