postfix SASL验证失败

Question

postifx+postfixadmin+dovecot+mysql+roudcube 整合sasl验证失败

postfixadmin 除了 $CONF["encrypt"] = dovecot:CRAM-MD5 其它地方正常配置，数据库读写数据都是正常的
postfix main.cf模块配置

master.cf 模块配置

dovecot-sql.conf模块配置

10-auth.conf

在测试postfix 日记记录
connect from unknown[194.48.251.80]
discarding EHLO keywords: CHUNKING
warning: unknown[194.48.251.80]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
disconnect from unknown[194.48.251.80] ehlo=1 auth=0/1 quit=1 commands=2/3
Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.145.53, lip=172.16.20.5, TLS: Connection closed,
systemctl status postfix 显示

systemctl status dovecot

[root@mail conf.d]# dovecot -n
# 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf
# OS: Linux 4.18.0-348.7.1.el8_5.x86_64 x86_64 CentOS Linux release 8.5.2111 
# Hostname: mail.chwin-tech.com
auth_mechanisms = plain login CRAM-MD5
dict {
  quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
}
disable_plaintext_auth = no
first_valid_uid = 1000
mail_location = maildir:%hMaildir
mbox_write_locks = fcntl
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  driver = pam
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
plugin {
  quota = dict:User quota::proxy::quota
  quota_rule = *:storage=1G
}
protocols = imap pop3
service auth {
  unix_listener auth-client {
    group = postfix
    mode = 0600
    user = postfix
  }
  unix_listener auth-userdb {
    group = vmail
    mode = 0600
    user = vmail
  }
}
service dict {
  unix_listener dict {
    group = vmail
    mode = 0600
    user = vmail
  }
}
ssl = required
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_cipher_list = PROFILE=SYSTEM
ssl_key = # hidden, use -P to show it
userdb {
  driver = passwd
  override_fields = uid=vmail gid=vmail home=/var/mail/%n
}
userdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
protocol lda {
  mail_plugins = quota
  postmaster_address = [e-mail]
}
protocol imap {
  mail_plugins = quota imap_quota
}
protocol pop3 {
  mail_plugins = quota
}

[root@mail conf.d]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
compatibility_level = 2
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
dovecot_destination_recipient_limit = 1
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
meta_directory = /etc/postfix
mydestination = $mydomain,$myhostname, localhost.$mydomain, localhost
mydomain = chwin-tech.com
myhostname = mail.chwin-tech.com
mynetworks = 172.16.0.0/16, 127.0.0.0/8
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix/README_FILES
sample_directory = /usr/share/doc/postfix/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
shlib_directory = /usr/lib64/postfix
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
smtp_tls_CApath = /etc/pki/tls/certs
smtp_tls_security_level = may
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = /var/run/dovecot/auth-client
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem
smtpd_tls_key_file = /etc/pki/tls/private/postfix.key
smtpd_tls_security_level = may
unknown_local_recipient_reject_code = 550
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_gid_maps = static:5000
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_limit_maps = proxy:mysql:/etc/postfix/mysql_virtual_mailbox_limit_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_transport = dovecot
virtual_uid_maps = static:5000

请教各位帮忙看下问题出在哪 postfixadmin 建立的账号密码 验证输入的时候是正确的 但就是验证失败。

Answer 1

引自免费微信小程序：皆我百晓生

从您提供的配置片段和日志信息中，可以看出您在整合Postfix、PostfixAdmin、Dovecot、MySQL和Roundcube时遇到了SASL验证失败的问题。以下是基于您给出的信息进行的分析与排查步骤：

1. 主配置文件 main.cf 中：

   • 您似乎在smtpd_sasl_path配置行中有拼写错误，应该是smtpd_sasl_path=/var/run/dovecot/auth-client。
   • 配置中有一处“smokd sas li security tontions yes noanonymous”，看起来像是打字错误，应为smtpd_sasl_security_options = noanonymous。

2. master.cf 文件配置 中：

   • 配置内容较多且有部分不完整，但注意到多个地方重复设置了smtpd_sasl_auth_enable=yes，只需在一处设置即可。
   • 确保所有涉及sasl认证相关的选项如smtpd_sasl_type、smtpd_sasl_path等都正确无误地配置了。

3. dovecot-sql.conf 配置 中：

   • 看起来数据库连接及查询语句正常，使用CRAM-MD5作为默认密码方案，并正确引用了数据库中的用户信息字段。

4. postfix 日志记录 显示：

   • 记录显示 SASL LOGIN authentication failed: UGFzc3dvcmQ6，这表明客户端尝试用LOGIN机制进行身份验证时密码验证失败。
   • 这可能的原因是Postfix无法通过Dovecot正确获取或验证用户的密码。

5. systemctl status dovecot 输出 中：

   • 出现了一系列的PAM认证失败的日志条目，例如 pam_unix(dovecot:auth):authentication failure;...，这说明Dovecot端对用户身份验证也未成功。

综上所述，问题可能出在以下几点：

• Dovecot与Postfix之间的通信配置问题，确保/var/run/dovecot/auth-client路径下服务运行正常，且Postfix能访问到。
• 检查Dovecot SASL插件是否正确配置并启用，确认其能够从MySQL数据库中读取和验证用户密码。
• 核实PostfixAdmin创建的账号密码是否已同步至Dovecot使用的数据库中，并确保加密方式一致（即都是CRAM-MD5）。
• 检查Dovecot的PAM配置，确认其可以正确验证用户凭据。

建议检查以下几个方面：

• Dovecot的/etc/dovecot/conf.d/10-auth.conf 和 /etc/dovecot/conf.d/10-master.conf 的相关配置项。
• Dovecot的系统日志文件以获得更多关于身份验证失败的详细信息。
• 确保Postfix和Dovecot配置文件中没有语法错误或遗漏的关键配置项。

同时，执行postconf -n和doveconf -n来查看当前生效的配置，并对照官方文档逐一核对，修复可能存在的配置错误。