Apologies on my slow response. I've been trying to finalize the v18.0 release and have been plagued with "death by 1000 papercuts".

Anyway, I am not super familiar with testsaslauthd myself (I just came across it when reading up on diagnosing postfix issues). Looking at the error message (file not found in /run - /run is tempfs - used for storing run state info), the name (has a 'd' as the last character - a common abbreviation for 'daemon') and inspecting the contents of the sasl2-bin package (I see a /etc/init.d/saslauthd - legacy sysvinit daemon script) I'm pretty sure that saslauthd needs to be running as a service for testsaslauthd to work. I/e/ try this:

systemctl start saslauthd

Then re-run the testsaslauthd test. It may not succeed, but hopefully it might give us some more insight into what is going wrong. FWIW as a bit of explanation/context to my conclusion, /run is a tempfs location when service sockets, etc are often stored (and wiped at shutdown and recreated when the services start). In retrospect, I probably should have noticed that and given you a heads up before.

As you note, the versions are essentially the same, so the only other thing that I can think of is a change that we made to our default config between v16.x & v17.x. I've just done a diff of the code and noted below the changes that we made (security hardening - a '+' prefix notes a line added, new lines that start with '#' - after '+' - are not ignored). TBH, I wouldn't have expected that to make significant difference, but perhaps?:

+# force TLS connections only - might break sending of mail so leaving disabled
+#postconf -e smtpd_tls_auth_only=yes
 
+# by default leave the snakeoil cert/key in place
+#postconf -e smtpd_tls_cert_file=/etc/ssl/private/cert.pem
+#postconf -e smtpd_tls_key_file=/etc/ssl/private/cert.key
+
+# despite name, accepts more bits (i.e. > 1024 bits)
+postconf -e smtpd_tls_dh1024_param_file=/etc/ssl/private/dhparams.pem
+postconf -e smtpd_tls_mandatory_protocols='!SSLv2, !SSLv3, !TLSv1, !TLSv1.1'
+postconf -e smtpd_tls_protocols='!SSLv2, !SSLv3, !TLSv1, !TLSv1.1'
+postconf -e smtpd_tls_mandatory_ciphers=medium
+
+# ciphers set by common/conf/turnkey.d/zz-ssl-ciphers
+postconf -e tls_medium_cipherlist="ZZ_SSL_CIPHERS"
+postconf -e tls_preempt_cipherlist=no

TBH, I wouldn't have thought so, but perhaps winding those back to defaults will resolve the issue? Although perhaps the cipher support is too tight?

FWIW the 'postconf -e tls_medium_cipherlist="ZZ_SSL_CIPHERS"' line will be updated at build time (so it will include a list of secure ciphers, rather than just "ZZ_SSL_CIPHERS").

You can get the default values for a postfix setting with 'postconf -d config-key'. E.g. like this:

root@tkldev5 ~# postconf -d smtpd_tls_dh1024_param_file
smtpd_tls_dh1024_param_file =

('smtpd_tls_dh1024_param_file' is empty by default).

So to reset to defaults, run these:

postconf -e smtpd_tls_dh1024_param_file=
postconf -e smtpd_tls_mandatory_protocols='!SSLv2, !SSLv3'
postconf -e smtpd_tls_protocols='!SSLv2, !SSLv3'
postconf -e smtpd_tls_mandatory_ciphers='medium'
postconf -e tls_medium_cipherlist='aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH'
postconf -e tls_preempt_cipherlist='no'

As I noted above, the only line that I would expect might have some impact is the cipherlist and/or if your mail provider is using an old (insecure) TLS protocol (technically anything lower that 1.3 is "broken", although 1.2 is still in common use and many older devices and legacy services don't support 1.3).

Apologies that I didn't think to check that out sooner. As a complete aside, here's how I found the differences:

git clone o turnkey https://github.com/turnkeylinux/common.git
cd common
# list files changed between 16.x & 17.x that include 'postfix' or 'mail' in the filename
git diff --name-only turnkey/16.x turnkey/17.x | grep 'postfix\|mail'

The only result was conf/turnkey.d/postfix-local.