[Problem] SMTP=Plaintext, IMAP/POP3=Encrypted

[jpieper]

I´ve a Problem with my stored passwords in Database. I´ve stored my Passwords in Database encrypted by MySQL´s ENCRYPT()-method. IMAP and POP3 are working fine but if I want to send a mail over my SMTP the password must be plaintext.

[root@vs2060074 ~]# cat /usr/lib/sasl2/smtpd.conf
log_level: 7
pwcheck_method: auxprop
mech_list: PLAIN LOGIN
auxprop_plugin: sql
sql_engine: mysql
sql_hostnames: localhost
sql_database: mail
sql_user: <db_user>
sql_passwd: <db_passwd>
sql_select: SELECT password FROM users WHERE (email='%u@%r') AND (active=1)
sql_usessl: no

mysql> describe users;
+----------+-------------+------+-----+----------+-------+
| Field | Type | Null | Key | Default | Extra |
+----------+-------------+------+-----+----------+-------+
| email | varchar(80) | NO | PRI | | |
| password | varchar(32) | NO | | | |
| quota | int(10) | YES | | 10485760 | |
| active | tinyint(1) | NO | | 0 | |
+----------+-------------+------+-----+----------+-------+

I used Virtual Users And Domains With Postfix, Courier And MySQL (Fedora Core 5) for my installation and I´ve changed my smtpd.conf (see above), changed field password value length from 20 to 32 and I´ve added "active" field to users-table to restrict access.

Any solutions/suggestions? Need more Logs/Information?

// Edit:
I think i´ve to change "PLAIN LOGIN" but I don´t know what to use instead of it.

[falko]

I used Virtual Users And Domains With Postfix, Courier And MySQL (Fedora Core 5) for my installation
Are you sure you followed it as close as possible? Because it's working for me.

[jpieper]

Changes:
- I do not changed my /etc/hosts file
- I commented out ed-command (following lines until EOF) in postfx.spec
- on RPM installation I got an error that there is no /etc/postfix/aliases file
- I am using newest versions of software
- I´ve done no changes in my httpd.conf[apache]/config.inc.php[phpMyAdmin]
- Created database in mysql-prompt instead of using mysqladmin
- Using MySQL5 (is it really a change!?)
- I am not using smtpd.conf from tutorial (s. first posting in thread)
- commented out "timj.co.uk" in spamassassin update cronjobs
- Added "active" column to mail.users table in database.

I had to install cyrus-sasl-plain to get this tutorial working.

SASLFINGER OUTPUT

Client
[root@vs2060074 ~]# saslfinger -c
saslfinger - postfix Cyrus sasl configuration Thu May 24 19:20:58 CEST 2007
version: 1.0.1
mode: client-side SMTP AUTH

-- basics --
Postfix: 2.3.3
System: Fedora Core release 6 (Zod)

-- smtp is linked to --
libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0xb7dd5000)

-- active SMTP AUTH and TLS parameters for smtp --
No active SMTP AUTH and TLS parameters for smtp in main.cf!
SMTP AUTH can't work!

Server:
[root@vs2060074 ~]# saslfinger -s
saslfinger - postfix Cyrus sasl configuration Thu May 24 19:21:24 CEST 2007
version: 1.0.1
mode: server-side SMTP AUTH

-- basics --
Postfix: 2.3.3
System: Fedora Core release 6 (Zod)

-- smtpd is linked to --
libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0xb7dd5000)

-- active SMTP AUTH and TLS parameters for smtpd --
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes


-- listing of /usr/lib/sasl --
total 24
drwxr-xr-x 2 root root 2048 May 23 00:59 .
drwxr-xr-x 47 root root 20480 May 23 01:17 ..
-rw-r--r-- 1 root root 47 May 23 00:58 smtpd.conf

