Re: Courier-authdaemon and authpam

Right, I just tested what you proposed, and that indeed was the complete solution.
I will post a comment on aur to hopefully get the solution integrated in the package build.

thanks again Sam!

Hendrik-Jan




Sent with Proton Mail secure email.

On Saturday, November 23rd, 2024 at 1:43 PM, hjheins via courier-users <[email protected]> wrote:

> Thank you very much Sam!
> 
> This is the build file: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=courier-authlib
> 
> indeed this is being rund with a different user and group. I will modify this one in order to have the default for the authenticate daemon (root).
> 
> I guess this is the best starting point I have; as pam_sssd seems to be a lot of trouble to get right...
> 
> Hendrik-Jan
> 
> 
> 
> Sent with Proton Mail secure email.
> 
> 
> On Saturday, November 23rd, 2024 at 1:29 AM, Sam Varshavchik [email protected] wrote:
> 
> > hjheins via courier-users writes:
> > 
> > > The issue:
> > > I have a setup running Arch Linux with courier-imap and courier-authd for
> > > accessing the mailboxes on the mailserver. This works, but the authorisation
> > > runs over authshadow. As that is not the preferred way, I tried to get this
> > > running over authpam.
> > > For this I followed the guide at: <URL:https://www.courier-
> > > mta.org/authlib/README_authlib.html#authpam>https://www.courier-
> > > mta.org/authlib/README_authlib.html#authpam
> > > 
> > > and I changed the settings to "include system-auth" to make it fit for my
> > > system.
> > > 
> > > This doesn't work, and throws authentication failures.
> > > 
> > > The reason this doesn't work seems to be that authpam expects the requesting
> > > process to run as root. Courier-* is running as user "courier". so this wil
> > > not work according to the pam documentation:
> > > URL:https://www.kilala.nl/index.php?id=2485https://www.kilala.nl/index.php?
> > > id=2485
> > 
> > authdaemond should be running as root. Additionally, imaplogin also gets
> > started as root. That's the only way to go, if after authentication imapd
> > needs to change its userid and groupid.
> > 
> > > How can I solve this, or maybe asked differently: how can I get courier-
> > > authdaemon to play nice with authpam ?
> > 
> > I'm not familiar with the arch packages, but based on your description they
> > are not set up in a standard, default configuration where authdaemond runs
> > as root.
> > 
> > You have two basic options: uninstall the arch versions and build courier-
> > unicode, courier-authlib, and courier-imap or courier yourself, using the
> > default configuration options; or try to see if you can contact the arch
> > packagers and have them figure out your situation.
> > _______________________________________________
> > courier-users mailing list
> > [email protected]
> > Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
> 
> 
> 
> _______________________________________________
> courier-users mailing list
> [email protected]
> Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users


_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users