[Exim] SPA Authentication

Top Pagina
Delete this message
Reply to this message
Auteur: Dennis Skinner
Datum:  
Aan: exim-users
Onderwerp: [Exim] SPA Authentication
Hello all,

Having some fun setting up SPA authentication in exim. Here is what I
have in the authentcators section:

spa:
driver = spa
public_name = NTLM
server_advertise_condition = 1
server_password = ${lookup{$1}lsearch{/export/exim/etc/passwd}}
server_set_id = $1

The passwd file is user:password format. I setup Evolution to use SPA
and tested. The value that ends up in $1 is missing every other
character, so for "dskinner", $1 contains "dkne". If I double the
username in Evolution (ddsskkiinnnneerr), it works fine. This could be
a bug in Evolution. Not sure. Not huge deal since I'll just use cram
instead (which seems to work).

I ran next door and setup a windows box (outlook express 6) to test it
and it seems to be having issues with the challenge/response. Here is a
portion of the debug (+all) output:

23:14:44  8150 SMTP>> 250-mail.digitaldms.com Hello apu [205.232.78.57]
23:14:44  8150 250-SIZE 5242880
23:14:44  8150 250-PIPELINING
23:14:44  8150 250-AUTH NTLM
23:14:44  8150 250 HELP
23:14:44  8150 SMTP<< AUTH NTLM
23:14:44  8150 SMTP>> 334 NTLM supported
23:14:44  8150 SMTP>> 334
TlRMTVNTUAACAAAAAAAAAAAoAAABggAArMmNAZGiCq0AAAAAAAAAAAAAAAAAAAAA
23:14:44  8150 ---0 Get 0x8105ee0     8       expand.c 4021
23:14:44  8150 ---0 Rst 0x8105ee1    **       expand.c 4029 16400
23:14:44  8150 expanding: $1
23:14:44  8150    result:
23:14:44  8150 ---0 Get 0x8105ee8    40       string.c  349
23:14:44  8150 SMTP>> 535 Incorrect authentication data
23:14:44  8150 LOG: MAIN REJECT
23:14:44  8150   spa authenticator failed for (apu) [205.232.78.57]: 535
Incorrect authentication data


Not sure where to go with this. It seems that the challenge-response
failed since there is no attempt to lookup even a blank key. I noticed
Evolution puts part of the challenge-response on the same line as AUTH
NTLM, but windows does not. Not sure if that has any significance.

I think I saw that Philip was going to play with the auth code back in
August. Not sure if this is the same issue or a new bug. I am using
Exim 4.24/Exiscan-4.24/RedHat 9.

Any help is greatly appreciated. Thanks!

--
Dennis Skinner
Systems Administrator
BlueFrog Internet
http://www.bluefrog.com