- Previous message: James Hunt: "Kerberos + LDAP + Cyrus-SASL woes"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
|
|
|
From: David B. O'Donnell (david at destinynewmedia dot net)
Date: Thu May 27 2004 - 17:41:32 EDT
Because I disagree with the way Apple modified (and IMO limited) Postfix
2.0.10 in Mac OS X Server, I decided I would roll my own, using the Postfix
2.1.1 source and integrating PCRE support and SASL Authentication.
Unfortunately, while Apple does supply their own SASL library, they don't
supply sasl.h or saslutil.h, both of which Postfix appears to need in order
to build SASL support. I say "appears to need" because (a) smtpd.h
references both files and (b) attempts to build Postfix and let it find SASL
on its own result in no SASL support at all.
I grabbed Cyrus SASL 2.1.18 from the FTP site and it configures, makes, and
installs just fine. However, moving Apple's /usr/lib/sasl2 (or removing it)
and symlinking /usr/local/lib/sasl2 to /usr/lib/sasl2 is a Very Bad
Thing--as in no users being able to log in at console, Server Apps refusing
to connect, etc.
Leaving Cyrus SASL 2.1.18 in /usr/local/lib/sasl2 and telling Postfix (via
CCARGS='-DUSE_SASL_AUTH -I/usr/local/include/sasl' and AUXLIBS='-L/usr/lib
-lsasl2') builds /usr/libexec/postfix/smtpd with the same SASL support as
the out of the box Postfix 2.0.10:
% otool -L /usr/libexec/postfix/smtpd | grep sasl
/usr/lib/libsasl2.2.0.1.dylib (compatibility version 3.0.0, current
version 1.0.0)
setting /usr/lib/sasl2/smtpd.conf up as:
auxprop_plugin: sasldb
pwcheck_method: auxprop
mech_list: plain login cram-md5
and chgrp postfix /etc/sasldb.db; chmod 640 /etc/sasldb.db seems to set
things up for authentication.
Apple includes a bunch of entries in /etc/sasldb.db already, like:
0x40aef2aa023ef6740000000300000003 at mrsgale dot fates dot org: cmusaslsecretOTP
After reading documentation (Postfix', what I could find on this list, and
various other Web sites reached by Google), I tried adding an entry for
myself with /usr/local/sbin/saslpasswd2 -c -u mrsgale.fates.org -a smtpd
atropos
The result is the following line ONLY being added to /etc/sasldb2.db:
atropos at mrsgale dot fates dot org: cmusaslsecretOTP
From the various sources of documentation, I was led to expect to see
atropos at mrsgale dot fates dot org: userPassword
as well, but Cyrus SASL 2.1.18 saslpasswd2 does not write that line and I
couldn't find any way of forcing it to do so.
I then switched to Cyrus SASL 2.1.15. That build installs, if you disable
krb4. Its saslpasswd2 also adds the userPassword line to /etc/sasldb.db.
Everything *seemed* to be kosher... but apparently not.
Following the directions in the Postfix SASL hotwo, I built the client and
server sample applications and ran them in separate terminals:
(Server)
root at mrsgale [/Volumes/Consulate/UNIX/cyrus-sasl-2.1.15/sample]: ./server
trying 30, 1, 6
trying 2, 1, 6
accepted new connection
send: {160}
TWOWAYRANDOM SMB-NT SMB-LAN-MANAGER MS-CHAPv2 LOGIN PLAIN PLAIN OTP OTP
LOGIN DIGEST-MD5 DIGEST-MD5 CRAM-MD5 CRAM-MD5 ANONYMOUS ANONYMOUS
WEBDAV-DIGEST DHX APOP
recv: {10}
DIGEST-MD5
recv: {1}
N
send: {122}
nonce="+UsMiyMQE69UQSh4nCErEt7jBx2of0ywVBIFhmjYU4Y=",realm="mrsgale.fates.org",qop="auth",charset=utf-8,algorithm=md5-sess
recv: {250}
username="atropos",realm="mrsgale.fates.org",nonce="+UsMiyMQE69UQSh4nCErEt7jBx2of0ywVBIFhmjYU4Y=",cnonce="6K/lU3XvynvInsEAvXIV2re5Tjvv01yfeUPLkrplimA=",nc=00000001,qop=auth,digest-uri="rcmd/mrsgale.fates.org",response=400d96e93b88e2d51ac2103e0e440f17
send: {40}
rspauth=d11a59a3c7d300023b93ff57f2f8456e
