Bug 175259

Summary:

smtpd.conf with saslauthd does not limit SASL mechanisms

Product:

[Fedora] Fedora

Reporter:

Patrick Ben Koetter <p>

Component:

postfix

Assignee:

Thomas Woerner <twoerner>

Status:

CLOSED NEXTRELEASE

QA Contact:

Severity:

medium

Docs Contact:

Priority:

medium

Version:

CC:

mattdm, sundaram

Target Milestone:

---

Keywords:

Reopened

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2007-04-07 11:55:03 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
replacement for current postfix-sasl.conf	none

Description Patrick Ben Koetter 2005-12-08 10:22:20 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8) Gecko/20051111 Firefox/1.5

Description of problem:
The default smtpd.conf that ships with the postfix rpm sets saslauthd as password verification, but it doesn't limit the SMTP AUTH mechanisms Postfix may announce to clients.

This will lead to authentication failures if a client chooses to use any other mechanism available than PLAIN or LOGIN, because saslauthd can only handle PLAIN and LOGIN.

It is quite likely that a client will choose any other mechanism, because it delegates the process of choosing the mechanism to libsasl, which will always go for the most secure mechanisms and PLAIN and LOGIN, being plaintext mechanisms, are the among the weakest mechanisms from a security standpoint.

Version-Release number of selected component (if applicable):
postfix-2.2.5-2.1.src.rpm

How reproducible:
Didn't try

Steps to Reproduce:
1. Configure Postfix to offer SMTP AUTH using the default smtpd.conf settings
2. Use a mail client that may use shared-secret mechanisms
3. Try to authenticate

Actual Results: Postfix offers all mechanisms that have been installed by the cyrus-sasl RPMs.
The client should fail, because it prefers CRAM-MD5 or DIGEST-MD5 over PLAIN or LOGIN.

Expected Results: Postfix should only offer mechanisms saslauthd can handle i.e. PLAIN and LOGIN.

Additional info:

Add the mech_list parameter and the options PLAIN LOGIN to smtpd.conf (or postfix-sasl.conf in the src.rpm) like this:

mech_list: PLAIN LOGIN

After this has been set and Postfix has been reloaded, it should only offer these plaintext-mechanisms after an "EHLO foo" in a telnet session to the SMTP port.

Comment 1 Rahul Sundaram 2006-02-20 10:50:59 UTC


These bugs are being closed since a large number of updates have been released
after the FC5 test1 and test2 releases. Kindly update your system by running yum
update as root user or try out the third and final test version of FC5 being
released in a short while and verify if the bugs are still present on the system
.Reopen or file new bug reports as appropriate after confirming the presence of
this issue. Thanks

Comment 2 Patrick Ben Koetter 2006-02-20 12:11:36 UTC

Created attachment 124881 [details]
replacement for current postfix-sasl.conf

Comment 3 Patrick Ben Koetter 2006-08-08 18:56:23 UTC

Hello Thomas Woerner,

I've noted that this bug is still present in postfix-2.3.2-1.src.rpm shipped
with FC6 test 2:

$ cat postfix-sasl.conf
pwcheck_method: saslauthd

Edit postfix-sasl.conf like this and the bug is fixed:

pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

Comment 4 Red Hat Bugzilla 2007-02-05 19:04:30 UTC

REOPENED status has been deprecated. ASSIGNED with keyword of Reopened is preferred.

Comment 5 Matthew Miller 2007-04-06 16:45:59 UTC

Fedora Core 5 and Fedora Core 6 are, as we're sure you've noticed, no longer
test releases. We're cleaning up the bug database and making sure important bug
reports filed against these test releases don't get lost. It would be helpful if
you could test this issue with a released version of Fedora or with the latest
development / test release. Thanks for your help and for your patience.

[This is a bulk message for all open FC5/FC6 test release bugs. I'm adding
myself to the CC list for each bug, so I'll see any comments you make after this
and do my best to make sure every issue gets proper attention.]

Comment 6 Patrick Ben Koetter 2007-04-07 11:55:03 UTC

The problem has been fixed. If I found a button to close this call, I'd do it.

Comment 7 Matthew Miller 2007-04-07 12:13:33 UTC

I think you did. Thanks. :)