On Thu, 05 Jun 2003 05:54:45 +0200, Dirk Meyer wrote
> > Sendmail 8.12.9-sasl2 (compiled from /usr/ports/mail/sendmail-sasl)
> > cyrus-sasl-2.1.13 (compiled from /usr/ports/security/cyrus-sasl2-saslauthd)
> >
> > A client is still not able to authenticate via SASL - looks like is it not
> > happy but I am not sure how to fix it. Anybody got a clue what I am doing
> > wrong here?
>
> > --- from the logs when some attempts to authenticate ----
> > Jun 4 20:09:46 typhoon sm-mta[78399]: AUTH: available mech=NTLM LOGIN PLAIN
> > OTP DIGEST-MD5 CRAM-MD5, allowed mech=LOGIN PLAIN
>
> > Jun 4 20:09:46 typhoon sm-mta[78399]: h5539jJQ078399: AUTH failure (LOGIN):
> > no mechanism available (-4) SASL(-4): no mechanism available: checkpass failed
>
> > define(`confAUTH_OPTIONS', `A p y')dnl
> > define(`confAUTH_MECHANISMS', `LOGIN PLAIN')dnl
> > TRUST_AUTH_MECH(`LOGIN PLAIN')dnl
>
> checkpass failed, is the saslauthd started?
> do you needd the "A" Option?
wait I figured this out. I changed the saslauthd flags to
if [ -z "${sasl_saslauthd_flags}" ]; then
sasl_saslauthd_flags="-a getpwent"
fi
got the daemon running and things are fine now.
are there any security issues here. looks liek I cannot send mail unless I
have SSL enabled on the client side. SO I think I have things running properly.
- Noah
>
> from: /usr/local/share/sendmail/cf/README
> confAUTH_OPTIONS AuthOptions [undefined] If this option
> is 'A' then the AUTH=
> parameter for the MAIL FROM
> command is only issued when
> authentication succeeded. [...] See doc/op/op.me
> for details.
>
> from: /usr/local/share/doc/sendmail/op.txt
> [no short name] List of options for SMTP
> AUTH consisting of single characters with
> intervening white space or commas.
>
> A Use the AUTH= parameter for the MAIL FROM
> command only when authentication succeeded.
> This can be used as a workaround for broken
> MTAs that do not implement RFC 2554
> correctly. a protection from active (non-
> dictionary) attacks during authentication exchange.
> c require mechanisms which pass client
> credentials, and allow mechanisms which can
> pass credentials to do so.
> d don't permit mechanisms susceptible to passive
> dictionary attack. f require forward
> secrecy between sessions
> (breaking one won't help break next).
> p don't permit mechanisms susceptible to simple
> passive attack (e.g., PLAIN, LOGIN), unless a
> security layer is active. y
> don't permit mechanisms that allow anonymous login.
>
> The first option applies to sendmail as a
> client, the others to a server. Example:
>
> O AuthOptions=p,y
>
> more links:
> http://www.sendmail.org/~gshapiro/
> http://www.sendmail.org/~ca/email/auth.html
> http://www.asp.ogi.edu/people/paja/linux/sendmail/
> http://blue-labs.org/clue/sendmail.php
> http://www.digitalanswers.org/sendmail/
>
>
> kind regards Dirk
>
> - Dirk Meyer, Im Grund 4, 34317 Habichtswald, Germany
> - [EMAIL PROTECTED],[EMAIL PROTECTED],[EMAIL PROTECTED]
> _______________________________________________
> [EMAIL PROTECTED] mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "[EMAIL PROTECTED]"
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
