Subject: [Imap-uw] Authentication with PAM

From: Jean-Luc Wasmer <[email-masked]>
Date: Tue, 04 Oct 2005 18:24:47 -0400

Hi,

I'm trying to make imap work with pam_ldap... when I log in, I can see 
the search for the user info being requested on the ldap server. The 
server replies with one entry (which is correct). Unfortunately, the 
imapd denies the login but I don't have much info. Ssh, su and other 
programs work fine with pam_ldap.
How can I get more debug on what's going on?
Could it be related to the way the password is encrypted in the LDAP 
backend?

Jean-Luc
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Tue, 4 Oct 2005 15:30:30 -0700 (Pacific Daylight Time)

On Tue, 4 Oct 2005, Jean-Luc Wasmer wrote:
> I'm trying to make imap work with pam_ldap... when I log in, I can see the 
> search for the user info being requested on the ldap server. The server 
> replies with one entry (which is correct). Unfortunately, the imapd denies 
> the login but I don't have much info.

Have you defined PAM authentication rules for IMAP in /etc/pam.d/imap?

Is the user defined in /etc/passwd?  LDAP is only used to get the 
encrypted password; everything else still comes from the passwd file.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Jean-Luc Wasmer <[email-masked]>
Date: Wed, 05 Oct 2005 01:06:32 -0400

Mark Crispin wrote:

 >> I'm trying to make imap work with pam_ldap... when I log in, I can
 >> see the search for the user info being requested on the ldap server.
 >> The server replies with one entry (which is correct). Unfortunately,
 >> the imapd denies the login but I don't have much info.
 >
 >

I thought I had... that' s why I said "I can see the search for the user 
info being requested on the ldap server" ie. /etc/pam.d/imap seems to be 
doing what it's supposed to.

 > Is the user defined in /etc/passwd?

no but I have nss_ldap which works fine.

Doing a bit of testing, I realized the LDAP lookups were actually 
happening because of the nss_ldap not the pam_ldap so I disabled nss_ldap.
I still can't log in with imap when I use either a LDAP-only user or a 
user which passwords is only in LDAP (but still has an entry in 
/etc/passwd).
Therefore the problem must be with the /etc/pam.d/imap configuration 
file. Unfortunately, no matter what I put in it, it doesn't seem to be 
affecting imapd.
Do I need a special switch to enable PAM when I build the software?

Jean-Luc

---

From: Mark Crispin <[email-masked]>
Date: Tue, 4 Oct 2005 22:13:08 -0700 (PDT)

> no but I have nss_ldap which works fine.

The user must be defined in /etc/passwd.  Each user must have a UNIX UID 
assigned.

> Do I need a special switch to enable PAM when I build the software?

It depends upon what command you used to build the software.  Some builds, 
such as "make lnp", "make lrh", automatically build with PAM.  Which build 
command did you use?

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Sven Carstens <[email-masked]>
Date: Wed, 5 Oct 2005 09:12:37 +0200

> The user must be defined in /etc/passwd.  Each user must have a UNIX UID

I suppose imapd isn't reading the /etc/passwd file directly, but using the
appropriate functions to access it.
At least it does on all out different SuSE systems.
The nss_ldap enables all applications to see the ldap users.
'getent passwd' should show all users.

Here everything works fine on SuSE 9.0 which still is based on
2002d.

/etc/pam.d/imap
-----------------------------------------------------
#%PAM-1.0
auth            required        pam_unix2.so
account         required        pam_unix2.so
-----------------------------------------------------

/etc/security/pam_unix2.conf
-----------------------------------------------------
auth:   use_ldap nullok
account:        use_ldap
password:       use_ldap nullok
session:        none
-----------------------------------------------------

/etc/nsswitch.conf
-----------------------------------------------------
passwd: compat ldap
group:  compat ldap
-----------------------------------------------------

So the passwd and group databases are populated from the ldap server.
Passwords are checked via the pam_unix2.so module against the ldap password.
Users in the ldap database are only able to login via pam aware applications.

