1

There are numerous instructions over the internet to use saslauthd. I've tried to run the service. It gave me a surprise when I discovered that /run/saslauthd/mux socket and /usr/sbin/testsaslauthd are both available for non-privileged users. So when you have saslauthd started, it makes your system vulnerable.

What is the supposed way to restrict brute force? I've tried to google it, but google shows only SMTP and IMAP stuff, not saslauthd vulnerability itself.

1 Answer 1

1

/run/saslauthd/mux socket and /usr/sbin/testsaslauthd are both available for non-privileged users.

Yes, because typically some of the services that use SASL to authenticate can also run as non-privileged users.

So when you have saslauthd started, it makes your system vulnerable.

That is quite a leap.

The saslauthd service can only be used by local users and processes, it is not a network service open to online brute force attempts. You don't really secure such a service against brute-force attempts at the service level, just like you don't secure the su command against brute-force attempts.

As you already hint at what you could do:

  • don't give access to your systems to users that can't be trusted and simply secure the actual network service(s) that call on SASL against brute-force attacks for instance by blocking the remote offenders there (fail2ban is one such implementation)
  • alternatively, since saslauthd is only a gateway to the actual authentication backend, log failed login attempts at the account level and (temporarily) lock the account after a number of failed login attempts on that specific account.
2
  • If you check /etc/shadow permissions you would see that it is available to root only. And if I establish saslauthd service, it is effectively like make /etc/shadow visible to all users. Local computer should be trusted as little as possible. Especially in the case it is your desktop computer and some programs withdraw PAM support in favour of SASL. So you should use saslauthd as transport between this particular program and PAM
    – ayvango
    Sep 30, 2016 at 9:45
  • Are you implying that salsauthd will return any local user the hashed passwords?
    – HBruijn
    Sep 30, 2016 at 9:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .