postfix & saslauth – quick and dirty

2017/08/31 Written by Gabriele

Questa va nel novero delle attività rapide: “20 minuti e faccio tutto” ma, dopo 3 ore, mi ritrovo irrimediabilmente ancora a litigare con la tastiera…

Partiamo dal principio. Telecamera ip cinesissima, la cui interfaccia web può essere configurata con un server di posta remoto per mandare gli alert.

Come server smtp potrei usare google/yahoo, mettere le mie credenziali e tutto dovrebbe funzionare. Diciamo però che di questo firmware cinese non mi fido e non voglio salvare al suo interno dei dati “sensibili”. Inoltre, sulla stessa rete privata della telecamera, c’è un fantastico Raspberry Pi 3 con Raspbian 8: in poco tempo in teoria ci si può installare un bel server di posta solo per le mail della telecamera, e poi chissà, magari torna utile anche per qualcos’ altro.

CONFIGURAZIONI DI BASE

Parto da un banale

root@p3gab:]# apt-get install postfix

1	root@p3gab:]# apt-get install postfix

Dopo l’installazione, parte una procedura guidata di configurazione. Visto che postfix lo conosco molto bene scelgo: “No Configuration”. Così facendo però non crea neppure il file /etc/postfix/main.cf (mi ha preso in parola insomma).
Rilancio la procedura guidata di configurazione

root@p3gab:]# dpkg-reconfigure postfix

1	root@p3gab:]# dpkg-reconfigure postfix

e questa volta scelgo

Local only: │<br /> │ The only delivered mail is the mail for local users. There is no network.

1 2	Local only:                                                                  │                           │   The only delivered mail is the mail for local users. There is no network.

Lascio tutto di default tranne

Please specify the network blocks for which this host should relay mail. The default is just the local host, which is needed │<br /> │ by some mail user agents. The default includes local host for both IPv4 and IPv6. If just connecting via one IP version, the │<br /> │ unused value(s) may be removed.<br /> 127.0.0.0/8 192.168.1.0/24

1 2 3 4

Please specify the network blocks for which this host should relay mail. The default is just the local host, which is needed   │   │ by some mail user agents. The default includes local host for both IPv4 and IPv6. If just connecting via one IP version, the   │   │ unused value(s) may be removed.                       127.0.0.0/8 192.168.1.0/24

dove tolgo le parti IPv6 e aggiungo l’indirizzo della rete locale (192.168.1.0/24).

root@p3gab:]# dpkg-reconfigure postfix<br /> Removing tcp map entry from /etc/postfix/dynamicmaps.cf<br /> Removing sqlite map entry from /etc/postfix/dynamicmaps.cf<br /> setting synchronous mail queue updates: false<br /> setting myhostname: p3gab<br /> setting alias maps<br /> setting alias database<br /> mailname is not a fully qualified domain name. Not changing /etc/mailname.<br /> setting destinations: p3gab, localhost.localdomain, localhost<br /> setting relayhost:<br /> setting mynetworks: 127.0.0.0/8 192.168.1.0/24<br /> setting mailbox_size_limit: 0<br /> setting recipient_delimiter: +<br /> setting inet_interfaces: loopback-only<br /> setting default_transport: error<br /> setting relay_transport: error<br /> setting inet_protocols: ipv4<br /> WARNING: /etc/aliases exists, but does not have a root alias.</p> <p>Postfix is now set up with a default configuration. If you need to make<br /> changes, edit<br /> /etc/postfix/main.cf (and others) as needed. To view Postfix configuration

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

root@p3gab:]# dpkg-reconfigure postfix Removing tcp map entry from /etc/postfix/dynamicmaps.cf Removing sqlite map entry from /etc/postfix/dynamicmaps.cf setting synchronous mail queue updates: false setting myhostname: p3gab setting alias maps setting alias database mailname is not a fully qualified domain name.  Not changing /etc/mailname. setting destinations: p3gab, localhost.localdomain, localhost setting relayhost: setting mynetworks: 127.0.0.0/8 192.168.1.0/24 setting mailbox_size_limit: 0 setting recipient_delimiter: + setting inet_interfaces: loopback–only setting default_transport: error setting relay_transport: error setting inet_protocols: ipv4 WARNING: /etc/aliases exists, but does not have a root alias. Postfix is now set up with a default configuration.  If you need to make changes, edit /etc/postfix/main.cf (and others) as needed.  To view Postfix configuration

Così facendo, come mi aveva anticipato quando ho scelto il preset “Local Only”, postfix si mette in ascolto solo in localhost. Io devo però servire anche la rete locale e gli altri dispositivi ad essa connessi, per cui postfix deve stare in ascolto sull’interfaccia ethernet.

Modifico quindi /etc/postfix/main.cf in questo modo

inet_interfaces = $myhostname,localhost<br /> mynetworks_style = subnet<br /> mynetworks = 127.0.0.0/8, 192.168.1.0/24

1 2 3

inet_interfaces = $myhostname,localhost mynetworks_style = subnet mynetworks = 127.0.0.0/8, 192.168.1.0/24

Sono le solite modifiche di postfix. Che indirizzi ip possono utilizzare il mail server per spedire mail all’esterno?

Visto che questo host non ha certo un FQDM (ha un nome, p3gab, ma non è conosciuto in rete con questo nome e di certo non ha un dominio vero), aggiungo anche

myorigin = $myhostname

1	myorigin = $myhostname

così che, le mail spedite da questo server, arrivino da da mittente@p3gab.

Vado a commentare le righe

#default_transport = error<br /> #relay_transport = error

1 2	#default_transport = error #relay_transport = error

per evitare che si presenti l’errore

Aug 30 19:01:49 p3gab postfix/smtpd[25107]: NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 550 5.1.1 <utente@gmail.com>: Recipient address rejected: gmail.com; from=<sec@p3gab> to=<utente@gmail.com> proto=SMTP

1	Aug 30 19:01:49 p3gab postfix/smtpd[25107]: NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 550 5.1.1 <utente@gmail.com>: Recipient address rejected: gmail.com; from=<sec@p3gab> to=<utente@gmail.com> proto=SMTP

Tutto funziona correttamente facendo le classiche prove con telnet.

Questo il file main.cf

root@p3gab:/etc/postfix]# cat main.cf<br /> # See /usr/share/postfix/main.cf.dist for a commented, more complete version</p> <p># Debian specific: Specifying a file name will cause the first<br /> # line of that file to be used as the name. The Debian default<br /> # is /etc/mailname.<br /> myorigin = $myhostname</p> <p>smtpd_banner = $myhostname ESMTP $mail_name (Raspbian)<br /> biff = no</p> <p># appending .domain is the MUA’s job.<br /> append_dot_mydomain = no</p> <p># Uncomment the next line to generate “delayed mail” warnings<br /> #delay_warning_time = 4h</p> <p>readme_directory = no</p> <p># TLS parameters<br /> smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem<br /> smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key<br /> smtpd_use_tls=yes<br /> smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache<br /> smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache</p> <p># See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for<br /> # information on enabling SSL in the smtp client.</p> <p>smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination<br /> myhostname = p3gab<br /> alias_maps = hash:/etc/aliases<br /> alias_database = hash:/etc/aliases<br /> mydestination = p3gab, localhost.localdomain, localhost<br /> relayhost =<br /> mynetworks_style = subnet<br /> mynetworks = 127.0.0.0/8 192.168.1.0/24<br /> mailbox_size_limit = 0<br /> recipient_delimiter = +<br /> inet_interfaces = $myhostname,localhost<br /> #default_transport = error<br /> #relay_transport = error<br /> inet_protocols = ipv4

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

root@p3gab:/etc/postfix]# cat main.cf # See /usr/share/postfix/main.cf.dist for a commented, more complete version # Debian specific:  Specifying a file name will cause the first # line of that file to be used as the name.  The Debian default # is /etc/mailname. myorigin = $myhostname smtpd_banner = $myhostname ESMTP $mail_name (Raspbian) biff = no # appending .domain is the MUA’s job. append_dot_mydomain = no # Uncomment the next line to generate “delayed mail” warnings #delay_warning_time = 4h readme_directory = no # TLS parameters smtpd_tls_cert_file=/etc/ssl/certs/ssl–cert–snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl–cert–snakeoil.key smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for # information on enabling SSL in the smtp client. smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination myhostname = p3gab alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases mydestination = p3gab, localhost.localdomain, localhost relayhost = mynetworks_style = subnet mynetworks = 127.0.0.0/8 192.168.1.0/24 mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = $myhostname,localhost #default_transport = error #relay_transport = error inet_protocols = ipv4

Vado poi a mettere in /etc/aliases (e a rigenerare la mappa con newaliases)

postmaster: root<br /> root: utente<br /> utente: mio_indirizzo_email@gmail.com

1 2 3

postmaster:    root root:   utente utente: mio_indirizzo_email@gmail.com

in modio che, tutte le mail indirizzate a root e al mio utente locale (tipicamente, le mail che genera il sistema automaticamente – tipo logwatch – , lui di certo non riceve mail dall’esterno visto che la porta 25 da fuori non è raggiungibile) vengano girate al mio vero indirizzo mail.

