Subject: [Imap-uw] ipop3d incompatible with Solaris10 built in pam_krb5?

From: Brian Thompson <[email-masked]>
Date: Sun, 08 May 2005 20:46:09 -0400

Ok, this one I just can't seem to get working no matter what I try...

Here's the setup:
The mail server (Solaris 10/sparc) is a client machine within a krb5 
realm and some users need to use their krb5 password.
The mail server also has some users who need to use their local 
/etc/shadow password.
We're using imap-2004d source distribution compiled without SSL support, 
with "pmb" pam support, using the Sun workshop compilers "make soc".

pam_krb and pam_unix are both working. They authenticate fine for 
telnet, ftp, ssh, and *imapd* using either password.
Users can use either their local password or their krb5 password to 
check their email via imapd.

Users who attempt to check their email via pop3d can only use their 
local password (pam_unix), not their krb5 passwd (pam_krb5).

When someone tries to log into ipop3d with their krb5 password, it fails 
with a bad password error.
Looking at the logs, pam_krb5 is being called and is returning successfully.

Anyone have any ideas what to try next?

Thanks for any insight,
Brian

_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Sun, 8 May 2005 17:58:06 -0700 (PDT)

The authentication code is identical between ipop3d and imapd, at least in 
those using the same build.

Did you remember to create a pop profile in /etc/pam.d?  What's in it? 
It can be identical to the imap profile (and probably should be).  Note 
that when ipop3d logs in, PAM will use the pop profile and not the imap 
profile.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Brian Thompson <[email-masked]>
Date: Sun, 08 May 2005 21:25:24 -0400

Here's my /etc/pam.conf below.
I believe both imapd and ipop3d are calling pam_krb5 via "other   auth 
sufficient    pam_krb5.so.1 debug".

pam_krb5 is being called and is succeeding in both cases.
imapd deals with the success properly.
ipop3d appears to get lost somewhere along the way and fails.

+OK POP3 srv03fac 2004.89 server ready
user briancs
+OK User name accepted, password please
pass 123password456
-ERR Bad login
quit
+OK Sayonara

Also below is the pam_krb5 debug log.

-Brian

#
#ident  "@(#)pam.conf   1.28    04/04/21 SMI"
#
# Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login   auth requisite          pam_authtok_get.so.1
login   auth required           pam_dhkeys.so.1
login   auth required           pam_unix_cred.so.1
login   auth sufficient         pam_krb5.so.1 debug
login   auth required           pam_unix_auth.so.1
login   auth required           pam_dial_auth.so.1
#
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin  auth sufficient         pam_rhosts_auth.so.1
rlogin  auth requisite          pam_authtok_get.so.1
rlogin  auth required           pam_dhkeys.so.1
rlogin  auth required           pam_unix_cred.so.1
rlogin  auth required           pam_unix_auth.so.1
#
# Kerberized rlogin service
#
krlogin auth required           pam_unix_cred.so.1
krlogin auth binding            pam_krb5.so.1 debug
krlogin auth required           pam_unix_auth.so.1
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
#
rsh     auth sufficient         pam_rhosts_auth.so.1
rsh     auth required           pam_unix_cred.so.1
#
# Kerberized rsh service
#
krsh    auth required           pam_unix_cred.so.1
krsh    auth binding            pam_krb5.so.1 debug
krsh    auth required           pam_unix_auth.so.1
#
# Kerberized telnet service
#
ktelnet auth required           pam_unix_cred.so.1
ktelnet auth binding            pam_krb5.so.1 debug
ktelnet auth required           pam_unix_auth.so.1
#
# PPP service (explicit because of pam_dial_auth)
#
ppp     auth requisite          pam_authtok_get.so.1
ppp     auth required           pam_dhkeys.so.1
ppp     auth required           pam_unix_cred.so.1
ppp     auth required           pam_unix_auth.so.1
ppp     auth required           pam_dial_auth.so.1
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other   auth requisite          pam_authtok_get.so.1
other   auth required           pam_dhkeys.so.1
other   auth required           pam_unix_cred.so.1
other   auth sufficient         pam_krb5.so.1 debug
other   auth required           pam_unix_auth.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd  auth required           pam_passwd_auth.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron    account required        pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other   account requisite       pam_roles.so.1
other   account required        pam_unix_account.so.1
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other   session required        pam_unix_session.so.1
#
# Default definition for  Password management
# Used when service name is not explicitly mentioned for password management
#
other   password required       pam_dhkeys.so.1
other   password requisite      pam_authtok_get.so.1
other   password requisite      pam_authtok_check.so.1
other   password required       pam_authtok_store.so.1
#
# Support for Kerberos V5 authentication and example configurations can
# be found in the pam_krb5(5) man page under the "EXAMPLES" section.
#

