2

I've set up pam-pgsql to lookup passwords in my database for Postfix via Saslauthd.

I can test credentials using the command line:

$ sudo testsaslauthd -u user@email.com -p password

0: NO "authentication failed"

Authentication will fail, and I don't know why.

$ sudo tail /var/log/auth.log

Feb  5 15:33:12 saslauthd[7460]: pam_unix(imap:auth): check pass; user unknown
Feb  5 15:33:12 saslauthd[7460]: pam_unix(imap:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Feb  5 15:33:14 saslauthd[7460]: DEBUG: auth_pam: pam_authenticate failed: Authentication failure
Feb  5 15:33:14 saslauthd[7460]: do_auth         : auth failure: [user=user@email.com] [service=imap] [realm=] [mech=pam] [reason=PAM auth error]

How can I know what pam-pgsql is doing? How can I get more helpful messages?

jonallard
  • 261
  • 2
  • 8

2 Answers2

2

Jon from the past! I have the answer to all your problems.

There's a clue right in your log:

saslauthd[8044]: pam_unix(imap:auth): check pass; user unknown

Remember how you put the PAM config in /etc/pam.d/smtp and not imap? And your log says imap? Yup, you're trying to auth on the wrong service.

I actually found the solution in the Postfix SASL manual, just under where you found that Sasl test command:

Testing saslauthd authentication

Specify an additional "-s smtp" if saslauthd was configured to contact the PAM authentication framework

Yup, you will soon find that the right invocation is rather:

$ sudo testsaslauthd -u user@email.com -p password -s smtp
0: OK "Success."
jonallard
  • 261
  • 2
  • 8
1

I assume you have config this module through it's config file /etc/pam_pgsql.conf which accepts debug parameter:

    database = db
    user = user
    [...]
    debug = 1

There's also a global debug parameter you should append to pam config lines:

    auth        required    pam_pgsql.so debug

source: [github] Official repo

maxxvw
  • 321
  • 1
  • 7