Ubuntu + Postfix SMTP AUTH + saslauthd + OpenLDAP

zondag 26 september 2010 22:06

Acties:

0 Henk 'm!

E = mc^2

Topicstarter

Ik ben bezig met een thuismailserver met eGroupWare met OpenLDAP als backend. Als IMAP server heb ik dovecot opgezet, die dezelfde openLDAP backend gebruikt als eGroupWare. Deze LDAP backend wil ik ook gebruiken voor SMTP AUTH via saslauthd, die dit zou moeten kunnen afhandelen. Ik gebruik deze guide om het op te zetten en ik heb de packages gewoon via aptitude geinstalleerd.

Wanneer ik echter bij het kopje Running saslauthd aankom en ga testen met testsaslauthd krijg ik echter de melding "Authentication failed".

Hierbij de meldingen; testsaslauthd:

****@host:~$ sudo testsaslauthd -s smtp -u admin -p <password> 
0: NO "authentication failed"

saslauthd:

****@host:~$ sudo /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -O /etc/saslauthd.conf -n 5 -d
saslauthd[18574] :main            : num_procs  : 5
saslauthd[18574] :main            : mech_option: /etc/saslauthd.conf
saslauthd[18574] :main            : run_path   : /var/run/saslauthd
saslauthd[18574] :main            : auth_mech  : ldap
saslauthd[18574] :cache_alloc_mm  : mmaped shared memory segment on file: /var/run/saslauthd/cache.mmap
saslauthd[18574] :cache_init      : bucket size: 96 bytes
saslauthd[18574] :cache_init      : stats size : 36 bytes
saslauthd[18574] :cache_init      : timeout    : 28800 seconds
saslauthd[18574] :cache_init      : cache table: 985828 total bytes
saslauthd[18574] :cache_init      : cache table: 1711 slots
saslauthd[18574] :cache_init      : cache table: 10266 buckets
saslauthd[18574] :cache_init_lock : flock file opened at /var/run/saslauthd/cache.flock
saslauthd[18574] :ipc_init        : using accept lock file: /var/run/saslauthd/mux.accept
saslauthd[18574] :detach_tty      : master pid is: 0
saslauthd[18574] :ipc_init        : listening on socket: /var/run/saslauthd/mux
saslauthd[18574] :main            : using process model
saslauthd[18574] :have_baby       : forked child: 18579
saslauthd[18574] :have_baby       : forked child: 18580
saslauthd[18574] :have_baby       : forked child: 18581
saslauthd[18574] :have_baby       : forked child: 18582
saslauthd[18574] :get_accept_lock : acquired accept lock

En vanaf hier word het testsaslauthd commando uitgevoerd:

saslauthd[18574] :rel_accept_lock : released accept lock
saslauthd[18582] :get_accept_lock : acquired accept lock
saslauthd[18574] :cache_get_rlock : attempting a read lock on slot: 626
saslauthd[18574] :cache_lookup    : [login=administrator] [service=] [realm=smtp]: not found, update pending
saslauthd[18574] :cache_un_lock   : attempting to release lock on slot: 626
saslauthd[18574] :do_auth         : auth failure: [user=administrator] [service=smtp] [realm=] [mech=ldap] [reason=Unknown]
saslauthd[18574] :do_request      : response: NO
saslauthd[18582] :server_exit     : child exited: 18582
saslauthd[18581] :server_exit     : child exited: 18581
saslauthd[18579] :server_exit     : child exited: 18579
saslauthd[18580] :server_exit     : child exited: 18580
saslauthd[18574] :handle_sigchld  : child exited: 18579
saslauthd[18574] :handle_sigchld  : child exited: 18581
saslauthd[18574] :handle_sigchld  : child exited: 18582
saslauthd[18574] :server_exit     : pid file lock removed: /var/run/saslauthd/saslauthd.pid.lock
saslauthd[18574] :cache_cleanup_lock: flock file removed: /var/run/saslauthd/cache.flock
saslauthd[18574] :cache_cleanup_mm: cache mmap file removed: /var/run/saslauthd/cache.mmap
saslauthd[18574] :ipc_cleanup     : accept lock file removed: /var/run/saslauthd/mux.accept
saslauthd[18574] :ipc_cleanup     : socket removed: /var/run/saslauthd/mux
saslauthd[18574] :handle_sigchld  : child exited: 18580

openldap:

daemon: activity on 1 descriptor
daemon: activity on:
slap_listener_activate(7): 
daemon: epoll: listen=7 busy
daemon: epoll: listen=8 active_threads=0 tvp=zero
>>> slap_listener(ldap:///)
daemon: listen=7, new connection on 13
daemon: added 13r (active) listener=(nil)
conn=1010 fd=13 ACCEPT from IP=127.0.0.1:49199 (IP=0.0.0.0:389)
daemon: activity on 2 descriptors
daemon: activity on: 13r
daemon: read active on 13
daemon: epoll: listen=7 active_threads=0 tvp=zero
daemon: epoll: listen=8 active_threads=0 tvp=zero
connection_get(13)
connection_get(13): got connid=1010
connection_read(13): checking for input on id=1010
ber_get_next
ldap_read: want=8, got=8
  0000:  30 40 02 01 01 60 3b 02                            0@...`;.          
ldap_read: want=58, got=58
  0000:  01 03 04 22 63 6e 3d 61  64 6d 69 6e 69 73 74 72   ..."cn=admin  
  0010:  61 74 6f 72 2c 64 63 3d  6f 6c 79 6d 70 6f 73 2c   ,dc=domein,  
  0020:  64 63 3d 64 6f 6d 80 12  30 4c 79 6d 70 30 24 64   dc=dom..pass  
  0030:  30 6d 40 31 6e 40 64 6d  31 6e                     word        
ber_get_next: tag 0x30 len 64 contents:
ber_dump: buf=0x7f6a6063e560 ptr=0x7f6a6063e560 end=0x7f6a6063e5a0 len=64
  0000:  02 01 01 60 3b 02 01 03  04 22 63 6e 3d 61 64 6d   ...`;...."cn=adm  
  0010:  69 6e 69 73 74 72 61 74  6f 72 2c 64 63 3d 6f 6c   in,dc=domein  
  0020:  79 6d 70 6f 73 2c 64 63  3d 64 6f 6d 80 12 30 4c   ,dc=dom..pass  
  0030:  79 6d 70 30 24 64 30 6d  40 31 6e 40 64 6d 31 6e   word
op tag 0x60, time 1285529555
ber_get_next
ldap_read: want=8 error=Resource temporarily unavailable
conn=1010 op=0 do_bind
ber_scanf fmt ({imt) ber:
ber_dump: buf=0x7f6a6063e560 ptr=0x7f6a6063e563 end=0x7f6a6063e5a0 len=61
  0000:  60 3b 02 01 03 04 22 63  6e 3d 61 64 6d 69 6e 69   `;...."cn=admin  
  0010:  73 74 72 61 74 6f 72 2c  64 63 3d 6f 6c 79 6d 70   ,dc=domein  
  0020:  6f 73 2c 64 63 3d 64 6f  6d 80 12 30 4c 79 6d 70   ,dc=dom..pass  
  0030:  30 24 64 30 6d 40 31 6e  40 64 6d 31 6e            word
ber_scanf fmt (m}) ber:
ber_dump: buf=0x7f6a6063e560 ptr=0x7f6a6063e58c end=0x7f6a6063e5a0 len=20
  0000:  00 12 30 4c 79 6d 70 30  24 64 30 6d 40 31 6e 40   ..password  
  0010:  64 6d 31 6e                                                      
>>> dnPrettyNormal: <cn=admin,dc=domein,dc=dom>
=> ldap_bv2dn(cn=admin,dc=domein,dc=dom,0)
<= ldap_bv2dn(cn=admin,dc=domein,dc=dom)=0 
=> ldap_dn2bv(272)
<= ldap_dn2bv(cn=admin,dc=domein,dc=dom)=0 
=> ldap_dn2bv(272)
<= ldap_dn2bv(cn=admin,dc=domein,dc=dom)=0 
<<< dnPrettyNormal: <cn=admin,dc=domein,dc=dom>, <cn=admin,dc=domein,dc=dom>
conn=1010 op=0 BIND dn="cn=admin,dc=domein,dc=dom" method=128
do_bind: version=3 dn="cn=admin,dc=domein,dc=dom" method=128
==> hdb_bind: dn: cn=admin,dc=domein,dc=dom
bdb_dn2entry("cn=admin,dc=domein,dc=dom")
=> access_allowed: result not in cache (userPassword)
=> access_allowed: auth access to "cn=admin,dc=domein,dc=dom" "userPassword" requested
=> acl_get: [1] attr userPassword
=> acl_mask: access to entry "cn=admin,dc=domein,dc=dom", attr "userPassword" requested
=> acl_mask: to value by "", (=0) 
<= check a_dn_pat: cn=admin,dc=domein,dc=dom
<= check a_dn_pat: anonymous
<= acl_mask: [2] applying auth(=xd) (stop)
<= acl_mask: [2] mask: auth(=xd)
=> slap_access_allowed: auth access granted by auth(=xd)
=> access_allowed: auth access granted by auth(=xd)
send_ldap_result: conn=1010 op=0 p=3
send_ldap_result: err=49 matched="" text=""
send_ldap_response: msgid=1 tag=97 err=49
ber_flush2: 14 bytes to sd 13
  0000:  30 0c 02 01 01 61 07 0a  01 31 04 00 04 00         0....a...1....    
ldap_write: want=14, written=14
  0000:  30 0c 02 01 01 61 07 0a  01 31 04 00 04 00         0....a...1....    
conn=1010 op=0 RESULT tag=97 err=49 text=
daemon: activity on 1 descriptor
daemon: activity on:
daemon: epoll: listen=7 active_threads=0 tvp=zero
daemon: epoll: listen=8 active_threads=0 tvp=zero

En /etc/saslauthd.conf:

ldap_servers: ldap://127.0.0.1/
ldap_search_base: dc=domein,dc=dom
ldap_bind_dn: cn=admin,dc=domein,dc=dom
ldap_bind_pw: password
ldap_version: 3
ldap_scope: sub
ldap_uidattr: uid
ldap_filter_mode: yes
ldap_filter: (&(objectClass=person)(uid=%u))

Ik kom er niet meer uit wat er nu precies misgaat; vooral omdat eGroupWare en dovecot zonder problemen binden en authenticeren. Ik hoop dat jullie me kunnen helpen dit uit te vogelen. Als jullie meer info nodig hebben hoor ik het graag.

Luctor et Emergo || specs

maandag 27 september 2010 00:53

Acties:

0 Henk 'm!

deadinspace

The what goes where now?

Dovecot bevat zelf ook een SASL server waar postfix gebruik van kan maken (zie bijvoorbeeld deze wiki page). Misschien wil jij die ook gebruiken, dan heb je saslauthd helemaal niet nodig.

maandag 27 september 2010 09:35

Acties: