slapd error in zimbra.log

[weigenmann]

Hello everyone,
I wonder if anyone might be able to help me track down the following error:

var/log/zimbra.log
Mar 14 23:55:00 tracker slapd[8924]: SASL [conn=2375] Failure: realm changed: authentication aborted

Zimbra is up and running and sends and receives emails.

Regards,
William

[ArcaneMagus]

From what I can see this is most often related to an error in the postfix configuration files. Have you modified any of these by hand?

[weigenmann]

Hello and thank you for your comment.

Yes I have modified postfix main.cf by hand when I implemented openDKIM and dk-filter. I know I may have to redo after a Zimbra upgrade.
To fill you in a bit more posix / samba is also implemented. I have gone away from CentOS 5 old Samba 3.0.33 packages and installed Enterprise Sernet samba v3.5. And a CaCert certificate.
That is all on top of my standard Zimbra installation if memory serves me right.

Mid February I upgraded to from Zimbra v5 to v6. I checked the log and this error did happen way before that too.

Here my master.cf (master.cf.in)
at the bottom I added no_milters to the following line
-o receive_override_options=no_header_body_checks,no_ unknown_recipient_checks,no_address_mappings,no_mi lters

Here my main.cf
Note: Changed those two entries to hide real names
myhostname = mail.example.com
relayhost = mail.myisp.net:25

Entries added by hand at the bottom:
smtpd_milters = inet:localhost:8891 inet:localhost:8892
non_smtpd_milters = inet:localhost:8891 inet:localhost:8892
milter_default_action = accept

sender_canonical_maps = proxy:ldap:/opt/zimbra/conf/ldap-scm.cf
virtual_alias_domains = proxy:ldap:/opt/zimbra/conf/ldap-vad.cf
lmtp_connection_cache_time_limit = 4s
recipient_delimiter = 
smtpd_tls_cert_file = /opt/zimbra/conf/smtpd.crt
smtpd_tls_auth_only = yes
myhostname = mail.example.com
virtual_mailbox_domains = proxy:ldap:/opt/zimbra/conf/ldap-vmd.cf
mydestination = localhost
mailbox_size_limit = 0
setgid_group = postdrop
smtpd_client_restrictions = reject_unauth_pipelining
queue_run_delay = 300s
minimal_backoff_time = 300s
virtual_alias_maps = proxy:ldap:/opt/zimbra/conf/ldap-vam.cf
transport_maps = proxy:ldap:/opt/zimbra/conf/ldap-transport.cf
message_size_limit = 1024000000
sendmail_path = /opt/zimbra/postfix/sbin/sendmail
broken_sasl_auth_clients = yes
lmtp_connection_cache_destinations = 
alias_maps = hash:/etc/aliases
manpage_directory = /opt/zimbra/postfix/man
policy_time_limit = 3600
smtpd_helo_required = yes
in_flow_delay = 1s
daemon_directory = /opt/zimbra/postfix/libexec
maximal_backoff_time = 4000s
virtual_transport = error
mynetworks = 10.1.1.0/24 127.0.0.0/8
bounce_queue_lifetime = 5d
smtpd_recipient_restrictions = reject_non_fqdn_recipient, permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unlisted_recipient, reject_invalid_hostname, reject_non_fqdn_sender, permit
lmtp_host_lookup = dns
smtpd_tls_loglevel = 1
relayhost = mail.myisp.net:25
disable_dns_lookups = no
smtpd_sasl_authenticated_header = no
mail_owner = postfix
virtual_mailbox_maps = proxy:ldap:/opt/zimbra/conf/ldap-vmm.cf
content_filter = smtp-amavis:[127.0.0.1]:10024
smtpd_tls_security_level = may
mailq_path = /opt/zimbra/postfix/sbin/mailq
header_checks = 
queue_directory = /opt/zimbra/data/postfix/spool
newaliases_path = /opt/zimbra/postfix/sbin/newaliases
smtpd_data_restrictions = reject_unauth_pipelining
local_header_rewrite_clients = permit_mynetworks,permit_sasl_authenticated
smtpd_reject_unlisted_recipient = yes
propagate_unmatched_extensions = canonical
command_directory = /opt/zimbra/postfix/sbin
smtpd_tls_key_file = /opt/zimbra/conf/smtpd.key
smtpd_sasl_auth_enable = yes
smtpd_milters = inet:localhost:8891 inet:localhost:8892
non_smtpd_milters = inet:localhost:8891 inet:localhost:8892
milter_default_action = accept

Just to show the frequency of the error:

Mar 18 07:02:49 tracker slapd[12782]: SASL [conn=5805] Failure: realm changed: authentication aborted
Mar 18 07:17:50 tracker slapd[12782]: SASL [conn=6036] Failure: realm changed: authentication aborted
Mar 18 07:32:50 tracker slapd[12782]: SASL [conn=6226] Failure: realm changed: authentication aborted
Mar 18 07:47:51 tracker slapd[12782]: SASL [conn=6446] Failure: realm changed: authentication aborted
Mar 18 08:02:51 tracker slapd[12782]: SASL [conn=6769] Failure: realm changed: authentication aborted
Mar 18 08:17:52 tracker slapd[12782]: SASL [conn=7000] Failure: realm changed: authentication aborted
Mar 18 08:32:52 tracker slapd[12782]: SASL [conn=7222] Failure: realm changed: authentication aborted
Mar 18 08:47:52 tracker slapd[12782]: SASL [conn=7497] Failure: realm changed: authentication aborted
Mar 18 09:02:52 tracker slapd[12782]: SASL [conn=7679] Failure: realm changed: authentication aborted
Mar 18 09:17:53 tracker slapd[12782]: SASL [conn=7881] Failure: realm changed: authentication aborted
Mar 18 09:32:53 tracker slapd[12782]: SASL [conn=8304] Failure: realm changed: authentication aborted
Mar 18 09:47:53 tracker slapd[12782]: SASL [conn=8463] Failure: realm changed: authentication aborted
Mar 18 10:02:54 tracker slapd[12782]: SASL [conn=8622] Failure: realm changed: authentication aborted

[mackoftrack]

I too am seeing the same errors in my logs. I also have a similar setup as yours. Any idea what is causing these errors?

[mackoftrack]

