[Courier-imap] Problem with SASL authentication with IMAP

[Tony Stocker]

Hello,

I'm trying to set up SASL authentication, and can't seem to connect or pass
the correct credentials to the IMAP server. I can't find any IMAP logs
either to figure out if it's even seeing the connections.

I'm using Cyrus-SASL and Courier IMAP. Right now I'm just using the Cyrus
sample server and client programs. Here's the outputs:

CLIENT:
/usr/bin/sasl2-sample-client -s rcmd -p 15000 -m PLAIN 127.0.0.1
receiving capability list... recv: {11}
PLAIN LOGIN
PLAIN LOGIN
please enter an authentication id:
please enter an authorization id: tony.stocker
Password:
send: {5}
PLAIN
send: {1}
Y
send: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
authentication failed
closing connection

SERVER:
/usr/bin/sasl2-sample-server -s rcmd -p 15000
trying 10, 1, 6
trying 2, 1, 6
accepted new connection
send: {11}
PLAIN LOGIN
recv: {5}
PLAIN
recv: {1}
Y
recv: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
starting SASL negotiation: authentication failureclosing connection

/VAR/LOG/AUTH:
Jul 14 16:58:24 mail saslauthd[1703]: do_auth : auth failure: [user=
tony.stocker] [service=rcmd] [realm=] [mech=rimap] [reason=remote server
rejected your credentials]
Jul 14 16:58:24 mail sasl2-sample-server: Password verification failed

My IMAP server works great for checking mail and the like, so I know that it
works in general. I need to setup the SASL stuff to use the IMAP database
so that remote users can then use the mail server for SMTP relaying after
authenticating themselves. I'm using authuserdb as the IMAP authentication
method, so there is no other DBMS in the loop here. I can use any mail
client and the user id "tony.stocker" and password "bbbbbbbb" to check my
mail, so I know that the password is correct.

Any ideas?

[Brian Candler]

Post by Tony Stocker
I'm trying to set up SASL authentication, and can't seem to connect or
pass the correct credentials to the IMAP server. I can't find any
IMAP logs either to figure out if it's even seeing the connections.
I'm using Cyrus-SASL and Courier IMAP.

Erm... courier-authlib doesn't have an authentication module which talks to
cyrus-sasl at all.

Do you just mean you're attempting to use some program from cyrus-sasl as a
client?

Post by Tony Stocker
receiving capability list... recv: {11}
PLAIN LOGIN
PLAIN LOGIN

You can talk the PLAIN mechanism directly using telnet. Take the string
"\0username\0password"

(where \0 is nul), and base64 encode it. Then telnet to port 143 and send

A AUTHENTICATE PLAIN base64encodedstring

There's an example of how to do this here, using Perl's MIME::Base64:
http://www.exim.org/exim-html-4.62/doc/html/spec_html/ch33.html#id2656429

That will log you in to your IMAP server. Of course, it's no more secure
than a normal login, since an attacker can easily base64decode your string.

Post by Tony Stocker
starting SASL negotiation: authentication failureclosing connection
[user=tony.stocker] [service=rcmd] [realm=] [mech=rimap]
[reason=remote server rejected your credentials]
Jul 14 16:58:24 mail sasl2-sample-server: Password verification failed

Well fine, you have a sample IMAP server which talks to your Cyrus SASL
authentication library, but that's nothing at all to do with courier-imap,
which as I say doesn't use the Cyrus SASL library at all. If it's rejecting
your credentials, it's because you haven't set up a user database for Cyrus
SASL (since courier-imap is using its own separate userdb database)

Post by Tony Stocker
My IMAP server works great for checking mail and the like, so I know
that it works in general. I need to setup the SASL stuff to use the
IMAP database so that remote users can then use the mail server for
SMTP relaying after authenticating themselves.

I should then point out:

1. That won't work, because an incoming request to courier-imap doesn't
touch Cyrus SASL at all, and

2. It's unnecessary, because you just need to configure your mail server to
do SMTP AUTH, and your roaming users can send mail by authenticating
directly to the mail server.

Brian.

[Christian Schmitz]

Cyrus-SASL is not needed. I have the following configuration:

postfix --->cyrusSASL --->LDAP
courier-imap --->authdaemon --->LDAP
Squirrelmail --->courier

What is your users database method? (MySql,Ldap, userdb, /etc/passwd etc..)

