Troubleshooting Postfix-Cyrus SASL Authentication Failures on CentOS 7: Mechanisms and Solutions


2 views

The core symptom appears when Postfix attempts to authenticate against Cyrus SASL (saslauthd), throwing these critical errors:

warning: xsasl_cyrus_server_get_mechanism_list: no mechanism available
fatal: no SASL authentication mechanisms

Interestingly, direct SASL authentication works perfectly when tested manually:

# testsaslauthd -u user -p password -s smtp
0: OK "Success."

Your current SASL configuration in /etc/sasl2/smtpd.conf appears correct at first glance:

pwcheck_method: saslauthd
mech_list: plain login

Postfix SASL-related settings show:

smtpd_sasl_type = cyrus
smtpd_sasl_path = smtpd

Several potential culprits could cause this mechanism disappearance:

  • Missing SASL mechanism libraries (particularly for plain/login)
  • Permission issues on SASL socket files
  • Mismatch between Postfix and SASL configurations
  • SELinux context problems (common on CentOS/RHEL)

First, verify SASL mechanisms are actually available:

# saslauthd -v
# sasldblistusers2
# ls -l /usr/lib64/sasl2/ | grep -E 'plain|login'

Check socket permissions (critical for Postfix communication):

# ls -la /var/run/saslauthd/
# stat /var/run/saslauthd/mux

Here's the complete fix sequence I recommend:

# yum install cyrus-sasl-plain cyrus-sasl-md5
# chmod 755 /var/run/saslauthd
# chgrp postfix /var/run/saslauthd/mux
# systemctl restart saslauthd
# systemctl restart postfix

For SELinux environments (likely on CentOS 7):

# semanage fcontext -a -t postfix_local_t "/var/run/saslauthd(/.*)?"
# restorecon -Rv /var/run/saslauthd

After applying fixes, test with:

# telnet localhost 25
EHLO test
AUTH LOGIN

You should now see proper mechanism listing and authentication flow.

If issues persist, enable detailed debugging:

# setsebool -P allow_postfix_local_write_mail_spool 1
# echo "psm_saslauthd_flags=\"-c -m /var/run/saslauthd -r -a pam -d\"" >> /etc/sysconfig/saslauthd
# tail -f /var/log/maillog | grep sasl

When working with Postfix and Cyrus SASL authentication on CentOS 7, you might encounter authentication failures despite saslauthd working correctly in isolation. The key symptoms from syslog show:

warning: SASL authentication failure: Internal Error -4 in server.c near line 1757
warning: xsasl_cyrus_server_get_mechanism_list: no mechanism available
fatal: no SASL authentication mechanisms

First, verify these critical components are properly configured:

# Check saslauthd service status
systemctl status saslauthd

# Verify saslauthd socket exists
ls -l /var/run/saslauthd/

The "no mechanism available" error typically indicates either:

  1. Missing SASL mechanism plugins
  2. Incorrect permissions on the saslauthd socket
  3. Mismatch between Postfix and SASL configurations

Install required SASL plugins:

yum install cyrus-sasl-plain cyrus-sasl-md5

Here's a complete working configuration:

# /etc/sysconfig/saslauthd
SOCKETDIR=/var/run/saslauthd
MECH=shadow
FLAGS="-O localhost"

# /etc/sasl2/smtpd.conf
pwcheck_method: saslauthd
mech_list: plain login
log_level: 7

Postfix main.cf additions:

smtpd_sasl_type = cyrus
smtpd_sasl_path = smtpd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

After configuration changes:

# Restart services
systemctl restart saslauthd postfix

# Test authentication
testsaslauthd -u username -p password -s smtp

# Check SASL debug output
journalctl -u saslauthd -f

If issues persist, increase logging:

# /etc/postfix/master.cf
submission inet n - n - - smtpd
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_sasl_security_options=noanonymous
  -o debug_peer_level=10
  -o debug_peer_list=192.0.2.0/24

Check SELinux context if enabled:

ls -Z /var/run/saslauthd/
semanage permissive -a saslauthd_t