Subject: imapd with PAM authentication on Solaris 8

From: Christopher Huyler <[email-masked]>
Date: Sun, 28 Mar 2004 19:14:54 -0500

Hi all,  

I've been trying to setup my Solaris 8 machine as a webmail server.  I want to
use PAM authentication so that I can use user's smb passwords.

I have built imapd w/o pam authentication and it works fine but when I try to
add pam authentication, it stops letting users connect.

I compiled it using:
make gso PASSWDTYPE=pmb SSLTYPE=unix
(I also tried PASSWDTYPE=pam but saw no difference)

I added the following to /etc/pam.conf
imap    auth sufficient         pam_unix_auth.so.1
imap    auth required           pam_smb_auth.so use_first_pass

Do I need to add anything else to pam.conf?  

Is there a way to debug?  I can't seem to connect to imapd when I run it in
gdb.
 I removed the imapd line from /etc/inetd.conf, restarted inetd, then started
up gdb with imapd and entered "run".  I added break points to checkpw and
loginpw but when I try to connect I get "connection refused" as if imapd wasn't
running at all.  Do I need to bind it to a port or something?  Any help on
debugging would be great.

--
Christopher Huyler
[email-masked]
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Dirk Jahnke <[email-masked]>
Date: Mon, 29 Mar 2004 09:41:14 +0200

Hi Christopher,

I do not use SMB passwords, but imap(s) with PAM on Solaris 8.
All my imap related entries in the pam.conf are like this:

imaps   auth optional   /usr/lib/security/$ISA/pam_afs.so.1 
try_first_pass ignore_root setenv_password_expires debug

(well, "debug" only when debugging...)

You can switch on debugging of PAM with syslog.conf:
auth.debug                    /where/ever/log/pam_debug

Do not forget to touch the file prior to SIGHUPing syslogd.

Cheers,

-- 
Dirk Jahnke                            Deutsches Elektronen-Synchrotron
DESY Hamburg                           IT Systems / Bldg. 2b / Room 221
D-22603 Hamburg                        Notkestrasse 85  / 22607 Hamburg
Tel: +49-40-899.8.1760    Fax: +49-40-899.4.1760    [email-masked]

---

From: evol <[email-masked]>
Date: Mon, 29 Mar 2004 08:55:17 -0800

Christopher Huyler wrote:
| Hi all,
|
| I've been trying to setup my Solaris 8 machine as a webmail server.  I
want to
| use PAM authentication so that I can use user's smb passwords.
|
| I have built imapd w/o pam authentication and it works fine but when I
try to
| add pam authentication, it stops letting users connect.
|
| I compiled it using:
| make gso PASSWDTYPE=pmb SSLTYPE=unix
| (I also tried PASSWDTYPE=pam but saw no difference)
|
| I added the following to /etc/pam.conf
| imap    auth sufficient         pam_unix_auth.so.1
| imap    auth required           pam_smb_auth.so use_first_pass
|
| Do I need to add anything else to pam.conf?
|
| Is there a way to debug?  I can't seem to connect to imapd when I run
it in
| gdb.
|  I removed the imapd line from /etc/inetd.conf, restarted inetd, then
started
| up gdb with imapd and entered "run".  I added break points to checkpw and
| loginpw but when I try to connect I get "connection refused" as if
imapd wasn't
| running at all.  Do I need to bind it to a port or something?  Any help on
| debugging would be great.
|
| --
| Christopher Huyler
| [email-masked]
no, there is no way to debug pam but trial and error.
You might see sothing in a debugger like ddd most likly just pam fails
blah in syslog or somthing.

~From your information it would be hard to make a pam config that would
work.

do you use NIS,NIS+,LDAP or somthing else to authenticate ?

If all fails.

"I removed the imapd line from /etc/inetd.conf, restarted inetd, then
started
| up gdb with imapd and entered "run"."

You need to start imapd
out of inetd xinetd or how ever your going to start it,
then attach to the PID with your gdb ( yuck ) "attach 1234"
and debug that way. watch your syslog etc.

I dont think you can start imapd as a stand alone daemon ( I dont know
how ). look for getpwnam() etc. Set your break point somewhere before
the getpwuid()/getpwnam() so you can see whats going on in the
authentication phase. In fact, set it after the username call and before
the getpwbynam() call this way you can step through the authentication
phase. ( I cant recall what imapd uses, been working on other stuff ).
somthing like p->pw will be what it will return.

Try googling for you pam config I think yours looks like a non working
config. I Dont have my solaris box here or id pull an example out for you.

Hopefully this has helped in the slightest.

I recomend for this that you use ddd or xxgdb so you can watch the code
as it runs past if your running gnu stuff.

remember compile with -ggdb and no optimizations and dont strip your
symbol table off :P

Take Care

Sincerely,
Aaron Waller

---

From: "Christopher Huyler" <[email-masked]>
Date: Mon, 29 Mar 2004 21:47:06 -0500

Great! Thanks!

Although this wasn't the answer, it helped me in two ways.
1) I had forgotten to put imaps in my pam.conf file.
2) Watching the authentication log proved that it was actually getting to
PAM.  I double checked my configuration and realized I wasn't using all the
modules that a standard login was using.  When I changed it to below,
everything worked:

imap    auth requisite          pam_authtok_get.so.1
imap    auth required           pam_dhkeys.so.1
imap    auth sufficient         pam_unix_auth.so.1
imap    auth required           pam_smb_auth.so use_first_pass
imaps   auth requisite          pam_authtok_get.so.1
imaps   auth required           pam_dhkeys.so.1
imaps   auth sufficient         pam_unix_auth.so.1
imaps   auth required           pam_smb_auth.so use_first_pass

I'm not sure exactly what the authtok_get and dhkeys modules do, but I guess
they are necessary.

~ Chris

--
Christopher Huyler
[email-masked]

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Dirk Jahnke
Sent: Monday, March 29, 2004 2:41 AM
To: Christopher Huyler; [email-masked]
Subject: Re: imapd with PAM authentication on Solaris 8

Hi Christopher,

Cheers,