Giusto per curiosità ecco cosa risponde il server postfix a un EHLO.

root@p3gab:]# telnet localhost 25<br /> Trying ::1…<br /> Trying 127.0.0.1…<br /> Connected to localhost.<br /> Escape character is ‘^]’.<br /> 220 p3gab ESMTP Postfix (Raspbian)<br /> EHLO me.com<br /> 250-p3gab<br /> 250-PIPELINING<br /> 250-SIZE 10240000<br /> 250-VRFY<br /> 250-ETRN<br /> 250-STARTTLS<br /> 250-ENHANCEDSTATUSCODES<br /> 250-8BITMIME<br /> 250 DSN

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

root@p3gab:]# telnet localhost 25 Trying ::1… Trying 127.0.0.1… Connected to localhost. Escape character is ‘^]’. 220 p3gab ESMTP Postfix (Raspbian) EHLO me.com 250–p3gab 250–PIPELINING 250–SIZE 10240000 250–VRFY 250–ETRN 250–STARTTLS 250–ENHANCEDSTATUSCODES 250–8BITMIME 250 DSN

Fino a qui tutto bene, ho giusto perso un po’ di tempo per capire di dover commentare le 2 righe #default_transport = error, #relay_transport = error per non incappare nell’errore “destinatario sconosciuto” (mea culpa, non ho ancora approfondito il motivo per cui accade).
AGG: Qui spiegano il problema
https://serverfault.com/questions/364873/new-mail-server-cant-send-emails-only-receives
In sostanza, fesso io, ho scelto in fase di configurazione il preset “Local Only” e lui, giustamente, come misura di sicurezza aggiuntiva, non permette di inviare mail all’esterno.

Purtroppo però il firmware della telecamera cinese vuole PER FORZA un’autenticazione smtp e non manda mail senza che questa sia stata effettuata: in soldoni, manda al server il comando AUTH LOGIN, il server non lo riconosce e disconnette subito il client.

Aug 30 19:15:42 p3gab postfix/smtpd[25660]: connect from unknown[192.168.1.50]<br /> Aug 30 19:15:42 p3gab postfix/smtpd[25660]: lost connection after AUTH from unknown[192.168.1.50]<br /> Aug 30 19:15:42 p3gab postfix/smtpd[25660]: disconnect from unknown[192.168.1.50]

1 2 3

Aug 30 19:15:42 p3gab postfix/smtpd[25660]: connect from unknown[192.168.1.50] Aug 30 19:15:42 p3gab postfix/smtpd[25660]: lost connection after AUTH from unknown[192.168.1.50] Aug 30 19:15:42 p3gab postfix/smtpd[25660]: disconnect from unknown[192.168.1.50]

Nessun problema, basta implementare l’autenticazione SASL.

AUTENTICAZIONE SASL

Per prima cosa controllo che postfix la supporti (leggi, compilato con le librerie sasl, almeno penso).

root@p3gab:/etc/postfix]# postconf -a<br /> cyrus<br /> dovecot

1 2 3

root@p3gab:/etc/postfix]# postconf -a cyrus dovecot

Vado a utilizzare la cyrus in quanto non ho interesse a installare dovecot.

Installo sasl

root@p3gab:]# apt-get install sasl2-bin

1	root@p3gab:]# apt-get install sasl2-bin

Qui l’elenco dei file che vengono installati con questo pacchetto:
https://packages.debian.org/cgi-bin/search_contents.pl?word=saslauthd&searchmode=searchfiles&case=insensitive&version=stable&arch=i386

File Packages<br /> /etc/default/saslauthd sasl2-bin<br /> /etc/init.d/saslauthd sasl2-bin<br /> /usr/sbin/saslauthd sasl2-bin<br /> /usr/sbin/testsaslauthd sasl2-bin<br /> /usr/share/man/man8/saslauthd.8.gz sasl2-bin<br /> /usr/share/man/man8/testsaslauthd.8.gz sasl2-bin

1 2 3 4 5 6 7

File Packages /etc/default/saslauthd sasl2–bin /etc/init.d/saslauthd sasl2–bin /usr/sbin/saslauthd sasl2–bin /usr/sbin/testsaslauthd sasl2–bin /usr/share/man/man8/saslauthd.8.gz sasl2–bin /usr/share/man/man8/testsaslauthd.8.gz sasl2–bin

Per far partire il demone devo andare, come minimo, a modificare il file di configurazione
/etc/default/saslauthd, andando a specificare:

START=yes

1

START=yes

(adoro – per davvero – quando gli sviluppatori impongono queste modifiche,solo per assicurarsi che l’utente guardi almeno una volta il file di configurazione).

Vado ad aggiungere l’utente postfix al gruppo sasl (file /etc/group).

sasl:x:45:postfix

1	sasl:x:45:postfix

Ora non mi resta che modificare il file /etc/postfix/main.cf andandogli a dire di utilizzare l’autenticazione sasl. Queste le direttive che aggiungo

#<br /> #SASL<br /> #<br /> smtpd_sasl_auth_enable = yes<br /> smtpd_sasl_security_options = noanonymous<br /> smtpd_sasl_local_domain =<br /> broken_sasl_auth_clients = yes<br /> smtpd_recipient_restrictions =<br /> permit_sasl_authenticated,<br /> permit_mynetworks,<br /> check_relay_domains

1 2 3 4 5 6 7 8 9 10 11

# #SASL # smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = broken_sasl_auth_clients = yes smtpd_recipient_restrictions =    permit_sasl_authenticated,    permit_mynetworks,    check_relay_domains

Un EHLO al server (dopo averlo riavviato), rivela le nuove capacità di autenticazione dello stesso:

root@p3gab:/etc/postfix]# telnet localhost 25<br /> Trying ::1…<br /> Trying 127.0.0.1…<br /> Connected to localhost.<br /> Escape character is ‘^]’.<br /> 220 p3gab ESMTP Postfix (Raspbian)<br /> EHLO me.com<br /> 250-p3gab<br /> 250-PIPELINING<br /> 250-SIZE 10240000<br /> 250-VRFY<br /> 250-ETRN<br /> 250-STARTTLS<br /> 250-AUTH DIGEST-MD5 CRAM-MD5 NTLM PLAIN LOGIN<br /> 250-AUTH=DIGEST-MD5 CRAM-MD5 NTLM PLAIN LOGIN<br /> 250-ENHANCEDSTATUSCODES<br /> 250-8BITMIME<br /> 250 DSN

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

root@p3gab:/etc/postfix]# telnet localhost 25 Trying ::1… Trying 127.0.0.1… Connected to localhost. Escape character is ‘^]’. 220 p3gab ESMTP Postfix (Raspbian) EHLO me.com 250–p3gab 250–PIPELINING 250–SIZE 10240000 250–VRFY 250–ETRN 250–STARTTLS 250–AUTH DIGEST–MD5 CRAM–MD5 NTLM PLAIN LOGIN 250–AUTH=DIGEST–MD5 CRAM–MD5 NTLM PLAIN LOGIN 250–ENHANCEDSTATUSCODES 250–8BITMIME 250 DSN

Andando a “spluciare” il file /etc/default/saslauthd, vedo che come meccanismo di autenticazione ha “PAM”, per cui vado a creare un utente di sistema di prova per testare se l’autenticazione funziona. Anche se solo di prova darò come shell /sbin/nologin.

Creo l’utente testuser/testpass, e poi provo l’autenticazione con il comando testsaslauthd (dopo aver fatto partire il demone saslauthd tramite systemd).

root@p3gab:/etc/default]# testsaslauthd -u testuser -p testpass -s smtp<br /> 0: OK “Success.”<br /> root@p3gab:/etc/default]# testsaslauthd -u testuser -p sbagliata -s smtp<br /> 0: NO “authentication failed”<br /> root@p3gab:/etc/default]# testsaslauthd -u testuser -p testpass -s smtp -r p3gab<br /> 0: OK “Success.

1 2 3 4 5 6

root@p3gab:/etc/default]# testsaslauthd -u testuser -p testpass -s smtp 0: OK “Success.” root@p3gab:/etc/default]# testsaslauthd -u testuser -p sbagliata -s smtp 0: NO “authentication failed” root@p3gab:/etc/default]# testsaslauthd -u testuser -p testpass -s smtp -r p3gab 0: OK “Success.

Ora, è evidente che postfix deve parlare al demone sasl tramite socket. Questo socket, guardando
– systemctl status saslauthd
– oppure /etc/default/saslauthd (OPTIONS=”-c -m /var/run/saslauthd”)
– oppure la documentazione in /usr/share/doc/sasl2-bin/README.Debian
é
/var/run/saslauthd.

Purtroppo, se si lascia tutto così, l’autenticazione funziona quando si prova con testsaslauthd, ma fallisce miseramente quando da postfix si lancia il comando AUTH LOGIN (o AUTH PLAIN).
Qui un bel link che spiega come fare le prove
https://networking.ringofsaturn.com/Protocols/howtotestsendmailauthentication.php

Lanciando il demone saslauthd in modalità debug in questo modo

root@p3gab:/etc/postfix]# /usr/sbin/saslauthd -a pam -c -m /var/run/saslauthd -n 5 -d<br /> saslauthd[28233] :main : num_procs : 5<br /> saslauthd[28233] :main : mech_option: NULL<br /> saslauthd[28233] :main : run_path : /var/run/saslauthd<br /> saslauthd[28233] :main : auth_mech : shadow<br /> saslauthd[28233] :cache_alloc_mm : mmaped shared memory segment on file: /var/run/saslauthd/cache.mmap<br /> saslauthd[28233] :cache_init : bucket size: 92 bytes<br /> saslauthd[28233] :cache_init : stats size : 36 bytes<br /> saslauthd[28233] :cache_init : timeout : 28800 seconds<br /> saslauthd[28233] :cache_init : cache table: 944764 total bytes<br /> saslauthd[28233] :cache_init : cache table: 1711 slots<br /> saslauthd[28233] :cache_init : cache table: 10266 buckets<br /> saslauthd[28233] :cache_init_lock : flock file opened at /var/run/saslauthd/cache.flock<br /> saslauthd[28233] :ipc_init : using accept lock file: /var/run/saslauthd/mux.accept<br /> saslauthd[28233] :detach_tty : master pid is: 0<br /> saslauthd[28233] :ipc_init : listening on socket: /var/run/saslauthd/mux<br /> saslauthd[28233] :main : using process model<br /> saslauthd[28233] :have_baby : forked child: 28234<br /> saslauthd[28234] :get_accept_lock : acquired accept lock<br /> saslauthd[28233] :have_baby : forked child: 28235<br /> saslauthd[28233] :have_baby : forked child: 28236<br /> saslauthd[28233] :have_baby : forked child: 28237

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

root@p3gab:/etc/postfix]# /usr/sbin/saslauthd -a pam -c -m /var/run/saslauthd -n 5 -d saslauthd[28233] :main            : num_procs  : 5 saslauthd[28233] :main            : mech_option: NULL saslauthd[28233] :main            : run_path   : /var/run/saslauthd saslauthd[28233] :main            : auth_mech  : shadow saslauthd[28233] :cache_alloc_mm  : mmaped shared memory segment on file: /var/run/saslauthd/cache.mmap saslauthd[28233] :cache_init      : bucket size: 92 bytes saslauthd[28233] :cache_init      : stats size : 36 bytes saslauthd[28233] :cache_init      : timeout    : 28800 seconds saslauthd[28233] :cache_init      : cache table: 944764 total bytes saslauthd[28233] :cache_init      : cache table: 1711 slots saslauthd[28233] :cache_init      : cache table: 10266 buckets saslauthd[28233] :cache_init_lock : flock file opened at /var/run/saslauthd/cache.flock saslauthd[28233] :ipc_init        : using accept lock file: /var/run/saslauthd/mux.accept saslauthd[28233] :detach_tty      : master pid is: 0 saslauthd[28233] :ipc_init        : listening on socket: /var/run/saslauthd/mux saslauthd[28233] :main            : using process model saslauthd[28233] :have_baby       : forked child: 28234 saslauthd[28234] :get_accept_lock : acquired accept lock saslauthd[28233] :have_baby       : forked child: 28235 saslauthd[28233] :have_baby       : forked child: 28236 saslauthd[28233] :have_baby       : forked child: 28237

noto che, quando lancio il test

root@p3gab:/etc/default]# testsaslauthd -u testuser -p testpass -s smtp -r p3gab<br /> 0: OK “Success.”

1 2	root@p3gab:/etc/default]# testsaslauthd -u testuser -p testpass -s smtp -r p3gab 0: OK “Success.”

ho una risposta

saslauthd[28234] :rel_accept_lock : released accept lock<br /> saslauthd[28234] :cache_get_rlock : attempting a read lock on slot: 162<br /> saslauthd[28234] :cache_lookup : [login=testuser] [service=smtp] [realm=p3gab]: not found, update pending<br /> saslauthd[28234] :cache_un_lock : attempting to release lock on slot: 162<br /> saslauthd[28236] :get_accept_lock : acquired accept lock<br /> saslauthd[28234] :cache_get_wlock : attempting a write lock on slot: 162<br /> saslauthd[28234] :cache_commit : lookup committed<br /> saslauthd[28234] :cache_un_lock : attempting to release lock on slot: 162<br /> saslauthd[28234] :do_auth : auth success: [user=testuser] [service=smtp] [realm=p3gab] [mech=shadow]<br /> saslauthd[28234] :do_request : response: OK

1 2 3 4 5 6 7 8 9 10

saslauthd[28234] :rel_accept_lock : released accept lock saslauthd[28234] :cache_get_rlock : attempting a read lock on slot: 162 saslauthd[28234] :cache_lookup    : [login=testuser] [service=smtp] [realm=p3gab]: not found, update pending saslauthd[28234] :cache_un_lock   : attempting to release lock on slot: 162 saslauthd[28236] :get_accept_lock : acquired accept lock saslauthd[28234] :cache_get_wlock : attempting a write lock on slot: 162 saslauthd[28234] :cache_commit    : lookup committed saslauthd[28234] :cache_un_lock   : attempting to release lock on slot: 162 saslauthd[28234] :do_auth         : auth success: [user=testuser] [service=smtp] [realm=p3gab] [mech=shadow] saslauthd[28234] :do_request      : response: OK

Quando invece mando il comando AUTH LOGIN tramite postfix non ho alcuna risposta, quindi NON stanno comunicando tramite quel socket.

Il problema è questo
https://wiki.debian.org/PostfixAndSASL

ovvero, postfix di default è configurato per “girare in chroot”, per cui non riesce ad accedere al socket creatogli da sasl.
Per risolvere è sufficente configurare postfix per non funzionare nella gabbia chroot.
/etc/postfix/master.cf

smtp inet n – n – – smtpd

1	smtp      inet  n       –        n      –       –       smtpd

(la cosa importante è la seconda n).
Questo ultimo passaggio è quello che mi ha fatto perdere 3 ore di tempo, sia per capire il vero motivo (chroot si/no), sia poi per cercare di far dialogare comunque i 2 sistemi pur tenendo postfix in chroot (pare possibile, vedi i miei tentativi qui in fondo, ma non ci sono riuscito).

Ora un’ultima modifica: per quanto l’utente creato per test non abbia shell (/sbin/nologin), non mi piace avere un utente di sistema che in realtà è fasullo e serve solo per fare l’ autenticazione smtp. Per questo motivo andrò a utilizzare, come metodo di autenticazione sasl, sasldb e non PAM (o shadow).

SASLDB PLUGIN

Per prima cosa vado a creare una coppia utente/password tramite il comando saslpasswd2 (utente: copia, password: incolla).

root@p3gab:/etc/default]# saslpasswd2 -c copia<br /> Password:<br /> Again (for verification):

1 2 3

root@p3gab:/etc/default]# saslpasswd2 -c copia Password: Again (for verification):

Elenco gli utenti creati.

root@p3gab:/etc/default]# sasldblistusers2<br /> copia@p3gab: userPassword

1 2	root@p3gab:/etc/default]# sasldblistusers2 copia@p3gab: userPassword

Vado a configurare /etc/default/saslauthd per utilizzare il sasldb e non più PAM.

MECHANISMS=”sasldb”

1	MECHANISMS=“sasldb”

Il db creato è il file /etc/sasldb2

root@p3gab:/etc]# file sasldb2<br /> sasldb2: Berkeley DB (Hash, version 9, native byte-order)</p> <p>root@p3gab:/etc]# ll -d sasldb2<br /> -rw-rw—- 1 root sasl 12288 Aug 31 09:19 sasldb2

1 2 3 4 5

root@p3gab:/etc]# file sasldb2 sasldb2: Berkeley DB (Hash, version 9, native byte–order) root@p3gab:/etc]# ll -d sasldb2 –rw–rw—— 1 root sasl 12288 Aug 31 09:19 sasldb2

e deve essere leggibile dall’utente postfix.

Effettuo il restart di saslauthd e controllo che il servizio stia utilizzando il plugin giusto (sasldb e non pam).

root@p3gab:/etc]# systemctl status saslauthd<br /> ● saslauthd.service – LSB: saslauthd startup script<br /> Loaded: loaded (/etc/init.d/saslauthd)<br /> Active: active (running) since Thu 2017-08-31 09:22:20 CEST; 951ms ago<br /> Process: 30094 ExecStop=/etc/init.d/saslauthd stop (code=exited, status=0/SUCCESS)<br /> Process: 30112 ExecStart=/etc/init.d/saslauthd start (code=exited, status=0/SUCCESS)<br /> CGroup: /system.slice/saslauthd.service<br /> ├─30132 /usr/sbin/saslauthd -a sasldb -c -m /var/run/saslauthd -n 5<br /> ├─30133 /usr/sbin/saslauthd -a sasldb -c -m /var/run/saslauthd -n 5<br /> ├─30134 /usr/sbin/saslauthd -a sasldb -c -m /var/run/saslauthd -n 5<br /> ├─30135 /usr/sbin/saslauthd -a sasldb -c -m /var/run/saslauthd -n 5<br /> └─30136 /usr/sbin/saslauthd -a sasldb -c -m /var/run/saslauthd -n 5</p> <p>Aug 31 09:22:20 p3gab saslauthd[30132]: detach_tty : master pid is: 30132<br /> Aug 31 09:22:20 p3gab saslauthd[30132]: ipc_init : listening on socket: /var/run/saslauthd/mux<br /> Aug 31 09:22:20 p3gab saslauthd[30112]: Starting SASL Authentication Daemon: saslauthd.<br /> Aug 31 09:22:20 p3gab systemd[1]: Started LSB: saslauthd startup script.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

root@p3gab:/etc]# systemctl status saslauthd ● saslauthd.service – LSB: saslauthd startup script    Loaded: loaded (/etc/init.d/saslauthd)    Active: active (running) since Thu 2017–08–31 09:22:20 CEST; 951ms ago   Process: 30094 ExecStop=/etc/init.d/saslauthd stop (code=exited, status=0/SUCCESS)   Process: 30112 ExecStart=/etc/init.d/saslauthd start (code=exited, status=0/SUCCESS)    CGroup: /system.slice/saslauthd.service            ├─30132 /usr/sbin/saslauthd –a sasldb –c –m /var/run/saslauthd –n 5            ├─30133 /usr/sbin/saslauthd –a sasldb –c –m /var/run/saslauthd –n 5            ├─30134 /usr/sbin/saslauthd –a sasldb –c –m /var/run/saslauthd –n 5            ├─30135 /usr/sbin/saslauthd –a sasldb –c –m /var/run/saslauthd –n 5            └─30136 /usr/sbin/saslauthd –a sasldb –c –m /var/run/saslauthd –n 5 Aug 31 09:22:20 p3gab saslauthd[30132]: detach_tty      : master pid is: 30132 Aug 31 09:22:20 p3gab saslauthd[30132]: ipc_init        : listening on socket: /var/run/saslauthd/mux Aug 31 09:22:20 p3gab saslauthd[30112]: Starting SASL Authentication Daemon: saslauthd. Aug 31 09:22:20 p3gab systemd[1]: Started LSB: saslauthd startup script.

Rifaccio le prove di autenticazione, sia con testsaslauthd che con postfix, e, questa volta,  fila tutto liscio.

APPENDICE

---

main.cf finale

root@p3gab:/etc/postfix]# cat main.cf<br /> # See /usr/share/postfix/main.cf.dist for a commented, more complete version</p> <p># Debian specific: Specifying a file name will cause the first<br /> # line of that file to be used as the name. The Debian default<br /> # is /etc/mailname.<br /> myorigin = $myhostname</p> <p>smtpd_banner = $myhostname ESMTP $mail_name (Raspbian)<br /> biff = no</p> <p># appending .domain is the MUA’s job.<br /> append_dot_mydomain = no</p> <p># Uncomment the next line to generate “delayed mail” warnings<br /> #delay_warning_time = 4h</p> <p>readme_directory = no</p> <p># TLS parameters<br /> smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem<br /> smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key<br /> smtpd_use_tls=yes<br /> smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache<br /> smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache<br /> # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for<br /> # information on enabling SSL in the smtp client.</p> <p>#<br /> #SASL<br /> #<br /> smtpd_sasl_auth_enable = yes<br /> smtpd_sasl_security_options = noanonymous<br /> smtpd_sasl_local_domain =<br /> broken_sasl_auth_clients = yes<br /> smtpd_recipient_restrictions =<br /> permit_sasl_authenticated,<br /> permit_mynetworks,<br /> check_relay_domains<br /> #smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd</p> <p>smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination<br /> myhostname = p3gab<br /> alias_maps = hash:/etc/aliases<br /> alias_database = hash:/etc/aliases<br /> mydestination = p3gab, localhost.localdomain, localhost<br /> relayhost =<br /> mynetworks_style = subnet<br /> mynetworks = 127.0.0.0/8 192.168.1.0/24<br /> mailbox_size_limit = 0<br /> recipient_delimiter = +<br /> inet_interfaces = $myhostname,localhost<br /> #default_transport = error<br /> #relay_transport = error<br /> inet_protocols = ipv4

