Linux System Administration

Adding Authentication and Encryption

|

115

If you use a Linux distribution other than Debian, you’ll work with different files,

directories, and commands. For example, on many systems the standard way to start

saslauthd for the first time is via this command:

# saslauthd -a pam

Debian specifies the use of PAM through the configuration file instead.

Configuring Postfix with SASL to authenticate users without accounts

Using the password file for Postfix authentication on a Linux system requires each

person who relays mail via the server to have a user account. Obviously, this solu-

tion lacks scalability and requires more administrative time. To support users who

don’t have accounts on the SMTP server, SASL lets you use other storage options;

popular options include sasldb, LDAP, Kerberos, and MySQL. The saslauthd dae-

mon does not run when Postfix uses one of these methods; the separate program

with superuser privileges is not needed because SASL does not need access to the

operating system’s password file.

When using saslauthd, you are limited to plain-text password transmission and login

authentication. Therefore, Postfix also offers an alternative auxprop method, which

supports plain-text, login, CramMD5, DigestMD5, OPT, and NTLM authentication

methods.

Of all the authentication mechanisms discussed in this chapter, LDAP is the most

robust and scalable, but it has the limitation of using primarily ...