Re: Cyradm saslauthd issue

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On 04/12/20 11:29 +0000, David Faller wrote:
I have a question of my configuration,
we’re using multiple domains and the users are stored on our samba ad dc server.

In past I wanted to prevent the issue, that user can login with their username and not with a fqdn mail address.

I had solved this issue by editing the /etc/default/saslauthd service file and added ‚-r‘  at options in the end:

# Settings for saslauthd daemon
DESC="SASL Authentication Daemon"
OPTIONS="-r -c -m /var/run/saslauthd"

My saslauthd.config file here use an other filter than default one:

ldap_servers: ldap://XXXXX
ldap_search_base: dc= XXX,dc=dir
#ldap_filter: sAMAccountName=%U
ldap_filter: userPrincipalName=%u

#ldap_version: 3
ldap_auth_method: bind
ldap_bind_dn: cn=Administrator,cn=Users,dc=XXX,dc=dir
ldap_bind_pw: XXX
#ldap_scope: sub
ldap_debug: -1

Here I have problem this config works fine all users can only sign in with their full e-mail address

So max.murry@xxxxxx can login AND Max.murry can’t login.

This is working fine,

but when I want to use cyradm I need to switch the filter on /etc/saslauthd.conf to sAMAccountName=%U
If I don’t do this I can’t access the cyradm tool, perhaps someone could help here?
I think the problem is here the same, authentication are only allowed with a fqdn but the linux user cyrus has no domain ending.

Hi David,

What error do you get when you attempt to login as the cyrus user? Try
adding 'cyrus@<domain>' to your admins entry in impad.conf. Depending on
your deployment, that may not be sufficient for administering all of your
domains. You may need a unique cyrus@<domain> account for each domain, with
each entry listed within an admins config line.

Since your problem is only with cyradm, consider running a second imapd
instance, using local sasldb authentication to, support cyradm, i.e.:

Within /etc/cyrus.conf:
  imap          cmd="imapd" listen="" prefork=0
  imaplocal     cmd="imapd" listen="" prefork=0

Then within /etc/imapd.conf, carve out a unique sasl pwcheck method for

imaplocal_sasl_pwcheck_method: auxprop
imaplocal_sasl_auxprop_plugin: sasldb
#imaplocal_sasl_mech_list: PLAIN

Then you would maintain the cyrus user's password with saslpasswd2.

Dan White
Network Admin Lead

[Index of Archives]     [Info Cyrus]     [Squirrel Mail]     [Linux Media]     [Yosemite News]     [gtk]     [KDE]     [Gimp on Windows]     [Steve's Art]

  Powered by Linux