Both servers have same ldd outputs and Sendmail.conf contains only "pwcheck_method: saslauthd"

--------
banyan# ldd -a /usr/sbin/sendmail
/usr/sbin/sendmail:
       libutil.so.7 => /lib/libutil.so.7 (0x2807d000)
       libc.so.7 => /lib/libc.so.7 (0x2808a000)
/lib/libutil.so.7:
       libc.so.7 => /lib/libc.so.7 (0x2808a000)
banyan#
banyan# ll /usr/local/lib/sasl2/Sendmail.conf
-rw-r--r--  1 root  wheel  26  7 29 14:56 /usr/local/lib/sasl2/Sendmail.conf
banyan# cat /usr/local/lib/sasl2/Sendmail.conf
pwcheck_method: saslauthd
--------

Reed

From: Ihor Prystay
Sent: Friday, July 31, 2009 2:55 AM
To: FreeBSD Question
Subject: Re: SMTP Authentication


You may check the location of sasl2 lib which sendmail is compiled with
- do ldd on sendmail executable. And verify if Sendmail.conf in the
sasl2 lib folder doesn't have any restrictions on available mechs.

Ihor



Reed Lai wrote:
The liblogin.so is in directory

banyan# ll /usr/local/lib/sasl2/liblogin.so
lrwxr-xr-x  1 root  wheel  13  7 29 14:54
/usr/local/lib/sasl2/liblogin.so -> liblogin.so.2
banyan# ll /usr/local/lib/sasl2/liblogin.so.2
-rwxr-xr-x  1 root  wheel  17172  7 29 14:54
/usr/local/lib/sasl2/liblogin.so.2

There is only confAUTH_MECHANISMS in .mc file, not confAUTH_OPTIONS

dnl set SASL options
dnl --------------------------------
TRUST_AUTH_MECH(`GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN')dnl
define(`confAUTH_MECHANISMS', `GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN')dnl

Reed

From: Ihor Prystay
Sent: Thursday, July 30, 2009 4:58 PM
To: FreeBSD Question
Subject: Re: SMTP Authentication


Check if /usr/local/lib/sasl2/liblogin.so exists - if not you have to
recompile sasl with LOGIN mech support.
Check in your .mc file if you define confAUTH_OPTIONS macro. If you do
make sure 'p' parameter is not on the list or LOGIN would be available
only after TLS encryption which is not a case for you as your working
configuration offers LOGIN during telnet session (it's actually a bad
idea to do authentication clear text).

Ihor


Reed Lai wrote:
Yes, the new server leaks LOGIN in the 250-AUTH list!

New server
=========
250-AUTH GSSAPI DIGEST-MD5 CRAM-MD5

Functional server
==============
250-AUTH GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN

I have checked the generated .cf file in the new server and there are
class and option listed

C{TrustAuthMech}GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN
O AuthMechanisms=GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN

The new server has same configuration to old server, but has not LOGIN
in the 250-AUTH list.
BTW, the new server has hostname changed once... I don't know if it does
matter or not..

Reed

From: Ihor Prystay
Sent: Thursday, July 30, 2009 2:35 PM
To: freebsd-questions@freebsd.org
Subject: Re: SMTP Authentication


Tray telnet to port 25 of your working SMTP server and compare the
output.
Check
250-AUTH <list of supported auth mech>
According to the provided log from the working server it should be LOGIN
mech available in the list, which is not present on the new server.

Ihor


Reed Lai wrote:
The maillog does not log the sm-mta: AUTH=server action. The functional
server has the AUTH=server action logged. How do I debug from this
different?

Reed

From: Reed Lai
Sent: Thursday, July 30, 2009 11:51 AM
To: FreeBSD Questions
Subject: Re: SMTP Authentication


The mail client is Windows Live Mail and it work well with the
functional
server. Its SMTP authenication should be ok.

Reed


From: Ihor Prystay
Sent: Thursday, July 30, 2009 10:49 AM
To: freebsd-questions@freebsd.org
Subject: Re: SMTP Authentication


your working server does support LOGIN mech while other one dosn't.
I doubt if your mail client has a support for GSSAPI DIGEST-MD5 CRAM-MD5
auth, usually it's PLAIN or/and LOGIN.

Ihor



Reed Lai wrote:
Instruction of the "SMTP AUTO in sendmail 8.10-8.13" to test the
Sendmail

banyan# sendmail -d0.1 -bv root
Version 8.14.2
Compiled with: DNSMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8 MIME8TO7
               NAMED_BIND NETINET NETINET6 NETUNIX NEWDB NIS PIPELINING
SASLv2
               SCANF STARTTLS TCPWRAPPERS USERDB XDEBUG

============ SYSTEM IDENTITY (after readcf) ============
     (short domain name) $w = banyan
 (canonical domain name) $j = banyan...com
        (subdomain name) $m = ..com
             (node name) $k = banyan...com
========================================================

root... deliverable: mailer local, user root

banyan# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 banyan...com ESMTP Sendmail 8.14.2/8.14.2; Wed, 29 Jul 2009
21:19:40
+0800 (CST)
ehlo localhost
250-banyan...com Hello localhost [127.0.0.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH GSSAPI DIGEST-MD5 CRAM-MD5
250-DELIVERBY
250 HELP

The Sendmail test seems OK
But the SMTP authentication does not work from my mail client.

Reed


From: Reed Lai
Sent: Wednesday, July 29, 2009 5:37 PM
To: freebsd-questions@freebsd.org
Subject: SMTP Authentication


Hi,

I have two freebsd mail servers both configured SMTP authentication:

   FreeBSD Handbook 28.10 SMTP Authenticatin
   http://www.freebsd.org/doc/en/books/handbook/smtp-auth.html

   SMTP AUTO in sendmail 8.10-8.13
   http://www.sendmail.org/~ca/email/auth.html

One is functional, and the other one doesn't seem to work. Compare the
maillogs of the two servers, there is an AUTH=server message appear in
the
functional server, but the other one has not.

The maillog of functional server
======================
Jul 29 16:15:10 maple sm-mta[57825]: AUTH=server, relay=59-....net
[59...147], authid=a660407, mech=LOGIN, bits=0
Jul 29 16:15:10 maple sm-mta[57825]: n6T8F9ej057825:
from=<reed...@...>,
size=1430, class=0, nrcpts=1,
msgid=<40f9cc65e8874d128639a39c1eebd...@reedxp>, proto=ESMTP,
daemon=IPv4,
relay=59-...net [59...147]

The other one
=========
Jul 29 17:12:41 banyan sm-mta[2539]: n6T9Cf9q002539:
ruleset=check_rcpt,
arg1=<reed...@...>, relay=59-...-147.HINET-IP.hinet.net [59...147],
reject=550 5.7.1 <reed...@...>... Relaying denied
Jul 29 17:12:41 banyan sm-mta[2539]: n6T9Cf9q002539:
from=<reed...@...>,
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=IPv4,
relay=59-...-147.HINET-IP.hinet.net [59...147]

It seems the other one's smtp authentication is not trigged.

Please help or tip me for something I forget.

Thank you!

Reed
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Reply via email to