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57

root@p3gab:/etc/postfix]# cat main.cf # See /usr/share/postfix/main.cf.dist for a commented, more complete version # Debian specific:  Specifying a file name will cause the first # line of that file to be used as the name.  The Debian default # is /etc/mailname. myorigin = $myhostname smtpd_banner = $myhostname ESMTP $mail_name (Raspbian) biff = no # appending .domain is the MUA’s job. append_dot_mydomain = no # Uncomment the next line to generate “delayed mail” warnings #delay_warning_time = 4h readme_directory = no # TLS parameters smtpd_tls_cert_file=/etc/ssl/certs/ssl–cert–snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl–cert–snakeoil.key smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for # information on enabling SSL in the smtp client. # #SASL # smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = broken_sasl_auth_clients = yes smtpd_recipient_restrictions =    permit_sasl_authenticated,    permit_mynetworks,    check_relay_domains #smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination myhostname = p3gab alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases mydestination = p3gab, localhost.localdomain, localhost relayhost = mynetworks_style = subnet mynetworks = 127.0.0.0/8 192.168.1.0/24 mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = $myhostname,localhost #default_transport = error #relay_transport = error inet_protocols = ipv4

---

Tentativi di far funzionare sasl con postfix in chroot.

Vado a modificare /etc/default/saslauthd mettendo, come da documentazione, il socket in:

#OPTIONS=”-c -m /var/run/saslauthd”<br /> OPTIONS=”-c -m /var/spool/postfix/var/run/saslauthd”

1 2	#OPTIONS=”-c -m /var/run/saslauthd” OPTIONS=“-c -m /var/spool/postfix/var/run/saslauthd”

Effettuo le configurazioni consigliate nella documentazione /usr/share/doc/sasl2-bin/README.Debian

If you run a chrooted server such as Postfix and wish to use saslauthd, you<br /> must place the saslauthd socket (“mux”) inside the Postfix chroot. You must<br /> also set correct overrides for the run directory inside the chroot, using<br /> dpkg-statoverride. Finally, you must add the postfix user to the sasl group.<br /> These steps ensure that the Debian subsystems know how you want things to be<br /> laid out.</p> <p>To know if your Postfix is running chroot, check /etc/postfix/master.cf.<br /> If it has the line “smtp inet n – y – – smtpd” or “smtp inet n – – – – smtpd”<br /> then your Postfix is running in a chroot.<br /> If it has the line “smtp inet n – n – – smtpd” then your Postfix is NOT<br /> running in a chroot.</p> <p>To place the saslauthd socket inside the Postfix chroot, edit<br /> /etc/default/saslauthd and set OPTIONS like this (you may omit -c):<br /> OPTIONS=”-c -m /var/spool/postfix/var/run/saslauthd”</p> <p>To set the run directory using dpkg-statoverride, run this command as root:<br /> dpkg-statoverride –add root sasl 750 /var/spool/postfix/var/run/saslauthd</p> <p>Finally, to add the postfix user to the sasl group:<br /> adduser postfix sasl

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

If you run a chrooted server such as Postfix and wish to use saslauthd, you must place the saslauthd socket (“mux”) inside the Postfix chroot. You must also set correct overrides for the run directory inside the chroot, using dpkg–statoverride. Finally, you must add the postfix user to the sasl group. These steps ensure that the Debian subsystems know how you want things to be laid out. To know if your Postfix is running chroot, check /etc/postfix/master.cf. If it has the line “smtp inet n – y – – smtpd” or “smtp inet n – – – – smtpd” then your Postfix is running in a chroot. If it has the line “smtp inet n – n – – smtpd” then your Postfix is NOT running in a chroot. To place the saslauthd socket inside the Postfix chroot, edit /etc/default/saslauthd and set OPTIONS like this (you may omit –c): OPTIONS=“-c -m /var/spool/postfix/var/run/saslauthd” To set the run directory using dpkg–statoverride, run this command as root: dpkg–statoverride —add root sasl 750 /var/spool/postfix/var/run/saslauthd Finally, to add the postfix user to the sasl group: adduser postfix sasl

Purtroppo però continua a funzionare solo il tester (peraltro specificando a mano il socket in posizione non standard)

root@p3gab:]# testsaslauthd -u testuser -p testpass -s smtpd -r p3gaba -f /var/spool/postfix/var/run/saslauthd/mux<br /> 0: OK “Success.

1 2	root@p3gab:]# testsaslauthd -u testuser -p testpass -s smtpd -r p3gaba -f /var/spool/postfix/var/run/saslauthd/mux 0: OK “Success.