Questions[saslauthd](server)

I'm trying to configure saslauthd with PAM. I created a user test with password test using useradd and passwd and I checked that I can login with su - test.

[arch@vps-5220ce87 ~]$ systemctl status saslauthd
● saslauthd.service - Cyrus SASL authentication daemon
     Loaded: loaded (/usr/lib/systemd/system/saslauthd.service; enabled; vendor preset: disabled)
     Active: active (running) since Sat 2020-12-19 21:57:28 UTC; 43min ago
    Process: 932358 ExecStart=/usr/sbin/saslauthd $SASLAUTHD_OPTS (code=exited, status=0/SUCCESS)
   Main PID: 932360 (saslauthd)
      Tasks: 5 (limit: 4585)
     Memory: 1.8M
     CGroup: /system.slice/saslauthd.service
             ├─932360 /usr/sbin/saslauthd -a pam
             ├─932361 /usr/sbin/saslauthd -a pam
             ├─932362 /usr/sbin/saslauthd -a pam
             ├─932363 /usr/sbin/saslauthd -a pam
             └─932364 /usr/sbin/saslauthd -a pam
[arch@vps-5220ce87 ~]$ cat /etc/conf.d/saslauthd
SASLAUTHD_OPTS="-a pam"
[arch@vps-5220ce87 ~]$ cat /etc/pam.d/smtp
#%PAM-1.0
auth            required        pam_unix.so
account         required        pam_unix.so
[arch@vps-5220ce87 ~]$ testsaslauthd -u test -p test
0: NO "authentication failed"
[arch@vps-5220ce87 ~]$ sudo journalctl -ru saslauthd -n 3
-- Logs begin at Mon 2020-11-16 09:26:47 UTC, end at Sat 2020-12-19 22:44:52 UTC. --
Dec 19 22:41:23 vps-5220ce87 saslauthd[932364]:                 : auth failure: [user=test] [service=imap] [realm=] [mech=pam] [reason=PAM auth error]
Dec 19 22:41:23 vps-5220ce87 saslauthd[932364]: DEBUG: auth_pam: pam_authenticate failed: Authentication failure
Dec 19 22:41:23 vps-5220ce87 saslauthd[932364]: pam_warn(imap:auth): function=[pam_sm_authenticate] flags=0x8000 service=[imap] terminal=[<unknown>] user=[t>

My employer has been running RHEL 6.x and Apache httpd 2.2 for many years. We are currently in the process of migrating to new hardware running RHEL 7.1 and Apache httpd 2.4. Our current web site has various locations that contain downloadable material for different sets of clients. Clients all have system accounts on the server box. We currently control access to the locations based on client user's group membership.

For example:

<Location /xyzzy/*>
    AuthName "xyzzy product support"
    AuthShadow on
    AuthType Basic
    require group xyzzy
    Options Includes ExecCGI Indexes FollowSymLinks MultiViews
</Location>

We have been successfully using mod_auth_shadow to implement this access control under Apache 2.2. However, we've found that this module won't load under 2.4 because the module calls ap_requires(), which is not present under 2.4.

We've noticed that RHEL 7 by default runs

/usr/sbin/saslauthd -m /run/saslauthd -a pam

so I've been looking at using PAM through mod_authn_sasl as a replacement for mod_auth_shadow. I've had partial success with this apache configuration:

<Location /xyzzy/*>
    AuthType Basic
    AuthName "xyzzy product support"
    AuthBasicProvider sasl
    AuthBasicAuthoritative On
    AuthSaslPwcheckMethod saslauthd
    Require valid-user
</Location>

combined with this /etc/pam.d/http file:

#%PAM-1.0
auth       include      password-auth
auth       include      pam_group
account    include      password-auth

With this combination any user with valid login credentials can access the xyzzy location. I believe this validates that the basic connection between Apache -> saslauthd -> PAM is working. But that's not the level of granularity we're looking for.

This alternative httpd configuration:

<Location /xyzzy/*>
    AuthType Basic
    AuthName "xyzzy product support"
    AuthBasicProvider sasl
    AuthBasicAuthoritative On
    AuthSaslPwcheckMethod saslauthd
    Require group xyzzy
</Location>

generates this error in the httpd log:

AH01664: No group file was specified in the configuration

This suggests that httpd is not going through saslauthd in order to validate group membership. So far, I haven't found an httpd directive that would force group authentication through sasl in the way that user/password authentication does.

(Why am I using the system passwd, shadow and group files for authentication instead of a separate database for http? Some clients prefer to download their support files via ftp rather than http. So we use the system in order to give our clients relatively easy switching between the two protocols)

As a last resort I'm prepared to try updating mod_auth_shadow for 2.4. But I've never coded or debugged an apache module, so there's an unknown learning curve involved in that approach. So I'm completely open to suggestions!

Trying to get authentication on my mail server (ubuntu 10.04) running but am having trouble. I have a server with postfix for smtp setup, imap server with courier setup. My postfix authentication is using cyrus (I haven't tried dovecot really) saslauth. The user name and password is stored in a MySql database. Logging in with imap-ssl works on a remote client (thunderbird), and I can read my mail. I can't get the SMTP side working, and have focused the issue down to saslauth.

Testing with

testsaslauthd -u 'username' -p 'passowrd' -s smtp 

returns

connect() : Permission denied

the password in the database is encrypted and I guess this testsaslauthd will take a plain text password and encrypt it.

Looking for someone to walk me through getting this working. Im new to the mail server, and have never got one fully working. Thanks. Ask me which log files I should look at/post, which tests to run, permissions to check.

Edit: (3/26/2012) for more information I can't get any mail client to work, they give errors like

The message could not be sent because connecting to SMTP server <mydomain.com> failed. The server may be unavailable or is refusing SMTP connections

I have respective ports open on iptables, but i am guessing that it is an internal problem because of the test I ran above. I have also run telnet to mail.mydomain.com 25 and run ehlo localhost and get this in return

250-mail.domain.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

EDIT: (3/28/2012 2:45pm)

~$ postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
inet_interfaces = all
inet_protocols = all
mailbox_size_limit = 0
mime_header_checks = regexp:/etc/postfix/mime_header_checks
mydestination = mail.mydomain.co, localhost, localhost.localdomain
myhostname = mail.mydomain.co
mynetworks = 127.0.0.0/8
myorigin = /etc/mailname
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
readme_directory = no
recipient_delimiter = +
relayhost =
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_tls_cert_file = /etc/ssl/certs/mailcert.pem
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-forwards.cf, mysql:/etc/postfix/mysql-email.cf
virtual_gid_maps = static:5000
virtual_mailbox_base = /home/vmail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-mailboxes.cf
virtual_uid_maps = static:5000

EDIT: Solved (3/29/2012) Thanks to both @AveryPane and @malloc4k for pointing me in the right direction. A few things I had to do, make sure that my MX records were in proper order. I used the tool intodns.com and also http://www.mxtoolbox.com for checking whether my server was accepting connections. Then using tail -f I watched my logs for any errors, was excited to see that there was actually something being logged once I got my DNS records straightened out, and tweaked some config files.

Two things that I didn't know about one of which was some ISPs block port 25, which might have been in my case why thunderbird wasn't seeing my server on port 25. Second in the file /etc/postfix/master.cf there are settings about which ports to allow postfix to listen on. The default port 25 is there the line

smtp      inet  n       -       -       -       -       smtpd

which basically says hi im postfix, I run on port 25. If you want to run postfix on another port, 587 which is popular for mail servers, add this line near there in master.cf

587      inet  n       -       -       -       -       smtpd

run a restart /etc/init.d/postfix restart and you should be set. That was the solution for me.

Woke up today to see my site slow/unresponsive. Pulled up top and it looks like a ton of saslauthd processes have spun up using about 64m of RAM each, causing the machine to enter swap space. I've never seen this many used on there.

top - 16:54:13 up 85 days, 11:48,  1 user,  load average: 0.32, 0.50, 0.38
Tasks: 143 total,   1 running, 142 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.7%us,  0.3%sy,  0.0%ni, 97.3%id,  0.2%wa,  0.0%hi,  0.0%si,  1.4%st
Mem:   1048796k total,  1025904k used,    22892k free,    14032k buffers
Swap:  2097144k total,   332460k used,  1764684k free,   194348k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                  
  848 admin     20   0  263m 115m 4840 S    0 11.3   5:02.91 ruby                                                                                      
  906 admin     20   0  265m 113m 4828 S    0 11.1   5:37.24 ruby                                                                                      
30484 admin     20   0  248m  91m 4256 S    6  9.0 219:02.30 delayed_job                                                                               
 4075 root      20   0  160m  65m  952 S    0  6.4   0:24.22 saslauthd                                                                                 
 4080 root      20   0  162m  64m  936 S    0  6.3   0:24.48 saslauthd                                                                                 
 4079 root      20   0  162m  64m  936 S    0  6.3   0:24.70 saslauthd                                                                                 
 4078 root      20   0  164m  63m  936 S    0  6.2   0:24.66 saslauthd                                                                                 
 4077 root      20   0  163m  62m  936 S    0  6.1   0:24.66 saslauthd                                                                                 
 3718 mysql     20   0  312m  52m 3588 S    1  5.1   3499:40 mysqld                                                                                    
  699 root      20   0 72744 7640 2164 S    0  0.7   0:00.50 ruby                                                                                      
15701 postfix   20   0  106m 5712 4164 S    1  0.5   0:00.50 smtpd                                                                                     
15702 postfix   20   0 52444 3252 2452 S    1  0.3   0:00.06 cleanup                                                                                   
 4062 postfix   20   0 41884 3104 1788 S    0  0.3 125:26.01 qmgr                                                                                      
15683 root      20   0 51504 2780 2180 S    0  0.3   0:00.04 sshd                                                                                      
14595 postfix   20   0 52308 2548 2304 S    1  0.2   0:24.60 proxymap                                                                                  
15483 postfix   20   0 43380 2544 1992 S    0  0.2   0:00.38 smtp                                                                                      
15486 postfix   20   0 43380 2544 1992 S    0  0.2   0:00.36 smtp                                                                                      
15488 postfix   20   0 43380 2540 1992 S    0  0.2   0:00.38 smtp                                                                                      
15485 postfix   20   0 43380 2532 1984 S    0  0.2   0:00.36 smtp                                                                                      
15489 postfix   20   0 43380 2532 1984 S    0  0.2   0:00.40 smtp 

Wasn't sure what Saslauthd is, Google says it handles plantext authentication. The machine has been sending a lot of email through postfix, so this could be related.

Anyone know why so many may have spun up? Are they safe to kill? Thanks!

Right now my company is using a network share to communicate with the SVN repository. It's really slow so I'd like to switch to SVNSERVE.

The main reason my company chose to go the filesystem route was because it made it easy to secure using our existing active directory authentication system.

From what I've read it is possible to use SvnServe with active directory as long as you use the Sasl library. I was just wondering if anybody else out there is doing this and could give some pointers on configuration since it doesn't seem to be documented anywhere.

Thanks

Edits

We have svn on a fast server but it is unfortunately used for other corporate file shares and services.

I'm being told that HTTP protocol won't be faster than file:// with SMB. Does anybody have any documentation of this. I figured a true client server model would perform better. We have about 13 developers and a build server committing and updating from it all day.