I'm currently setting up a new imap server to replace my old one.
Yesterday I had GSSAPI authentication running, today it ceased working.
I did quite some configuration in the meantime mostly on the LDAP
server, but nothing I'd readily associate with cyrus-imap authentication.
I appreciate any ideas for more systematic troubleshooting.
Regards,
- lars.
The setup:
KDC and LDAP is a sever called hel. The KDC uses LDAP as backend.
Cyrus-Imap (v2.2.13-Debian-2.2.13-14+b3) runs on hermod.
What worked yesterday:
kinit cyrus
imtest -v -u cyrus -a cyrus -p imap -r MGR hermod.mgr
cyradm --user cyrus --auth GSSAPI --server hermod.mgr
What still works today:
kinit cyrus
Diagnostics:
# kinit cyrus
hermod:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: cyrus@MGR
Valid starting Expires Service principal
01/02/09 16:41:41 01/03/09 02:41:41 krbtgt/MGR@MGR
renew until 01/03/09 16:41:41
Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached
hermod:~# imtest -v -u cyrus -a cyrus -p imap -r MGR hermod.mgr
S: * OK hermod.mgr Cyrus IMAP4 v2.2.13-Debian-2.2.13-14+b3 server ready
C: C01 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ NAMESPACE UIDPLUS ID NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT THREAD=ORDEREDSUBJECT THREAD=REFERENCES ANNOTATEMORE IDLE STARTTLS AUTH=GSSAPI AUTH=NTLM AUTH=DIGEST-MD5 AUTH=CRAM-MD5 SASL-IR
S: C01 OK Completed
Authentication failed. generic failure
Security strength factor: 0
C: Q01 LOGOUT
* BYE LOGOUT received
Q01 OK Completed
Connection closed.
hermod: /var/log/auth.log
Jan 2 17:07:54 hermod imtest: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Decrypt integrity check failed)
hel: /var/log/syslog
Jan 2 16:07:54 hel krb5kdc[1652]: TGS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.6.5: PROCESS_TGS: authtime 0, <unknown client> for imap/hermod.mgr@MGR, Decrypt integrity check failed
Jan 2 16:07:54 hel last message repeated 3 times
What I tried:
Since "Decrypt integrity check failed" means "wrong password" I recreated the principal "imap/hermod.mgr" and replaced the keytab file with the new key. I also removed the ldapdb auxprop, which I had installed in the meantime, but nothing helped.
If I remove the ticket for cyrus, I receive:
Jan 2 17:13:36 hermod imtest: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No credentials cache found)
as I would expect.
----
Cyrus Home Page: http://cyrusimap.web.cmu.edu/
Cyrus Wiki/FAQ: http://cyrusimap.web.cmu.edu/twiki
List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html
