1

I have spent some time searching for this and it seems I'm the only one having problem with PAM not authenticating through mysql due to current updates so I thought I will post my problem here and if I find solution I will post here as well for others to follow.

In short - I'm running postfix with saslauthd and dovecot. Both are authenticating through pam employing mysql as credentials source.

Everything was working fine until today update - I can't connect to mail server any more and here is what I see in logs:

PAM unable to dlopen(/usr/lib/security/pam_mysql.so): /usr/lib/security/pam_mysql.so:     undefined symbol: make_scrambled_password
PAM adding faulty module: /usr/lib/security/pam_mysql.so
DEBUG: auth_pam: pam_authenticate failed: Module is unknown
do_auth         : auth failure: [user=xxxx] [service=smtp] [realm=xxxx] [mech=pam] [reason=PAM auth error]

So I may be wrong but to my understanding pam_mysql.so is using deprecated make_scrambled_password that is not supported by mysql any more.

I don't know what the solution would be and will appreciate if anybody can advice.

I checked source code on project page and can see deprecated function is being used. So this seems to be a bug in pam_mysql and update will be needed ([bug reported on pam_mysql sourceforge page][1] as well as on arch community bug tracker (https://bugs.archlinux.org/task/39083?project=5&pagenum=1))

I have seen some workaround patches around internet (https://lists.fedoraproject.org/pipermail/scm-commits/2011-June/613231.html) however I'm not sure if that's suitable for production environment. It seems I will have to patch it myself. I will post patch here for others to use.

Many thanks, Greg

Improve this question
2
  • Did you update your system? It seems one of the shared libraries that pam_mysql.so uses no longer has the symbol (aka function) "make_scrambled_password". Perhaps reverting to a previous version of that library will fix the problem. Or updating your pam_mysql.so to a newer version (preferable). If this is part of distro packages (and not hand-compiled) then all dependencies should match.
    – Friedrich 'Fred' Clausen
    Feb 27, 2014 at 10:42
  • Thanks Fred. It seems this is other way around - pam_mysql is using make_scrambled_password which was deprecated a while ago and was now ruled out from mysql. I raised bug report with pam_mysql developers (hopefully they are still around) so this can be patched at source.
    – Greg0ry
    Feb 27, 2014 at 11:03

1 Answer 1

Reset to default
0

Support for pam_mysql is now dropped due to project being dead for almost 6 years. Solution will be to migrate and use another pam backend.

I was using cyrus sasl - that was now uninstalled and replaced by dovecot that provides smtpd authentication backend recognized by postfix. I configured dovecot to use sql natively (without pam in the middle).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .