主页 / unix / 问题 / 763565
Accepted
schrodingerscatcuriosity
Asked: 2023-12-11 22:06:22 +0800 CST

Ubuntu 服务器 22.04 Postfix/Dovecot 错误：postfix/smtpd 致命：没有 SASL 身份验证机制

  • 772

当我运行时，遵循 Ubuntu 的官方指南安装和配置 Postfix

telnet localhost 25

我明白了

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.

当我查看日志时我得到

$ sudo tail /var/log/mail.err
Dec  7 11:38:17 <host> postfix/smtpd[8477]: fatal: no SASL authentication mechanisms

上面的示例是在虚拟机中运行的，但同样的情况也发生在云中的服务器中，并且telnet远程运行到域中。（我尝试在虚拟机中复制该过程，看看是否可以更轻松地发现发生的情况）。

我已经阅读了所有新旧帖子、博客、文章，尝试了我能想到的所有配置，但错误仍然存​​在。我不明白出了什么问题。我的配置：

/etc/postfix/main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 3.6 on
# fresh installs.
compatibility_level = 3.6



# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/server.crt
smtpd_tls_key_file = /etc/ssl/private/server.key
smtpd_tls_security_level = may

smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache


smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = <host>
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = <host>, <host>.local, <host>, localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::1]/128 [::ffff:127.0.0.0]/104 [::1]/128 192.168.30.0/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous,noplaintext
smtpd_sasl_tls_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtp_tls_note_starttls_offer = yes
smtpd_tls_loglevel = 4
smtpd_tls_received_header = yes

/etc/dovecot/conf.d/10-master.conf

service auth {
  unix_listener auth-userdb {
    #mode = 0666
    #user = 
    #group = 
  }

  # Postfix smtp-auth
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }

  # Auth process is run as this user.
  #user = $default_internal_user
}

我按照官方指南“安全-证书”创建了 VM 中的 SSL 文件。在我的云服务器中，我尝试使用 Let's encrypt/Certbot 文件。我将它们添加到/etc/dovecot/conf.d/10-ssl.conf文件中

ssl_cert = </etc/ssl/certs/server.crt
ssl_key = </etc/ssl/private/server.key

每次配置更改后，我都重新启动了 Postfix 和 Dovecot 服务。服务声明：

后缀

● postfix.service - Postfix Mail Transport Agent
     Loaded: loaded (/lib/systemd/system/postfix.service; enabled; vendor preset: enabled)
     Active: active (exited) since Thu 2023-12-07 12:26:07 UTC; 9min ago
       Docs: man:postfix(1)
    Process: 3362 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
   Main PID: 3362 (code=exited, status=0/SUCCESS)
        CPU: 1ms

dic 07 12:26:07 <host> systemd[1]: Starting Postfix Mail Transport Agent...
dic 07 12:26:07 <host> systemd[1]: Finished Postfix Mail Transport Agent.

鸽舍

● dovecot.service - Dovecot IMAP/POP3 email server
     Loaded: loaded (/lib/systemd/system/dovecot.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2023-12-07 12:26:08 UTC; 12min ago
       Docs: man:dovecot(1)
             https://doc.dovecot.org/
   Main PID: 3372 (dovecot)
     Status: "v2.3.16 (7e2e900c1a) running"
      Tasks: 5 (limit: 2220)
     Memory: 3.1M
        CPU: 44ms
     CGroup: /system.slice/dovecot.service
             ├─3372 /usr/sbin/dovecot -F
             ├─3373 dovecot/anvil
             ├─3374 dovecot/log
             ├─3375 dovecot/config
             └─3381 dovecot/stats

dic 07 12:26:08 <host> systemd[1]: Starting Dovecot IMAP/POP3 email server...
dic 07 12:26:08 <host> dovecot[3372]: master: Dovecot v2.3.16 (7e2e900c1a) starting up without any protocols (core dumps disabled)
dic 07 12:26:08 <host> systemd[1]: Started Dovecot IMAP/POP3 email server.

我按照指南中的故障排除部分进行操作。我尝试了很多排列，但没有任何效果，并且日志没有提供我可以使用的任何细节。

这个问题已经太长了，因为我尝试了很多事情，所以我不想让它变得更长，请在评论中提问，如果需要，我将编辑添加相关信息。也许我错过了一些非常基本的东西。

ubuntu

1 个回答

  1. Best Answer

    Ubuntu 指南

    人们会从Ubuntu 官方指南中期望遵循步骤S将给出可以用T测试的结果R，因为这就是指南的呈现方式。

    执行S → R → T后，我的测试失败了，因此我很困惑，问题也发布在这里。

    但是，紧接着的S不会产生R：

    该指南在S中给出了此配置：

    ...
sudo postconf -e 'smtpd_sasl_security_options = noanonymous,noplaintext'
...

    注意noplaintext.

    然后指南显示“初始配置的结果”：

    ...
smtpd_sasl_security_options = noanonymous
...
smtpd_tls_auth_only = no

    请注意，没有 noplaintext，并且smtpd_tls_auth_only = no不在S中，也不在默认postfix配置文件（版本 3.6.4）中。

    因此，telnet如果设置了，按照指南中建议的方式进行测试将不起作用noplaintext，因为这意味着通信必须安全地进行，并且telnet不支持 SSL。

    来自www.postfix.org/SASL_README

    更复杂的策略允许明文机制，但只能通过 TLS 加密的连接：

    /etc/postfix/main.cf:
       smtpd_sasl_security_options = noanonymous, noplaintext
       smtpd_sasl_tls_security_options = noanonymous

    测试：

    • smtpd_sasl_security_options = noanonymous连接 with将telnet起作用：

      telnet <domain> 25

    • withsmtpd_sasl_security_options = noanonymous,noplaintext连接telnet 不起作用。

    • withsmtpd_sasl_security_options = noanonymous,noplaintext和smtpd_tls_auth_only = yesconnect withopenssl都可以。

      openssl s_client -starttls smtp -connect <domain>:25

    • withsmtpd_sasl_security_options = noanonymous,noplaintext和smtpd_tls_auth_only = no连接 withopenssl 不起作用。

    总而言之，Ubuntu 指南已损坏，至少对于 Ubuntu 服务器 22.04 而言，跟随S不会导致R，因此T将失败。

    • 0

相关问题