Re: Jamm-users digest, Vol 1 #374 - 7 msgs

[email protected] wrote:

>Send Jamm-users mailing list submissions to
>	[email protected]
>
>To subscribe or unsubscribe via the World Wide Web, visit
>	https://lists.sourceforge.net/lists/listinfo/jamm-users
>or, via email, send a message with subject or body 'help' to
>	[email protected]
>
>You can reach the person managing the list at
>	[email protected]
>
>When replying, please edit your Subject line so it is more specific
>than "Re: Contents of Jamm-users digest..."
>
>
>Today's Topics:
>
>   1. Authentication (Michael)
>   2. Re: Authentication (Massimiliano Ferrero)
>   3. Re: Authentication (Keith T. Garner)
>   4. Re: Re: [Jamm-users] Authentication (Michael)
>   5. Re: Authentication (Michael)
>   6. Re: Authentication (Alan Hodgson)
>
>--__--__--
>
>Message: 1
>Date: Mon, 20 Dec 2004 15:32:55 +0100
>From: Michael <[email protected]>
>To:  [email protected]
>Subject: [Jamm-users] Authentication
>Reply-To: [email protected]
>
>Hi jamm-users,
>
>
>the following (debian) configuration for postfix allows me "only" to 
>authenticate ALL users (local and virtual) with pam/ldap + sasl (local 
>users have to be virtual users).
>
>Does the configuration of jamm and postfix allow to seperate the 
>authentication process for local users (authentication over pam/passwd + 
>sasl) and  virtual users (authentication over pam/ldap + sasl)?
>
>---------------------------------------------------------------------
>
>/etc/default/saslauthd:
>
>#
>START=yes
>MECHANISMS="ldap"
>#
>
>/etc/postfix/sasl/smtpd.conf:
>
>#
>pwcheck_method: saslauthd
>mech_list: PLAIN LOGIN
>#
>
>/etc/pam_ldap.conf:
>
>#
>host 127.0.0.1
>base dc=example,dc=com
>ldap_version 3
>rootbinddn cn=admin,dc=example,dc=come
>pam_password crypt
>
>---------------------------------------------------------------------
>
>This howto http://jamm.sourceforge.net/contrib_docs/jamm-sasl-tls.txt 
>describes "only" the configuration when ALL users are virtual users, as 
>in my config.
>
>---------------------------------------------------------------------
>
>The jamm howto says:
>
>...
>Local user information can be accessed from the standard account 
>database. A list of valid users can be obtained from /etc/passwd. The 
>users' home directory, which can also be obtained from /etc/passwd, 
>provides the location of the mailbox. Authentication can be handled by 
>standard Unix mechanisms, such as pluggable authentication modules (PAM).
>...
>
>the configuration looks like:
>
>/etc/default/saslauthd:
>
>#
>START=yes
>MECHANISMS="pam"
>#
>
>/etc/postfix/sasl/smtpd.conf:
>
>#
>pwcheck_method: saslauthd
>mech_list: PLAIN LOGIN
>#
>
>---------------------------------------------------------------------
>
>The configuration above authenticate local users with pam/passwd + sasl 
>but NOT jamm virtual users with pam/xxx + sasl (without sasl, jamm 
>virtual users have access to postfix).
>
>Output from auth.log:
>
>... saslauthd[5396]: (pam_unix) check pass; user unknown
>... saslauthd[5396]: (pam_unix) authentication failure; logname= uid=0 
>euid=0 tty= ruser= rhost=
>... saslauthd[5396]: DEBUG: auth_pam: pam_authenticate failed: User not 
>known to the underlying authentication module
>... saslauthd[5396]: do_auth         : auth failure: [user=virtual] 
>[service=smtp] [realm=example.com] [mech=pam] [reason=PAM auth error]
>
>
>Sorry for my english it is not my native language.
>
>Thanks for informations!
>
>Regards,
>
>Michael
>
>
>--__--__--
>
>Message: 2
>Date: Mon, 20 Dec 2004 17:37:30 +0100
>From: Massimiliano Ferrero <[email protected]>
>To: [email protected]
>Subject: Re: [Jamm-users] Authentication
>Reply-To: [email protected]
>
>Michael wrote:
>  
>
>>Hi jamm-users,
>>
>>
>>the following (debian) configuration for postfix allows me "only" to 
