Subject: Cyrus -> LDAP Authentication

From: "Gavin Young" <[email-masked]>
Date: Thu, 16 Dec 2004 11:49:10 +1300

Hopefully someone here can help me...

Has anyone else set-up a Postfix + Cyrus mail server authentication against OpenLDAP using saslauthd?

I'm really struggling so any help including links to existing documents would be very useful. My main concern at the moment is getting Cyrus IMAP to authenticate against LDAP. I have been told to use saslauthd but any easier suggestions would be welcomed. Sorry for the long post but I'm trying not to miss anything.

I am using Fedora Core 2 on the test box but it will be RHEL3 when in production. My postifix+cyrus install works correctly with local accounts using the setup below:

/etc/sysconfig/saslauthd
SOCKETDIR=/var/run/saslauthd
#MECH=shadow --default FC3, couldn't get cyradm to work
MECH=pam
FLAGS=

/etc/imapd.conf
configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
sasl_mech_list: PLAIN
tls_cert_file: /usr/share/ssl/certs/cyrus-imapd.pem
tls_key_file: /usr/share/ssl/certs/cyrus-imapd.pem
tls_ca_file: /usr/share/ssl/certs/ca-bundle.crt

/etc/openldap/ldap.conf
HOST localhost
BASE dc=example,dc=org

/etc/ldap.conf
host 127.0.0.1
base dc=example,dc=org
ssl no
pam_password md5

To try an get Cyrus to authenticate against LDAP these are the steps I have taken:

1) Install saslauthd
--cyrus-sasl-2.1.18-2.2 (+devel & md5) RPMS are installed

2) Choose ldap as auth mechanism if supported
--ldap seems supported, saslauthd -v outputs:
saslauthd 2.1.18
authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap
--changed /etc/sysconfig/saslauthd config file to:
SOCKETDIR=/var/run/saslauthd
#MECH=shadow --default FC3, couldn't get cyradm to work
#MECH=pam
MECH=ldap
FLAGS=

3) Edit ldap.conf so that it fits your ldap server
--no changes, defaults ok??

4) Edit imap.conf so auth method = saslauthd
--no change required, already set to saslauthd
--restarted cyrus-imapd and saslauthd

When testing with "testsaslauthd -u john -p password" or "testsaslauthd -u [email-masked] -p password" testauthd returns: 0: NO "authentication failed"

When testing with "./imtest -a john localhost" and ""./imtest -a [email-masked] localhost" login fails. Log output:

/var/log/maillog
badlogin: localhost.localdomain [127.0.0.1] plaintext john SASL(-13):
authentication failure: checkpass failed

/var/log/messages
saslauthd[6142]: do_auth : auth failure: [user=john] [service=imap] [realm=] [mech=ldap] [reason=Unknown]

Reading the saslauthd ldap documentation
( <http://www.irbs.net/internet/info-cyrus/0207/att-0599/LDAP_SASLAUTHD>) it explains how to define ldap servers etc but when I place this in /etc/sysconfig/saslauthd and restart saslauthd I get "line x: ldap_servers:: command not found". Should this info be placed somewhere else?

HELP!
1) Are there are any other log files I should be watching for hints?
2) Have I missed a config file somewhere?
3) Am I testing correctly?
3) Do I need to define more than just the base in /etc/ldap.conf (ie username field = uid and the password field = userPassword?

Any help would be greatly appreciated.

Regards,
Gavin

---

From: "Tim Kehres" <[email-masked]>
Date: Thu, 16 Dec 2004 08:15:14 +0800

Gavin,

> Has anyone else set-up a Postfix + Cyrus mail server authentication
against OpenLDAP using saslauthd?

First you will have to decide if you are going to use PAM or SASLAUTHD as
your authentication method.   I've been using saslauthd as I don't need the
extra flexibility (complexity) afforded by PAM.   Have also gone through a
similar exercise lately, and barely lived to tell about it.  All is
relatively straightforward until you hit one of the Cyrus modules it seems.

