The Postfix Cyrus SASL support is used to authenticate remote SMTP clients to the Postfix SMTP server. Thanks to the Pluggable Authentication Modules (PAM) in Linux, we can configure Cyrus SASL to delegate the authentication process to an Active Directory server.

Setup and Configure Kerberos

The steps below describes how to configure Kerberos using the GUI tool. You can apply the changes manually by editing the file /etc/krb5.conf.

ImportantThe Kerberos network authentication protocol requires the clocks of the involved machines to be synchronized or at least the difference is less than 5 minutes.

Authentication1. Click System, select Administration and click Authentication. This will launch the Authentication Configuration window.
Authentication2. Click the Authentication tab and check the Enable Kerberos Support. Next, click the Configure Kerberos button.
Kerberos Settings3. In the Kerberos Settings window, fill in the Realm, clear out KDC and Admin Servers and check the Use DNS to locate KDCs for realms. Realm is usually your domain name capitalized, capitalization is important. KDC is your Active Directory server. Click Ok when you’re done.

NoteTo make sure that your KDC can be automatically located, type in the command host -t any _kerberos._tcp.acme.local in a terminal window. Replace acme.local with your own realm. If it replies “_kerberos._tcp.acme.local has SRV record …” then it works, otherwise you’ll have to fill in the KDC field above. This is how the Windows workstation is able to find the domain controller during domain logon.

Authentication4. Uncheck the Enable Kerberos Support and click Ok. We don’t actually want to use Kerberos authentication in Linux, we just want the tool to setup Kerberos for us.
Terminal5. Test Kerberos by typing in kinit username in a terminal window. If you need help in making sense of the kinit error messages, check out Test the Kerberos Authentication.

Configuring Cyrus SASL

Edit pam dovecot1. Edit the file /etc/pam.d/smtp and replace the content with the lines below.
auth     sufficient pam_krb5.so no_user_check validate
account  sufficient pam_permit.so
Service Configuration2. Restart the saslauthd service.
Terminal3. Test saslauthd by typing in the command below in a terminal window.
testsaslauthd -u username -p password -s smtp

Cyrus SASL is now configured to authenticate against an Active Directory server. Proceed to Postfix SMTP Authentication for instructions on configuring Postfix. Or restart Postfix or MailScanner and jump directly to the Test Postfix using Telnet part if you have already done so.

Visit the forum to ask for help or to give a comment.

***
Posted on 4/12/2008 and last updated on 4/24/2010
Filed under Active Directory , CentOS 5 , Kerberos , Red Hat Enterprise Linux 5 , SASL