Problem with pam_mysql, saslauthd and ONLY imap

[Dan White]

Egoitz Aurrekoetxea wrote:
> Hi!!
>
> I have reinstalled the whole testing machine trying to solve the 
> problem (with the same config files)... but no way... pop and smtp 
> work but not IMAP.... smtpd.conf file (of /usr/local/lib/sasl2) 
> constains :
>
> pwcheck_method: saslauthd
> mech_list: PLAIN LOGIN
>
> just this....
>
>
> and if I use pop3test or smtptest... checks are ok and I can logon... 
> but... look with imtest :
>
> correopiloto# imtest  -aegoitz at ramattack.net 
> <mailto:aegoitz at ramattack.net> -mplain
> WARNING: no hostname supplied, assuming localhost
>
> S: * OK [CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID AUTH=PLAIN SASL-IR] 
> server ready

You may be aware, but including the AUTHENTICATE line from the output, 
when performing PLAIN/LOGIN authentications, makes it trivial for 
someone to uunencode your username and password. You should consider 
that password compromised.

> S: A01 NO authentication failure
>
> In auth.log we can see :
>
> Sep 15 14:00:54 correopiloto imap[835]: sql_select option missing
> Sep 15 14:00:54 correopiloto imap[835]: auxpropfunc error no mechanism 
> available
> Sep 15 14:00:57 correopiloto saslauthd[488]: do_auth         : auth 
> failure: [user=egoitz at ramattack.net <mailto:egoitz at ramattack.net>] 
> [service=imap] [realm=ramattack.net <http://ramattack.net>] [mech=pam] 
> [reason=PAM auth error]
>
> In messages :
>
> Sep 15 14:02:40 correopiloto imap[835]: badlogin: localhost [127.0.0.1 
> <http://127.0.0.1>] PLAIN [SASL(-13): authentication failure: Password 
> verification failed]

You may have better luck trouble shooting this as a PAM configuration issue.

I tried searching for a PAM testing tool and ran across 'pamtester':

http://pamtester.sourceforge.net/

I was able to test like this:

./pamtester imap jsmith authenticate
Password: xxx
pamtester: successfully authenticated

- Dan