0

I'm trying to use the pam_mysql module in conjunction with postfix and saslauthd. Everything appears to be working, except the actual password comparison is failing.

Note: the case being tested is SMTPD authentication for submission.

I've built and instrumented a debug copy of pam_mysql. It turns out that the password being handed to pam_mysql_check_passwd() has a EOL (i.e., (char)10) tacked on the end..., thus the password comparison fails.

I've implemented a simple-minded fix that appears to work..., simply stripping the EOL if present.

Firstly, I don't know if this is a truly correct solution, since there are several layers above pam_mysql in the stack that could be the culprits, but at the same time, I'm really burned out from debugging postfix, saslauthd et al.

Does this problem ring a bell for anyone? I just hate to maintain my own copy of pam_mysql..., especially since I haven't actually done any significant C dev in probably 20 years, and just ain't feeling super sure of myself.

This is my first post to serverfault..., so apologies and thanks beforehand.

3
  • OK..., a little more info: I was debugging with STARTTLS disabled. When STARTTLS is enabled, the EOL goes away and the stock pam_mysql module works fine. So..., the bug is limited to the non-STARTTLS case..., which probably isn't a bad thing... ;) Nov 1, 2019 at 0:48
  • Why using this compound path, postfix with cyrus_sasl can access mysql directly without pam and without saslauthd. And proxymap also works well here. I can describe setup in answer, if you wish. Nov 1, 2019 at 6:11
  • I needed a solution that allowed all the various components to use a common, encrypted/hashed form of the password. Auxprop was off the table since it required cleartext passwords. I'd be very interested in anything that got rid of saslauthd but that worked with postfix/postfixadmin/courier. Not sure it matters wrt your solution, but this is also a multi domain installation. Thx! Nov 3, 2019 at 21:40

0

You must log in to answer this question.

Browse other questions tagged .