LPIC-2 DNS, Web and Mail Services Practice Question
A systems administrator is configuring a Postfix mail server to use Dovecot for SASL authentication. The authentication method is set to PLAIN in Dovecot, and Postfix has smtpd_sasl_auth_enable=yes and smtpd_sasl_type=dovecot. Dovecot's auth socket is at /var/run/dovecot/auth-client. The mail logs show repeated "SASL authentication failed" errors for known good credentials. The administrator checks that the socket exists and that Dovecot is running. What is the most likely cause?
⚠ Common exam trap
Many candidates assume a running service and existing socket guarantee functionality, overlooking Unix socket permissions and the need for the Postfix process user to have read/write access to the auth socket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The postfix user does not have read permission on the Dovecot auth socket.
The most likely cause is that the Postfix user (typically 'postfix' or the mail queue owner) lacks read permission on the Dovecot auth socket at /var/run/dovecot/auth-client. Dovecot's SASL authentication via a Unix socket requires the connecting process (Postfix) to have read/write access to that socket file. Even though the socket exists and Dovecot is running, if the permissions are too restrictive (e.g., owned by 'dovecot' with mode 0600), Postfix cannot communicate with Dovecot's auth service, resulting in repeated 'SASL authentication failed' errors despite valid credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The smtpd_recipient_restrictions does not include permit_sasl_authenticated.
Why it's wrong here
This would cause relay rejection after authentication, not authentication failure.
- ✗
The Dovecot service is not listening on TCP port 143 for IMAP.
Why it's wrong here
Dovecot's SASL service uses a Unix socket, not IMAP port.
- ✗
The mynetworks parameter in Postfix is set incorrectly.
Why it's wrong here
mynetworks controls relaying, not authentication.
- ✓
The postfix user does not have read permission on the Dovecot auth socket.
Why this is correct
The socket file permissions may restrict access to the postfix user, causing authentication failures.
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.