In setting up a replacement email server (upgrading from sendmail 8.12), the biggest struggle I have had is getting sendmail to play nice with sasl for user authentication. The end result is going to be that only authenticated users can relay.
Anyway, I've been researching this problem and trying to fix it for a month and I'm soon going to beat myself to death with the sendmail book if I can't solve it. :) I would GREATLY appreciate any assistance for getting this resolved!
Sendmail is compiled with with STARTTLS and SASLv2, using the DIGEST-MD5 and CRAM-MD5 mechanisms:
---------------------
Compiled with: DNSMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8 MIME8TO7
NAMED_BIND NETINET NETUNIX NEWDB NIS PIPELINING SASLv2 SCANF
SOCKETMAP STARTTLS TCPWRAPPERS USERDB XDEBUG
---------------------
and
---------------------
12760 >>> 250-AUTH DIGEST-MD5 CRAM-MD5
12760 >>> 250-STARTTLS
---------------------
The sendmail configuration options for this are set as I believe they should be (/etc/mail/sendmail.mc):
----------------------
define(`confAUTH_OPTIONS',
`A p y')dnl
define(`confAUTH_MECHANISM
S', `DIGEST-MD5 CRAM-MD5')dnl
TRUST_AUTH_MECH(`DIGEST-MD
5 CRAM-MD5')dnl
----------------------
saslauthd is up and running, using the 'shadow' mechanism, as I want for password authentication:
-----------------------
root 2891 0.0 0.0 2212 736 ? Ss Aug13 0:00 /usr/sbin/saslauthd -a shadow
-----------------------
And I've got the sasl Sendmail.conf file set for the same (/usr/lib/sasl2/Sendmail.c
onf):
-----------------------
pwcheck_method: saslauthd
mech_list: digest-md5 cram-md5
saslauthd_path: /var/state/saslauthd/
-----------------------
Though, I have absolutely no confidence that this file is even being read or used by sendmail.
I know that saslauthd is working because when I run testsaslauthd, it provides the following
response (password blurred for privacy):
-----------------------
> testsaslauthd -u caveman -p **********
0: OK "Success."
-----------------------
With sendmail up and running, I instruct Thunderbird to connect to the server and send a message
using 'username and password authentication'. SSL is disabled (in TB) for the moment because I am
simply testing, but the end result is the same whether it is enabled or not (in TB).
I put 'caveman', which is obviously a legitimate user, into the username field and then I click 'send'
on the email. Here is the authentication log from sendmail (hashes and domains obscured for privacy):
----------------------
12772 >>> 220 mail.domain.tld ESMTP Sendmail 8.14.3/8.14.3; Sat, 15 Aug 2009 15:35:46 -0500
12772 <<< EHLO [192.168.100.11]
12772 >>> 250-mail.domain.tld Hello mail.domain.tld [1.2.3.4], pleased to meet you
12772 >>> 250-ENHANCEDSTATUSCODES
12772 >>> 250-PIPELINING
12772 >>> 250-8BITMIME
12772 >>> 250-SIZE 20971520
12772 >>> 250-DSN
12772 >>> 250-AUTH DIGEST-MD5 CRAM-MD5
12772 >>> 250-DELIVERBY
12772 >>> 250 HELP
12772 <<< AUTH CRAM-MD5
12772 >>> 334 RDG53TZw3zH0KzGuPDf1KDE0A0
L3v3iyHmOw
eWGunmI0Dg
==
12772 <<< G2E2AW3hhiF1PTd4LGBiMDF4Km
JmATF4WWCy
HGP5YTCmWT
XyKjf2Rw==
12772 >>> 535 5.7.0 authentication failed
12772 <<< QUIT
12772 >>> 221 2.0.0 mail.domain.tld closing connection
----------------------
For whatever reason, DIGEST-MD5 is being ignored, I don't know why (maybe this is a
limitation in Thunderbird?).
Anyway, it doesn't matter what I type into the password field for Thunderbird, it always
fails authentication. And, sendmail logs this as a result:
----------------------
Aug 15 15:35:58 mail sm-mta[11234]: n9GWXfEI923132: mail.domain.tld [1.2.3.4] did not issue MAIL/EXPN/VRFY/ETR
N during connection to MSA-SSL
----------------------
I've tried making every change I've read about online to the authentication mechanisms,
but it doesn't matter what I put.. if CRAM-MD5 is there, it is what it uses. I am also convinced
that the Sendmail.conf file is not being used at, because I've changed everything in it to
garbage or legitimate items and sendmail never bats an eye or logs anything out of the
ordinary. Maybe its not in the right path? The sendmail book says to put it in /usr/lib/sasl2
but since this version of sendmail was not compiled by me (by the Slackware team), I
don't know this for certain.
Now, if I remove the DIGEST-MD5 and CRAM-MD5 and put LOGIN and PLAIN in their place,
sendmail doesn't even ask for a password and the mail goes out just fine. As well (though
I'm not certain if it is truly relative), the server receives mail just fine, too (from outside
servers).
I really don't know what else do to here. I've tried everything I can find online, everything
I think of, and even some things that I'm sure are not going to work.. and nothing does.
What am I missing? I could really use assistance!