Skip to content

bug report: SMTP_ONLY=1 fails login with warning: SASL authentication failure: Password verification failed #3660

@deimosfr

Description

@deimosfr

📝 Preliminary Checks

  • I tried searching for an existing issue and followed the debugging docs advice, but still need assistance.

👀 What Happened?

I'm trying to setup SASL authentication with SMTP_ONLY=1, using virtual alias only (no account).

I can't connect to send emails. I'm always having this issue when I'm trying to add an email address to Gmail. Thanks in advance for your help

👟 Reproduction Steps

From the given below configuration with:

SMTP_ONLY=1
ENABLE_SASLAUTHD=1
SASLAUTHD_MECHANISMS=

Start a container and try to SMTP login.

🐋 DMS Version

v13.0.0

💻 Operating System and Architecture

Synology DSM 7

⚙️ Container configuration files

Here is my compose.yaml config:

  dms:
    image: mailserver/docker-mailserver:13.0.0
    container_name: dms
    restart: always
    cap_add:
    - "NET_ADMIN"
    - "SYS_PTRACE"
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 512M
    ports:
      - "25:25"
      - "465:465"
      - "587:587"
      - "11334:11334"
    stop_grace_period: 1m
    healthcheck:
      test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
      timeout: 3s
      retries: 0
    hostname: mail.mydomain.com
    env_file: ./dockermailserver/mailserver.env
    environment:
      LOG_LEVEL: debug
      PERMIT_DOCKER: container
      OVERRIDE_HOSTNAME: mail.mydomain.com
      ENABLE_POP3: 0
      ENABLE_CLAMAV: 0
      SMTP_ONLY: 1
      ENABLE_SASLAUTHD: 1
      SASLAUTHD_MECHANISMS: 
      ENABLE_FETCHMAIL: 0
      SPOOF_PROTECTION: 1
      ENABLE_DNSBL: 1
      ENABLE_SRS: 1
      MOVE_SPAM_TO_JUNK: 0
      POSTFIX_MESSAGE_SIZE_LIMIT: 102400000 # 100 MB
      POSTMASTER_ADDRESS: [email protected]
      ENABLE_RSPAMD: 1
      RSPAMD_LEARN: 0
      ENABLE_OPENDKIM: 0
      ENABLE_OPENDMARC: 0
      ENABLE_POLICYD_SPF: 0
      ENABLE_AMAVIS: 0
      ENABLE_SPAMASSASSIN: 0
      SSL_TYPE: letsencrypt
      SSL_DOMAIN: mail.mydomain.com
    volumes:
      - ./dockermailserver/data/:/var/mail/
      - ./dockermailserver/state/:/var/mail-state/
      - ./dockermailserver/logs/:/var/log/mail/
      - ./dockermailserver/config/:/tmp/docker-mailserver/
      - ./dockermailserver/config/postfix-policyd-spf.conf:/etc/postfix-policyd-spf-python/policyd-spf.conf
      - ./traefik/config/acme.json:/etc/letsencrypt/acme.json:ro
      - /etc/localtime:/etc/localtime:ro

I'm using Traefik in front of it, TLS retrieve works well.

I've followed this https://github.com/orgs/docker-mailserver/discussions/3472#discussioncomment-6714298 but unfortunately didn't work for me.

So here is what I have in postfix-main.cf:

smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
smtpd_sasl_type = cyrus

The postfix-policyd-spf.conf config file:

debugLevel = 1
#0(only errors)-4(complete data received)

skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1

# Preferably use IP-Addresses for whitelist lookups:
Whitelist = y.y.y.y/24, x.x.x.x/24

file postfix-sasl-password.cf:

file postfix-virtual.cf:

And file user-patches.sh:

mkdir -p /etc/postfix/sasl

echo "pwcheck_method: auxprop
auxprop_plugin: sasldb
mech_list: PLAIN" > /etc/postfix/sasl/smtpd.conf

echo 'password' | saslpasswd2 -c -u mail.mydomain.com user

📜 Relevant log output

Nov 26 18:21:21 mail postfix/postfix-script[582]: starting the Postfix mail system
Nov 26 18:21:21 mail postfix/master[583]: daemon started -- version 3.5.18, configuration /etc/postfix
Nov 26 18:23:02 mail postfix/submission/smtpd[906]: error: open database /etc/postfix/vmailbox: No such file or directory
Nov 26 18:23:02 mail postfix/submission/smtpd[906]: connect from unknown[172.20.0.1]
Nov 26 18:23:02 mail postfix/submission/smtpd[906]: Anonymous TLS connection established from unknown[172.20.0.1]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
Nov 26 18:23:02 mail postfix/submission/smtpd[906]: warning: SASL authentication failure: Password verification failed
Nov 26 18:23:02 mail postfix/submission/smtpd[906]: warning: unknown[172.20.0.1]: SASL PLAIN authentication failed: authentication failure
Nov 26 18:23:03 mail postfix/submission/smtpd[906]: lost connection after AUTH from unknown[172.20.0.1]
Nov 26 18:23:03 mail postfix/submission/smtpd[906]: disconnect from unknown[172.20.0.1] ehlo=2 starttls=1 auth=0/1 commands=3/4

I've tried this as well to validate:

testsaslauthd -u user -p password

It doesn't work until I create a PAM account. Locally it works, but still not from Gmail, I'm getting this error:

535 5.7.8 Error: authentication failed: authentication failure , code: 535

I'm using virtual alias to forward to gmail, but would like to configure the SMTP server to be able to send from my email address in Gmail.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions