New dovecot server, authentication confusion

24 Jan 2021 · _should_


      I've set up a new dovecot+postfix instance with virtual (not system) users.
I've a few questions, mostly about auth.  I /think/ that postfix handles
auth by asking dovecot.
Users need to provide user + password to send (smtps) and receive
(imaps).  I see where I've configured this for dovecot, which is
/etc/dovecot/passwd.db.  That file contains lines like this:
jeff@mobilitains.fr:{BLF-CRYPT}$2y$05$c...
What concerns me is that I see occasional log items like this:
Jan 24 11:26:33 nantes-m1 postfix/smtpd[4597]: fatal: no SASL
authentication mechanisms
(Also, I can't connect with thunderbird.)
But I think I've configured SASL auth, so I'm not sure what to look at /
how to debug this.  I'm looking for suggestions how to approach this.
I do not see how postfix knows who is allowed to connect, however.  Am I
correct that postfix delegates SASL to dovecot?  This is the relevant
config, I think:
[T] jeff@nantes-m1:log $ doveconf -n
# 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.7.2 ()
# OS: Linux 5.4.0-64-generic x86_64 Ubuntu 20.04.1 LTS
# Hostname: nantes-m1.p27.eu
auth_verbose = yes
mail_location = mbox:~/mail:INBOX=/var/mail/%u
mail_privileged_group = mail
namespace inbox {
  inbox = yes
  location =
  mailbox Archive {
    auto = subscribe
    special_use = \Archive
  }
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  prefix =
}
passdb {
  args = username_format=%u scheme=blf-crypt /etc/dovecot/passwd.db
  driver = passwd-file
}
plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve
  sieve_after = /var/mail/vmail/sieve-after
  sieve_before = /var/mail/vmail/sieve-before
  sieve_dir = ~/sieve
}
protocols = " imap"
ssl = required
ssl_cert = &lt;/etc/letsencrypt/live/nantes-m1.p27.eu/fullchain.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
userdb {
  args = uid=4000 gid=4000 home=/var/mail/vmail/%d/%n
  driver = static
}
protocol lda {
  deliver_log_format = msgid=%m: %$
  mail_plugins = sieve
  postmaster_address = postmaster@{{ primary_domain }}
  quota_full_tempfail = yes
  rejection_reason = Your message to &lt;%t> was automatically
rejected:%n%r
}
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
tb-lsub-flags
  mail_max_userip_connections = 20
}
[T] jeff@nantes-m1:log $

[T] jeff@nantes-m1:log $ postconf -n | grep -i sasl
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
reject_unknown_client_hostname,reject_unknown_sender_domain,reject_unknown_recipient_domain,permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,reject_invalid_hostname,reject_non_fqdn_sender
smtpd_relay_restrictions = permit_mynetworks
permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot

[T] jeff@nantes-m1:log $ postconf -Mf
smtp       inet  n       -       y       -       -       smtpd
submission inet  n       -       y       -       -       smtpd
    -o syslog_name=postfix/submission
    -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=
    -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    -o milter_macro_daemon_name=ORIGINATING
smtps      inet  n       -       y       -       -       smtpd
    -o syslog_name=postfix/smtps
    -o smtpd_tls_wrappermode=yes
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_reject_unlisted_recipient=no
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=
    -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    -o milter_macro_daemon_name=ORIGINATING
...
Many thanks for any pointers.
I'm also a bit confused on how to test it, really, short of connecting
with a regular email client (mutt, thunderbird, etc.).  If there are
more appropriate tools that I've missed, I'm quite open to pointers.
--
Jeff Abrahamson
+33 6 24 40 01 57
+44 7920 594 255
http://p27.eu/jeff/
http://transport-nantes.com/

Jeff Abrahamson

Jeff Abrahamson

Christian Kivalo

tags

participants (2)