One of the greatest challenges in migrating my server from a managed FreeBSD server to the new OpenBSD server was learning how to implement support for SASL on SMTP connections. This seems like something so elementary in a mail server that it should be really simple. Unfortunately, simply installing the cyrus-sasl package doesn’t handle the integration with sendmail for you nor is there any really good documentation online. I was particularly disappointed that OpenBSD’s documentation was completely silent on how to do it.

After searching online nearly all searches for SASL on OpenBSD were for Postfix. Fortunately I did come across an article on how to do it. While it was written for OpenBSD 3.3 nearly all of the steps also apply to 4.7 and later. You can find the original article here.

First we’re going to need to install the cyrus-sasl package. We’re going to be using the plain vanilla version which allows us to use OpenBSD’s Unix style authentication from /etc/master.passwd. There are other flavors for LDAP, MySQL, and db4.

Here we’ll choose option 1.

Next we want to let saslauthd (the Cyus SASL 2 daemon) know that it’s going to be working with sendmail and what types of authentication we want to support. This is done by creating a file called Sendmail.conf in /usr/local/lib/sasl2 like this. The cat command listed first allows you to enter the contents into the file without opening an editor such as vi.

# cat > /usr/local/lib/sasl2/Sendmail.conf

pwcheck_method: saslauthd

mech_list: LOGIN PLAIN

(hit ctrl-d to save)

There are other authentication methods than just LOGIN and PLAIN that you can use such as DIGEST-MD5 and CRAM-MD5 that you can also add on the second line of the file if you plan on using them. Since we’re using OpenBSD’s own authentication mechanism we’ll omit them from the line.

Before we forget, let’s add our startup script to /etc/rc.local to ensure that saslauthd is started with the server:

if [ -x /usr/local/sbin/saslauthd ]; then

echo -n ‘ saslauthd’; /usr/local/sbin/saslauthd -a getpwent

fi

On OpenBSD 5.0 and later*, saslauthd will be started using the rc.d(8) mechanism. You will need to add the following line to /etc/rc.conf.local:

pkg_scripts=”saslauthd”

saslauthd_flags=”-a getpwent”

* Substitute “pkg_scripts” for “rc_scripts” if you’re using 4.9.

Worth noting here is that we are using getpwent(3) as our authentication method. This is basically just saying that we’re authenticating against /etc/master.passwd. Since saslauthd defaults to starting up 5 threads or processes each time it runs, we can limit this by adjusting the startup command with a -n option followed by the desired number of threads we want to limit to. This may be desirable on an older machine with fewer resources.

Now that we have SASL configured we can move onto telling sendmail about it. This is where things can get a little tricky as I found after toying with various setups. We’ll need to recompile sendmail with SASL support. This is made much simpler on FreeBSD as there is a sendmail-sasl port that you can build. Why OpenBSD doesn’t do something similar or simply compile the support into their binaries is beyond me. The actual /etc/sendmail.cf or /etc/localhost/cf doesn’t even know that it needs to use cyrus-sasl until you configure it to.

Rant aside. Let’s get back to work now.

We need to tell our make environment that we want to support SMTP AUTH. This is done by creating /etc/mk.conf if it doesn’t already exist on your system.

# echo “WANT_SMTPAUTH=yes” >> /etc/mk.conf

Next we need to create a symlink for the library file for our version of cyrus-sasl.

# cd /usr/local/lib; ln -fs libsasl2.so.2.23 libsasl2.so

Now we need to add our cyrus-sasl support to sendmail prior to recompiling it. Be sure that you’ve untarred the src.tar.gz file into /usr/src from the OpenBSD source installation CD or that you’ve downloaded it for your release from their FTP site.

# cd /usr/src/gnu/usr.sbin/sendmail/cf/cf

Here you will find numerous example M4 source files. The one that we want to modify is the openbsd-proto.mc since we’re setting up a mail server that sends and receives mail. If your mail server will only be offering SMTP services you want the openbsd-localhost.mc file.

Look for this line:

FEATURE(`no_default_msa’)dnl

Below it we’re going to add our changes:

define(`confAUTH_MECHANISMS’,`PLAIN LOGIN’)dnl

TRUST_AUTH_MECH(`PLAIN LOGIN’)dnl

define(`confAUTH_OPTIONS’,“y,p”)dnl

Remember that we added PLAIN and LOGIN to our /usr/local/lib/sasl2/Sendmail.conf? This is just telling sendmail to also use these authentication methods. If you wanted to use the MD5 methods that we talked about you’d also include them here. The third line with the AUTH_OPTIONS is optional and may not work well with all mail clients. The “y” option is disallowing any mechanism that allows anonymous login. The “p” option is disallowing any mechanism susceptible to a passive attack unless a security layer such as STARTTLS is used. While Thunderbird had no issues with these options being turned on Apple Mail and the iPhone Mail client failed to make SMTP connections with them on. There are several more options you can turn on here but I will leave it up to you to check out official sendmail sources for further information, or pick up a copy of the O’Reilly sendmail, 4th Edition book.

Now to recompile sendmail and put it in place. The end is in sight.

# cd /usr/src/gnu/usr.sbin/sendmail

# make clean && make obj && make depend && make && make install

# cp cf/cf/obj/openbsd-proto.cf /etc/mail/sendmail.cf

Start saslauthd and restart sendmail:

# /usr/local/sbin/saslauthd -a getpwent

# kill -HUP `head -1 /var/run/sendmail.pid`

On OpenBSD 4.9 and later:

# /etc/rc.d/saslauthd start

# /etc/rc.d/sendmail restart

If you get an error about no matching pid it just means that sendmail is not running and needs to be started up manually. To do this we need to grab the sendmail_flags line from our /etc/rc.conf.local and run it. If you’re only using your mail server for SMTP the line will still be in /etc/rc.conf.

