![Postfix + sasldb 问题(截至 2021 年 3 月已解决)](https://linux22.com/image/762475/Postfix%20%2B%20sasldb%20%E9%97%AE%E9%A2%98%EF%BC%88%E6%88%AA%E8%87%B3%202021%20%E5%B9%B4%203%20%E6%9C%88%E5%B7%B2%E8%A7%A3%E5%86%B3%EF%BC%89.png)
PS(已解决:截至 2021 年 3 月,针对 Alpine Linux 的解决方案,cyrus-sasl 2.1.27-r12 中的修复位于边缘分支中。3.13 仅具有 cyrus-sasl 2.1.27-r10。
附言:我知道有类似的帖子,但它们非常过时,就像 2015 年一样。我的问题是 2021 年,去年还在运行。
我在 alpine:edge docker 容器中使用带有 sasldb2 的 postfix。但最近(2021 年 1 月)我发现它停止工作了。情况很奇怪,因为相同的 /etc/sasl2/sasldb2 文件可以与 saslauthd 一起使用,但如果我使用 auxprop 设置则不行。
使用 sasldb2(不起作用)
/etc/sasl2/smtpd.conf
pwcheck_method: auxprop
auxprop_plugin: sasldb
mech_list: PLAIN
Postfix 日志:
Jan 17 07:46:07 johnsiu postfix/smtpd[108]: connect from mail-ej1-x635.google.com[2a00:1450:4864:20::635]
Jan 17 07:46:08 johnsiu postfix/smtpd[108]: warning: SASL authentication failure: Couldn't fetch entry from /etc/sasl2/sasldb2
Jan 17 07:46:08 johnsiu postfix/smtpd[108]: warning: SASL authentication failure: Password verification failed
Jan 17 07:46:08 johnsiu postfix/smtpd[108]: warning: mail-ej1-x635.google.com[2a00:1450:4864:20::635]: SASL PLAIN authentication failed: generic failure
Jan 17 07:46:08 johnsiu postfix/smtpd[108]: lost connection after AUTH from mail-ej1-x635.google.com[2a00:1450:4864:20::635]
Jan 17 07:46:08 johnsiu postfix/smtpd[108]: disconnect from mail-ej1-x635.google.com[2a00:1450:4864:20::635] ehlo=2 starttls=1 auth=0/1 commands=3/4
使用 saslauthd(工作)
/etc/sasl2/smtpd.conf
pwcheck_method: saslauthd
mech_list: PLAIN
手动运行 saslauthd:
saslauthd -a sasldb -d
输出:
saslauthd[125] :num_procs : 5
saslauthd[125] :mech_option: NULL
saslauthd[125] :run_path : /run/saslauthd
saslauthd[125] :auth_mech : sasldb
saslauthd[125] :using accept lock file: /run/saslauthd/mux.accept
saslauthd[125] :master pid is: 0
saslauthd[125] :listening on socket: /run/saslauthd/mux
saslauthd[125] :using process model
saslauthd[125] :forked child: 126
saslauthd[125] :forked child: 127
saslauthd[125] :forked child: 128
saslauthd[125] :forked child: 129
saslauthd[125] :acquired accept lock
saslauthd[125] :released accept lock
saslauthd[129] :acquired accept lock
saslauthd[125] :auth success: [user=test] [service=smtp] [realm=example.org] [mech=sasldb]
saslauthd[125] :response: OK
Postfix 日志:
Jan 17 07:48:41 johnsiu postfix/smtpd[120]: connect from mail-ej1-x631.google.com[2a00:1450:4864:20::631]
Jan 17 07:48:42 johnsiu postfix/smtpd[120]: disconnect from mail-ej1-x631.google.com[2a00:1450:4864:20::631] ehlo=2 starttls=1 auth=1 quit=1 commands=5
操作系统版本
# cat /etc/os-release
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.13.0_alpha20201218
PRETTY_NAME="Alpine Linux edge"
HOME_URL="https://alpinelinux.org/"
