DIGEST-MD5 not working for Postfix

[Chris1]

Hello

I have a strange issue which is causing our clients to be banned by the "plesk-postfix" Fail2Ban jail.

These clients were recently migrated from Plesk 10 to the current Plesk 12 server.

We are seeing the following in /var/log/maillog

Sep 30 13:22:14 plesk-1 postfix/smtpd[276918]: connect from hostname.isp.com[111.111.111.111]
Sep 30 13:22:15 plesk-1 postfix/smtpd[276918]: warning: hostname.isp.com[111.111.111.111]: SASL DIGEST-MD5 authentication failed: authentication failure
Sep 30 13:22:15 plesk-1 postfix/smtpd[276918]: 423168A1213: client=hostname.isp.com[111.111.111.111], sasl_method=LOGIN, [email protected]
Sep 30 13:22:15 plesk-1 postfix/smtpd[276918]: disconnect from hostname.isp.com[111.111.111.111]

Notes:
For privacy reasons
Clients IP has been replaced with 111.111.111.111
Clients hostname has been replaced with hostname.isp.com
Our server name has been replaced with plesk-1
Email address has been changed to [email protected]

So it seems that the client attempts to authenticate with Postfix, it issues an authentication failure but then immediately successfully logs in, sends the email and then disconnects from the server.

Why are we getting a failure when they have the correct login details and are successfully logging in?

I have replicated this problem on a different computer on a different internet connection/IP.

Has anyone run into this problem before?

Update:
This also appears to be happening on our other Plesk 12 servers on domains that haven't been migrated from Plesk 10.

I've found that by removing DIGEST-MD5 from the mech_list in /usr/lib64/sasl2/smtpd.conf it prevents the authentication failure. Is this a proper fix though?

This is my /usr/lib64/sasl2/smtpd.conf file:

pwcheck_method: auxprop saslauthd
auxprop_plugin: plesk
saslauthd_path: /var/spool/postfix/private/plesk_saslauthd
mech_list: DIGEST-MD5 CRAM-MD5 PLAIN LOGIN
sql_engine: intentionally disabled
log_level: 4

I've tested the following clients:

Samsung S4 - Uses Plain method by default, no problem
Outlook 2010 - Uses DIGEST-MD5 by default, problem as shown above
Outlook 2013 - Uses DIGEST-MD5 by default, problem as shown above
Thunderbird - Uses Plain method by default, no problem

 

[Chris1]

Ive tested this on a 12.5 server and DIGEST-MD5 works ok, just not on any of the Plesk 12 servers..?

I've found that on the Plesk 12 servers, the Postfix version is 2.6.6-6.el6_5 but the Plesk 12.5 server is 2.10.1-6.el7.

Was there a change between these versions that would have solved this issue?

I'm surprised that there aren't more complaints about the DIGEST-MD5 auth fail issue. Why is CentOS 6 or CloudLinux 6.7 hanging onto such old software that is no longer supported?

 

[PSi_101]

I've been seeing this same issue with my customers since Plesk 12.0.18. All of them (that are failing auth using digest-md5) are using Outlook. Even the latest Outlook in Windows 10 is failing auth against Dovecot.
The only way i've found to work around the problem is to disable digest-md5 in dovecot.

Debian 7 with Plesk 12.5

 

[G J Piper]

This is a verified problem in Outlook. There's not much you can do. However, Outlook does eventually connect as it keeps trying other ways — but it gives errors in the server logs regardless. http://bit.ly/outlook-breaks-digest-md5