Ubuntu-fr

Jean-Bastien

Problème SASL

Bonjour,

J'ai un serveur Postfix+courier+TLS+SASL à travers lequel je souhaite envoyer des Emails de l'exterieur (téléphone portable). Le serveur doit être en SASL afin d'accepter de relayer le mail.
Mon problème est que lorsque j'essaye d'envoyer avec une adresse autre que mes domaines autorisés, donc à travers un mobile, celà ne fonctionne pas.
NOQUEUE: reject: RCPT from unknown[80.215.0.132]: 554 5.7.1 <yyyyy@yyyyy>: Relay access denied; from=<xxxx@xxxx> to=<yyyyy@yyyyy> proto=ESMTP helo=<infraware.co.kr>
Voici comment j'ai configurer mon Postfix -en me basant sur ceci :http://doc.ubuntu-fr.org/postfix_mysql_tls_sasl -
main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

#domaine ou sous-domaine autorisé  pour l'envoi ou réception de mail.
relay_domains = $mydestination, $virtual_maps
# Nom de domaine de messagerie principal.
mydomain = pyrescom.eu
# Nom de d'hôte.
myhostname = mail.pyrescom.eu
# Activer l'écoute IPv6.
inet_protocols = all
# Les clients SMTP sûrs.Concrètement, le droit d'utiliser ce serveur comme relais.
mynetworks = 127.0.0.0/8 ,192.168.1.0/24
# Les noms de domaine pour lesquels on accepte le courrier.
mydestination = $myhostname, localhost.$mydomain, localhost
smtpd_client_restrictions =  permit_mynetworks, permit_sasl_authenticated, sleep 1, reject_unauth_pipelining
smtpd_helo_restrictions = reject_invalid_helo_hostname
smtpd_sender_restrictions = reject_unknown_sender_domain,reject_sender_login_mismatch,permit_sasl_authenticated,permit_mynetworks,reject_non_fqdn_sender
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_non_fqdn_hostname,reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unauth_destination,reject_unauth_pipelining,permit
#reject_invalid_hostname,
#-----------------SASL-----------------
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_security_options = noanonymous
smtpd_sender_login_maps = mysql:/etc/postfix/mysql/owners.cf
#recipient_canonical_maps = mysql:/etc/postfix/mysql/owners.cf

#-----------------TLS-----------------
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_cert_file = /etc/postfix/tls/smtpd.pem
smtpd_tls_key_file = /etc/postfix/tls/smtpd.key
smtpd_tls_CAfile = /etc/postfix/tls/smtpdI.pem

#-----------------SUPPORT MYSQL-----------------
# Support Mysql
#Correspondance entre adresses ou domaines spécifiées avec les adresses localse ou distantes/
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf
#Groupe de l'utilisateur système postfix
virtual_gid_maps = static:5000
#UID de l'agent de livraison
virtual_uid_maps = static:5000
virtual_mailbox_base = /home/vmail
#Liste des domaines virtuels
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_limit = 51200000
#Liste des adresses valides des domaines correspondants à virtual_mailbox_domains
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_transport = virtual

# Suport du relay
#relay_domains = mysql:/etc/postfix/mysql_relay_domains_maps.cf

#-----------------OPTIONNELS-----------------
#Bannière.Doit commencer obligatoirement par $myhostname
smtpd_banner = $myhostname ESMTP $mail_name 
#Desactivation du service local biff:Envoie des notifications "nouveau message" aux utilisateurs
biff = no
#Refus d'ajout de la chaine .$mydomain ou @$remote_header_rewrite_domain pour les adresses qui non pas d'information .domaine
append_dot_mydomain = no
# Temps au delà duquel l'expéditeur reçoit les en-têtes d'un message toujours en file d'attente.
delay_warning_time = 300s
#Impose au client de commencer par HELO OU EHLO
smtpd_helo_required = yes
#Taille maximale d'un message en octet (20Mo)
message_size_limit= 20480000
#Base de données des alias utilisée pour la livraison locale
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
#Taille maximale des boites à lettres (dossiers)
mailbox_size_limit = 0
#Separateur entre noms d'utilisateurs et extensions d'adresse.Par défaut, le client SMTP (logiciel) essaie user+foo et .forward+foo avant d'essayer user et .forward.
recipient_delimiter = +
#Adresses réseau par lesquelles le système de messagerie reçoit les message
inet_interfaces = all
#vacation
#transport_maps = proxy:mysql:/etc/postfix/mysql_virtual_transports.cf
#vacation_destination_recipient_limit = 1

#IMPORTANT

smtpd_reject_unlisted_sender = yes
smtpd_tls_loglevel = 1

master.cf:

587	  inet	n	-	n	-	-	smtpd 
smtp      inet  n       -       n       -       -       smtpd
...

saslauth:

#
# Settings for saslauthd daemon
# Please read /usr/share/doc/sasl2-bin/README.Debian for details.
#

# Should saslauthd run automatically on startup? (default: no)
START=yes

# Description of this saslauthd instance. Recommended.
# (suggestion: SASL Authentication Daemon)
DESC="SASL Authentication Daemon"

