On 09/29/14 17:44 -0500, Patrick Goetz wrote: >Hi - > >I've been setting up some new servers and wanted to revisit and optimize >my cyrus-sasl configuration. I couldn't find answers to these questions >anywhere in the documentation or online, but figured this list would >know. Ironically, the postfix documentation for using sasl >(http://www.postfix.org/SASL_README.html) appears to be more complete >than anything I could find on the cyrus source site. > >1. Postfix suggests that I can put the SASL configuration file in >/etc/sasl2 instead of /usr/lib/sasl2, but I couldn't find this anywhere >in the official cyrus-sasl documentation. User configurable options >always need to go in /etc, not /usr/lib, so I just want to confirm that >2.1.26 will look for the configuration file in /etc/sasl2 The location depends how cyrus sasl was compiled. '--with-configdir=DIR' is used to specify the location config files will be searched for. By default, that's /usr/lib/sasl2. Distributions may specify others. For Debian, that's: /etc/sasl2:/etc/sasl:/usr/lib/$(DEB_HOST_MULTIARCH)/sasl2:/usr/lib/sasl2 See ./configure --help for an explanation. Additionally, the cyrus sasl api allows the location to be overridden using the 'sasl_getconfpath_t' callback. See the manpage for sasl_callbacks (3). To determine where to place a sasl config file for a particular daemon, you'll need to consult the documentation for your distribution/OS if you're not compiling it yourself. To confuse matters even more, Cyrus IMAP uses the API to store configuration data into imapd.conf, and will look for the options to be preprended with 'sasl_', e.g. 'sasl_pwcheck_method'. OpenLDAP does the same, but for one option only (olcSaslAuxprops). >2. I can't find any hints about what an optimal PAM configuration file >is if you only want to authenticate users through PAM with valid >accounts. Currently the /etc/pam.d/imap file is basically set up as > > auth required pam_unix.so > account required pam_unix.so > >(Debian/Ubuntu add other junk via default common authentication groups >which must be superfluous). I don't understand why the account >management group is needed for imap authentication. Is it just there >because there's no documentation on how to do this properly, so people >are guessing? The PAM backend for saslauthd calls 'pam_authenticate' (auth), 'pam_acct_mgmt' (account), but not 'pam_open_session' (session) or 'pam_chauthtok' (password). As far as I know, this is not documented anywhere. >3. Both cyrus and postfix use SASL. In the past, I've run postfix in a >chroot jail, so it had it own saslauthd daemon process. Since chroot >jails don't add much security, I'm jettisoning that, but presumably >cyrus and postfix will happily use the same saslauthd daemon process? Yes. You should not override the location of the saslauthd mux (in /etc/default/saslauthd, on Debian), unless you are chrooting postfix. By default, Cyrus and Postfix will use the default (at compile time) location, by way of the libsasl2 glue library. >Postfix requires a sasl configuration file, but I just noticed that my >cyrus 2.3.16 install doesn't seem to have one. Is this compile time >default or am I just overlooking where the configuration file? Or does >cyrus use the SASL libraries directly, in which case I'm not sure how it >knows to use pam. Is there any documentation on this? There is no default cyrus sasl config file installed for Postfix. In the case of a missing config file, the defaults will be used (auxprop instead of saslauthd/pam). 'saslfinger' is highly recommended for trouble shooting Postfix/Cyrus Sasl config issues. To direct Postfix to authenticate against PAM, you'll need to start saslauthd with the PAM backend. Then create a Postfix sasl config file (in /etc/postfix/sasl/smtpd.conf, on Debian) which includes: pwcheck_method: saslauthd And you'll want to include: # exclude shared secret mechanisms mech_list: plain login external gssapi See: http://www.cyrussasl.org/docs/cyrus-sasl/2.1.25/options.php -- Dan White ---- Cyrus Home Page: http://www.cyrusimap.org/ List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/ To Unsubscribe: https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