# /usr/sbin/sendmail -L sm-mta -C/etc/mail/sendmail.cf -bd -q30m

Congratulations! You should now have a fully working mail server. You may also want to explore adding STARTTLS support for added security. The starttls(8) man page had the best tutorial you’ll ever read on this. It’s very straightforward and gives you all the commands you need to generate your self-signed SSL certificates and put them in place.

]]> http://bsdforever.org/index.php/2012/06/07/sassy-cyrus-sasl-say-that-5-times-fast/feed/ 7 http://bsdforever.org/index.php/2011/08/29/chicks-dig-openbsd-femail-chroot/ http://bsdforever.org/index.php/2011/08/29/chicks-dig-openbsd-femail-chroot/#comments Mon, 29 Aug 2011 20:20:48 +0000 admin http://bsdforever.org/?p=174 Recently I’ve had this really nagging issue where I could no longer send email from Roundcube. Mail would send just fine from any email client. A review of the mail logs for the failed message being sent from Roundcube gave a puzzling error about an unbalanced “< ” proceeding the recipient’s name with the email address. I did find that removing the person’s name proceeding the email address from the “To” line allowed me to send the message. Basically, removing the name when the field looks like this:

John Doe <user@somedomain.com>

I tried playing around with a few things including re-installations of Roundcube and did a really thorough glean of my sendmail config files comparing them to the defaults. Looking through the MySQL database showed no extra angle brackets in any of the stored contacts. I did find a post on the Roundcube forums about the same error but for an older version. I tried messing around with some of the PHP files as the fix mentioned in the article was no longer applicable due to filename changes, but had no change in behavior. Thinking that perhaps there was some bug in the PHP code itself I tried installing later versions but I still got the same error about the message failing to send. I had no issues with the 0.3.x releases. This issue cropped up in the 0.5.x branch.

Finally on a hunch I began to suspect that mini_sendmail-chroot was the culprit. It turns out that I was exactly right. A search of the OpenBSD mailing list archives pointed me to a replacement called femail-chroot which was described as being less problematic. I tried it out and problem resolved! I’m not sure what it was about mini_sendmail that breaks with newer PHP scripts. Unfortunately, the project is apparently no longer maintained with the last release being from 2005.

Femail is basically a drop-in replacement for mini_sendmail. The only work involved is to just point PHP to it in your php.ini and restart Apache. You can install femail-chroot as a package (run pkg_add femail-chroot as root) or from ports (mail/femail). If you install it from ports please note that the chrooted version is available as a flavor.

Peeter Hansteen, author of the indispensable The Book of PF has a very nice explanation of some of the things we can expect in 5.0 and how this is not a revolutionary release but an evolutionary one.

Some of the interesting things he mentions are that sysmerge(8) will now be available to run from the installer instead of having to boot from the CD or new bsd.rd RAM disk and later going through and merging /etc, and being able to install non-free firmware from the get-go.

You can see a list of changes already implemented since 4.9-release here.

I just installed a copy of the beta and started playing with it. So far I noticed that work on rc.d scripts continues to evolve as startup daemons in base now have individual scripts. In 4.9 rc scripts were only available for third-party software installed from packages or ports.

The man pages for rc.conf(8) and rc.d(8) were extremely helpful for updating my configuration to take advantage of the new rc scripts. The only gotcha I ran into was that not everything has an rc script written for it yet and I had forgotten to setup certain ones to use a particular user like I had in my previous rc.local. Not a problem. The option to set a user for the startup daemon will always be named the same as the rc script. For example, the rc script for ClamAV is /etc/rc.d/clamd. To tell my server what user to run as I just add these lines to 1) start the daemon and 2) start it as the proper user in /etc/rc.conf.local.

rc_scripts=”clamd”
clamd_user=”_clamav”

Simple enough, huh?

OpenBSD admits that the rc script functionality is a work in progress. It works very well in its current form and is well implemented as it is in the other BSDs. This is a great release and you should upgrade if you haven’t already. A round of applause for the OpenBSD developers!

You can find the release notes here:

http://openbsd.org/49.html

# pkg_add colorls

Colorls works exactly the same as regular “ls”. To get the color option you just need to use the -G option. If you want it to replace “ls” for regular work you can create an alias in your favorite shell’s environment file. The output for file and directory listings will now have a different color for different types of files.

White = regular file
Purple = directory
Red = executable file
Magenta = symbolic link
White highlight = Set Group ID enabled
Red highlight = Set User ID enabled
Yellow highlight = Sticky bit enabled

Enjoy! Almost as good as getting the window seat at work.

In yet another attempt to get Adobe to reconsider their position the PC-BSD team has put together a petition to get Flash for FreeBSD. Getting Adobe to see the growing number of BSD users is very important in making BSD more mainstream. Adobe has maintained Solaris support for Flash for a number of years. I think we’ve come a long way since Solaris was last a mainstream Unix desktop system compared to the number of desktop BSD systems there are now. If Adobe were to make Flash for FreeBSD I believe that it would be a fairly simple matter to get it to work under OpenBSD’s FreeBSD emulation mode.

Please take a moment to sign.

http://www.petitiononline.com/flash4me/petition.html

The Book of PF 2nd edition
Mac OS X for Unix Geeks (Leopard), Fourth Edition
Mac OS X Snow Leopard: The Missing Manual
Network Warrior
Practical UNIX and Internet Security, Third Edition
Unix Power Tools, Third Edition
Learning Perl, Fifth Edition
Learning MySQL
Learning the bash Shell, Third Edition
Classic Shell Scripting
Learning Python
Postfix: The Definitive Guide

The contest ends on February 22, 2011 at 11:59 PM PST.  Good luck!