Cyrus SASL

Cyrus SASL provides authentication for roaming users who want to use your mail server to send their mail. This doesn't have anything to do with the storage and reception of email. That will be handled with Courier IMAP and POP daemons that we'll deal with shortly. SASL stands for Simple Authentication and Security Layer and is essentially a challenge-response system for identifying and authenticating a user on a system. With our mail system, if you need to send a mail and want to use it as a relay, then you'll have to provide a user name and password before you're allowed to route your message through it. SASL will handle this.

Configuration and Installation

At this point, you should have the Cyrus-SASL tarball untarred in a directory. Our first step will be to prepare our shell for configuring the source code for compilation. Enter the following into your terminal:

export CPPFLAGS="-I/usr/include/mysql"
export LDFLAGS="-L/usr/lib/mysql -lmysqlclient -lz -lm"

This tells the shell where to find mysql libraries that SASL needs. Now we're ready to configure our source for compilation. Enter the following:

./configure --enable-anon --enable-plain --enable-login        --enable-sql \
--disable-krb4 --disable-otp --disable-cram --disable-digest \
--with-mysql=/usr/lib/mysql --without-pam --without-saslauthd \
--without-pwcheck --with-plugindir=/usr/local/lib/sasl2

If you didn't get any errors after that (and you shouldn't), then we can proceed to compile our Cyrus-SASL binaries. Type:

make

Again, if you didn't have any problems with that, now it's time to switch to being the 'root' user. We're going to install the packages. Type:

make install

and that will install everything where it's needed. Now, we need to check and make sure that that the path /usr/local/lib is in a file called ld.so.conf in the /etc directory. If it isn't, add the line:

/usr/local/lib

to this file and issue the command ldconfig. You must do this all as root. Now we need to create a configuration file that Cyrus-SASL needs to handle authentication of email users. Go to the directory /usr/local/lib/sasl2/ and create the file smtpd.conf with the following in it:

pwcheck_method: auxprop
auxprop_plugin: sql
sql_engine: mysql
mech_list: sql plain login
sql_hostnames: localhost
sql_user: postfix
sql_passwd: XXXXXXX
sql_database: postfix
sql_statement: SELECT clear FROM postfix_smtp WHERE email = '%u@%r'
sql_verbose: yes

Let me say again that it's very important that you not leave any extra spaces after those lines. Also, this file, at the moment is meaningless because we don't have MySQL set up. That's what we'll do right now - get the MySQL part of the system running.