Re: Re: Authentication

Keith T. Garner said:

>On Mon, Dec 20, 2004 at 03:32:55, Michael said:
>  
>
>>the following (debian) configuration for postfix allows me "only" to 
>>authenticate ALL users (local and virtual) with pam/ldap + sasl (local 
>>users have to be virtual users).
>>
>>Does the configuration of jamm and postfix allow to seperate the 
>>authentication process for local users (authentication over pam/passwd + 
>>sasl) and  virtual users (authentication over pam/ldap + sasl)?
>>    
>>
>
>In all cases I have courier (and postfix) use pam.  I have pam
>configured to test the local unix database and if that fails to then
>try LDAP.  For SASL, though, I'm only using the PLAIN or LOGIN methods
>as both postfix and courier are setup to either only do SSL or only
>accept a login after a STARTTLS.
>
>>From /etc/pam.d/smtp:
>   auth        required      /lib/security/pam_env.so
>   auth        sufficient    /lib/security/pam_unix.so likeauth nullok
>   auth        sufficient    /lib/security/pam_ldap.so use_first_pass
>   auth        required      /lib/security/pam_deny.so
>
>   account     sufficient    /lib/security/pam_unix.so
>   account     [default=ok user_unknown=ignore service_err=ignore system_err=ignore] /lib/security/pam_ldap.so
>
>   password    required      /lib/security/pam_deny.so
>   password    sufficient    /lib/security/pam_unix.so nullok use_authtok md5 shado
>   password    sufficient    /lib/security/pam_ldap.so use_authtok
>   password    required      /lib/security/pam_deny.so
>
>   session     required      /lib/security/pam_limits.so
>   session     required      /lib/security/pam_unix.so
>   session     optional      /lib/security/pam_ldap.so
>  
>
OK,

now pam speaks to ldap, if the pam test on local unix database fails:

output:

slapd ... : => access_allowed: search access to "dc=example,dc=come" 
"uid" requested
slapd ... : <= root access granted

but,

pam, sasl:

(pam_unix) check pass; user unknown
(pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
saslauthd ... : DEBUG: auth_pam: pam_authenticate failed: Authentication 
failure
saslauthd ... : do_auth : auth failure: [user=virtual] [service=smtp] 
[realm=example.com] [mech=pam] [reason=PAM auth error]

and postfix:

postfix/smtpd ... : warning: SASL authentication failure: Password 
verification failed
postfix/smtpd ... : warning: unknown[192.168.1.10]: SASL PLAIN 
authentication failed

are failing.

With courier NO problem.

What's going wrong?


Michael






-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/