>>authenticate ALL users (local and virtual) with pam/ldap + sasl (local 
>>users have to be virtual users).
>>
>>Does the configuration of jamm and postfix allow to seperate the 
>>authentication process for local users (authentication over pam/passwd + 
>>sasl) and  virtual users (authentication over pam/ldap + sasl)?
>>    
>>
>
>I use the following configuration, but beware: it's rather complicate ;)
>
>My ldap has two trees:
>
>let's call the first
>
>o=example
>
>and the second
>
>dc=example,dc=com
>
>inside o=example I've an ou=hosting and inside this all my hosting ldap 
>tree, that is all jvd domains
>
>inside dc=example,dc=com I've three ou
>
>ou=Users
>ou=Groups
>ou=Computer
>
>I've integrated ldap, unix and samba logins using Idealx howto
>http://www.idealx.org/prj/samba/samba-ldap-howto.pdf
>(my solution is still samba 2.2 based, I'm migrating to LAM and samba 
>3.0 just these days)
>
>unix logins have been integrated using pam-ldap and libnss-ldap (nscd), 
>and they point to ou=Users,dc=example,dc=com
>The are several documents that explain how to do this.
>
>All the mail system (postfix + courier pop/imap) see both unix (pam) 
>accounts and ldap accounts
>
>Sasl into postfix was one the most trickiest part: I've "glued" it using 
>imap :)
>
>/etc/default/saslauthd:
>
># This needs to be uncommented before saslauthd will be run automatically
>START=yes
>
># You must specify the authentication mechanisms you wish to use.
># This defaults to "pam" for PAM support, but may also include
># "shadow" or "sasldb", like this:
># MECHANISMS="pam shadow"
>
>MECHANISMS="rimap"
>PARAMS="-m /var/spool/postfix/var/run/saslauthd -r -O 127.0.0.1"
>PWDIR=/var/spool/postfix/var/run/saslauthd
>
>Some notes:
>- MECHANISMS="rimap" of course means to use imap for authentication
>- the saslauthd socket has been moved into the postfix chroot jail
>- the -r is used to pass the user in the form user@domain, until sasl 
>2.1.15 this was standard behaviour, then it changed without warning (on 
>debian), it was a real pain, and at first I had to fetch a patch from 
>cvs to get the -r parameter, I've upgraded to sasl 2.1.19 two days ago 
>and the patch has been merged into sasl2 code
>
>Courier:
>
>- courier /etc/courier/authdaemonrc
>authmodulelist="authldap authpam"
>so again it see both unix (pam) and ldap accounts
>
>- courier authldaprc point to the o=example part of the ldap tree
>
>One last note: I didn't want to have mail accounts for my main domain 
>(midhgard.it) separate from unix accounts, but still I wanted to have 
>midhgard.it integrated in jamm
>
>I found this one last trick: midhgard.it is a virtual mail domain into 
>jamm, it has some virtual mail accounts (no unix user)
>When I want to give the mailbox to a real unix user I create an alias 
>into jamm and make it point to the unix user name (no domain)
>Since postfix and courier both see unix (pam) users, all results to be 
>integrated.
>I just have to "remember" that for this kind of users I've both to 
>create the unix/samba users and the alias into jamm, but this is just 
>because I want to manage one domain a "special" way.
>
>If somebody can be interested (not jamm related): I've integrated the 
>login into apache too, using apache pam auth module
>Then I had another problem: pam can read from ldap but can't read from 
>shadow (unless you give apache permission to read shadow, not advisable)
>I bypassed pam_unix and used pam_imap: this way apache auth is 
>integrated with both ldap and "real" unix users.
>
>Hope this helps you and it's not too off-topic for the list
>
>Massimiliano
>
>  
>


Thanks for proposals, I will check your recommendations and  let you 
know  if  it works...

Regards,

Michael


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/