Podstawowa konfiguracja z wykorzystaniem PAM.
Cyrus SASL
Zainstaluj:
xbps-install -Suv cyrus-sasl cyrus-sasl-modules
Skonfiguruj SMTP:
/etc/sasl2/smtpd.conf:
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN
saslauthd_path: /var/run/saslauthd/mux
autotransition:true
log_level: 7
Ustaw PAM:
/etc/pam.d/smtp:
#%PAM-1.0
auth required pam_unix.so
account required pam_unix.so
Zobacz wersję:
saslauthd -v
saslauthd 2.1.28
authentication mechanisms: sasldb getpwent kerberos5 pam rimap shadow ldap
Uruchom:
saslauthd -d -a pam
saslauthd[22126] :num_procs : 5
saslauthd[22126] :mech_option: NULL
saslauthd[22126] :run_path : /run/saslauthd
saslauthd[22126] :auth_mech : pam
saslauthd[22126] :using accept lock file: /run/saslauthd/mux.accept
saslauthd[22126] :master pid is: 0
saslauthd[22126] :listening on socket: /run/saslauthd/mux
saslauthd[22126] :using process model
saslauthd[22126] :forked child: 22227
saslauthd[22126] :forked child: 22228
saslauthd[22127] :acquired accept lock
saslauthd[22126] :forked child: 22229
saslauthd[22126] :forked child: 22230
saslauthd[22128] :acquired accept lock
saslauthd[22127] :released accept lock
Przetestuj:
testsaslauthd -u jdoe -p ElevenBenevolentElephants -s smtp
0: OK "Success."
W logach zobaczysz:
saslauthd[22128] :auth success: [user=jdoe] [service=smtp] [realm=] [mech=pam]
saslauthd[22128] :response: OK
Postfix
W Postfiksie opcja cyrus_sasl_config_path jest domyślnie pusta. Ścieżka do
konfiguracji Cyrus SASL jest wkompilowana w bibliotekę (w 2.1.28 to
/etc/sasl2/) i Postfix tam właśnie szuka.
Można wpisać ścieżkę do własnej konfiguracji, np.:
/etc/postfix/main.cf:
cyrus_sasl_config_path = /etc/postfix/sasl/
Konfiguracja submission w /etc/postfix/master.cf:
[...]
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_auth_only=yes
# -o local_header_rewrite_clients=static:all
# -o smtpd_reject_unlisted_recipient=no
# Instead of specifying complex smtpd_<xxx>_restrictions here,
# specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
# here, and specify mua_<xxx>_restrictions in main.cf (where
# "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
# -o smtpd_client_restrictions=
# -o smtpd_helo_restrictions=
# -o smtpd_sender_restrictions=
# -o smtpd_relay_restrictions=
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
[...]
sv restart postfix
Ostrzeżenie
Jeśli nie zainstalujesz modułów zobaczysz w logach coś w tym stylu:
[postfix/submission/smtpd] warning: SASL authentication failure: Internal Error -4 in server.c near line 1765
[postfix/submission/smtpd] warning: xsasl_cyrus_server_get_mechanism_list: no mechanism available
[postfix/submission/smtpd] fatal: no SASL authentication mechanisms