You must configure authdaemon to comunicate with users backend.

regard

Christian Schmitz

Post by Tony Stocker
Hello,
I'm trying to set up SASL authentication, and can't seem to connect or pass
the correct credentials to the IMAP server. I can't find any IMAP logs
either to figure out if it's even seeing the connections.
I'm using Cyrus-SASL and Courier IMAP. Right now I'm just using the Cyrus
/usr/bin/sasl2-sample-client -s rcmd -p 15000 -m PLAIN 127.0.0.1
receiving capability list... recv: {11}
PLAIN LOGIN
PLAIN LOGIN
please enter an authorization id: tony.stocker
send: {5}
PLAIN
send: {1}
Y
send: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
authentication failed
closing connection
/usr/bin/sasl2-sample-server -s rcmd -p 15000
trying 10, 1, 6
trying 2, 1, 6
accepted new connection
send: {11}
PLAIN LOGIN
recv: {5}
PLAIN
recv: {1}
Y
recv: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
starting SASL negotiation: authentication failureclosing connection
[user= tony.stocker] [service=rcmd] [realm=] [mech=rimap] [reason=remote
server rejected your credentials]
Jul 14 16:58:24 mail sasl2-sample-server: Password verification failed
My IMAP server works great for checking mail and the like, so I know that
it works in general. I need to setup the SASL stuff to use the IMAP
database so that remote users can then use the mail server for SMTP
relaying after authenticating themselves. I'm using authuserdb as the IMAP
authentication method, so there is no other DBMS in the loop here. I can
use any mail client and the user id "tony.stocker" and password "bbbbbbbb"
to check my mail, so I know that the password is correct.
Any ideas?

[Tony Stocker]

Christian,

I think I do need SASL since I want to allow remote users, from
unknown/dynamic IP's, to be able to relay mail through the server AFTER
authenticating themselves with their IMAP password. At least the
guide/cookbook I"m using to set things up seems to indicate that SASL is
needed for this.

I'm using the userdb backend method rather than SQL or LDAP because while my
user base is mobile, it's fairly small so I don't want to introduce another
component into the mix if I don't have to. I'm not using the system passwd
file because I want the users to be virtual users in case something snoops
their password when they're on a remote location, all that gets compromised
is their mail folders rather than a user account on the system.

What I'm trying to do seems to be called "Relay-after-IMAP" by the
'cookbook' but it just assumes that things work and provides no guidance for
when the 'simple' tests don't work.

Thanks for the help,

Tony

Post by Christian Schmitz
postfix --->cyrusSASL --->LDAP
courier-imap --->authdaemon --->LDAP
Squirrelmail --->courier
What is your users database method? (MySql,Ldap, userdb, /etc/passwd etc..)
You must configure authdaemon to comunicate with users backend.
regard
Christian Schmitz

Post by Tony Stocker
Hello,
I'm trying to set up SASL authentication, and can't seem to connect or

pass

Post by Tony Stocker
the correct credentials to the IMAP server. I can't find any IMAP logs
either to figure out if it's even seeing the connections.
I'm using Cyrus-SASL and Courier IMAP. Right now I'm just using the

Cyrus

Post by Tony Stocker
/usr/bin/sasl2-sample-client -s rcmd -p 15000 -m PLAIN 127.0.0.1
receiving capability list... recv: {11}
PLAIN LOGIN
PLAIN LOGIN
please enter an authorization id: tony.stocker
send: {5}
PLAIN
send: {1}
Y
send: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
authentication failed
closing connection
/usr/bin/sasl2-sample-server -s rcmd -p 15000
trying 10, 1, 6
trying 2, 1, 6
accepted new connection
send: {11}
PLAIN LOGIN
recv: {5}
PLAIN
recv: {1}
Y
recv: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
starting SASL negotiation: authentication failureclosing connection
[user= tony.stocker] [service=rcmd] [realm=] [mech=rimap] [reason=remote
server rejected your credentials]
Jul 14 16:58:24 mail sasl2-sample-server: Password verification failed
My IMAP server works great for checking mail and the like, so I know

that

Post by Tony Stocker
it works in general. I need to setup the SASL stuff to use the IMAP
database so that remote users can then use the mail server for SMTP
relaying after authenticating themselves. I'm using authuserdb as the

IMAP

Post by Tony Stocker
authentication method, so there is no other DBMS in the loop here. I

can

Post by Tony Stocker
use any mail client and the user id "tony.stocker" and password

"bbbbbbbb"

Post by Tony Stocker
to check my mail, so I know that the password is correct.
Any ideas?

--
En un mundo sin fronteras.... ¿Quién necesita Puertas y Ventanas?
EN INGLES: In a world without frontiers, who needs Gates and Windows
http://www.schdev.com.ar
http://gnc2.schdev.com.ar
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Courier-imap mailing list
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-imap

[Christian Schmitz]

Post by Tony Stocker
I think I do need SASL since I want to allow remote users, from
unknown/dynamic IP's, to be able to relay mail through the server AFTER
authenticating themselves with their IMAP password. At least the
guide/cookbook I"m using to set things up seems to indicate that SASL is
needed for this.

Yes, you need to enable to the users SEND mail. But when you send mail
courier-imap nothig have to do.

I have the same situation

Post by Tony Stocker
I'm using the userdb backend method rather than SQL or LDAP because while
my user base is mobile, it's fairly small so I don't want to introduce
another component into the mix if I don't have to. I'm not using the
system passwd file because I want the users to be virtual users in case
something snoops their password when they're on a remote location, all that
gets compromised is their mail folders rather than a user account on the
system.

Good idea, me too. but use LDAP (was the only tutorial that i can find)

Post by Tony Stocker
What I'm trying to do seems to be called "Relay-after-IMAP" by the
'cookbook' but it just assumes that things work and provides no guidance
for when the 'simple' tests don't work.

NO!, This method is deprecated, and is a security risk. Today in ALL MUA (OE,
tundebird, kmail) you can find some like "autentication to send".

Generally into the sending mail configuration box exist a checkbox "this
server require autentication"

Here the customer must write their data, for example:
User:***@doe.com
pass:john

Obviously is off topic, but here how i solved this.

into the postfix main.cf you must write some like

smtpd_helo_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
......
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
......
smtpd_sasl_auth_enable = yes
#this to force SSL, but you must generate the certificate
# (other long problem)
smtpd_tls_auth_only = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_application_name = smtpd
broken_sasl_auth_clients = yes
sasl_pwcheck_method = saslauthd

So you need
send mail postfix --->cyrusSASL --->userdb
read mail courier-imap --->authdaemon --->userdb
view mail Squirrelmail --->courier

I know has no sense having 2 authentication daemons (authdaemon and
cyrusSASL). But postfix cant talk with autdaemon. And Courier cant talk with
cyrusSASL.

Regards
Christian

Post by Tony Stocker
Thanks for the help,
Tony

Post by Christian Schmitz
What is your users database method? (MySql,Ldap, userdb, /etc/passwd etc..)
You must configure authdaemon to comunicate with users backend.
regard
Christian Schmitz

Post by Tony Stocker
Hello,
I'm trying to set up SASL authentication, and can't seem to connect or

pass

Post by Tony Stocker
the correct credentials to the IMAP server. I can't find any IMAP logs
either to figure out if it's even seeing the connections.
I'm using Cyrus-SASL and Courier IMAP. Right now I'm just using the

Cyrus

Post by Tony Stocker
/usr/bin/sasl2-sample-client -s rcmd -p 15000 -m PLAIN 127.0.0.1
receiving capability list... recv: {11}
PLAIN LOGIN
PLAIN LOGIN
please enter an authorization id: tony.stocker
send: {5}
PLAIN
send: {1}
Y
send: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
authentication failed
closing connection
/usr/bin/sasl2-sample-server -s rcmd -p 15000
trying 10, 1, 6
trying 2, 1, 6
accepted new connection
send: {11}
PLAIN LOGIN
recv: {5}
PLAIN
recv: {1}
Y
recv: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
starting SASL negotiation: authentication failureclosing connection
[user= tony.stocker] [service=rcmd] [realm=] [mech=rimap]
[reason=remote server rejected your credentials]
Jul 14 16:58:24 mail sasl2-sample-server: Password verification failed
My IMAP server works great for checking mail and the like, so I know

that

Post by Tony Stocker
it works in general. I need to setup the SASL stuff to use the IMAP
database so that remote users can then use the mail server for SMTP
relaying after authenticating themselves. I'm using authuserdb as the

IMAP

Post by Tony Stocker
authentication method, so there is no other DBMS in the loop here. I

can

Post by Tony Stocker
use any mail client and the user id "tony.stocker" and password

"bbbbbbbb"

Post by Tony Stocker
to check my mail, so I know that the password is correct.
Any ideas?

--
En un mundo sin fronteras.... ¿Quién necesita Puertas y Ventanas?
EN INGLES: In a world without frontiers, who needs Gates and Windows
http://www.schdev.com.ar
http://gnc2.schdev.com.ar
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Courier-imap mailing list
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-imap

[Tony Stocker]

Christian,

Okay, let me poke at this a bit more focusing on your suggestion and see if
I can make it work. I've already got that self-signed SSL thing worked out,
so that's not a big deal. Would it be all right if I contacted you directly
with any questions, since any further questions are a bit off-topic for the
IMAP list?

Thanks for the help!

Post by Christian Schmitz

Post by Tony Stocker
I think I do need SASL since I want to allow remote users, from
unknown/dynamic IP's, to be able to relay mail through the server AFTER
authenticating themselves with their IMAP password. At least the
guide/cookbook I"m using to set things up seems to indicate that SASL is
needed for this.

Yes, you need to enable to the users SEND mail. But when you send mail
courier-imap nothig have to do.
I have the same situation

Post by Tony Stocker
I'm using the userdb backend method rather than SQL or LDAP because

while

Post by Tony Stocker
my user base is mobile, it's fairly small so I don't want to introduce
another component into the mix if I don't have to. I'm not using the
system passwd file because I want the users to be virtual users in case
something snoops their password when they're on a remote location, all

that

Post by Tony Stocker
gets compromised is their mail folders rather than a user account on the
system.

Good idea, me too. but use LDAP (was the only tutorial that i can find)

Post by Tony Stocker
What I'm trying to do seems to be called "Relay-after-IMAP" by the
'cookbook' but it just assumes that things work and provides no guidance
for when the 'simple' tests don't work.

NO!, This method is deprecated, and is a security risk. Today in ALL MUA (OE,
tundebird, kmail) you can find some like "autentication to send".
Generally into the sending mail configuration box exist a checkbox "this
server require autentication"
pass:john
Obviously is off topic, but here how i solved this.
into the postfix main.cf you must write some like
smtpd_helo_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
......
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
......
smtpd_sasl_auth_enable = yes
#this to force SSL, but you must generate the certificate
# (other long problem)
smtpd_tls_auth_only = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_application_name = smtpd
broken_sasl_auth_clients = yes
sasl_pwcheck_method = saslauthd
So you need
send mail postfix --->cyrusSASL --->userdb
read mail courier-imap --->authdaemon --->userdb
view mail Squirrelmail --->courier
I know has no sense having 2 authentication daemons (authdaemon and
cyrusSASL). But postfix cant talk with autdaemon. And Courier cant talk with
cyrusSASL.
Regards
Christian

Post by Tony Stocker
Thanks for the help,
Tony

Post by Christian Schmitz
What is your users database method? (MySql,Ldap, userdb, /etc/passwd etc..)
You must configure authdaemon to comunicate with users backend.
regard
Christian Schmitz

Post by Tony Stocker
Hello,
I'm trying to set up SASL authentication, and can't seem to connect

or

Post by Tony Stocker

Post by Christian Schmitz
pass

Post by Tony Stocker
the correct credentials to the IMAP server. I can't find any IMAP

logs

Post by Tony Stocker

Post by Christian Schmitz

Post by Tony Stocker
either to figure out if it's even seeing the connections.
I'm using Cyrus-SASL and Courier IMAP. Right now I'm just using the

Cyrus

Post by Tony Stocker
/usr/bin/sasl2-sample-client -s rcmd -p 15000 -m PLAIN 127.0.0.1
receiving capability list... recv: {11}
PLAIN LOGIN
PLAIN LOGIN
please enter an authorization id: tony.stocker
send: {5}
PLAIN
send: {1}
Y
send: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
authentication failed
closing connection
/usr/bin/sasl2-sample-server -s rcmd -p 15000
trying 10, 1, 6
trying 2, 1, 6
accepted new connection
send: {11}
PLAIN LOGIN
recv: {5}
PLAIN
recv: {1}
Y
recv: {34}
tony.stocker[0]tony.stocker[0]bbbbbbbb
starting SASL negotiation: authentication failureclosing connection
Jul 14 16:58:24 mail saslauthd[1703]: do_auth : auth
[user= tony.stocker] [service=rcmd] [realm=] [mech=rimap]
[reason=remote server rejected your credentials]
Jul 14 16:58:24 mail sasl2-sample-server: Password verification