May 24 12:53:33 myserver slapd[9944]: SASL [conn=67272] Failure: realm changed: authentication aborted
May 24 12:56:17 myserver slapd[9944]: SASL [conn=67297] Failure: realm changed: authentication aborted
May 24 13:06:49 myserver slapd[9944]: SASL [conn=67398] Failure: realm changed: authentication aborted
May 24 13:08:33 myserver slapd[9944]: SASL [conn=67411] Failure: realm changed: authentication aborted
May 24 13:11:17 myserver slapd[9944]: SASL [conn=67434] Failure: realm changed: authentication aborted
May 24 13:21:49 myserver slapd[9944]: SASL [conn=67535] Failure: realm changed: authentication aborted
May 24 13:23:33 myserver slapd[9944]: SASL [conn=67548] Failure: realm changed: authentication aborted
May 24 13:26:17 myserver slapd[9944]: SASL [conn=67573] Failure: realm changed: authentication aborted
May 24 13:37:11 myserver slapd[9944]: SASL [conn=67674] Failure: realm changed: authentication aborted
May 24 13:38:33 myserver slapd[9944]: SASL [conn=67687] Failure: realm changed: authentication aborted
May 24 13:41:17 myserver slapd[9944]: SASL [conn=67710] Failure: realm changed: authentication aborted
May 24 13:52:28 myserver slapd[9944]: SASL [conn=67814] Failure: realm changed: authentication aborted
May 24 13:53:33 myserver slapd[9944]: SASL [conn=67825] Failure: realm changed: authentication aborted
May 24 13:56:17 myserver slapd[9944]: SASL [conn=67850] Failure: realm changed: authentication aborted
May 24 14:07:42 myserver slapd[9944]: SASL [conn=67956] Failure: realm changed: authentication aborted
May 24 14:08:33 myserver slapd[9944]: SASL [conn=67964] Failure: realm changed: authentication aborted
May 24 14:11:17 myserver slapd[9944]: SASL [conn=67987] Failure: realm changed: authentication aborted
May 24 14:22:40 myserver slapd[9944]: SASL [conn=68093] Failure: realm changed: authentication aborted
May 24 14:23:33 myserver slapd[9944]: SASL [conn=68101] Failure: realm changed: authentication aborted
May 24 14:26:17 myserver slapd[9944]: SASL [conn=68126] Failure: realm changed: authentication aborted
May 24 14:37:55 myserver slapd[9944]: SASL [conn=68237] Failure: realm changed: authentication aborted
May 24 14:38:33 myserver slapd[9944]: SASL [conn=68240] Failure: realm changed: authentication aborted
May 24 14:41:17 myserver slapd[9944]: SASL [conn=68263] Failure: realm changed: authentication aborted
May 24 14:53:18 myserver slapd[9944]: SASL [conn=68376] Failure: realm changed: authentication aborted
May 24 14:53:33 myserver slapd[9944]: SASL [conn=68377] Failure: realm changed: authentication aborted
May 24 14:56:17 myserver slapd[9944]: SASL [conn=68402] Failure: realm changed: authentication aborted
May 24 15:08:24 myserver slapd[9944]: SASL [conn=68515] Failure: realm changed: authentication aborted
May 24 15:08:33 myserver slapd[9944]: SASL [conn=68516] Failure: realm changed: authentication aborted
May 24 15:11:17 myserver slapd[9944]: SASL [conn=68539] Failure: realm changed: authentication aborted
May 24 15:23:31 myserver slapd[9944]: SASL [conn=68652] Failure: realm changed: authentication aborted
May 24 15:23:34 myserver slapd[9944]: SASL [conn=68653] Failure: realm changed: authentication aborted
May 24 15:26:17 myserver slapd[9944]: SASL [conn=68678] Failure: realm changed: authentication aborted
May 24 15:38:34 myserver slapd[9944]: SASL [conn=68791] Failure: realm changed: authentication aborted
May 24 15:38:46 myserver slapd[9944]: SASL [conn=68792] Failure: realm changed: authentication aborted
May 24 15:41:17 myserver slapd[9944]: SASL [conn=68815] Failure: realm changed: authentication aborted
May 24 15:53:34 myserver slapd[9944]: SASL [conn=68928] Failure: realm changed: authentication aborted
May 24 15:54:10 myserver slapd[9944]: SASL [conn=68941] Failure: realm changed: authentication aborted
May 24 15:56:17 myserver slapd[9944]: SASL [conn=68954] Failure: realm changed: authentication aborted
May 24 16:08:34 myserver slapd[9944]: SASL [conn=69067] Failure: realm changed: authentication aborted
May 24 16:09:16 myserver slapd[9944]: SASL [conn=69078] Failure: realm changed: authentication aborted
May 24 16:11:17 myserver slapd[9944]: SASL [conn=69091] Failure: realm changed: authentication aborted
May 24 16:23:34 myserver slapd[9944]: SASL [conn=69204] Failure: realm changed: authentication aborted
May 24 16:24:23 myserver slapd[9944]: SASL [conn=69217] Failure: realm changed: authentication aborted
May 24 16:26:17 myserver slapd[9944]: SASL [conn=69230] Failure: realm changed: authentication aborted
May 24 16:38:34 myserver slapd[9944]: SASL [conn=69343] Failure: realm changed: authentication aborted
May 24 16:39:38 myserver slapd[9944]: SASL [conn=69354] Failure: realm changed: authentication aborted

[mackoftrack]

I wonder if anyone ever figured out what's causing these errors in my logs...
Can this post be moved to the "Administrators" forum?

[mackoftrack]

<bump please>

[phoenix]

<bump please>

Those messages don't actually tell us much in detail, what other error messages are there just before this starts? Do you use an external relay? Have you modified the main.cf? Does this problem still occur on 6.0.10?

[mackoftrack]

Those messages don't actually tell us much in detail, what other error messages are there just before this starts? Do you use an external relay? Have you modified the main.cf? Does this problem still occur on 6.0.10?

I am now running 7.0.0 (just updated my sig) and the messages persist in the logs. There doesn't seem to be anything just prior to these messages, but these seem to come in pairs:

Feb 16 12:18:01 LDAPSLAVE slapd[7785]: SASL [conn=30436] Failure: realm changed: authentication aborted  
Feb 16 12:20:46 ZIMBRASERVER slapd[14381]: SASL [conn=241387] Failure: no secret in database 
Feb 16 12:33:01 LDAPSLAVE slapd[7785]: SASL [conn=30499] Failure: realm changed: authentication aborted  
Feb 16 12:36:48 ZIMBRASERVER slapd[14381]: SASL [conn=242273] Failure: no secret in database

I do have an external relay. I don't believe I have modified main.cf, although I may have at one point in the past to try to get Postfix to work with piped scripts (per Configuring Postfix to work with piped scripts - Zimbra :: Wiki), but I think I gave up on that since it didn't seem to work the way I wanted it to. Do you need any config files from me?