Patch status

[Amir 'CG' Caspi]

Hi all,

	RHEL has closed the downstream bug (link below) as "WONTFIX" 
because of their claim that these updates break compatibility with 
various clients that rely on saslauthd.  There are some suggestions 
in that thread of a possible different implementation to the fix, but 
basically, they're saying this has to be fixed on the cyrus/sasl side 
and they won't include the existing patch as a fix.
	They did make the (correct) comment that this should be fixed 
for all auth mechanisms, not just auth_pam.

	I know other people, besides just me, are interested in 
getting this resolved... we're getting hit hard by spammers on our 
SMTP server every day, and it would be enormously helpful to be able 
to use fail2ban or some other firewall to block their access, but 
without the rhost info, this is not possible.

	Hopefully it's possible to come up with a more "global" 
solution that would be acceptable to RHEL (and thus CentOS, 
downstream).

Thanks!

						--- Amir

At 6:26 PM +0100 10/16/2012, Alexey Melnikov wrote:
>Hi Amir,
>
>On 13/10/2012 02:55, Amir 'CG' Caspi wrote:
>>Speaking of more updates...
>>
>>     This issue still hasn't been truly resolved:
>>http://lists.andrew.cmu.edu/pipermail/cyrus-sasl/2011-April/002233.html
>>
>>     Lorenzo Catucci released a couple of patches to deal with this 
>>but they were "rejected" by RHEL because they supposedly broke 
>>compatibility with other utilities.  From reading the latest 
>>comments in the bug report 
>>(https://bugzilla.redhat.com/show_bug.cgi?id=683797), especially 
>>#16, it appears that this is because the patch causes saslauthd to 
>>hang up if it doesn't receive rhost info, which it wouldn't from 
>>utilities that haven't been modified to send it.  Perhaps the patch 
>>could be rewritten so that saslauthd doesn't _expect_ rhost, but 
>>still allows it, so it won't hang up if not given that info.
>>     Some later comments (notably #20) remark that this is an issue 
>>with other auth schemes besides pam.
>
>I can apply the older patch (for 1.5.X, possibly updated), but my 
>problem is that I can't really test it. If somebody is willing to 
>try it out, I can attempt to fix this issue.
>
>>     In any case, it would be awesome to have this updated at the 
>>source (here), and to have it work - right now, without rhost 
>>logging capability, DDoS banners like fail2ban can't use saslauthd 
>>info (at least not with pam).