Hello, Exim-Users,
I want to use LDAP for SMTP authentication.
The second box on
http://www.exim.org/exim-html-current/doc/html/spec_html/ch-the_plaintext_authenticator.html#SECID173
shows an example which I customized for my environment:
--> /etc/exim4/conf.d/auth/40_LDAP-auth
plain_server:
driver = plaintext
public_name = PLAIN
server_prompts = Username:: : Password::
server_condition = ${if and{{ \
!eq{}{$auth2} }{ \
ldapauth{\
user="uid=${quote_ldap_dn:$auth2},ou=Users,dc=BASE" \
pass=${quote:$auth3} \
ldap://ldap/} }} }
"ldap" is my LDAP server and 'telnet ldap 389' on mailserver
(192.168.1.4) shows that *there is no packet filter between*:
Mar 2 21:20:03 ldap slapd[9942]: conn=1113 fd=43 ACCEPT from
IP=192.168.1.4:60401 (IP=0.0.0.0:389)
Mar 2 21:21:25 ldap slapd[9942]: conn=1113 fd=43 closed (connection lost)
*When delivering to Exim with SMTP auth* I get this in Exim's logs:
2013-03-02 20:52:49 plain_server authenticator failed for <client>:
435 Unable to authenticate at present (set_id=paul): failed to bind the
LDAP connection to server ldap:389 - ldap_bind() returned -1 inside
"and{...}" condition
*The LDAP server does not see any incoming connection from mailserver.*
I tried removing "and{{" clause, that changed Exim's log entry:
2013-02-20 23:10:00 plain_server authenticator failed for <client>: 435
Unable to authenticate at present (set_id=paul): failed to bind the LDAP
connection to server ldap:389 - ldap_bind() returned -1
Also adding a return code in server_condition...
ldap://ldap/} }} {yes} {no} }
... did not help.
In the meantime I'm of the opinion that there must be something defect
in Exim's LDAP functionality...
Some additional information:
# exim -d -be '${if
ldapauth{user="uid=${quote_ldap_dn:paul},ou=Users,dc=BASIS"
pass=${quote:geheim} ldap://ldap/}}'
shows:
* with existing user and wrong password:
Mar 4 18:28:06 ldap slapd[9942]: conn=5292 fd=70 ACCEPT from
IP=192.168.1.4:37312 (IP=0.0.0.0:389)
Mar 4 18:28:06 ldap slapd[9942]: conn=5292 op=0 BIND
dn="uid=paul,ou=Users,dc=BASIS" method=128
Mar 4 18:28:06 ldap slapd[9942]: conn=5292 op=0 RESULT tag=97 err=49 text=
Mar 4 18:28:06 ldap slapd[9942]: conn=5292 op=1 UNBIND
Mar 4 18:28:06 ldap slapd[9942]: conn=5292 fd=70 closed
Exim version 4.80 uid=0 gid=0 pid=14864 D=fbb95cfd
Berkeley DB: Berkeley DB 5.1.29: (October 25, 2011)
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS
move_frozen_messages Content_Scanning DKIM Old_Demime
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm
dbmjz dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql
sqlite
Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram
redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Compiler: GCC [4.7.2]
Library version: GnuTLS: Compile: 2.12.20
Runtime: 2.12.20
Library version: Cyrus SASL: Compile: 2.1.25
Runtime: 2.1.25 [Cyrus SASL]
Library version: PCRE: Compile: 8.31
Runtime: 8.30 2012-02-04
Total 19 lookups
Library version: MySQL: Compile: 5.5.28 [(Debian)]
Runtime: 5.5.28
Library version: SQLite: Compile: 3.7.15.1
Runtime: 3.7.13
WHITELIST_D_MACROS: "OUTGOING"
TRUSTED_CONFIG_LIST: "/etc/exim4/trusted_configs"
changed uid/gid: -C, -D, -be or -bf forces real uid
uid=0 gid=0 pid=14864
auxiliary group list: 0
seeking password data for user "uucp": cache not available
getpwnam() succeeded uid=10 gid=10
changed uid/gid: calling tls_validate_require_cipher
uid=104 gid=106 pid=14865
auxiliary group list: 0
tls_validate_require_cipher child 14865 ended: status=0x0
configuration file is /var/lib/exim4/config.autogenerated
log selectors = 00000ffc 00612001
trusted user
admin user
seeking password data for user "mail": cache not available
getpwnam() succeeded uid=8 gid=8
user name "root" extracted from gecos field "root"
originator: uid=0 gid=0 login=root name=root
sender address = root@???
LDAP parameters: user=uid=paul,ou=Users,dc=BASIS pass=geheim size=0
time=0 connect=0 dereference=0 referrals=on
perform_ldap_search: ldapauth URL = "ldap://ldap/" server=NULL port=0
sizelimit=0 timelimit=0 tcplimit=0
after ldap_url_parse: host=ldap port=389
ldap_initialize with URL ldap://ldap:389/
initialized for LDAP (v3) server ldap:389
LDAP_OPT_X_TLS_TRY set
binding with user=uid=paul,ou=Users,dc=BASIS password=geheim
Invalid credentials: ldapauth returns FAIL
search_tidyup called
unbind LDAP connection to ldap:389
>>>>>>>>>>>>>>>> Exim pid=14864 terminating with rc=0 >>>>>>>>>>>>>>>>
* with existing user and right password:
Mar 4 18:29:48 ldap slapd[9942]: conn=5293 fd=70 ACCEPT from
IP=192.168.1.4:37313 (IP=0.0.0.0:389)
Mar 4 18:29:48 ldap slapd[9942]: conn=5293 op=0 BIND
dn="uid=paul,ou=Users,dc=BASIS" method=128
Mar 4 18:29:48 ldap slapd[9942]: conn=5293 op=0 BIND
dn="uid=paul,ou=Users,dc=BASIS" mech=SIMPLE ssf=0
Mar 4 18:29:48 ldap slapd[9942]: conn=5293 op=0 RESULT tag=97 err=0 text=
Mar 4 18:29:48 ldap slapd[9942]: conn=5293 op=1 UNBIND
Exim version 4.80 uid=0 gid=0 pid=14867 D=fbb95cfd
Berkeley DB: Berkeley DB 5.1.29: (October 25, 2011)
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS
move_frozen_messages Content_Scanning DKIM Old_Demime
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm
dbmjz dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql
sqlite
Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram
redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Compiler: GCC [4.7.2]
Library version: GnuTLS: Compile: 2.12.20
Runtime: 2.12.20
Library version: Cyrus SASL: Compile: 2.1.25
Runtime: 2.1.25 [Cyrus SASL]
Library version: PCRE: Compile: 8.31
Runtime: 8.30 2012-02-04
Total 19 lookups
Library version: MySQL: Compile: 5.5.28 [(Debian)]
Runtime: 5.5.28
Library version: SQLite: Compile: 3.7.15.1
Runtime: 3.7.13
WHITELIST_D_MACROS: "OUTGOING"
TRUSTED_CONFIG_LIST: "/etc/exim4/trusted_configs"
changed uid/gid: -C, -D, -be or -bf forces real uid
uid=0 gid=0 pid=14867
auxiliary group list: 0
seeking password data for user "uucp": cache not available
getpwnam() succeeded uid=10 gid=10
changed uid/gid: calling tls_validate_require_cipher
uid=104 gid=106 pid=14870
auxiliary group list: 0
tls_validate_require_cipher child 14870 ended: status=0x0
configuration file is /var/lib/exim4/config.autogenerated
log selectors = 00000ffc 00612001
trusted user
admin user
seeking password data for user "mail": cache not available
getpwnam() succeeded uid=8 gid=8
user name "root" extracted from gecos field "root"
originator: uid=0 gid=0 login=root name=root
sender address = root@???
LDAP parameters: user=uid=paul,ou=Users,dc=BASIS pass=<password> size=0
time=0 connect=0 dereference=0 referrals=on
perform_ldap_search: ldapauth URL = "ldap://ldap/" server=NULL port=0
sizelimit=0 timelimit=0 tcplimit=0
after ldap_url_parse: host=ldap port=389
ldap_initialize with URL ldap://ldap:389/
initialized for LDAP (v3) server ldap:389
LDAP_OPT_X_TLS_TRY set
binding with user=uid=paul,ou=Users,dc=BASIS password=<password>
Bind succeeded: ldapauth returns OK
true
search_tidyup called
unbind LDAP connection to ldap:389
>>>>>>>>>>>>>>>> Exim pid=14867 terminating with rc=0 >>>>>>>>>>>>>>>>
* as user Debian-exim it works, too:
Mar 4 18:38:41 ldap slapd[9942]: conn=5309 fd=70 ACCEPT from
IP=192.168.1.4:37333 (IP=0.0.0.0:389)
Mar 4 18:38:41 ldap slapd[9942]: conn=5309 op=0 BIND
dn="uid=paul,ou=Users,dc=BASIS" method=128
Mar 4 18:38:41 ldap slapd[9942]: conn=5309 op=0 BIND
dn="uid=paul,ou=Users,dc=BASIS" mech=SIMPLE ssf=0
Mar 4 18:38:41 ldap slapd[9942]: conn=5309 op=0 RESULT tag=97 err=0 text=
Mar 4 18:38:41 ldap slapd[9942]: conn=5309 op=1 UNBIND
Mar 4 18:38:41 ldap slapd[9942]: conn=5309 fd=70 closed
Exim version 4.80 uid=104 gid=106 pid=15501 D=fbb95cfd
Berkeley DB: Berkeley DB 5.1.29: (October 25, 2011)
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS
move_frozen_messages Content_Scanning DKIM Old_Demime
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm
dbmjz dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql
sqlite
Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram
redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Compiler: GCC [4.7.2]
Library version: GnuTLS: Compile: 2.12.20
Runtime: 2.12.20
Library version: Cyrus SASL: Compile: 2.1.25
Runtime: 2.1.25 [Cyrus SASL]
Library version: PCRE: Compile: 8.31
Runtime: 8.30 2012-02-04
Total 19 lookups
Library version: MySQL: Compile: 5.5.28 [(Debian)]
Runtime: 5.5.28
Library version: SQLite: Compile: 3.7.15.1
Runtime: 3.7.13
WHITELIST_D_MACROS: "OUTGOING"
TRUSTED_CONFIG_LIST: "/etc/exim4/trusted_configs"
changed uid/gid: -C, -D, -be or -bf forces real uid
uid=104 gid=106 pid=15501
auxiliary group list: 1 106 109
seeking password data for user "uucp": cache not available
getpwnam() succeeded uid=10 gid=10
tls_validate_require_cipher child 15502 ended: status=0x0
configuration file is /var/lib/exim4/config.autogenerated
log selectors = 00000ffc 00612001
LOG: MAIN PANIC
exim user lost privilege for using -D option
trusted user
admin user
seeking password data for user "mail": cache not available
getpwnam() succeeded uid=8 gid=8
user name "" extracted from gecos field ""
originator: uid=104 gid=106 login=Debian-exim name=
sender address = Debian-exim@???
LDAP parameters: user=uid=paul,ou=Users,dc=BASIS pass=<password> size=0
time=0 connect=0 dereference=0 referrals=on
perform_ldap_search: ldapauth URL = "ldap://ldap/" server=NULL port=0
sizelimit=0 timelimit=0 tcplimit=0
after ldap_url_parse: host=ldap port=389
ldap_initialize with URL ldap://ldap:389/
initialized for LDAP (v3) server ldap:389
LDAP_OPT_X_TLS_TRY set
binding with user=uid=paul,ou=Users,dc=BASIS password=<password>
Bind succeeded: ldapauth returns OK
true
search_tidyup called
unbind LDAP connection to ldap:389
>>>>>>>>>>>>>>>> Exim pid=15501 terminating with rc=0 >>>>>>>>>>>>>>>>
What's wrong with my Exim or my configuration?
Thanks for any help!
Greetings, Paul
