In order to get kerberized SMTP by Postfix backending onto Dovecot's SASL
implementation, Dovecot needs to have access to an smtp/olinda.dehnerts.com key
(as well as an imap/olinda.dehnerts.com key for the IMAP). Sticking
smtp/olinda.dehnerts.com in a file named imap.keytab seemed silly, so I renamed
that file to olinda.keytab and added the smtp/ key. Getting and using the new
principal (and reconfiguring the MUA's like Thunderbird) turns out to be the
only config change required.
# Kerberos keytab to use for the GSSAPI mechanism. Will use the system
# default (usually /etc/krb5.keytab) if not specified. You may need to change
# the auth service to run as root to be able to read this file.
-auth_krb5_keytab = /etc/dovecot/imap.keytab
+auth_krb5_keytab = /etc/dovecot/olinda.keytab
# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>