No SMTP-Auth on SMTP Submission, due to saslauth not available

sbudach

I installed grommunio from the previous release in 2021. Back then I tried the OVA and the ISO, which is, what is still installed and has been updated to be up to date. I do have an issue with SMTP-Auth on SMTP Submission, where I cannot authenticate at all, since saslauth is not available, as stated in the smtp log:

2022-05-29 10:44:33.810645]: connect from budysmbp.stephanbudach.de[10.10.0.106]
[2022-05-29 10:44:33.815799]: warning: SASL authentication failure: cannot connect to saslauthd server: No such file or directory
[2022-05-29 10:44:33.816023]: warning: SASL authentication failure: Password verification failed
[2022-05-29 10:44:33.816084]: warning: budysmbp.stephanbudach.de[10.10.0.106]: SASL PLAIN authentication failed: generic failure
[2022-05-29 10:44:33.816674]: warning: SASL authentication failure: cannot connect to saslauthd server: No such file or directory
[2022-05-29 10:44:33.816844]: warning: SASL authentication failure: Password verification failed
[2022-05-29 10:44:33.816915]: warning: budysmbp.stephanbudach.de[10.10.0.106]: SASL PLAIN authentication failed: generic failure
[2022-05-29 10:44:33.818015]: disconnect from budysmbp.stephanbudach.de[10.10.0.106] ehlo=2 starttls=1 auth=0/2 quit=1 commands=4/6

Cyrus Sasl is actually installed, but it doesn't seem to be invoked:

grommunio:~ # rpm -qa | grep cyrus
cyrus-sasl-2.1.27-150300.4.6.1.x86_64
cyrus-sasl-plain-2.1.27-150300.4.6.1.x86_64
cyrus-sasl-saslauthd-2.1.27-150300.4.6.1.x86_64

The account is configured to allow authentication through IMAP/POP and SMTP

So, how do I tackle this?

mwilliams

sbudach

can you share some logs, e.g. from saslauthd (journalctl -u saslauthd)? is the service running (systemctl status saslauthd)? what happens when you issue systemctl restart saslauthd?

Beleggrodion

I had a similar issue, but i'am some steps further on a complete different setup approach.

I installed grommunio from scratch via the 22.04 community repository with the information on the minimal howto in the grommunio documentation, which i found here in the forum as a link.

After it looks like the basics works (like web, etc.) I tried to add an account in Thunderbird with IMAP/SMTP.
Then i see that SMTP is not working and after checking the configuration files i see that their is no sasl informations in the postfix main.cf.

Because i don't find anything useful in the manual or here in the forum i tried the approach i used on kopano setups in the past years.

Because I use ubuntu 22.04 on my side i installed it saslauthd with

apt-get install sasl2-bin

and added then to the /etc/postfix/main.cf some thing like:

smtpd_client_restrictions =
        permit_mynetworks,
        permit_sasl_authenticated
 
smtpd_sender_restrictions =
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination

smtpd_sasl_path=smtpd
smtpd_sasl_auth_enable=yes
broken_sasl_auth_clients = yes

and into the /etc/postfix/master.cf something like

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Also created the file /etc/postfix/sasl/smtpd.conf with

pwcheck_method: saslauthd
mech_list: plain login

Then i modified /etc/default/saslauthd with the following:

START=yes
 
MECHANISMS="rimap"
MECH_OPTIONS="127.0.0.1"
THREADS=0
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"

And also created the needed directories and permissions with:

mkdir -p /var/spool/postfix/var/run/saslauthd
usermod -aG sasl postfix

Then i start and restart postfix and saslauthd

Now the authentication is still not working but in /var/log/mail.log i see now the following:

Jun  2 11:36:07 mail01 postfix/submission/smtpd[126907]: connect from unknown[192.168.1.103]
Jun  2 11:36:07 mail01 postfix/submission/smtpd[126907]: warning: SASL authentication failure: Password verification failed
Jun  2 11:36:07 mail01 postfix/submission/smtpd[126907]: warning: unknown[192.168.1.103]: SASL PLAIN authentication failed: authentication failure
Jun  2 11:36:07 mail01 postfix/submission/smtpd[126907]: warning: unknown[192.168.1.103]: SASL LOGIN authentication failed: authentication failure
Jun  2 11:36:09 mail01 postfix/submission/smtpd[126907]: disconnect from unknown[192.168.1.103] ehlo=2 starttls=1 auth=0/2 quit=1 commands=4/6