CU Sven

---

From: Jean-Luc Wasmer <[email-masked]>
Date: Wed, 05 Oct 2005 10:20:59 -0400

Mark Crispin wrote:

> The user must be defined in /etc/passwd.  Each user must have a UNIX 
> UID assigned.

As Sven said, if Imap uses getpwnam or any of the standard Posix 
password database access function, nsswitch and nss_ldap will return the 
users from the LDAP.
'getent passwd' shows all my local and ldap users.

> It depends upon what command you used to build the software.  Some 
> builds, such as "make lnp", "make lrh", automatically build with PAM.  
> Which build command did you use?

I use pkgsrc and it doesn't provide any switch for PAM.
I edited imap-2004e/src/osdep/unix/Makefile to replace 'PASSWDTYPE=std' 
by 'PASSWDTYPE=pam'.
Looking at pkgsrc's makefile
(http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/mail/imap-uw/Makefile?rev=1.100&content-type=text/x-cvsweb-markup)
I would say imap-uw is built with:
neb
EXTRAAUTHENTICATORS="gss"
SPECIALAUTHENTICATORS="ssl"
SSLTYPE="unix"

I've just noticed imap-2004e/Makefile also defines the PASSWDTYPE variable.
Maybe I should change that one too?
I there a way to see that is supported? Imapd greets me with:
OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS STARTTLS AUTH=LOGIN]

Jean-Luc

---

From: Sven Carstens <[email-masked]>
Date: Wed, 5 Oct 2005 16:58:13 +0200

> OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS STARTTLS

I can see that my imapd is build with imap support by using the ldd command:
deepthought:/usr/sbin # ldd imapd
        libpam.so.0 => /lib/libpam.so.0 (0x40025000)
        libdl.so.2 => /lib/libdl.so.2 (0x4002d000)
        libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x40030000)
        libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x40060000)
        libc.so.6 => /lib/i686/libc.so.6 (0x40152000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

So it is linked against pam and I suppose it won't be linked if it doesn't use 
it.

CU Sven

---

From: Jean-Luc Wasmer <[email-masked]>
Date: Wed, 05 Oct 2005 11:21:25 -0400

>I can see that my imapd is build with imap support by using the ldd command:
Right... let's see what it tells me:

ldd /usr/pkg/libexec/imapd
/usr/pkg/libexec/imapd:
        -lcrypt.0 => /usr/lib/libcrypt.so.0
        -lgssapi.5 => /usr/lib/libgssapi.so.5
        -lcrypto.2 => /usr/lib/libcrypto.so.2
        -lasn1.6 => /usr/lib/libasn1.so.6
        -lcom_err.4 => /usr/lib/libcom_err.so.4
        -lroken.12 => /usr/lib/libroken.so.12
        -lkrb5.19 => /usr/lib/libkrb5.so.19
        -lssl.3 => /usr/lib/libssl.so.3
        -lc-client.4 => /usr/pkg/lib/libc-client.so.4
        -lc.12 => /usr/lib/libc.so.12

No PAM here :-(

Well, I guess I'll have to play with the makefiles.

Jean-Luc

---

From: Jean-Luc Wasmer <[email-masked]>
Date: Thu, 06 Oct 2005 14:28:00 -0400

Mark Crispin wrote:

> On Wed, 5 Oct 2005, Jean-Luc Wasmer wrote: .
>

OK... The reason why my first attempt didn't work (make PASSWDTYPE=pam) 
is because NetBSD doesn't have a dl library (in NetBSD, one doesn't need 
to link any library to support dynamic linking in an application).
Changing "PAMLDFLAGS= -lpam -ldl" for "PAMLDFLAGS= -lpam" in 
imap-2004e/src/osdep/unix/Makefile fixed the problem.

Jean-Luc

PS: I'm unsubscribing from the list so cc me when replying.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw