Lähettäjä: John Jetmore Päiväys: Vastaanottaja: Brian Spraker Kopio: exim-users@exim.org Aihe: Re: [exim] Plain Authentication Failures
On Tue, Sep 27, 2011 at 6:29 PM, Brian Spraker <spraker@???> wrote: > Hello all,
>
> Been struggling with a problem here. I am getting "535 incorrect authentication data" errors when folks attempt to use plain authentication.
>
> The odd thing is - I have users using Outlook and none of them appear to have the problems.
Outlook is likely using LOGIN while the others are using PLAIN. Just
guessing, but see below
> Here is my authenticators config:
>
> begin authenticators
>
> plain:
> driver = plaintext
> public_name = PLAIN
> server_prompts = :
> server_set_id = $auth2
> server_condition = ${lookup mysql{SELECT user_uid FROM horde_users WHERE user_uid ='${quote_mysql:$1}' AND user_pass ='${quote_mysql:$2}'}{1}fail}
> server_advertise_condition = true
>
> login:
> driver = plaintext
> public_name = LOGIN
> server_prompts = "Username:: : Password::"
> server_condition = ${lookup mysql{SELECT user_uid FROM horde_users WHERE user_uid="$1" AND user_pass="$2"}{1}fail}
> server_set_id = $1
> server_advertise_condition = false
PLAIN and LOGIN both use the same plaintext driver, but the vars are
different. In LOGIN the login creds are in $1 and $2 (although $auth1
and $auth2 are preferred now). In PLAIN, the creds are in $2 and $3
($auth2 and $auth3).
So, your LOGIN authenticator is correctly using $1 and $2. Your PLAIN
authenticator is incorrectly using $1 and $2. Try, in PLAIN, changing
the user_uid condition to $2 ($auth2) and the user_pass condition to
$3 ($auth3).
> Here is the error in the log:
>
> 2011-09-27 17:10:19 plain authenticator failed for android_5efb516d7ad14990.domain.com (localhost) [192.168.254.33]: 535 Incorrect authentication data (set_id=user@???)
Note that the error correctly references the user credential as
user@???, which you set to $auth2 in the PLAIN authenticator,
but in your query you're using $1.
Also, I don't have a ton of mysql/exim experience, but it sure looks
like your LOGIN authenticator is a potential attack vector. You
should look into wrapping the user inputs ($1 and $2) in ${quote_mysql
like PLAIN.