Dotaz: unknown authentication mechanism: PAM

[Dalibor]

Zdravim,

zkousel jsem hledat v diskusi i na Google, ale nikde zadna zminka, proto se obracim na vas

Snazim se rozchodit SMTP relaying na postfixu, k tomu potrebuji overovani pomoci saslauthd. Nainstaloval jsem si Cyrus-sasl, ale nenasel jsem zadne spousteci skripty pro saslauthd, tak ho zkousim spustit rucne (tento zapis jsem vytahl nekde tady v diskusi, podle Z. Burdy by mel fungovat):

/usr/sbin/saslauthd -r -m /var/spool/postfix/var/run/saslauthd -a pam

Ale na tento pokus skonci chybou:

# /usr/sbin/saslauthd -r -m /var/spool/postfix/var/run/saslauthd -a pam
saslauthd[25043] :set_auth_mech   : unknown authentication mechanism: pam

Nevite nekdo prosim cim by to mohlo byt? Pri konfiguraci Cyrus-sasl se da nastavit cesta k PAMu, ale nevim jakou tam mam uvest, tak jsem ji neuvadel.

Diky moc, i za nakopnuti

Pouzivam Debian

Odpovědi

[pasmen]

Mozna tim, ze saslauthd nemas zkompilovany s podporou PAM? Zkus ldd saslauthd a koukni jestli je ve vypisu libpam.so.x.

[pasmen]

A pokud by to bylo tim, ze nevis kam co napsat, pokud se nepletu, konfiguracni soubor SASLu pro mailer by mel byt v /usr/lib/sasl/smtpd.conf. Syntax viz. manualova stranka.

[Dalibor]

Takze sasl nemam zkompilovany s podporou PAM, je na to volba --with-pam=[path], jakou cestu mam uvest jako cestu k PAM? Zadnou binarku PAM jsem nenasel.

# ldd /usr/sbin/saslauthd
        linux-gate.so.1 =>  (0xffffe000)
        libcrypt.so.1 => /lib/tls/libcrypt.so.1 (0x55571000)
        libresolv.so.2 => /lib/tls/libresolv.so.2 (0x5559e000)
        libc.so.6 => /lib/tls/libc.so.6 (0x555b1000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x55555000)

Diky!

[pasmen]

Nevim presne, po cem se SASL diva, jestli po samotne knihovne PAMu (tipnul bych si), nebo po modulech. Pokud mas PAM nainstalovany, melo by stacit --with-pam bez uvedeni cesty. Pokud se diva po modulech, zkus --with-pam /lib/security. Ale rekl bych, ze jde o prvni pripad, moduly by ho nemely zajimat...

[Dalibor]

PAM mam zrejme nainstalovany, knihovny /lib/libpam* a /lib/security/pam* jsem nasel, ale i po instalaci cyrus-sasl s --with-pam nebo --with-pam=/lib mi to haze stale tu samou chybu - unknown authentication mechanism: PAM

jakou cestu bych mel uvest do --with-pam?

Nebo muzu nejak otestovat pam, jestli ho mam dobre nainstalovany?

[pasmen]

Zacni tim, ze nam reknes jakou mas distribuci. Jak vis, ze mas PAM nainstalovany? Koukni do balickovaciho systemu.

[Dalibor]

Pouzivam Debian, myslim, ze mam PAM nainstalovany, protoze jsem nasel knihovny PAMu, jak jsem psal v minulem prispevku. V baliccich pro Debian jsem nasel balicek libpam0g s popisem Pluggable Authentication Modules library, myslim tedy, ze to je zakladni balicek PAMu a ten instalovany mam. viz:

# apt-get remove libpam0g
Reading Package Lists... Done
Building Dependency Tree... Done
The following packages will be REMOVED:
  adduser base-config bash courier-authdaemon courier-authmysql courier-imap courier-pop cron cyrus21-common hotplug libauthen-pam-perl
  libpam-chroot libpam-modules libpam-mysql libpam0g login logrotate passwd postfix postfix-mysql postfix-tls ppp pppconfig pppoe pppoeconf
  ssh webmin webmin-core
WARNING: The following essential packages will be removed
This should NOT be done unless you know exactly what you are doing!
  bash passwd (due to bash) login libpam-modules (due to login) libpam0g (due to login)
0 upgraded, 0 newly installed, 28 to remove and 0 not upgraded.
Need to get 0B of archives.
After unpacking 40.0MB disk space will be freed.
You are about to do something potentially harmful
To continue type in the phrase 'Yes, do as I say!'
 ?]

Jak muzu zjistit nejake podrobnejsi info z balickovaciho systemu?

Diky moc za vas cas!

[petr_p]

Hlavickovy soubory mas?

[pasmen]

Balickovaci prikazy, ktere by se ti mohly hodit jsou:

apt-cache show libpam0g

a pole Description, podrobnejsi informace o balicku.

dpkg -L <balicek>

vypise seznam souboru nainstalovanych danym balickem.

Zda se, ze PAM balicky mas nainstalovane, ale zda se mi to divne... Moduly by meli byt v umisteni /lib/security/pam_modul.so, prisli v balicku libpam-modules. Knihovna libpam.so.0.x je v balicku libpam0g jak spravne rikas. Pokud neni v /libM tak nevim. Co rekne prikaz locate libpam.so?

[Dalibor]

Zacnu tim locate libpam.so -

# locate libpam.so
/lib/libpam.so.0
/lib/libpam.so.0.76

Moduly mam tam jak pisete, tohle by melo byt ok, ze?

# apt-cache show libpam0g
Package: libpam0g
Priority: required
Section: base
Installed-Size: 168
Maintainer: Sam Hartman <hartmans@debian.org>
Architecture: i386
Source: pam
Version: 0.76-22
Replaces: libpam0g-util
Depends: libc6 (>= 2.3.2.ds1-4), libpam-runtime
Suggests: libpam-doc
Conflicts: libpam0 (<= 0.56-2), libpam
Filename: pool/main/p/pam/libpam0g_0.76-22_i386.deb
Size: 74154
MD5sum: 0980c28f636131671dda807c259bec36
Description: Pluggable Authentication Modules library
 Contains the C shared library for Linux-PAM, a suite of shared
 libraries that enable the local system administrator to choose how
 applications authenticate users.  In other words, without rewriting
 or recompiling a PAM-aware application, it is possible to switch
 between the authentication mechanism(s) it uses.  One may entirely
 upgrade the local authentication system without touching the
 applications themselves.

# dpkg -L libpam0g
/.
/lib
/lib/libpam.so.0.76
/lib/libpam_misc.so.0.76
/lib/libpamc.so.0.76
/usr
/usr/share
/usr/share/doc
/usr/share/doc/libpam0g
/usr/share/doc/libpam0g/README
/usr/share/doc/libpam0g/README.Debian
/usr/share/doc/libpam0g/TODO.Debian
/usr/share/doc/libpam0g/copyright
/usr/share/doc/libpam0g/changelog.Debian.gz
/usr/share/doc/libpam0g/changelog.gz
/usr/share/doc/libpam0g/Debian-PAM-MiniPolicy.gz
/lib/libpam_misc.so.0
/lib/libpamc.so.0
/lib/libpam.so.0

Nebude problem spis v cyrus-sasl? Zkousel jsem uz jako cestu k PAM uvest pri konfiguraci ruzne variace, ale nic se nepovedlo, porad neni cyrus zkompilovany s podporou PAM:

# ldd /usr/sbin/saslauthd
        linux-gate.so.1 =>  (0xffffe000)
        libcrypt.so.1 => /lib/tls/libcrypt.so.1 (0x55571000)
        libresolv.so.2 => /lib/tls/libresolv.so.2 (0x5559e000)
        libc.so.6 => /lib/tls/libc.so.6 (0x555b1000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x55555000)

# /usr/sbin/saslauthd  -v
saslauthd 2.1.22
authentication mechanisms: getpwent rimap shadow

Jak otestovat ten PAM? Kdyby fungoval spravne, tak musim hledat spis v cyrus-sasl

[pasmen]

Jak uz pisu dole, chybi balik sasl2-bin a jak pise Libor, mozna i libsasl2-modules.

[Dalibor]

tyhle baliky jsem uz nainstaloval, SMTP server uz mi na EHLO vypisuje AUTH LOGIN PLAIN...

Akorat po autentifikaci se objevi 501 malformed initial response

vysvetleni 501ky: (501 Not Implemented The server does not support the functionality required to fulfill the request.)

Takze jdu zkoumat logy..

[ch-in-A]

rekl bych ze budete potrebovat mit v /etc/conf.d/saslauthd uvedeno kde ma sasl brat overovaci udaje. v pripade ze tam mate pam, budete potrebovat mit pam nainstalovany a nastaveny tak aby vedel jaky moul pouzit tudiz kde hledat jmena a hesla.

funkcnost saslu si muzete overit nastrojem testsaslauthd sluzba saslauthd musi bezet, tudiz si skuste nekde najit rc skript na jeji spousteni

ja mam na archu tenhle

#!/bin/bash

# source application-specific settings
[ -f /etc/conf.d/saslauthd ] && . /etc/conf.d/saslauthd

. /etc/rc.conf
. /etc/rc.d/functions

DAEMON_NAME="saslauthd"
SASLAUTHD_BIN=/usr/sbin/saslauthd
SASLAUTHD_PID=`pidof -o %PPID $SASLAUTHD_BIN`

case "$1" in
  start)
    stat_busy "Starting $DAEMON_NAME"
    [ -z "$SASLAUTHD_PID" ] && $SASLAUTHD_BIN $SASLAUTHD_OPTS
    if [ $? -gt 0 ]; then
      stat_fail
      exit 1
    else
      echo `pidof -o %PPID $SASLAUTHD_BIN` > /var/run/$DAEMON_NAME.pid
    fi
    add_daemon $DAEMON_NAME
    stat_done
    ;;

  stop)
    stat_busy "Stopping $DAEMON_NAME"
    [ ! -z "$SASLAUTHD_PID" ]  && kill $SASLAUTHD_PID &> /dev/null
    if [ $? -gt 0 ]; then
      stat_fail
      exit 1
    else
      rm /var/run/$DAEMON_NAME.pid &> /dev/null
    fi
    rm_daemon $DAEMON_NAME
    stat_done
    ;;

  restart)
    $0 stop
    sleep 1
    $0 start
    ;;

  *)
    echo "usage: $0 {start|stop|restart}"
esac
exit 0
# vim: ts=2 sw=2 et ft=sh

[Dalibor]

Tady tech problemu bude asi vic. Nemam ani adresar /etc/conf.d, ani spousteci skripty pro saslauthd (/etc/init.d/saslauthd), nemely by se nainstalovat samy spolu s cyrus-sasl?

Pripadne, jak mam nainstalovat ten PAM? Nejlepe pomoci balicku..

Hlavickovy soubor jsem nenasel ani v /usr/include ani /usr/local/include, hledal jsem pam_appl.h, zkusil jsem ho vytvorit a hodit do /usr/include podle http://www.opengroup.org/onlinepubs/8329799/apdxa.htm a instalaci cyrus-sasl provest znova (s --with-pam=/usr), ale nic..

[pasmen]

Adresar /etc/conf.d je specialita Arch linuxu. V Debianu tomu odpovida adresar /etc/default. Co se tyce /etc/init.d/saslauthd, chybi ti balicek sasl2-bin, nainstaluj ho.

[pasmen]

Adresar /etc/conf.d je specialita Arch linuxu. V Debianu tomu odpovida adresar /etc/default. Co se tyce /etc/init.d/saslauthd, chybi ti balicek sasl2-bin, nainstaluj ho.

[Dalibor]

tak jsem nainstaloval sasl2-bin a objevily se mi tu tyto soubory: /etc/default/saslauthd a /etc/init.d/saslauthd, kdyz zkousim /etc/init.d/saslauthd start, tak se prikaz provede bez jakekoliv chybove hlasky, ale demon se nespusti (ps ax | grep sasl nic neukaze).

/etc/default/saslauthd:

# This needs to be uncommented before saslauthd will be run automatically
# START=yes

# You must specify the authentication mechanisms you wish to use.
# This defaults to "pam" for PAM support, but may also include
# "shadow" or "sasldb", like this:
# MECHANISMS="pam shadow"

MECHANISMS="pam"

[pasmen]

Po chybovych hlaskach se koukej do logu ve /var/log.

[pasmen]

Btw, co ta hlaska This needs to be uncommented before saslauthd starts automatically? Odkomentoval jsi to?

[Dalibor]

Odkomentoval a hazi to tuto chybu:

Starting SASL Authentication Daemon: (failed)

v logu jsem nenasel zadne podrobnosti

[pasmen]

Zkus to spoustet s optionem -d pro debugging.

[Libor Klepac]

takze debian?

aptitude install sasl2-bin libsasl2-modules

[Dalibor]

Tak jsem se nakonec na kombinaci pam_mysql x saslauthd vykaslal a pouzil primo modul auxprop sql, ktery je v sasl2 k dispozici, do databaze se tak dotazuju rovnou ze SASLu. Konfigurak SASLu bylo treba dat misto do /etc/postfix/sasl/smtpd.conf do /usr/lib/sasl2/smtpd.conf