Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

SASL/PAM/LDAP is driving me crazy... that's what I read a lot when googling for problems in this area, and what I experience myself :-S I'm trying to get Cyrus imap working for virtual hosting on CentOS with this authorisation backend and really don't know what's happening. In saslauthd I configured the LDAP search filter to use, but it looks like pam completely ignores it.

Here's what I do for testing (done more tests but all with similar results):

[root@testserv ~]# imtest -u my.Email@testserv.mydomain.com -a my.Email@testserv.mydomain.com
WARNING: no hostname supplied, assuming localhost

S: * OK [CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS] testserv. Cyrus IMAP4 v2.3.7-Invoca-RPM-2.3.7-7.el5_6.4 server ready
S: C01 OK Completed
Please enter your password: 
C: L01 LOGIN my.Email@testserv.mydomain.com {6}
S: + go ahead
C: <omitted>
S: L01 NO Login failed: authentication failure
Authentication failed. generic failure
Security strength factor: 0
* BYE LOGOUT received
Q01 OK Completed
Connection closed.

The LDAP entry does exist (and so does the mailbox in Cyrus):

[root@testserv ~]# ldapsearch -WxD cn=Manager,o=mydomain,c=com mail=my.Email@testserv.mydomain.com
Enter LDAP Password: 
# extended LDIF
# LDAPv3
# base <> with scope subtree
# filter: mail=my.Email@testserv.mydomain.com
# requesting: ALL

# myuser, accounts, testserv.mydomain.com, mydomain, com
dn: uid=myuser,ou=accounts,dc=testserv.mydomain.com,o=mydomain,c=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uidNumber: 16
uid: myuser
gidNumber: 5
givenName: My
sn: Name
mail: my.Email@testserv.mydomain.com
cn: My Name
userPassword:: dYN5ebB0fXhNRn1pZllhRnJX7Uk=
shadowLastChange: 15176
homeDirectory: /dev/null

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

This is what I get in /var/log/messages

Aug  2 04:00:11 testserv cyrus/imap[12514]: auxpropfunc error invalid parameter supplied 
Aug  2 04:00:19 testserv saslauthd[5926]: do_auth         : auth failure: [user=my.email@testserv.mydomain.com] [service=imap] [realm=testserv.mydomain.com] [mech=pam] [reason=PAM auth error]

... /var/adm/auth.log

Aug  2 04:00:11 testserv cyrus/imap[12514]: auxpropfunc error invalid parameter supplied 
Aug  2 04:00:11 testserv cyrus/imap[12514]: _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: ldapdb 
Aug  2 04:00:19 testserv saslauthd[5926]: DEBUG: auth_pam: pam_authenticate failed: User not known to the underlying authentication module
Aug  2 04:00:19 testserv saslauthd[5926]: do_auth         : auth failure: [user=my.email@testserv.mydomain.com] [service=imap] [realm=testserv.mydomain.com] [mech=pam] [reason=PAM auth error]

(AFAIK I can ignore the auxprop msg)

... and /var/log/slapd.log:

Aug  2 04:00:19 testserv slapd[5968]: conn=61 fd=27 ACCEPT from IP= (IP= 
Aug  2 04:00:19 testserv slapd[5968]: conn=61 op=0 BIND dn="" method=128 
Aug  2 04:00:19 testserv slapd[5968]: conn=61 op=0 RESULT tag=97 err=0 text= 
Aug  2 04:00:19 testserv slapd[5968]: conn=61 op=1 SRCH base="o=mydomain,c=com" scope=2 deref=0 filter="(mail=my.Email@testserv.mydomain.com)" 
Aug  2 04:00:19 testserv slapd[5968]: conn=61 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= 
Aug  2 04:00:19 testserv slapd[5968]: conn=61 op=2 UNBIND 
Aug  2 04:00:19 testserv slapd[5968]: conn=61 fd=27 closed 

These are the settings in In /etc/imapd.conf:

sasl_mech_list: PLAIN LOGIN
sasl_pwcheck_method: saslauthd
## sasl_auxprop_plugin: sasldb
sasl_auto_transition: no

and my sasl config:

[root@testserv ~]# cat /etc/sysconfig/saslauthd 
# Directory in which to place saslauthd's listening socket, pid file, and so
# on.  This directory must already exist.

