After the publication several questions were asked and also I came to useful
conclusions. Here it goes...
I was asked why not use PAM while authenticating via SASL.
When I was working on the article it was not possible. Also the manpage
was misleading stating that PAM option works on Linux and Solaris.
According to manpage getpwent option works on all platforms. That is why
I chose the latter.
I made some tests and PAM authenticaion works fine with saslauthd daemon
now.
Moreover it is possible to chroot(1) postfix while working with
SASL.
In my article I suggested to edit master.cf file and change it to read
like this:
smtp inet n n n - - smtpd
Don't do that! Leave it as it was. The whole secret lies in SASL
installation.
After last cvsup of ports I have noticed some changes. There are now three
SASL ports - cyrus-sasl, cyrus-sasl2 and cyrus-sasl2-saslauthd.
(I decided not to go with the details regarding old layout of ports,
sorry.)
Before you make(1) anything go to cyrus-sasl2 and cyrus-sasl2-saslauthd;
and apply these patches as follows:
(Get the patches from here.)
Go to /usr/ports/security/cyrus-sasl2 and apply:
# patch -p < cyrus-sasl2.patch
Go to /usr/ports/security/cyrus-sasl2-saslauthd
# patch -p < cyrus-sasl2-saslauthd.patch
then chdir to /usr/ports/security/cyrus-sasl2-saslauthd/files
# patch -p < saslauthd.sh.patch
Go back to /usr/ports/security/cyrus-sasl2-saslauthd and now type:
# make all install
I assume you have not changed the queue_directory variable in
main.cf file. It is essential. queue_directory is the place where
Postfix chroots. My patches force SASL to use
/var/spool/postfix/saslauthd as a place to keep pid file and its socket.
This way, even when postfix is chrooted, it can see what's below
queue_directory. The config has been tested!
