Subject: RH9; imap-2002e; PAM authentication

From: David Lee <[email-masked]>
Date: Wed, 1 Oct 2003 17:15:39 +0100 (BST)

We have been happily using Washington imap and pop for several years on
Solaris, using NIS authentication.  We are in the process of making two
migrations: (1) from Solaris towards Linux (2) from NIS authentication
towards Active Directory (via PAM/krb5) authentication.  So that's four
combinations.

1. Solaris/NIS: Fine; using for years;

2. Linux/NIS: Fine; using for a few months;

3. Solaris/AD-via-PAM: Fine (PAM only uses perm_krb5 not pam_unix;
   verified on accounts with deliberately different NIS and AD passwords);

4. Linux/AD: Trouble.  Following the FAQ (PAM for plaintext passwords) I
   rebuilt with "make lnp".  But neither password works.  Have tried
   versions imap-2002c1 and imap-2002e.  (The other services on the box
   (telnet, rlogin, etc.) are fine: "/etc/pam.d/system-auth" has, for the
   moment, been set to accept either password.)

In debugging this Linux/AD, I determined that in "src/osdep/unix/ckp_pam.c":

  if ((pam_start ((char *) mail_parameters (NIL,GET_SERVICENAME,NIL),
                  pw->pw_name,&conv,&hdl) != PAM_SUCCESS) ||
      (pam_set_item (hdl,PAM_RHOST,tcp_clientaddr ()) != PAM_SUCCESS) ||
      (pam_authenticate (hdl,NIL) != PAM_SUCCESS) ||
      (pam_acct_mgmt (hdl,NIL) != PAM_SUCCESS) ||
      (pam_setcred (hdl,PAM_ESTABLISH_CRED) != PAM_SUCCESS)) {

"pam_start()" and the first "pam_set_item()" were succeeding, but that
"pam_authenticate()" fails.  Further, I suspect that "checkpw_conv()"
(part of the "&conv" argument) is not being called (it didn't stop at a
breakpoint on the routine, whereas it does on (working) Solaris/AD).

[ System details:

/etc/redhat-release:
   Red Hat Linux release 9 (Shrike)

uname -a:
   Linux pluto2 2.4.20-19.9smp #1 SMP Tue Jul 15 17:04:18 EDT 2003 i686 i686 i386 GNU/Linux

cc --version:
   cc (GCC) 3.2.2 20030222 (Red Hat Linux 3.2.2-5)

]

Any thoughts, tips, hints etc. and what I might have missed?  (Or known
bugs/issues, etc.?)

-- 

:  David Lee                                I.T. Service          :
:  Systems Programmer                       Computer Centre       :
:                                           University of Durham  :
:  http://www.dur.ac.uk/t.d.lee/            South Road            :
:                                           Durham                :
:  Phone: +44 191 334 2752                  U.K.                  :
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Wed, 1 Oct 2003 09:41:20 -0700 (PDT)

Are you sure that you have properly configured PAM for IMAP on the Linux
system?  I know that there is a specific PAM configuration that has to be
done for IMAP (something about an /etc/pam.d/imap file) but I don't know
the details.

I know that lots of people are using PAM with IMAP successfully, and
getting the right PAM configuration file set up is the most common hurdle.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: David Lee <[email-masked]>
Date: Wed, 1 Oct 2003 18:33:49 +0100 (BST)

> done for IMAP (something about an /etc/pam.d/imap file) but I don't know

That was it!  Thanks.  Appreciated.  (Although much Solaris experience,
including PAM, I'm still finding my feet with Linux.)

--