# Mechanism to use when checking passwords.  Run "saslauthd -v" to get a list
# of which mechanism your installation was compiled with the ablity to use.

# Additional flags to pass to saslauthd on the command line.  See saslauthd(8)
# for the list of accepted flags.
FLAGS="-c -r -O /etc/saslauthd.conf"

[root@testserv ~]# cat /etc/saslauthd.conf
ldap_servers: ldap://
ldap_search_base: dc=%d,o=mydomain,c=com
ldap_auth_method: bind 
#ldap_filter: (|(uid=%u)((&(mail=%u@%d)(accountStatus=active))) 
ldap_filter: (&(mail=%u@%d)(accountStatus=active)) 
ldap_debug: 1 
ldap_version: 3

The accountStatus=active is not in ldap yet, but that doesn't make a difference since I don't see it in the filter... that's not the reason for the failure. The weird thing is, I do get an error when I rename or remove /etc/saslauthd.conf, but when the file exists it seems happily ignored...

The filter in slapd.log seems to be taken from /etc/ldap.conf. Apart from some timers, that only contains:

base o=mydomain,c=com
pam_login_attribute mail

Outcommenting the pam_login_attribute results in this filter in slapd.log:


Pam-imap looks like this:

[root@testserv ~]# cat /etc/pam.d/imap 
auth       required    pam_ldap.so debug
account       required    pam_ldap.so debug

#auth       sufficient   pam_unix.so likeauth nullok
#auth       sufficient  pam_ldap.so use_first_pass
#auth       required     pam_deny.so
#account    sufficient   pam_unix.so
#account    sufficient   pam_ldap.so

The outcommented stuff is because I don't have the cyrus admin user in Ldap; that's a Linux user. That works fine when uncommented, but I still need to play around with that a little and first I wanna get imap working.

Finally nsswitch:

[root@testserv ~]# cat /etc/nsswitch.conf 
# /etc/nsswitch.conf
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
# Legal entries are:
#       nisplus or nis+         Use NIS+ (NIS version 3)
#       nis or yp               Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       db                      Use the local database (.db) files
#       compat                  Use NIS on compat mode
#       hesiod                  Use Hesiod for user lookups
#       [NOTFOUND=return]       Stop searching if not found so far

# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
# Example:
#passwd:    db files nisplus nis
#shadow:    db files nisplus nis
#group:     db files nisplus nis

passwd: compat ldap
group:  compat ldap
shadow: compat ldap

hosts:      files dns

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files

netgroup:   nisplus

publickey:  nisplus

automount:  files nisplus
aliases:    files nisplus

Any info where to start looking will be greatly appreciated!

Thnx in advance

share|improve this question

2 Answers 2

Encountered similar problem with CentOS 5.8 today after upgrading some packages including openldap, nss, kernel, etc. In my case pam do not even connect to LDAP server. Did not discovered reasons yet. But found a workaround - told saslauthd to connect directly to LDAP, not via PAM, by changing MECH=pam to MECH=ldap in /etc/sysconfig/saslauthd.

share|improve this answer

From your slapd.log: the session with the directory server uses "" as the bind DN, and the search returned zero entries. Are you sure that the entry exists? Are you sure that a zero-length DN is what you want to use for the bind? Can you search for the entry and get it returned by using ldapsearch (the ldapsearch you used to display the entry did not use a zero-length bind DN)? For example:

ldapsearch -x -b o=mydomain,c=com -s sub '(mail=my.Email@testserv.mydomain.com)'

By the way, and this has nothing to do with your problem, you should not use the c (countryName) attribute with a three letter code. The c or countryName attribute is a two letter country code from ISO3166. As I say, it has nothing to do with your problem, although some modern directory servers will (correctly) reject a three-letter country code.

share|improve this answer
Thanks for your response! A zero-length DN is indeed not what I want, but I don't understand why it's empty..> I tried adding ldap_bind_dn: cn=Manager,o=mydomain,c=com to saslauthd.conf, but it remains empty. BTW: on the actual server, the c = nl; I just changed the server and domain names for this post ;) –  Oscar Aug 3 '11 at 11:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.