BUG_REPORT_URL="https://bugs.alpinelinux.org/"
已安装的软件包
apk list -I|sort
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/edge/main: No such file or directory
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/edge/community: No such file or directory
alpine-baselayout-3.2.0-r8 x86_64 {alpine-baselayout} (GPL-2.0-only) [installed]
alpine-keys-2.2-r0 x86_64 {alpine-keys} (MIT) [installed]
apk-tools-2.12.0-r3 x86_64 {apk-tools} (GPL-2.0-only) [installed]
busybox-1.32.0-r8 x86_64 {busybox} (GPL-2.0-only) [installed]
ca-certificates-20191127-r5 x86_64 {ca-certificates} (MPL-2.0 AND MIT) [installed]
ca-certificates-bundle-20191127-r5 x86_64 {ca-certificates} (MPL-2.0 AND MIT) [installed]
cyrus-sasl-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
cyrus-sasl-crammd5-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
cyrus-sasl-digestmd5-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
cyrus-sasl-gs2-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
cyrus-sasl-gssapiv2-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
cyrus-sasl-login-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
cyrus-sasl-ntlm-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
cyrus-sasl-scram-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
gdbm-1.19-r0 x86_64 {gdbm} (GPL-3.0-or-later) [installed]
heimdal-libs-7.7.0-r4 x86_64 {heimdal} (BSD-3-Clause) [installed]
icu-libs-67.1-r2 x86_64 {icu} (MIT ICU Unicode-TOU) [installed]
krb5-conf-1.0-r2 x86_64 {krb5-conf} (MIT) [installed]
libc-utils-0.7.2-r3 x86_64 {libc-dev} (BSD-2-Clause AND BSD-3-Clause) [installed]
libcom_err-1.45.6-r1 x86_64 {e2fsprogs} (GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT) [installed]
libcrypto1.1-1.1.1i-r0 x86_64 {openssl} (OpenSSL) [installed]
libgcc-10.2.1_pre1-r3 x86_64 {gcc} (GPL-2.0-or-later LGPL-2.1-or-later) [installed]
libsasl-2.1.27-r10 x86_64 {cyrus-sasl} (custom) [installed]
libssl1.1-1.1.1i-r0 x86_64 {openssl} (OpenSSL) [installed]
libstdc++-10.2.1_pre1-r3 x86_64 {gcc} (GPL-2.0-or-later LGPL-2.1-or-later) [installed]
libtls-standalone-2.9.1-r1 x86_64 {libtls-standalone} (ISC) [installed]
lmdb-0.9.27-r0 x86_64 {lmdb} (OLDAP-2.8) [installed]
musl-1.2.2_pre6-r0 x86_64 {musl} (MIT) [installed]
musl-utils-1.2.2_pre6-r0 x86_64 {musl} (MIT BSD GPL2+) [installed]
ncurses-libs-6.2_p20210109-r0 x86_64 {ncurses} (MIT) [installed]
ncurses-terminfo-base-6.2_p20210109-r0 x86_64 {ncurses} (MIT) [installed]
postfix-3.5.8-r0 x86_64 {postfix} (IPL-1.0 EPL-2.0) [installed]
readline-8.1.0-r0 x86_64 {readline} (GPL-2.0-or-later) [installed]
scanelf-1.2.6-r1 x86_64 {pax-utils} (GPL-2.0-only) [installed]
sqlite-libs-3.34.0-r1 x86_64 {sqlite} (Public-Domain) [installed]
ssl_client-1.32.0-r8 x86_64 {busybox} (GPL-2.0-only) [installed]
tzdata-2020f-r0 x86_64 {tzdata} (Public-Domain) [installed]
zlib-1.2.11-r3 x86_64 {zlib} (Zlib) [installed]
我不确定这是 Alpine 发行版问题、Postfix 问题还是 Cyrus-sasl 问题。
我的docker容器:https://hub.docker.com/repository/docker/jsiu/postfix
更新到 postfix 3.5.9-r0 后问题仍然存在。
testsaslauthd 结果:
/ # ls -lh /run/saslauthd/
total 4K
srwxrwxrwx 1 root root 0 Feb 18 02:36 mux
-rw------- 1 root root 0 Feb 18 02:36 mux.accept
-rw------- 1 root root 4 Feb 18 02:36 saslauthd.pid
以下语法有效:
/ # testsaslauthd -f /run/saslauthd/mux -r **** -u **** -p ****
但以下操作不起作用:
/ # testsaslauthd -f /run/saslauthd/mux -s"smtpd" -u"****@****" -p"****"
0: NO "authentication failed"
尝试使用单引号、双引号、无引号、空格作为密码,但结果相同。
失败尝试的“saslauthd -a sasldb -d”输出:
/etc/postfix # saslauthd -a sasldb -d
saslauthd[195] :num_procs : 5
saslauthd[195] :mech_option: NULL
saslauthd[195] :run_path : /run/saslauthd
saslauthd[195] :auth_mech : sasldb
saslauthd[195] :using accept lock file: /run/saslauthd/mux.accept
saslauthd[195] :master pid is: 0
saslauthd[195] :listening on socket: /run/saslauthd/mux
saslauthd[195] :using process model
saslauthd[195] :forked child: 196
saslauthd[196] :acquired accept lock
saslauthd[195] :forked child: 197
saslauthd[195] :forked child: 198
saslauthd[195] :forked child: 199
saslauthd[198] :acquired accept lock
saslauthd[196] :released accept lock
saslauthd[196] :auth failure: [user=****@****] [service=smtpd] [realm=] [mech=sasldb] [reason=Unknown]
saslauthd[196] :response: NO
答案1
这是一个错误。fetcherrno
调用被另一个调用破坏。请参阅:https://github.com/cyrusimap/cyrus-sasl/pull/554
高山修复:https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/18576
编辑:截至 2021-03-10,已合并并作为 2.1.27-r12 发布到 Alpine Edge。
答案2
正如您所建议的,找出问题所在很重要。您的身份验证链如下:postfix => (Cyrus) saslauthd => /etc/sasldb2
我建议您使用 testsaslauthd 命令测试 SASL:
testsaslauthd -f /run/saslauthd/mux -s"smtp" -u"[email protected]" -p"yourpass"
testsaslauthd -f /run/saslauthd/mux -s"smtp" -r"example.org" -u"test" -p"yourpass"
如果上述方法不起作用,请在此处发布输出。
如果上述操作有效,你将获得
0: OK "Success."
我们必须比 SASL 看得更远。
答案3
关于:
pwcheck_method: auxprop
auxprop_plugin: sasldb
另一个问题可能来自于postfix
在单独的环境中运行,其中/etc
有自己的子目录/var/spool/postfix
,因此解决方案是复制sasldb2
该目录结构中的文件。
以下是我对 Docker 镜像的修复:
RUN echo "password" | saslpasswd2 -p -c -u example.com username \
&& mkdir /var/spool/postfix/etc \
&& cp -a /etc/sasl2 /var/spool/postfix/etc/ \
&& chgrp -R postfix /var/spool/postfix/etc/ \
&& chmod -R g+rX /var/spool/postfix/etc/
答案4
我也有同样的问题。
从 Alpine 容器 3.12.3 更新到 3.13.3 后,我的带有 sasl 的 postfix 无法工作。首先,它根本无法读取我的 sasldb2 文件 - 我不得不用 saslpasswd2 重新创建它。然后 sasldblistusers2 就可以正常工作了。
但是 postfix 无法解决这个问题。我收到以下错误消息:
SASL 身份验证失败:无法从 /etc/sasl2/sasldb2 获取条目
我不得不回到 3.12.3 并重建容器,因为我没有找到任何合适的解决方案。