iMay  8 18:24:04 srv03fac ipop3d[8499]: [ID 655841 mail.debug] PAM-KRB5 
(auth): pam_sm_authenticate flags=0
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 549540 mail.debug] PAM-KRB5 
(auth): attempt_krb5_auth: start: user='briancs'
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 704353 mail.debug] PAM-KRB5 
(auth): Forwardable tickets requested
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 912857 mail.debug] PAM-KRB5 
(auth): Renewable tickets requested
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 179272 mail.debug] PAM-KRB5 
(auth): attempt_krb5_auth:krb5_get_init_creds_password returns: SUCCESS
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 833335 mail.debug] PAM-KRB5 
(auth): attempt_krb5_auth returning 0
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 914654 mail.debug] PAM-KRB5 
(auth): pam_sm_auth finalize ccname env, result =0, 
env='KRB5CCNAME=FILE:/tmp/krb5cc_100', age = 0, status = 0
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 525286 mail.debug] PAM-KRB5 
(auth): end: Success
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 629253 mail.debug] PAM-KRB5 
(setcred): start: nowarn = 0, flags = 0x1
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 586274 mail.debug] PAM-KRB5 
(setcred): kmd auth_status: Success
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 522831 mail.debug] PAM-KRB5 
(setcred): attempt_refresh: set uid of user 'briancs'
May  8 18:24:04 srv03fac ipop3d[8499]: [ID 735350 mail.debug] PAM-KRB5 
(setcred): end: Success
May  8 18:24:10 srv03fac ipop3d[8499]: [ID 533678 mail.info] Logout 
user=briancs host=UNKNOWN
May  8 18:24:10 srv03fac ipop3d[8499]: [ID 629253 mail.debug] PAM-KRB5 
(setcred): start: nowarn = 0, flags = 0x2
May  8 18:24:10 srv03fac ipop3d[8499]: [ID 586274 mail.debug] PAM-KRB5 
(setcred): kmd auth_status: Success
May  8 18:24:10 srv03fac ipop3d[8499]: [ID 337111 mail.debug] PAM-KRB5 
(setcred): deleting user's credentials (initcreds)
May  8 18:24:10 srv03fac ipop3d[8499]: [ID 735350 mail.debug] PAM-KRB5 
(setcred): end: Success
May  8 18:24:10 srv03fac ipop3d[8499]: [ID 490997 mail.debug] PAM-KRB5 
(auth): krb5_cleanup auth_status = 12

Mark Crispin wrote:

> The authentication code is identical between ipop3d and imapd, at 
> least in those using the same build.
>
> It can be identical to the imap profile (and probably should be).  
> Note that when ipop3d logs in, PAM will use the pop profile and not 
> the imap profile.
>
> -- Mark --
>

---

From: Mark Crispin <[email-masked]>
Date: Sun, 8 May 2005 18:40:27 -0700 (PDT)

I don't use Solaris, and I can't tell you how PAM on Solaris works other 
than the fact that I know that PAM on Solaris doesn't pass the appdata_ptr 
correctly (hence the need for the "broken PAM" module).

The call to PAM is identical in both imapd and ipop3d, with the exception 
that pam_start() is being given a service name of "pop" rather than of 
"imap".

I suggest that you create explicit rules for imap and pop.

-- Mark --

---

From: Brian Thompson <[email-masked]>
Date: Sun, 08 May 2005 22:23:45 -0400

Ok, this keeps getting wierder...

I was testing imapd using Thunderbird, since it was already configured
on my desktop for my inbox. Then to test ipop3d I was using telnet to
connect to port 110 (user, pass, quit).

Just to get rid of any other variables that might be different, I created a
Thunderbird profile on my desktop configured for pop3.

Thunderbird (pop3) works with either the krb5 password or the local
password while telnet servername 110 only works with the local password.

Then I figured maybe it had something to do with me typing "telnet 
localhost
110" on the server so I tried telnet servername 110 from my desktop and
it still failed.

What could Thunderbird be doing differently than telnet and why do only
krb5 passwords fail via telnet, not also local passwords via telnet?

-Brian

Mark Crispin wrote:

> I don't use Solaris, and I can't tell you how PAM on Solaris works 
> other than the fact that I know that PAM on Solaris doesn't pass the 
> appdata_ptr correctly (hence the need for the "broken PAM" module).
>
> The call to PAM is identical in both imapd and ipop3d, with the 
> exception that pam_start() is being given a service name of "pop" 
> rather than of "imap".
>

---

From: Mark Crispin <[email-masked]>
Date: Sun, 8 May 2005 19:46:14 -0700

Are you absolutely certain that you are running the binaries that you 
think you are?  Is there any possibility that the binary on the SSL port 
is different than the binary on the plaintext port (so maybe Thunderbird 
is connecting on the SSL port)?

Have you tried creating explicit rules for imap and pop like I suggested 
in the previous message?

This sounds very much like a configuration problem, so I suggest that you 
review every detail of your [x]inetd, PAM, and ports configuration.

-- Mark --

---

From: Brian Thompson <[email-masked]>
Date: Sun, 08 May 2005 22:57:34 -0400

I did create explicit pop and imap services in pam.conf as you
suggested. Again, there's no issues with telnet, ftp, ssh, or now
I guess Thunderbird.

Here's some more info. Earlier I was thinking I must have mistyped the
password via telnet but it just doesn't work the the first time. At least
we know it isn't a pam_krb5 vs. pam_unix issue now.

I'm guessing there must be something different about Thunderbird's login
procedure that makes it retry a second time? Or maybe just different
timing? Or?

srv03fac# telnet localhost 110
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
+OK POP3 localhost 2004.89 server ready
user briancs
+OK User name accepted, password please
pass 123localpw456
-ERR Bad login
pass 123localpw456
+OK Mailbox open, 4382 messages
quit
+OK Sayonara
Connection to localhost closed by foreign host.

srv03fac# !!
telnet localhost 110
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
+OK POP3 localhost 2004.89 server ready
user briancs
+OK User name accepted, password please
pass 123krb5pw456
-ERR Bad login
pass 123krb5pw456
+OK Mailbox open, 4382 messages
quit
+OK Sayonara
Connection to localhost closed by foreign host.

Mark Crispin wrote:

> think you are?  Is there any possibility that the binary on the SSL 
> port is different than the binary on the plaintext port (so maybe 
> Thunderbird is connecting on the SSL port)?
>
> Have you tried creating explicit rules for imap and pop like I 
> suggested in the previous message?
>
> This sounds very much like a configuration problem, so I suggest that 
> you review every detail of your [x]inetd, PAM, and ports configuration.
>
> -- Mark --
>

---

From: Brian Thompson <[email-masked]>
Date: Sun, 08 May 2005 23:22:06 -0400

I just checked the debug log and it appears Thunderbird does try
log in twice. It fails the first time and succeeds the second time (all
transparent to the user). Interesting...

-Brian

---

From: David Lee <[email-masked]>
Date: Mon, 9 May 2005 12:21:22 +0100 (BST)

On Sun, 8 May 2005, Brian Thompson wrote:

> The mail server (Solaris 10/sparc) is a client machine within a krb5 realm 
> and some users need to use their krb5 password.
> The mail server also has some users who need to use their local /etc/shadow 
> password.
> We're using imap-2004d source distribution compiled without SSL support, with 
> "pmb" pam support, using the Sun workshop compilers "make soc".
>
> pam_krb and pam_unix are both working. They authenticate fine for telnet, 
> ftp, ssh, and *imapd* using either password.
> Users can use either their local password or their krb5 password to check 
> their email via imapd.

I cannot directly answer the question.  But I can offer a similar, though 
still unresolved issue.  Our Solaris systems are NIS based.  Two or three 
years ago, we migrated our authentication away from NIS and towards Active 
Directory.  This was basically OK for all services on Solaris 8.  But...

But when we tried Solaris 9 we found that CDE would not authenticate. 
All other services were OK.  And CDE (and everything else) had been fine 
on Solaris 8.  So the exact combination CDE/S9/krb5 was failing.  We 
opened a call with Sun, but this never get resolved (Solaris is a 
dwindling part of our service; the CDE machines remain on S8).

