Hi Patrick I would do as you ask, but it's bad security to download anything from a mailing list and just run it. Especially something as long and complex as gen-auth, at which I can only have a quick and un-informed look.
Given that I don't know who you are, give me some more info. Who are you? How can I authenticate you? What is the script you want me to run? In the light of no definitive answer from cyrus-sasl, your answer is plausible only. Understand I'm running sendmail and only just thinking about switching to postfix. The server I'm configuring is running SELinux enforcing which has its own foibles. Will a test of CRAM-MD5 with the installed cyrus-sasl libraries tell you anything? I'm pretty confident it will work! LOL I am willing and happy to co-operate. How should I trust you? Charles Bradshaw On Mon, 14 Jan 2013 23:09:06 +0100, Patrick Ben Koetter wrote > > * Charles Bradshaw <[email protected]>: > > I am considering switching my smptd from sendmail to postfix, but I am a > > little confused. > > > > The following snip from http://www.postfix.org/SASL_README.html > > > > " > > /etc/sasl2/smtpd.conf: > > pwcheck_method: saslauthd > > mech_list: PLAIN LOGIN > > > > Do not specify any other mechanisms in mech_list than PLAIN or LOGIN when > > using saslauthd! It can only handle these two mechanisms, and authentication > > will fail if clients are allowed to choose other mechanisms. > > " > > > > Appears to be wrong! I have the sasl2 configuration: > > > > /etc/sasl2/Sendmail.conf: > > pwcheck_method: saslauthd > > mech_list: DIGEST-MD5 PLAIN > > > > >> DEFINITELY WORKING << > > > > Admittedly, I am using sendmail and not postfix so perhaps I have a miss > > configuartion somewhere. The server in question is using /etc/salsdb with > > some > > test users NOT having accounts on the server and the debug dialogs clearly > > show that DIGEST-MD5 is being used. > > > > The above quote, cut and paste from the readme, contains a clear enough > > statement, except for the grammer, ie the word "other" missing between the > > words "mech_list" and "than". But: > > > > I'm confused because I have a solid, tested, working example which > > contradicts > > the postfix readme. > > > > Is the operation of Sendmail.conf somehow different to smtpd.conf? > > > > Further on the readme does say: > > > > /etc/sasl2/smtpd.conf: > > pwcheck_method: auxprop > > auxprop_plugin: sasldb > > mech_list: CRAM-MD5 PLAIN > > > > Which also works. > > This will work, because the auxprop mechanism 'sasldb' can handle plaintext > (PLAIN, LOGIN) and shared secret mechanisms (CRAM-MD5, DIGEST-MD5). > > > Is there a rational explanation or do I just put it down to a ghost in the > > machine? > > I am confused too, because I had it first hand from Alexey Melnikov, > who is one of the main developers of Cyrus SASL, and he told me all > saslauthd can handle are plaintext mechanisms aka PLAIN and LOGIN. > > Out of curiosity: Would you mind to download gen-auth > <http://jetmore.org/john/code/gen-auth>, make it executable and run > a CRAM-MD5 AUTH session against your Sendmail server? > > It would go along these lines: > > telnet YOURSERVER 25 > EHLO foo > ... > AUTH CRAM-MD5 > abcdefg0123456 > > The server then outputs a challenge (here: abcdefg0123456) string. > Use that string in gen-auth like this: > > ./gen-auth cram-md5 username password abcdefg0123456 > 6543210gfedcba > > gen-auth will return a respone string (here: 6543210gfedcba). Paste > that back into your telnet dialogue. If you get "Authentication > successful" then I will need to investigate further and I will > update the documentation. If not you just might have been lucky to > offer PLAIN as alternative, which clients either choose in the first > (the client chooses the SASL MECH) or fell back to once they had > failed attempting CRAM-MD5. > > p@rick > > -- > [*] sys4 AG > > http://sys4.de, +49 (89) 30 90 46 64 > Franziskanerstraße 15, 81669 München > > Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 > Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer > Aufsichtsratsvorsitzender: Joerg Heidrich > > ------- End of Forwarded Message ------- > > -- > Open WebMail Project (http://openwebmail.org) ------- End of Original Message -------