# Short name of this saslauthd instance. Strongly recommended.
# (suggestion: saslauthd)
NAME="saslauthd"

# Which authentication mechanisms should saslauthd use? (default: pam)
#
# Available options in this Debian package:
# getpwent  -- use the getpwent() library function
# kerberos5 -- use Kerberos 5
# pam       -- use PAM
# rimap     -- use a remote IMAP server
# shadow    -- use the local shadow password file
# sasldb    -- use the local sasldb database file
# ldap      -- use LDAP (configuration is in /etc/saslauthd.conf)
#
# Only one option may be used at a time. See the saslauthd man page
# for more information.
#
# Example: MECHANISMS="pam"
MECHANISMS="pam"

# Additional options for this mechanism. (default: none)
# See the saslauthd man page for information about mech-specific options.
MECH_OPTIONS=""

# How many saslauthd processes should we run? (default: 5)
# A value of 0 will fork a new process for each connection.
THREADS=5

# Other options (default: -c -m /var/run/saslauthd)
# Note: You MUST specify the -m option or saslauthd won't run!
#
# WARNING: DO NOT SPECIFY THE -d OPTION.
# The -d option will cause saslauthd to run in the foreground instead of as
# a daemon. This will PREVENT YOUR SYSTEM FROM BOOTING PROPERLY. If you wish
# to run saslauthd in debug mode, please run it by hand to be safe.
#
# See /usr/share/doc/sasl2-bin/README.Debian for Debian-specific information.
# See the saslauthd man page and the output of 'saslauthd -h' for general
# information about these options.
#
# Example for postfix users: "-c -m /var/spool/postfix/var/run/saslauthd"
#OPTIONS="-c -m /var/run/saslauthd"
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"

smtpd.conf:

pwcheck_method: saslauthd
mech_list: login plain
log_level: 7
auxprop_plugin: sql
sql_engine: mysql
sql_hostnames: localhost
sql_user: postfix
sql_database: postfix
sql_passwd: XXXXX
sql_database: postfix
sql_select: select password from mailbox where username = '%u@%r' 
saslauthd_path: /var/spool/postfix/var/run/saslauthd/mux

pam.d\smtp:

auth    required   pam_mysql.so user=postfix passwd=XXXX host=127.0.0.1 db=postfix table=mailbox usercolumn=username passwdcolumn=password crypt=1 
account sufficient pam_mysql.so user=postfix passwd=XXXX host=127.0.0.1 db=postfix table=mailbox usercolumn=username passwdcolumn=password crypt=1 

je vois pas ce qui pose problème.

je vous donne le log\saslauth

Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: sql plugin Parse the username XXXX
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: sql plugin try and connect to a host
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: sql plugin trying to open db 'postfix' on host 'localhost'
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: begin transaction
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: sql plugin create statement from userPassword XXXXX
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: sql plugin doing query select password from mailbox where username = 'XXXXX';
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: commit transaction
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: sql plugin Parse the username XXXXX
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: sql plugin try and connect to a host
Jun 22 17:38:27 sd-47955 postfix/smtpd[21109]: sql plugin trying to open db 'postfix' on host 'localhost'

dans var/run:

lrwxrwxrwx 1 root       root         36 juin  14 20:21 saslauthd -> /var/spool/postfix/var/run/saslauthd

Pseudo supprimé

Re : Problème SASL

Bonjour,

1/ et ton authentification de base, fonctionne-t-elle ?

sudo testsaslauthd  -u toto@domain.tld -p mot_de_passe -f /var/spool/postfix/var/run/saslauthd/mux   
0: OK "Success."

2/ relay_recipient_maps est plus efficace que relay_domains.
relay_domains à supprimer ( sudo postconf -d | grep relay_domains )
ou si tu veux
relay_domains = $mydestination

relay_recipient_maps = hash:/etc/postfix/all_recipients

pour tester, tu peux y faire correspondre à une liste
toto@domain.tld OK
...
ou requête sql

 
relay_recipient_maps = mysql:/etc/postfix/all_recipients

sudo postmap -q toto@domain.tld mysql:/etc/postfix/all_recipients
renvoie un résultat non nul, non vide, si le toto@domain.tld existe.

3/

smtpd_sasl_local_domain =  #aucune valeur 

ou facultatif ( à toi de tester )

smtpd_sasl_local_domain = $mydomain # devrait correspondre au realm 

4/ Attention à toutes tes *_restrictions, qu'il vaut mieux par la suite compléter, une fois que tout  marche
à comparer

sudo postconf -d | grep restrictions
sudo postconf -n | grep restrictions

5/ Renseigner le master.cf concernant le sasl
par exemple submission

submission      inet    n    -    n    -    -    smtpd
...
	-o smtpd_tls_security_level=encrypt
	-o smtpd_sasl_auth_enable=yes
	-o smtpd_client_restrictions=permit_sasl_authenticated,reject
...

sudo postconf -e 'smtp_sasl_auth_enable=yes'

6/ Pour rendre bavard ton log, mettre "-v" au moins tu sauras ce qui matche en premier, ... et quoi modifier ...
quel paramètre est évalué en premier et qu'est -ce qui est validé ?

smtp      inet  n       -       n       -       -       smtpd -v
...
submission      inet    n    -    n    -    -    smtpd -v
... 
smtps     inet  n       -       n       -       -       smtpd -v
...
et pourquoi tlsmgr -v et je ne sais trop quoi.

sudo postconf -e 'debug_peer_list=127.0.0.1'
sudo postconf -e 'debug_peer_level=4'
...