failed

Post by Tony Stocker

Post by Christian Schmitz

Post by Tony Stocker
My IMAP server works great for checking mail and the like, so I know

that

Post by Tony Stocker
it works in general. I need to setup the SASL stuff to use the IMAP
database so that remote users can then use the mail server for SMTP
relaying after authenticating themselves. I'm using authuserdb as

the

Post by Tony Stocker

Post by Christian Schmitz
IMAP

Post by Tony Stocker
authentication method, so there is no other DBMS in the loop

here. I

Post by Tony Stocker

Post by Christian Schmitz
can

Post by Tony Stocker
use any mail client and the user id "tony.stocker" and password

"bbbbbbbb"

Post by Tony Stocker
to check my mail, so I know that the password is correct.
Any ideas?

--
En un mundo sin fronteras.... ¿Quién necesita Puertas y Ventanas?
EN INGLES: In a world without frontiers, who needs Gates and Windows
http://www.schdev.com.ar
http://gnc2.schdev.com.ar

-------------------------------------------------------------------------

Post by Tony Stocker

Post by Christian Schmitz
Using Tomcat but need to do more? Need to support web services,

security?

Post by Tony Stocker

Post by Christian Schmitz
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo

http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

Post by Tony Stocker

Post by Christian Schmitz
_______________________________________________
Courier-imap mailing list
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-imap

--
En un mundo sin fronteras.... ¿Quién necesita Puertas y Ventanas?
EN INGLES: In a world without frontiers, who needs Gates and Windows
http://www.schdev.com.ar
http://gnc2.schdev.com.ar
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share
your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Courier-imap mailing list
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-imap

[Brian Candler]

Post by Tony Stocker
I think I do need SASL since I want to allow remote users, from
unknown/dynamic IP's, to be able to relay mail through the server
AFTER authenticating themselves with their IMAP password.

Then I think you're a bit confused.

* Sending outbound mail is done using SMTP, not IMAP.

* If you want to allow roaming users (i.e. on arbitary dynamic IP addresses)
to send outbound mail using SMTP via your server, then they need to
authenticate themselves somehow, because you don't want to be an open
relay.

Five years ago, the way you might have implemented this was to check for
a valid POP3 or IMAP login, and then enable relaying from that IP address
for a few minutes. You could implement this by scanning POP3/IMAP logs.

However, today you would not do this. Instead, you configure your SMTP
server to allow SMTP authentication (SMTP AUTH), and your mail client
to authenticate to the SMTP server when sending outbound mail. This
avoids having to frig with POP3/IMAP at all

So I suspect your cookbook is perhaps 5 or more years out of date.

* SASL is an authentication framework (RFC 2222). That is, when a protocol
like IMAP has been extended to support SASL, it's then possible to add
new SASL mechanisms without further modification to the protocol.

Common SASL mechansisms include 'PLAIN' (just send plaintext username
and password), and 'CRAM-MD5' (challenge-response authentication
mechanism; server sends a random challenge, and client responses with
a hash of challenge+password, to prove that they know the password
without sending the password in plaintext across the wire)

* Cyrus-SASL is a piece of software. It has nothing to do with the
courier suite. Courier has it's own implementation of SASL built in
and does not rely on any external software for this.

* The IMAP "AUTHENTICATE" command, and the SMTP "AUTH" command, both
implement SASL.

So essentially: you want your MTA (e.g. postfix) to accept SASL
authentication, authenticate against the same user data as courier-imap is
using, and to permit relaying for authenticated users.

Post by Tony Stocker
I'm using the userdb backend method rather than SQL or LDAP because
while my user base is mobile, it's fairly small so I don't want to
introduce another component into the mix if I don't have to.

That's fine.

If you want your MTA to authenticate against the same database, then either
you need to configure your MTA to lookup usernames/passwords in courier's
proprietary userdb format, or configure your MTA to send authentication
requests to courier's authdaemond using the authdaemond protocol.

Off-the-shelf solutions: you can configure exim to do either of those
options. You could also use the MTA from the full courier suite.

If you want to use postfix, I suspect you may need to take the userdb file
and reformat into a second file to suit the format which postfix requires
(but that's just a guess as I'm not a postfix user). Read the postfix
documentation for setting up SMTP AUTH.

Brian.