postfix + smtp + sasl + cyrus

Работает сервер со сквозной аунтификацией smtp с mydestination. Сейчас появилсь необходимость прикрутить авторизацию на smtp. Система debian. Все пакеты вроде поставлены, сервак при попытки коннекта к нему пишет фатальную ошибку

Apr 21 16:39:30 noisy postfix/smtpd[23024]: warning: xsasl_cyrus_server_get_mechanism_list: no applicable SASL mechanisms
Apr 21 16:39:30 noisy postfix/smtpd[23024]: fatal: no SASL authentication mechanisms
Apr 21 16:39:31 noisy postfix/master[22986]: warning: process /usr/lib/postfix/smtpd pid 23024 exit status 1
Apr 21 16:39:31 noisy postfix/master[22986]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling

Почему не могу понять. Пробовал уже по всякому
вот что настраивал:

$cat /etc/postfix/sasl/smtpd.conf
pwcheck_method: sasldb

$cat /etc/postfix/main.cf
...
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
#smtpd_sasl_application_name = cyrus
smtpd_sasl_password_maps = /etc/sasldb2
smtpd_sasl_type = cyrus
...
smtpd_recipient_restrictions =
                permit_sasl_authenticated,
                permit_mynetworks,
#               check_client_access hash:/etc/postfix/client_checks,
                reject_non_fqdn_hostname,
                reject_non_fqdn_recipient,
                reject_unknown_sender_domain,
                reject_unknown_recipient_domain,
#               reject_unauth_destination,
                reject_unauth_pipelining,
                reject_invalid_hostname,
                reject_non_fqdn_hostname,
                reject_rbl_client cn-kr.blackholes.us,
                reject_rbl_client cbl.abuseat.org,
                reject_rbl_client dul.dnsbl.sorbs.net,
                reject_rbl_client list.dsbl.org,
                reject_rbl_client opm.blitzed.org,
                reject_rbl_client sbl.spamhaus.org,
                warn_if_reject reject_invalid_hostname,
                warn_if_reject reject_non_fqdn_sender,
                warn_if_reject reject_non_fqdn_hostname,
                warn_if_reject reject_non_fqdn_recipient,
                warn_if_reject reject_unauth_pipelining,
                warn_if_reject reject_unknown_recipient_domain,
                warn_if_reject reject_unknown_sender_domain,
#postgrey
                check_policy_service inet:127.0.0.1:60000,
                reject_unauth_destination,
                permit

$cat /etc/default/saslauthd
#
# Settings for saslauthd daemon
#

# Should saslauthd run automatically on startup? (default: no)
START=yes

# Which authentication mechanisms should saslauthd use? (default: pam)
#
# Available options in this Debian package:
# getpwent  -- use the getpwent() library function
# kerberos5 -- use Kerberos 5
# pam       -- use PAM
# rimap     -- use a remote IMAP server
# shadow    -- use the local shadow password file
# sasldb    -- use the local sasldb database file
# ldap      -- use LDAP (configuration is in /etc/saslauthd.conf)
#
# Only one option may be used at a time. See the saslauthd man page
# for more information.
#
# Example: MECHANISMS="pam"
MECHANISMS="sasldb"

# Additional options for this mechanism. (default: none)
# See the saslauthd man page for information about mech-specific options.
MECH_OPTIONS=""

# How many saslauthd processes should we run? (default: 5)
# A value of 0 will fork a new process for each connection.
THREADS=5

# Other options (default: -c)
# See the saslauthd man page for information about these options.
#
# Example for postfix users: "-c -m /var/spool/postfix/var/run/saslauthd"
# Note: See /usr/share/doc/sasl2-bin/README.Debian
OPTIONS="-c"