Mailing List Archive: SMTP Authentication

SMTP Authentication

Jul 12, 2002, 4:31 AM

Post #1 of 5 (596 views)

--
I'm quite new at Exim, and I'm having a bit of trouble getting SMTP
authentication to work.

Here are the relevant bits of exim.conf:

host_auth_accept_relay = *

plain:
driver = plaintext
public_name = PLAIN
server_condition = "${if
crypteq{$2}{${extract{1}{:}{${lookup{$1}lsearch{/etc/exim/passwd}{$value}{*:*}}}}}{1}{0}}"
server_set_id = $1

I want it to work with most clients. I haven't done SMTP authentication
before so I don't really know which are the most common mechanisms..

My /etc/exim/passwd contains but a single line:
sha:foo

I'm not sure how to interpret that server_condition (as I said, I'm
quite new to exim). I can hardly even break it into parts. This is my
guess:
${lookup{$1}lsearch{/etc/exim/passwd}{$value}{*:*}}

lsearch can look through text files. lookup calls lsearch and tells it
to search for a key $1. My guess is that $1 expands to the username
supplied in the SMTP AUTH string by the client, correct?
If so, the password "foo" is returned to extract. Extract returns the
first field seperated by ":"'s, which in this case is "foo", right?
Now this is crypteq'ed to $2, which I'm guessing is the password from
SMTP AUTH. So far so good.. What is /etc/exim/passwd supposed to look
like to make this work? I can't seem to figure it out.

--
Søren Hansen Linuxkonsulent I/S
Open source specialist http://www.linuxkonsulent.dk
sha@linuxkonsulent.dk
--
Content-Description: Dette er en digitalt underskrevet brevdel

[ signature.asc of type application/pgp-signature deleted ]
--

Re: SMTP Authentication [ In reply to ]

masta at perlgolf

Jul 12, 2002, 4:40 AM

Post #2 of 5 (596 views)

Permalink

Søren Hansen wrote:
> --
> I'm quite new at Exim, and I'm having a bit of trouble getting SMTP
> authentication to work.
>
> Here are the relevant bits of exim.conf:
>
> host_auth_accept_relay = *
>
> plain:
> driver = plaintext
> public_name = PLAIN
> server_condition = "${if
> crypteq{$2}{${extract{1}{:}{${lookup{$1}lsearch{/etc/exim/passwd}{$value}{*:*}}}}}{1}{0}}"
> server_set_id = $1
>
> I want it to work with most clients. I haven't done SMTP authentication
> before so I don't really know which are the most common mechanisms..
>
> My /etc/exim/passwd contains but a single line:
> sha:foo
>
> I'm not sure how to interpret that server_condition (as I said, I'm
> quite new to exim). I can hardly even break it into parts. This is my
> guess:
> ${lookup{$1}lsearch{/etc/exim/passwd}{$value}{*:*}}
>
> lsearch can look through text files. lookup calls lsearch and tells it
> to search for a key $1. My guess is that $1 expands to the username
> supplied in the SMTP AUTH string by the client, correct?
> If so, the password "foo" is returned to extract. Extract returns the
> first field seperated by ":"'s, which in this case is "foo", right?
> Now this is crypteq'ed to $2, which I'm guessing is the password from
> SMTP AUTH. So far so good.. What is /etc/exim/passwd supposed to look
> like to make this work? I can't seem to figure it out.

Username:CryptedPassword
Username2:CryptedPassword2
....

Re: SMTP Authentication [ In reply to ]

lists at nospammail

Jul 12, 2002, 9:13 AM

Post #3 of 5 (588 views)

Permalink

* Søren Hansen [2002-07-12 13:31]:
> I'm quite new at Exim, and I'm having a bit of trouble getting SMTP
> authentication to work.
>
> Here are the relevant bits of exim.conf:
>
> host_auth_accept_relay = *
>
> plain:
> driver = plaintext
> public_name = PLAIN
> server_condition = "${if
> crypteq{$2}{${extract{1}{:}{${lookup{$1}lsearch{/etc/exim/passwd}{$value}{*:*}}}}}{1}{0}}"
> server_set_id = $1

Username is stored in $2 and password in $3 in your case, $1 blank no
matter what you supply as username. You want to rewrite server_condition
to reflect that.

--
Kirill

smtp authentication [ In reply to ]

mjs at blitz-technology

Jul 22, 2002, 5:07 PM

Post #4 of 5 (592 views)

Permalink

Hi list,

I am having a few problems getting smtp authentication working.

I am running exim-tls 3.35 on a Debian Linux 3.0 installation.

I am trying to authenticate from the /etc/shadow file via PAM.

My client is MS Outlook Express 6.

Here is the error I am getting in my exim logs when I try and authenticate.

2002-07-22 16:56:51 Authentication failed for
golax6-118.dialup.optusnet.com.au (titanium) [211.28.134.118]: 535 Incorrect
authentication data

This is what I have in my /etc/exim/exim.conf file

# SMTP Authentication
plain:
driver = plaintext
public_name = PLAIN
server_condition = "${if pam{$2:$3}{1}{0}}"
server_set_id = $2

login:
driver = plaintext
public_name = LOGIN
server_prompts = "Username:: : Password::"
server_condition = "${if pam{$1:$2}{1}{0}}"
server_set_id = $1

My /etc/pam.d/exim file is as follows.

# PAM configuration for exim
auth required pam_unix_auth.so shadow
account required pam_unix_acct.so

If I do a ldd on /usr/sbin/exim it has the pam lib compiled in.

Can anyone see anything obvious that I am not doing right in this setup?

Thanks

Re: smtp authentication [ In reply to ]

mb at dcs

Jul 23, 2002, 1:10 AM

Post #5 of 5 (595 views)

Permalink

At 10:07 +1000 Mitchell Smith wrote:

>I am trying to authenticate from the /etc/shadow file via PAM.
[snip]
>Here is the error I am getting in my exim logs when I try and authenticate.
>
>2002-07-22 16:56:51 Authentication failed for
>golax6-118.dialup.optusnet.com.au (titanium) [211.28.134.118]: 535 Incorrect
>authentication data
>
>This is what I have in my /etc/exim/exim.conf file
>
># SMTP Authentication
> plain:
> driver = plaintext
> public_name = PLAIN
> server_condition = "${if pam{$2:$3}{1}{0}}"
> server_set_id = $2

Two things:

1. Try ${if pam{$2:${sg{$3}{:}{::}}}{1}{0}}

(if this works we know you've got a ":" in your password ;)

>My /etc/pam.d/exim file is as follows.
>
># PAM configuration for exim
>auth required pam_unix_auth.so shadow
>account required pam_unix_acct.so

Ahh.. are you using shadow passwords, which Exim can't read as it's not
running as root?

Someone made a pam_exim module (google for it), which might help, or (if
you're feeling nice and insecure or just want to prove this is what bit
you) you could stick the exim (or mail or whatever Debian call it) user a
member of a group which can read /etc/shadow.

Any good?

Matt