[tlug] Re: 'Postfix' as SMTP AUTH Client

[Dennis McMurchy <denismcm@example.com>]

On Thu, 5 Jun 2003, Dennis McMurchy wrote:

>   I'm trying to use the 'postfix' MTA as a client for SMTP AUTH.
>   This made me think that perhaps the PLAIN and LOGIN mechanisms that
> GOL is offering were explicitly disallowed in ..postfix/main.cf, but this
> isn't the case.

  I have fixed the problem finally.  My hunch above was right, after all.
Plaintext authentication methods are not EXPLICITLY disallowed in the
..postfix/main.cf, they are disallowed BY DEFAULT.

  This is clearly stated in 
/usr/share/doc/postfix-1.1.11/README_FILES/SASL_README.sasl2
(I had looked carefully at the SASL_README, but somehow missed this
one):

	Note: some SMTP servers support PLAIN or LOGIN authentication
	only.  By default, the Postfix SMTP client does not use
	authentication methods that send plaintext passwords, and defers
	delivery with the following error message:  "Authentication
	failed: cannot SASL authenticate to server". To enable plaintext
	authentication specify, for example: 

	    /etc/postfix/main.cf:
		smtp_sasl_security_options = 

(That's right, there's nothing at all after that there '=' sign).
  Anyhow, adding this to /etc/postfix/main.cf, got everything working.

  I found no reference anywhere in any of the documentation that I
pored over in the last 36 hours to the fact that you need to run
'/usr/sbin/postmap  /etc/postfix/saslpass' to generate the saslpass.db
file that 'postfix' actually uses.  This may be OBVIOUS to some people,
but it sure to me a long, long time to get there.  

  Summing this all up just for the record:

 You add the following lines to /etc/postfix/main.cf:

	relayhost = mail.your.isp

	smtp_sasl_auth_enable = yes
	smtp_sasl_password_maps = hash:/etc/postfix/saslpass

	# this next line allows plaintext methods
	smtp_sasl_security_options =

  The 'saslpass' file has the following form:
mail.your.isp	userID:Password

  You then run '/usr/sbin/postmap  /etc/postfix/saslpass' on it.
And don't forget, of course, to run '/sbin/service postfix restart' so
the configuration files are reread.  It's pretty simple, really.  

  I guess I won't have to telnet to the mailserver and manually 
authenticate to relay my email, after all.  

  Does anyone have any thoughts on whether it makes any sense at all to
require users who are already connected to the ISP to authenticate 
themselves in this way to the mailserver?  I don't quite see the point,
myself, but I may just be missing something obvious (again).

  Cheers, Dennis