> I'm really struggling so any help including links to existing documents
would be very useful. My main concern at the moment is getting Cyrus IMAP to
authenticate against LDAP. I have been told to use saslauthd but any easier
suggestions would be welcomed. Sorry for the long post but I'm trying not to
miss anything.
>
> I am using Fedora Core 2 on the test box but it will be RHEL3 when in
production. My postifix+cyrus install works correctly with local accounts
using the setup below:

Using FC2 here and saslauthd.   Try to use the testsaslauthd utility to make
sure that all is working properly before having Cyrus IMAP use it.   Running
saslauthd in a shell so that you can see debugging output while at the same
time turning on debugging in OpenLDAP can be extremely helpful.   The use of
Cyrus realms sometimes causes problems depending on your configuration, and
the debugging output should tell you exactly what is being sent to
saslauthd, and then down the line to OpenLDAP.

> #MECH=shadow --default FC3, couldn't get cyradm to work

For saslauthd, you should use:

MECH="ldap"

For my site, I also had to modify /etc/rc.d/init.d/saslauthd and change the
default MECH (MECH=ldap).

Also make sure that /var/run/saslauthd exists.   The Cyrus SASL code, at
least on Fedora 2 seems to have several problems in default directories.
The install does not seem to identify and adjust to different
configurations.   Potential problems exist for SOCKETDIR as well as where
the default libraries are installed.   If you are running the standard FC2
RPM's however there should be fewer problems.  Just make sure you understand
where the saslauthd configuration file is for the particular version / build
you are running.  If I remember correctly, if you build from source, the
default is /usr/local/etc/saslauthd.conf, but the RedHat RPM's default to
/etc/saslauthd.conf.

For my configuration (you will most likely need to modify per your local
network as well as your LDAP schema you are using), my saslauthd.conf is:

ldap_servers: ldap://cebu.jade.net:389/
ldap_password_attr: userPassword
ldap_default_realm: jade.net
ldap_filter: uid=%U@%r
ldap_search_base: uid=%U@%r,dc=jade,dc=net

> tls_ca_file: /usr/share/ssl/certs/ca-bundle.crt

This looks ok.

> When testing with "testsaslauthd -u john -p password" or "testsaslauthd -u
[email-masked] -p password" testauthd returns: 0: NO "authentication
failed"

Try to run saslauthd with debugging in a separate shell that you can monitor
what is being passed to it.   At the same time turn on debuggin in the LDAP
server and try to see into the LDAP server.   Cyrus realms get in the way
sometimes here.

> ( <http://www.irbs.net/internet/info-cyrus/0207/att-0599/LDAP_SASLAUTHD>)
it explains how to define ldap servers etc but when I place this in
/etc/sysconfig/saslauthd and restart saslauthd I get "line x: ldap_servers::
command not found". Should this info be placed somewhere else?
> 3) Do I need to define more than just the base in /etc/ldap.conf (ie
username field = uid and the password field = userPassword?

Check the configuration of your saslauthd.conf file and make sure it is
consistent with your schema that you are trying to authenticate against in
LDAP.  Make sure that the ldap filter saslauthd is using is proper for your
setup.

If you have any other specific issues, feel free to drop me a line and I can
go through my notes to see if I can be of any further assistance.

Best Regards,

Tim Kehres

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 15 Dec 2004 21:23:47 -0800

Please note that this list is for discussing the standardization
of SASL.  Discussions specific to any given implementation of
SASL, such as Cyrus SASL, should be directed to forums particular
to the implementation.  For Cyrus SASL, please use the
<[email-masked]>.  See
<http://asg.web.cmu.edu/sasl/#mailinglists> for subscription
details.

Thanks, Kurt (SASL WG chair)

---

From: "Tim Kehres" <[email-masked]>
Date: Thu, 16 Dec 2004 08:15:14 +0800

Gavin,

MECH="ldap"

This looks ok.

Best Regards,

Tim Kehres

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 15 Dec 2004 21:23:47 -0800