www.sendmail.org/~ca/email/auth.html
Terminology SASL defines two terms which are important in this context: authorization identifier and authentication identifer. That is, the authentication credentials of the client contain the authentication identifier. This can be used for a proxy server to act as (proxy for) another user. Read the 16 docs which come with it (as well as README and INSTALL). Make sure the libraries are installed in a location which 18 sendmail uses on your system by default. BTW: sendmail requires 22 sasldb to be owned by root or the trusted user and not be readable by anyone else since the file contains sensitive data (shared secrets). If there is a conflict with other applications that need to read it too, you can 23 try a trick. You maybe need to set: APPENDDEF(confLIBDIRS', -L/PATH/TO/SASL/lib') APPENDDEF(confINCDIRS', -I/PATH/TO/SASL/include') (obviously you have to replace /PATH/TO/SASL/ with the path on your system) if you haven't installed sasl in a location where the Build tool looks for include and library files. However, this may cause problems during runtime, since the sasl library is dynamically loaded, and most OS don't load libraries from "unknown" locations, esp. If this doesn't reveal any problems, increase the LogLevel to 13 and try again. Examples of problems in the 30 logfile: * SASL error: listmech=0, num=0 or AUTH warning: no mechanisms This means the SASL library didn't find any mechanisms. Are any libraries installed in /usr/lib/sasl (or wherever you told SASL to be installed)? You can also set the environment variable SASL_PATH, see the Cyrus SASL docs. If it doesn't, then your configuration is wrong (check your parameters for configure (SASL) and all the paths). This can be done by looking at its content (using strings or od -c) and checking that the names of those mechanisms appear in the file. Possible solutions are: don't use sendmail -bs but talk directly to the MTA, or if you really need this feature, make sasldb group readable for smmsp (if you use it) and set the appropriate DontBlameSendmail option GroupReadableSASLDBFile. DefaultAuthInfo (confDEF_AUTH_INFO) specifies a file in which the authorization identity, the authentication identity, the secret, and the realm to be used for authentication are stored. This file must be in a safe directory and unreadable by everyone except root (or TrustedUser). It is used when 40 sendmail acts as a client to authenticate itself to a server. This may reveal the secret if the other side offers a plaintext authentication mechanism. Make sure the secret is not a real password used for an account somewhere. See cf/README for details, look in the section SMTP AUTHENTICATION. If you really want to use DefaultAuthInfo (it is deprecated) then you have to remove the ruleset. DaemonPortOptions (DAEMON_OPTIONS has now suboptions (called modifiers), one of which is a'. This tells the daemon to require authentication for all connections to it. The ruleset trust_auth is used to decide whether the client's authentication identifier ( 46 authid) is trusted to act as (proxy for) the requested authorization identity ( 47 userid). The provided rules allow 48 authid to act for 49 userid if both are identical and they disallow it if the authentication failed. The ruleset Local_trust_auth can be used to provide further tests. As usual, it can either return the error mailer ($# error) to disallow proxying or $# OK to allow proxying. Requiring SMTP AUTH for all mails is in general a bad idea, because then you cannot receive mails from other users (since the cannot authenticate). So you must do this only on a server that is solely intended for your own users to send mail, not for a publically advertised (via MX records) server. Now that 57 sendmail provides SMTP AUTHentication, you probably want a MUA that uses it. Many MUAs on Unix call 59 sendmail directly, so for roaming users it is sufficient if their 60 sendmail can 61 authenticate itself against the mailserver. PLAIN SASL mechanism Clear-text passwords are simple, interoperate with almost all existing operating system authentication databases, and are useful for a smooth transition to a more secure password-based authentication mechanism. The drawback is that they are unacceptable for use over an unencrypted network connection. If you use it anyway, and you use Netscape as MUA, then in some cases you may want to turn it off; More Possible Problems 70 Realms can cause some problems because they are not standardized for all mechanisms. This is fixed in Mercury/32 according to 72 Pegasus tech support. Security Layer 73 SASL means Simple Authentication and Security Layer. This is a problem with Cyrus SASL which doesn't obey the maximum security settings of 78 sendmail. Other WWW Pages about SMTP AUTH Some people complained that my explanations are too hard to understand for beginners. Otherwise use a search engine to find more explanations or let me know how to enhance this WWW page. He and Larry Greenfield also provided valuable feedback during further development and integrated our patches or implemented features we requested.
|
http://csua.com/feed/