0

when I use cyrus sasl to auth postfix, meet 454 4.7.0 Temporary authentication failure: generic failure. auth chain was telnet -> postfix -> sasl -> pam -> mysql ps: I found if I start saslauthd with shadow method, testsaslauthd can test ubuntu system login success, but change to pam, it failed, so authentication failure caused by pam ?

1.OS

Ubuntu 16.04.03 Gnome

2. Software version

postfix-3.2.2
cyrus-sasl-2.1.26
Linux-PAM-1.3.0
mariadb-10.2.7
openldap-2.4.45 
openssl-1.1.0f
dovecot-2.2.31

all these software was installed by compilied from source code.

3.configure file contents

vim /etc/default/saslauthd

START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="pam"
MECH_OPTIONS=""
THREADS=5
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"

vim /etc/pam.d/smtp

auth    required   pam_mysql.so user=mail_admin passwd=password-for-mail_admin host=127.0.0.1 db=mail table=users usercolumn=email passwdcolumn=password crypt=1
account sufficient pam_mysql.so user=mail_admin passwd=password-for-mail_admin host=127.0.0.1 db=mail table=users usercolumn=email passwdcolumn=password crypt=1

vim /etc/postfix/sasl/smtpd.conf

pwcheck_method: saslauthd
mech_list: plain login
allow_plaintext: true
auxprop_plugin: sql
sql_engine: mysql
sql_hostnames: 127.0.0.1
sql_user: mail_admin
sql_passwd: password-for-mail_admin
sql_database: mail
sql_select: select password from users where email = '%u@%r'

vim /etc/postfix/master.cf

canceled submission comments
submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=$mua_client_restrictions
  -o milter_macro_daemon_name=ORIGINATING

and and below at last
dovecot   unix  -       n       n       -       -       pipe
    flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}

vim /etc/postfix/main.cf

compatibility_level = 2
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
#default_privs = nobody
myhostname = localhost
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4
#mynetworks_style = subnet
mynetworks = 127.0.0.0/8, 192.168.0.0/24, 192.168.3.0/24, 192.168.1.0/24,hash:/etc/postfix/access
#masquerade_domains = mail.example.com www.example.com
#masquerade_exceptions = root
mydestination = example.com, localhost, localhost.localdomain
#relay_domains = $mydestination
#relayhost = $isp.com

notify_classes=2bounce, policy, protocol, software, resource
debug_peer_level = 2
debug_peer_list = 127.0.0.1
debugger_command =
     PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
     ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
html_directory = /usr/share/doc/postfix-3.2.2/html
manpage_directory = /usr/share/man
sample_directory = /etc/postfix
readme_directory = /usr/share/doc/postfix-3.2.2/readme
meta_directory = /etc/postfix
shlib_directory = no

smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
#smtpd_tls_CAfile = /etc/postfix/CAcert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
allow_untrusted_routing = no

smtpd_sasl_type = cyrus
cyrus_sasl_config_path = /etc/postfix/sasl
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = example.com
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = smtpd

smtpd_sender_login_maps = mysql:/etc/postfix/mysql_sender_login_maps.cf
#smtpd_recipient_restrictions=check_sender_access hash:/etc/postfix/sender_access,permit_mynetworks,mysql:/etc/postfix/mysql_smtpd_sender_limit.cf,reject_sender_login_mismatch,eermit_sasl_authenticated,permit_auth_destination, reject
#smtpd_client_restrictions = mysql:/etc/postfix/mysql_smtpd_client_limit.cf,permit_sasl_authenticated
#smtpd_sender_restrictions = permit_mynetworks,mysql:/etc/postfix/mysql_smtpd_sender_limit.cf,reject_sender_login_mismatch,permit_sasl_authenticated,reject_unknown_sender_domain
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_exceptions_networks = !192.168.0.0/24, 192.168.1.0/24,192.168.2.0/24,192.168.3.0/24
#smtpd_restriction_classes = local_only
#local_only = check_recipient_access hash:/etc/postfix/local_domains,reject

smtpd_delay_reject=yes
disable_vrfy_command =yes
#smtpd_helo_restrictions = mysql:/etc/postfix/mysql_smtpd_client_limit.cf,mysql:/etc/postfixsmtpd_recipient_limitmysql_smtpd_helo_limit.cf
smtpd_helo_required = yes

maximal_queue_lifetime = 6h
queue_run_delay = 3600s

fallback_relay = mysql:/etc/postfix/mysql_fallbackrelay.cf
smtpd_hard_error_limit = 10

smtpd_client_connection_count_limit=200
smtp_data_done_timeout=3600
smtp_data_init_timeout=3600
smtp_data_xfer_timeout=3600
hopcount_limit = 50
always_add_missing_headers = yes
unknown_local_recipient_reject_code = 450

local_recipient_maps = 
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases

virtual_alias_domains =
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /home/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks 
home_mailbox=Maildir/

message_size_limit = 30720000
mailbox_size_limit = 62222222
bounce_size_limit = 50000

virtual_transport = dovecot
local_transport = dovecot
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

4.log files saslfinger -s

saslfinger - postfix Cyrus sasl configuration Sun Aug 27 19:12:41 CST 2017
version: 1.0.4
mode: server-side SMTP AUTH

-- basics --
Postfix: 3.2.2
System: Ubuntu 16.04.3 LTS \n \l

-- smtpd is linked to --
    libsasl2.so.3 => /usr/lib/libsasl2.so.3 (0x00007f566b162000)

-- active SMTP AUTH and TLS parameters for smtpd --
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_exceptions_networks = !192.168.0.0/24, 192.168.1.0/24,192.168.2.0/24,192.168.3.0/24
smtpd_sasl_local_domain = example.com
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = cyrus
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes


-- listing of /usr/lib/sasl2 --
total 3788
drwxr-xr-x   2 root root   4096 Aug 27 16:55 .
drwxr-xr-x 189 root root  20480 Aug 27 16:55 ..
-rwxr-xr-x   1 root root    684 Aug 27 16:55 libanonymous.la
-rwxr-xr-x   1 root root  73088 Aug 27 16:55 libanonymous.so
-rwxr-xr-x   1 root root  73088 Aug 27 16:55 libanonymous.so.3
-rwxr-xr-x   1 root root  73088 Aug 27 16:55 libanonymous.so.3.0.0
-rwxr-xr-x   1 root root    672 Aug 27 16:55 libcrammd5.la
-rwxr-xr-x   1 root root  84752 Aug 27 16:55 libcrammd5.so
-rwxr-xr-x   1 root root  84752 Aug 27 16:55 libcrammd5.so.3
-rwxr-xr-x   1 root root  84752 Aug 27 16:55 libcrammd5.so.3.0.0
-rwxr-xr-x   1 root root    693 Aug 27 16:55 libdigestmd5.la
-rwxr-xr-x   1 root root 218144 Aug 27 16:55 libdigestmd5.so
-rwxr-xr-x   1 root root 218144 Aug 27 16:55 libdigestmd5.so.3
-rwxr-xr-x   1 root root 218144 Aug 27 16:55 libdigestmd5.so.3.0.0
-rwxr-xr-x   1 root root    704 Aug 27 16:55 libgs2.la
-rwxr-xr-x   1 root root 130464 Aug 27 16:55 libgs2.so
-rwxr-xr-x   1 root root 130464 Aug 27 16:55 libgs2.so.3
-rwxr-xr-x   1 root root 130464 Aug 27 16:55 libgs2.so.3.0.0
-rwxr-xr-x   1 root root    734 Aug 27 16:55 libgssapiv2.la
-rwxr-xr-x   1 root root 122640 Aug 27 16:55 libgssapiv2.so
-rwxr-xr-x   1 root root 122640 Aug 27 16:55 libgssapiv2.so.3
-rwxr-xr-x   1 root root 122640 Aug 27 16:55 libgssapiv2.so.3.0.0
-rwxr-xr-x   1 root root    668 Aug 27 16:55 liblogin.la
-rwxr-xr-x   1 root root  76808 Aug 27 16:55 liblogin.so
-rwxr-xr-x   1 root root  76808 Aug 27 16:55 liblogin.so.3
-rwxr-xr-x   1 root root  76808 Aug 27 16:55 liblogin.so.3.0.0
-rwxr-xr-x   1 root root    657 Aug 27 16:55 libotp.la
-rwxr-xr-x   1 root root 205728 Aug 27 16:55 libotp.so
-rwxr-xr-x   1 root root 205728 Aug 27 16:55 libotp.so.3
-rwxr-xr-x   1 root root 205728 Aug 27 16:55 libotp.so.3.0.0
-rwxr-xr-x   1 root root    668 Aug 27 16:55 libplain.la
-rwxr-xr-x   1 root root  76296 Aug 27 16:55 libplain.so
-rwxr-xr-x   1 root root  76296 Aug 27 16:55 libplain.so.3
-rwxr-xr-x   1 root root  76296 Aug 27 16:55 libplain.so.3.0.0
-rwxr-xr-x   1 root root    669 Aug 27 16:55 libscram.la
-rwxr-xr-x   1 root root 148848 Aug 27 16:55 libscram.so
-rwxr-xr-x   1 root root 148848 Aug 27 16:55 libscram.so.3
-rwxr-xr-x   1 root root 148848 Aug 27 16:55 libscram.so.3.0.0
-rwxr-xr-x   1 root root    687 Aug 27 16:55 libsql.la
-rwxr-xr-x   1 root root 114808 Aug 27 16:55 libsql.so
-rwxr-xr-x   1 root root 114808 Aug 27 16:55 libsql.so.3
-rwxr-xr-x   1 root root 114808 Aug 27 16:55 libsql.so.3.0.0

-- listing of /etc/postfix/sasl --
total 12
drwxr-xr-x 2 root root 4096 Aug 19 15:31 .
drwxr-xr-x 4 root root 4096 Aug 27 17:26 ..
-rw-r--r-- 1 root root  257 Aug 19 15:31 smtpd.conf




-- content of /etc/postfix/sasl/smtpd.conf --
pwcheck_method: saslauthd
mech_list: plain login
allow_plaintext: true
auxprop_plugin: sql
sql_engine: mysql
sql_hostnames: 127.0.0.1
sql_user: --- replaced ---
sql_passwd: --- replaced ---
sql_database: mail
sql_select: select password from users where email = '%u@%r'

-- content of /etc/postfix/sasl/smtpd.conf --
pwcheck_method: saslauthd
mech_list: plain login
allow_plaintext: true
auxprop_plugin: sql
sql_engine: mysql
sql_hostnames: 127.0.0.1
sql_user: --- replaced ---
sql_passwd: --- replaced ---
sql_database: mail
sql_select: select password from users where email = '%u@%r'


-- active services in /etc/postfix/master.cf --
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
smtp      inet  n       -       n       -       -       smtpd -v
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  #-o smtpd_client_restrictions=$mua_client_restrictions
  #-o smtpd_helo_restrictions=$mua_helo_restrictions
  #-o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
pickup    unix  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache
devocot    unix  -       n       n       -       -       pipe
   flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}

-- mechanisms on localhost --
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
-- end of saslfinger output --

vim /var/log/mail.log

Aug 27 17:48:44 tiger postfix/smtpd[17580]: warning: localhost[127.0.0.1]: SASL login authentication failed: generic failure
Aug 27 17:48:44 tiger postfix/smtpd[17580]: > localhost[127.0.0.1]: 454 4.7.0 Temporary authentication failure: generic failure

telnet localhost 25

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 localhost ESMTP Postfix
ehlo localhost
250-localhost
250-PIPELINING
250-SIZE 30720000
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 SMTPUTF8
AUTH PLAIN AHRlc3QxQHhpZWRlYWNjLmNvbQBxaDYyODhRSFc=
454 4.7.0 Temporary authentication failure: generic failure

5.process status

mysql
ps -fe | grep mysql
root     15826     1  0 17:21 ?        00:00:00 /bin/sh /usr/local/mariadb/bin/mysqld_safe --defaults-file=/usr/local/mariadb/etc/my_3306.cnf --basedir=/usr/local/mariadb --datadir=/usr/local/mariadb/data/3306/data/dbdata_raw/data --log-error=/usr/local/mariadb/data/3306/logs/dblogs/mysqld.err --open-files-limit=65535 --pid-file=/usr/local/mariadb/data/3306/prod/mysql.pid --socket=/usr/local/mariadb/data/3306/prod/mysql.sock --port=3306 --user=mysql
mysql    16280 15826  0 17:21 ?        00:00:08 /usr/local/mariadb/bin/mysqld --defaults-file=/usr/local/mariadb/etc/my_3306.cnf --basedir=/usr/local/mariadb --datadir=/usr/local/mariadb/data/3306/data/dbdata_raw/data --plugin-dir=/usr/local/mariadb/lib/plugin --user=mysql --log-error=/usr/local/mariadb/data/3306/logs/dblogs/mysqld.err --open-files-limit=65535 --pid-file=/usr/local/mariadb/data/3306/prod/mysql.pid --socket=/usr/local/mariadb/data/3306/prod/mysql.sock --port=3306
root     19029  5101  0 19:16 pts/0    00:00:00 grep --color=auto mysql

saslauthd
ps -fe | grep sasl 
root      1408     1  0 16:07 ?        00:00:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root      1438  1408  0 16:07 ?        00:00:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root      1439  1408  0 16:07 ?        00:00:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root      1440  1408  0 16:07 ?        00:00:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5
root      1441  1408  0 16:07 ?        00:00:00 /usr/sbin/saslauthd -a pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5

postfix
ps -fe | grep postfix
root      2255     1  0 16:07 ?        00:00:00 /usr/lib/postfix/master -w
postfix  16796  2255  0 17:26 ?        00:00:00 qmgr -l -t unix -u
postfix  17581  2255  0 17:45 ?        00:00:00 tlsmgr -l -t unix -u
postfix  18865  2255  0 18:58 ?        00:00:00 trivial-rewrite -n rewrite -t unix -u
postfix  18922  2255  0 19:07 ?        00:00:00 pickup -l -t unix -u
postfix  19034  2255  0 19:17 ?        00:00:00 cleanup -z -t unix -u
root     19043  5101  0 19:18 pts/0    00:00:00 grep --color=auto postfix

dovecot
ps -fe | grep dovecot
root      1391     1  0 16:07 ?        00:00:00 /usr/sbin/dovecot
dovecot   1392  1391  0 16:07 ?        00:00:00 dovecot/anvil
root      1393  1391  0 16:07 ?        00:00:00 dovecot/log
root      1395  1391  0 16:07 ?        00:00:00 dovecot/config

thanks~

0

I have fixed it by updating libpam-mysql, since the package version in ubuntu 16.04 was too low.

Manual download libpam-mysql from https://packages.ubuntu.com/zesty/libpam-mysql, and install it.

Be aware that this version is not tested in 16.04 and therefore not recommended for production use.

  • 4
    How did you do that? Please edit your answer to add some detail that will help others solve the same problem – Zanna Sep 3 '17 at 6:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.