And on the grommunio side when i check service gromox-imap status the following:

Jun 02 11:28:08 mail01.domain.dmz imap[112446]: user=user@domain.ch, host=[::ffff:192.168.1.103]  PASSWORD2 failed: "user@domain.ch" is not authorized to use service(s) 1h
Jun 02 11:28:09 mail01.domain.dmz imap[112446]: user=user@domain.ch, host=[::ffff:192.168.1.103]  LOGIN failed: "user@domain.ch" is not authorized to use service(s) 1h

So it still is not working on my side, but perhaps it gives you, or others here in the forum, some clues what is perhaps missing on both of our different setups with a simillar issue. (And i don't wan't to add a second thread with an issue with is nearly the same)

When i look to your screenshot i already enable smtp and imap for this user.

mwilliams

Beleggrodion

Your SASL setup is valid, what you need to validate is that pam_gromox is in the right place, see also https://docs.grommunio.com/man/pam_gromox.4gx.html#incantation-in-etc-pam-d-smtp:

/etc/pam.d/smtp:

#%PAM-1.0
auth required pam_gromox.so service=smtp
account required pam_permit.so

I don't have an Ubuntu 22 right at hand right now to validate; Make sure, your saslauthd is running with -a pam, might be required for you to set that either in OPTIONS or MECHANISMS. saslauthd should be started with -a pam for it to work (so you can see that in the process list).

Finally make sure you've enabled SMTP sending for user(s) in admin API, otherwise you'd be denied there.

mwilliams

Now I got one: MECHANISMS="pam" is your go-to on Ubuntu

Beleggrodion

mwilliams

Thanks that was it. Change vom rimap to pam and created the file /etc/pam.d/smtp (doesn't existed yet) and now smtp sending works.

sbudach

mwilliams No saslauthd is not running. It hasn't a systemd unit anyway and trying to start saslauthd only yields an error, probably due to a missing config. However, the Beleggrodion's post shoved my brain in the right direction. Running this command worked for me:

 saslauthd -d -r -a rimap -O grommunio.stephanbudach.de

mwilliams

sbudach

You wrote you have:

cyrus-sasl-saslauthd-2.1.27-150300.4.6.1.x86_64

file list of the package:

rpm -ql cyrus-sasl-saslauthd-2.1.27-150300.4.6.1.x86_64 | grep -i systemd
/usr/lib/systemd/system/saslauthd.service

sbudach Let's agree to disagree that there is no systemd-unit. :)

Using -a rimap is not recommended as per your last post. In the appliance, there is /etc/sysconfig/salsauthd and the important options are:

SASLAUTHD_AUTHMECH=pam
and
SASLAUTHD_PARAMS="-r"

If you are missing the config, you must be using a very, very, very old version of our appliance. The configuration you need for saslauthd is:

/etc/sasl2/smtpd.conf

pwcheck_method: saslauthd
mech_list: plain login

then make sure your saslauthd is enabled and started: systemctl enable saslauthd, systemctl start saslauthd and then systemctl status saslauthd:

systemctl status saslauthd
● saslauthd.service - saslauthd Server Daemon
     Loaded: loaded (/usr/lib/systemd/system/saslauthd.service; enabled; vendor preset: disabled)
     Active: active (running) since Thu 2022-06-02 00:39:32 CEST; 17h ago
   Main PID: 13098 (saslauthd)
      Tasks: 5 (limit: 4915)
     CGroup: /system.slice/saslauthd.service
             ├─13098 /usr/sbin/saslauthd -a pam -n 5 -r
             ├─13099 /usr/sbin/saslauthd -a pam -n 5 -r
             ├─13100 /usr/sbin/saslauthd -a pam -n 5 -r
             ├─13101 /usr/sbin/saslauthd -a pam -n 5 -r
             └─13102 /usr/sbin/saslauthd -a pam -n 5 -r

anyways... since everyone seems happy, im tagging this one as solved.