recv: {0}
successful authentication 'atropos'
closing connection
(Client)
root at mrsgale [/Volumes/Consulate/UNIX/cyrus-sasl-2.1.15/sample]: ./client
mrsgale.fates.org
receiving capability list... recv: {160}
TWOWAYRANDOM SMB-NT SMB-LAN-MANAGER MS-CHAPv2 LOGIN PLAIN PLAIN OTP OTP
LOGIN DIGEST-MD5 DIGEST-MD5 CRAM-MD5 CRAM-MD5 ANONYMOUS ANONYMOUS
WEBDAV-DIGEST DHX APOP
TWOWAYRANDOM SMB-NT SMB-LAN-MANAGER MS-CHAPv2 LOGIN PLAIN PLAIN OTP OTP
LOGIN DIGEST-MD5 DIGEST-MD5 CRAM-MD5 CRAM-MD5 ANONYMOUS ANONYMOUS
WEBDAV-DIGEST DHX APOP
send: {10}
DIGEST-MD5
send: {1}
N
recv: {122}
nonce="+UsMiyMQE69UQSh4nCErEt7jBx2of0ywVBIFhmjYU4Y=",realm="mrsgale.fates.org",qop="auth",charset=utf-8,algorithm=md5-sess
please enter an authentication id: atropos
please enter an authorization id: atropos
Password:
send: {250}
username="atropos",realm="mrsgale.fates.org",nonce="+UsMiyMQE69UQSh4nCErEt7jBx2of0ywVBIFhmjYU4Y=",cnonce="6K/lU3XvynvInsEAvXIV2re5Tjvv01yfeUPLkrplimA=",nc=00000001,qop=auth,digest-uri="rcmd/mrsgale.fates.org",response=400d96e93b88e2d51ac2103e0e440f17
recv: {40}
rspauth=d11a59a3c7d300023b93ff57f2f8456e
send: {0}
successful authentication
closing connection
*** malloc[3571]: Deallocation of a pointer not malloced: 0x357b; This could
be a double free(), or free() called with the middle of an allocated block;
Try setting environment variable MallocHelp to see tools to help debug
*** malloc[3571]: Deallocation of a pointer not malloced: 0x300970; This
could be a double free(), or free() called with the middle of an allocated
block; Try setting environment variable MallocHelp to see tools to help debug
*** malloc[3571]: error for object 0x300970: Incorrect checksum for freed
object - object was probably modified after being freed; break at szone_error
I tried authenticating using -m PLAIN and -m CRAM-MD5, and in all cases
authentication was successful (with the three lines of complaints afterward).
Next, I tried the SMTP method:
220 mrsgale.fates.org ESMTP Postfix (2.1.1) [NO UCE, NO UBE, C=US, L=VA]
ehlo mrsgale.fates.org
250-mrsgale.fates.org
250-PIPELINING
250-SIZE 20971520
250-ETRN
250-AUTH PLAIN LOGIN CRAM-MD5
250 8BITMIME
auth plain YXRyb3BvcwBhdHJvcG9zAGlsbHlyaWE=
235 Authentication successful
That also seems fine... EXCEPT for the following in /var/log/mail.log:
May 27 17:31:15 localhost postfix/smtpd[9281]: connect from
localhost[127.0.0.1]
May 27 17:31:25 localhost postfix/smtpd[9281]: warning: SASL authentication
failure: no user in db
May 27 17:31:25 localhost postfix/smtpd[9281]: warning: SASL authentication
failure: no user in db
/usr/local/sbin/sasldblistusers2 says:
atropos at mrsgale dot fates dot org: userPassword
atropos at mrsgale dot fates dot org: cmusaslsecretOTP
(among other lines).
At this point, I thought that since smtpd was saying I am authenticated,
that I should just be able to go ahead and enable SASL support in Postfix
and authenticate away... except that I can't. Postfix refuses to let me
relay (it always fails by triggering a built-in reject_unauth_destination
check, and returns 554 cannot relay errors). Before I risk being flamed for
daring to ask a question on the Postfix-users list, I thought I would see if
anyone here could offer any insight as to why I'm getting the "no user in
db" errors in /var/log/mail.log, yet getting 235 Authentication successful
in the transaction.
Any assistance, pointers, guidance, or guesses would be most welcome.
-- David B. O'Donnell - david at destinynewmedia dot net E-mail, List, and Web Hosting Services - http://www.destinynewmedia.net
|
|
|