After trying a couple of days I am not able to send emails via saslauthd.
I found a thread here, but this was not helpfull. Then I tryed the debian install script where also Postfix with saslauthd is configured, but also, some small changes did not help.
My system is a Debian 12 and I installed with the documentation. After installing, it worked well, I could send emails internally. After that, I want to configure Postfix more secure and add opendkim and connect a mailclient via smtp to send e-mails.
But always, in /var/log/mail.log there is the error message:
warning: SASL authentication failure: Password verification failed
warning: dyndsl-080-228-208-174.ewe-ip-backbone.de[80.228.208.174]: SASL PLAIN authentication failed: authentication failure, sasl_username=mawe@tamaly.de
after changeing the master.cf to
submission inet n - y - - smtpd
the error message change one time to
NOQUEUE: reject: RCPT from dyndsl-080-228-208-174.ewe-ip-backbone.de[80.228.208.174]: 554 5.7.1 mawe@tama-concept.de: Relay access denied; from=mawe@tamaly.de to=mawe@tama-concept.de proto=ESMTP helo=<fedora1.tamaly.de>
I can´t find my mistake. It would be great, if there is anyone who can help me.
Thanks in advance
Marco
--------
Here my configuration:
/etc/pam.d/
#%PAM-1.0
auth required pam_gromox.so service=smtp
account required pam_permit.so
/etc/default/saslauthd
START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="pam"
MECH_OPTIONS="" # also with 127.0.0.1 it did not work
THREADS=5 # also with 0 it did not work
OPTIONS="-r -c -m /var/spool/postfix/var/run/saslauthd"
/etc/postfix/main.cf [only the in my eyes relevant lines]
TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level=may
smtpd_milters = inet:localhost:12345
smtpd_tls_ciphers = high
smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem
smtpd_tls_dh512_param_file = ${config_directory}/dh512.pem
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3
smtpd_tls_protocols = TLSv1.2, TLSv1.3, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_ciphers = high
smtp_tls_loglevel = 1
smtp_tls_mandatory_protocols = TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
smtp_tls_protocols = TLSv1.2, TLSv1.3, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3
non_smtpd_milters = inet:localhost:12345
milter_protocol = 6
milter_default_action = accept
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated, defer_unauth_destination
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated
smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
#smtp_sasl_path = smtpd
smtp_sasl_path = /etc/postfix/sasl
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = /etc/postfix/sasl
broken_sasl_auth_clients = yes
cyrus_sasl_config_path = /etc/postfix/sasl
myhostname = mail3.tamaly.de
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $myhostname
mydestination = localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
virtual_alias_maps = mysql:/etc/postfix/g-alias.cf
virtual_mailbox_domains = mysql:/etc/postfix/g-virt.cf
virtual_transport = smtp:[localhost]:24
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
/etc/postfix/master.cf
smtp inet n - y - - smtpd
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
