Subject: Sendmail-8.12.1 & Cyrus-1.5.27 AUTH problem with MD5 AUTH

From: "Bruce Pennypacker" <[email-masked]>
Date: Sun, 17 Feb 2002 13:07:51 -0500

Hi all,

I've been running sendmail 8.12.1 on RedHat Linux 7.1 successfully for quite
some time now and decided to try to get SMTP AUTH working.  I installed
Cyrus 1.5.27, rebuilt, and configured sendmail as shown at
http://www.sendmail.org/~ca/email/auth.html and managed to get it working at
a limited extent, however when I issue an ehlo it only shows LOGIN and PLAIN
as the authentication methods (I built Cyrus with --enable-login for testing
purposes).  I'm unable to get it to list DIGEST-MD5, CRAM-MD5, etc. as
authentication methods.

Here's a rundown of what I did:

- build Cyrus with --enable-login and no other options (I verified that
digest & cram are enabled by default)

- Added the following to sendmail/devtools/Site/site.config.m4 & rebuilt
sendmail:

APPENDDEF(`confENVDEF', `-DSASL')
APPENDDEF(`conf_sendmail_LIBS', `-lsasl')
APPENDDEF(`confLIBDIRS', `-L/usr/lib/sasl')
APPENDDEF(`confINCDIRS', `-I/usr/include')

- Added the following to my sendmail.mc & rebuilt sendmail.cf

define(`confDEF_AUTH_INFO', `/etc/mail/auth/default-auth-info')dnl
define(`confAUTH_MECHANISMS', `LOGIN PLAIN GSSAPI KERBEROS_V4 DIGEST-MD5
CRAM-MD5')dnl
TRUST_AUTH_MECH(`LOGIN PLAIN GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5')dnl
DAEMON_OPTIONS(`Port=smtp, Name=MTA')dnl
FEATURE(`no_default_msa')dnl
DAEMON_OPTIONS(`Port=587, Name=MSA, M=Ea')dnl
ESASL_PATH=/usr/lib/sasl

- Created a dummy /etc/mail/auth/default-auth-info and set it to be readable
by root only

- Created /etc/sasldb via saslpasswd and set it to be readable by root only.
sasldblistusers lists the accounts I've created with both CRAM-MD5 &
DIGEST-MD5:

user: test realm: localhost mech: PLAIN
user: test realm: localhost mech: CRAM-MD5
user: test realm: localhost mech: DIGEST-MD5

After doing all  the above & running sendmail I get the following response
to ehlo:

250-localhost Hello IDENT:[email-masked] [127.0.0.1], pleased to
meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH LOGIN PLAIN
250-DELIVERBY
250 HELP

If I run sendmail with -O LogLevel=14 it doesn't show any bad permissions or
other errors/warnings in my log.    The only thing I found interesting in
the log when using a high log level is:

Feb 17 11:34:27 localhost sendmail[7555]: AUTH: available mech=PLAIN LOGIN
ANONYMOUS, allowed mech=LOGIN PLAIN GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5

So what am I missing in getting sendmail to support authentication  methods
other than login & plain?  Any suggestions would be greatly appreciated!

Thanks!

-Bruce