<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 03/13/2013 10:47 AM, Dale Macartney wrote: > > > On 03/12/2013 02:05 PM, Anthony Messina wrote: > > On Tuesday, March 12, 2013 08:53:59 AM Anthony Messina wrote: > >> On Tuesday, March 12, 2013 01:50:47 PM Dale Macartney wrote: > >>> > # Import environment for Kerberos v5 GSSAPI > >>> > > >>> > import_environment = > >>> > > >>> > MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY > >>> > >>> LANG=C > >>> > >>> > KRB5_KTNAME=/etc/postfix/smtp.keytab > >>> > >>> > >>> Anthony, where were you declaring the above? In Squid, I've added the > >>> keytab to the service startup script. Presumably it would be somewhere > >>> similar?> > >>> > >>> > >>> Dale > >> > >> In /etc/postfix/main.cf > > > Sorry, I sent too fast. from man (5) postconf: > > > import_environment (default: see postconf -d output) > > The list of environment parameters that a Postfix process will import > > from a non-Postfix parent process. Examples of relevant parameters: > > > TZ Needed for sane time keeping on most System-V-ish systems. > > > DISPLAY > > Needed for debugging Postfix daemons with an X-windows debugger. > > > XAUTHORITY > > Needed for debugging Postfix daemons with an X-windows debugger. > > > MAIL_CONFIG > > Needed to make "postfix -c" work. > > > Specify a list of names and/or name=value pairs, separated by > > whitespace or comma. The name=value form is supported with Postfix version 2.1 > > and later. > Things aren't really playing ball here.... > > I've configured postfix from default install with the below changes.. > > Am I missing something? > > ipa-getkeytab -s ds01.example.com -p smtp/$(hostname) -k /etc/postfix/smtp.keytab > postconf -e 'inet_interfaces = all' > postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain' > postconf -e 'myorigin = $mydomain' > postconf -e 'import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY LANG=C KRB5_KTNAME=/etc/postfix/smtp.keytab' > postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination' > postconf -e 'smtpd_sasl_auth_enable = yes' > postconf -e 'smtpd_sasl_security_options = noanonymous' > postconf -e 'smtpd_sasl_tls_security_options = $smtpd_sasl_security_options' > > cat >> /etc/postfix/main.cf << EOF > virtual_alias_domains = example.com > virtual_alias_maps = <a class="moz-txt-link-freetext" href="ldap:/etc/postfix/ldap_aliases.cf">ldap:/etc/postfix/ldap_aliases.cf</a> > EOF > > cat > /etc/postfix/ldap_aliases.cf << EOF > server_host = ds01.example.com > search_base = cn=accounts,dc=example,dc=com > query_filter = (mail=%s) > result_attribute = uid > bind = no > start_tls = yes > version = 3 > EOF > > postmap /etc/postfix/ldap_aliases.cf > restorecon -R /etc/postfix/ > > cat > /etc/sasl2/smtpd.conf << EOF > pwcheck_method: saslauthd > mech_list: GSSAPI PLAIN LOGIN > EOF > > > > LDAP lookups work perfectly, however kerberos authentication doesn't seem to want to work. I should mention, I am not using SSL (yet). Does sasl/gssapi have some form of prereq of SSL by any chance? > > Logs from maillog are as follows > > Mar 12 15:51:27 mail01 postfix/smtpd[26240]: connect from unknown[10.0.1.101] > Mar 12 15:51:27 mail01 postfix/smtpd[26240]: warning: SASL authentication failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information () > Mar 12 15:51:27 mail01 postfix/smtpd[26240]: warning: unknown[10.0.1.101]: SASL GSSAPI authentication failed: generic failure > Mar 12 15:51:27 mail01 postfix/smtpd[26240]: disconnect from unknown[10.0.1.101] > > Thanks all > Silly mistake on my part. Simple perms issue with keytab file. Below is a working config of postfix with IPA user lookups and kerberos authenticated sending. ipa-getkeytab -s ds01.example.com -p smtp/$(hostname) -k /etc/postfix/smtp.keytab chown root:mail /etc/postfix/smtp.keytab chmod 644 /etc/postfix/smtp.keytab postconf -e 'inet_interfaces = all' postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain' postconf -e 'myorigin = $mydomain' postconf -e 'import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY LANG=C KRB5_KTNAME=/etc/postfix/smtp.keytab' postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination' postconf -e 'smtpd_sasl_auth_enable = yes' postconf -e 'smtpd_sasl_security_options = noanonymous' postconf -e 'smtpd_sasl_tls_security_options = $smtpd_sasl_security_options' postconf -e 'broken_sasl_auth_clients = yes' postconf -e 'smtpd_sasl_authenticated_header = yes' postconf -e 'smtpd_sasl_local_domain = $mydomain' cat >> /etc/postfix/main.cf << EOF virtual_alias_domains = example.com virtual_alias_maps = <a class="moz-txt-link-freetext" href="ldap:/etc/postfix/ldap_aliases.cf">ldap:/etc/postfix/ldap_aliases.cf</a> EOF cat > /etc/postfix/ldap_aliases.cf << EOF server_host = ds01.example.com search_base = cn=accounts,dc=example,dc=com query_filter = (mail=%s) result_attribute = uid bind = no start_tls = yes version = 3 EOF postmap /etc/postfix/ldap_aliases.cf restorecon -R /etc/postfix/ cat > /etc/sasl2/smtpd.conf << EOF pwcheck_method: saslauthd mech_list: GSSAPI PLAIN LOGIN EOF sed -i 's/MECH=pam/MECH=kerberos5/g' /etc/sysconfig/saslauthd > > > > > > > _______________________________________________ > > Freeipa-users mailing list > > <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> > > <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - <a class="moz-txt-link-freetext" href="http://www.enigmail.net/">http://www.enigmail.net/</a> iQIcBAEBAgAGBQJRQHPYAAoJEAJsWS61tB+qpOsQAJsGDmZVHLbP4YloMoYDM4M2 zOkF7fhIqT+4OKlb5hgBxcFY/VFvwGK/qvYguNbvlxIfT+DQgkTZ5hHKSHjWj1kQ YVTaztp7p3S3acAYLTKprOltPslnFED4PuUA+EN8pxV/VAiABBE0xBoEIUGoIvEn oRsU2UmAkaDpFxP1F9vVM6APsvDXkTMaxmzlRZFkaotDkbSXAd58x5h5TajjpEs7 rnppLgB7rfgL5bmeNjEoUT7g61nRvMYINh+Rr6HhZwOxWWfbe0SWXHasCkUrJ0V3 5aXzhFH9z4hEGCKYZv5ugqDD/uw0c8/GOpYwONqwfVhEET0JxiKxgZnhoUP20SrT 7RV8D6vzqhXtFdiD6MLrZ1euejuNRmGpSg3NxfOmKC8z1rHjXmYj61ppPGHJslNs 4Ey61JuB+s5ickJKJ13juCzNmqYTmjclBUc4kzvEiYBPpskgmus3e/d3MUqpC/Jp 17pS/aiPvm6Ko1N2QFbApAMVPGtooF3rt0HuJW8O7oJLnQw3GPwx4jViOY57t4Ka aiiYTs/ECddKKhTmc/GX12HuXhvZQtembGUar+BDt85nFYX5nkKlHxL7D9znmXmO /fA83oOhJexdzcq5zD/aOHlnv2j/eLDLXpPZFV8McLO9tqTPgeToqznyDVstrO4f JyxVSyPS8fY9noBVXydH =0xzR -----END PGP SIGNATURE----- </body> </html>