So something, somewhere is wrong with a specific service (CDE) on S9/krb5. 
It wouldn't surprise me if this remains unresolved in S10 (your OS) and/or 
if S10 has introduced another, analogous strange bug that might affect 
other particular services.

Sorry that doesn't directly help.  But it illustrates that Sun's PAM/krb5
has had bugs in the past.  It might be worth opening a call with them. 
(But don't hold your breath for a quick resolution!)

-- 

:  David Lee                                I.T. Service          :
:  Senior Systems Programmer                Computer Centre       :
:                                           University of Durham  :
:  http://www.dur.ac.uk/t.d.lee/            South Road            :
:                                           Durham                :
:  Phone: +44 191 334 2752                  U.K.                  :
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Brian Thompson <[email-masked]>
Date: Mon, 09 May 2005 07:51:17 -0400

Thanks, I was sort of thinking the same thing... I'll open a ticket
with Sun and see what they say. The problem is definitely narrowed
down to UWimap/pop3+Sun pam+Solaris 10. Could be any of the
three.

Sorry for all the confusing posts. At first I thought it was pop3d not
working while imapd was, but later found that neither worked the
first auth attempt and both succeeded the second. Thunderbird just
happens to transparently retry if it fails the first time, which is why
imapd initially appeared to work. That's another mystery why
Thunderbird would bother retrying after receiving a failed auth but
anyway...

Hopefully Sun will be able to shed some light.

-Brian

David Lee wrote:

>> We're using imap-2004d source distribution compiled without SSL 
>> support, with "pmb" pam support, using the Sun workshop compilers 
>> "make soc".
>>
> I cannot directly answer the question.  But I can offer a similar, 
> though still unresolved issue.  Our Solaris systems are NIS based.  
> Two or three years ago, we migrated our authentication away from NIS 
> and towards Active Directory.  This was basically OK for all services 
> on Solaris 8.  But...
>
> All other services were OK.  And CDE (and everything else) had been 
> fine on Solaris 8.  So the exact combination CDE/S9/krb5 was failing.  
> We opened a call with Sun, but this never get resolved (Solaris is a 
> So something, somewhere is wrong with a specific service (CDE) on 
> S9/krb5. It wouldn't surprise me if this remains unresolved in S10 
> (your OS) and/or if S10 has introduced another, analogous strange bug 
> that might affect other particular services.
>

---

From: "Chr. von Stuckrad" <[email-masked]>
Date: Mon, 9 May 2005 16:34:07 +0200

On Mon, May 09, 2005 at 07:51:17AM -0400, Brian Thompson wrote:
>                     ..., but later found that neither worked the

THIS behaviour seems to stem from the 'nsswitch'(.conf) and
pam(.conf) libraries, which try to authenticate 'as often as
necessary', but give errors in 'intermediate stages'?
[The only explanation we at mi.fu-berlin.de so far assumed]

Trying here too to authenticate with Win*-AD and kerberos,
we first found out, that up to Solaris9 the 'group handling'
went crazy if a user was in more than (seemingly) 8 groups.
Kerberos on Sol-upto-9 has no way to accept a 'larger Krb5-
Ticket via TCP', so broke if a Ticket was not transferable
by (Default-)UDP. This may be fixed in Sol10, but largely
confuses the Issue, because it works/fails for specific users.

AND *if* a user exists in NIS *and* AD and has different
Passwords in both *and* sends a wrong password to 'login'
at 'first time' (according to the pams), we saw the same
behaviour (1. wrong, 2. correct login) in other Programs
too (we *therefore* did NOT yet try IMAP so far :-)

So either one needs to find a config to 'fall through'
to the correct 'mechanism for the password' without an
error message, or (as Thunderbird already does) you'll
have to retry to answer the password for every failing pam?

Hope that this might point in the right direction ...

Stucki

---

From: Brian Thompson <[email-masked]>
Date: Mon, 09 May 2005 11:08:30 -0400

Thanks for the info. That might be part of the situation.

Even though I've already tried both the krb5 password and the local
password separately, finding that they both fail until the second 
attempt - I just
set my local password to be the same as my krb5 password. It still
fails until the second attempt. This should eliminate the idea that it's 
asking
for the "other" password.

I also verified that ftp still works on the first try using either password
and then after setting both to the same, it still works on the first try.
Ftp is going through the same pam mechanism in order to authenticate.

-Brian