I'm having some bizarre issues with krb 5 authentication and Cyrus
imapd v2.1.9.
The really odd this about this is I get different behavior when I try
from my user account and when I try from root.
Here's the output of "imtest -m GSSAPI mail" as root:
S: * OK mail.paradoxical.net Cyrus IMAP4 v2.1.9 server ready
C: C01 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ MAILBOX-REFERRALS NAMESPACE UIDPLUS
ID NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND SORT THREAD=ORDEREDSUBJECT
THREAD=REFERENCES IDLE AUTH=GSSAPI
S: C01 OK Completed
C: A01 AUTHENTICATE GSSAPI
S: +
C:
ZIICWAYJKoZIhvcSAQICAQBuggJHMIICQ6ADAgEFoQMCAQ6iBwMFACAAAACjggFnYYIBYzCCAV+gAwIBBaERGw9QQVJBRE9YSUNBTC5ORVSiJzAloAMCAQOhHjAcGwRpbWFwGxRtYWlsLnBhcmFkb3hpY2FsLm5ldKOCARowggEWoAMCARChAwIBBKKCAQgEggEEOjp0YQAF2/kBgARDKi9TPkO9hS1PTewJ+hZl7XcZ0fddqDQoP4iTc01Sg6LH+RufqQ18lwmdCzt4ppQhYneIbACmR66PEokvSlFaNxvThf7RwvMW3x2xQ1TTk+/6Ge9ZAEk3sbQjADjWz6YQW2hv0ymxig+RUDU21lqUMX6wlMYOj70p/f9NWT7cgmVMqGr7Cppz9xuoOQpMKgrkSsV30f0IAEuY+7GtU2bs6j+2OqV6NzpLVWMbbaX6ob4OtuXjaJLm2DMV/jx52mqHxY41XY3Hhd5ZKSfFjTO07pcqRLWNmyCdaboXcSrOqnXBjDROBpbyDePpEoG3/9/Ahc8CfmwZ16qkgcIwgb+gAwIBEKKBtwSBtLgzSku+Lgv9rOnJVVjAhhse3ZNV2P7yZu3pBsMLe3CotavsnG5S4CzVH9yj9hbbnaUiRdzTxkHaS7tPrG8rp4k2xTExo4t8sb5n40l7YHFfVQLGPFELK5ReXqdVbUvEWUmGrkGCALNcE7VoUhgtTE4zY6PtDqqZn5vKz6bcPK75RY5jq5qnFe1FZ/UX+QhiqEVtMuYQyk8ZyzWq8qSM402Ycsvp7Cu8rw3iIsuZvUlKFzd1sg==
<delay of a couple seconds>
S: A01 NO Error authenticating
Authentication failed. generic failure
Security strength factor: 0
Here's the output from my lowly user account:
S: * OK mail.paradoxical.net Cyrus IMAP4 v2.1.9 server ready
C: C01 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ MAILBOX-REFERRALS NAMESPACE UIDPLUS
ID NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND SORT THREAD=ORDEREDSUBJECT
THREAD=REFERENCES IDLE AUTH=GSSAPI
S: C01 OK Completed
C: A01 AUTHENTICATE GSSAPI
S: +
Segmentation fault
/etc/imapd.conf:
# imap setup
configdirectory: /var/imap
partition-default: /var/spool/imap
admins: admin
sasl_pwcheck_method: auxprop
keytab: /etc/imap.keytab
/etc/cyrus.conf:
# standard standalone server implementation
START {
# do not delete this entry!
recover cmd="ctl_cyrusdb -r"
# this is only necessary if using idled for IMAP IDLE
# idled cmd="idled"
}
# UNIX sockets start with a slash and are put into /var/imap/socket
SERVICES {
# add or remove based on preferences
imap cmd="imapd" listen="imap" prefork=0
imaps cmd="imapd -s" listen="imaps" prefork=0
# pop3 cmd="pop3d" listen="pop3" prefork=0
# pop3s cmd="pop3d -s" listen="pop3s" prefork=0
sieve cmd="timsieved" listen="sieve" prefork=0
# at least one LMTP is required for delivery
# lmtp cmd="lmtpd" listen="lmtp" prefork=0
lmtpunix cmd="lmtpd" listen="/var/imap/socket/lmtp" prefork=0
# this is only necessary if using notifications
# notify cmd="notifyd" listen="/var/imap/socket/notify" proto="udp" prefork=1
}
EVENTS {
# this is required
checkpoint cmd="ctl_cyrusdb -c" period=30
# this is only necessary if using duplicate delivery suppression
delprune cmd="ctl_deliver -E 3" period=1440
# this is only necessary if caching TLS sessions
tlsprune cmd="tls_prune" period=1440
}
Here's the output in /var/log/imapd.log when the login fails (as
root):
Oct 1 00:03:10 mail imapd[14807]: badlogin: mail.paradoxical.net[192.168.0.5] GSSAPI
[SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context]
And here's the output in /var/log/auth.log (as root):
Oct 1 00:01:40 mail imapd[14781]: GSSAPI Failure: gss_accept_sec_context
The corresponding output in auth.log from when I'm running as my user
account is:
Oct 1 00:07:21 mail imtest: Bad IPLOCALPORT value
If I already have principals in the krb5 database for users (I do)
should there be additional setup required to allow them to use the
IMAP server? That's not quite clear to me, unfortunately.
Software involved:
MIT Kerberos V5 1.2.5
SASL 2.1.2
OpenLDAP 2.0.23 (for user & group information)
OpenAFS 1.2.6 (for user home directories)
Another question I have, which I can't seem to find an answer to is
would it be possible to store mailboxes on an afs filesystem? I'm not
doing this yet, but I may in the future if it's supported.
Thanks for any help you can provide,
--
Josh Huber