-- listing of /usr/lib/sasl2 --
total 2908
drwxr-xr-x 2 root root 2048 May 23 22:13 .
drwxr-xr-x 47 root root 20480 May 23 01:17 ..
?--------- ? ? ? ? ? /usr/lib/sasl2/sasl2
-rwxr-xr-x 1 root root 884 Sep 29 2006 libanonymous.la
-rwxr-xr-x 1 root root 14596 Sep 29 2006 libanonymous.so
-rwxr-xr-x 1 root root 14596 Sep 29 2006 libanonymous.so.2
-rwxr-xr-x 1 root root 14596 Sep 29 2006 libanonymous.so.2.0.22
-rwxr-xr-x 1 root root 856 Sep 29 2006 liblogin.la
-rwxr-xr-x 1 root root 14976 Sep 29 2006 liblogin.so
-rwxr-xr-x 1 root root 14976 Sep 29 2006 liblogin.so.2
-rwxr-xr-x 1 root root 14976 Sep 29 2006 liblogin.so.2.0.22
-rwxr-xr-x 1 root root 856 Sep 29 2006 libplain.la
-rwxr-xr-x 1 root root 15072 Sep 29 2006 libplain.so
-rwxr-xr-x 1 root root 15072 Sep 29 2006 libplain.so.2
-rwxr-xr-x 1 root root 15072 Sep 29 2006 libplain.so.2.0.22
-rwxr-xr-x 1 root root 930 Sep 29 2006 libsasldb.la
-rwxr-xr-x 1 root root 905200 Sep 29 2006 libsasldb.so
-rwxr-xr-x 1 root root 905200 Sep 29 2006 libsasldb.so.2
-rwxr-xr-x 1 root root 905200 Sep 29 2006 libsasldb.so.2.0.22
-rwxr-xr-x 1 root root 878 Sep 29 2006 libsql.la
-rwxr-xr-x 1 root root 23276 Sep 29 2006 libsql.so
-rwxr-xr-x 1 root root 23276 Sep 29 2006 libsql.so.2
-rwxr-xr-x 1 root root 23276 Sep 29 2006 libsql.so.2.0.22
-rw-r--r-- 1 root root 433 May 23 20:35 smtpd.conf

-- listing of /etc/sasl2 --
total 6
drwxr-xr-x 2 root root 2048 Sep 29 2006 .
drwxr-xr-x 61 root root 4096 May 23 01:17 ..




-- content of /usr/lib/sasl/smtpd.conf --
pwcheck_method: saslauthd
saslauthd_version: 2

-- content of /usr/lib/sasl2/smtpd.conf --
#pwcheck_method: saslauthd
#pwcheck_method: authdaemond
#log_level: 3
#mech_list: PLAIN LOGIN
#authdaemond_path:/var/spool/authdaemon/socket
log_level: 7
pwcheck_method: auxprop
mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5
auxprop_plugin: sql
sql_engine: mysql
sql_hostnames: localhost
sql_database: mail
sql_user: --- replaced ---
sql_passwd: --- replaced ---
sql_select: SELECT password FROM users WHERE (email='%u@%r') AND (active=1)
sql_usessl: no


-- active services in /etc/postfix/master.cf --
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
smtp inet n - n - - smtpd
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
-o fallback_relay=
showq unix n - n - - showq
error unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
old-cyrus unix - n n - - pipe
flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user }
cyrus unix - n n - - pipe
user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} $ {user}
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient

amavis unix - - - - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes

127.0.0.1:10025 inet n - - - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,rej ect
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o receive_override_options=no_unknown_recipient_chec ks,no_header_body_c hecks
-o smtpd_bind_address=127.0.0.1

-- mechanisms on localhost --
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN


-- end of saslfinger output --

[falko]

I had to install cyrus-sasl-plain to get this tutorial working.

So it's working now? :)

[jpieper]

No, I only wanted to say that the tutorial won´t work (FC6) without installing cyrus-sasl-plain. I tried it twice and it won´t work. Don´t know why and I don´t think you´ve posted a tutorial that won´t work.

Okay, but I can´t send emails because SMTP needs Plaintext passwords and IMAP/POP3 are using encrypted passwords. Because of that I´ve pasted saslfinger output.

[jpieper]

No ideas? Can´t use SMTP while it uses Plaintext passwords because I only have them encrypted in database.

[falko]

No ideas?
Unfortunately not... :(