No authentication error when replication attempted in automatic mode

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I've said before that I fixed the issue with authentication from
Master<->Replica in a basic two-host setup in a mysterious way. Funny
thing is that I've managed to successfully replicate from M to R and
vice versa, swapping the roles of the hosts as many times as I wanted.
Everything worked  as expected.

Then I set out to repeat this success on a set of two other machines,
and reached another dead end with a slightly different problem.

This message attempts to describe the issue that I'm battling with and
what has been tried thus far to win this fight :)

This is a basic two-host setup, host A is Master, host B is Replica.

When replication is attempted in automatic mode it fails.
Incidentally, it fails in manual mode too.

------------------- Replica
Jul 20 15:29:24 clone-machine-target syncserver[3630]: accepted connection
Jul 20 15:29:24 clone-machine-target syncserver[3630]: cmdloop(): startup
Jul 20 15:29:24 clone-machine-target syncserver[3630]: imapd:Loading
hard-coded DH parameters
Jul 20 15:29:24 clone-machine-target syncserver[3630]: SSL_accept()
incomplete -> wait
Jul 20 15:29:24 clone-machine-target syncserver[3630]: SSL_accept()
succeeded -> done
Jul 20 15:29:24 clone-machine-target syncserver[3630]: starttls: TLSv1
with cipher DHE-RSA-AES256-SHA (256/256 bits new) no authent
ication

------------------- Master
Jul 20 15:29:00 clone-machine sync_client[3638]: Doing a peer verify
Jul 20 15:29:00 clone-machine sync_client[3638]: verify
error:num=19:self signed certificate in certificate chain
Jul 20 15:29:00 clone-machine sync_client[3638]: received server certificate
Jul 20 15:29:00 clone-machine sync_client[3638]: starttls: TLSv1 with
cipher DHE-RSA-AES256-SHA (256/256 bits new client) no authen
tication
Jul 20 15:29:00 clone-machine sync_client[3638]: couldn't authenticate
to backend server: no mechanism available
Jul 20 15:29:00 clone-machine sync_client[3638]: Can not connect to
server '10.10.0.178'

The interesting fact is that I can successfully authenticate with
synctest from Master to Replica like this:

[root@clone-machine ~]# synctest -a cyrus -u cyrus -m plain -t ""
replica.localdomain
S: * SASL PLAIN LOGIN
S: * STARTTLS
S: * COMPRESS DEFLATE
S: * OK clone-machine-target Cyrus sync server v2.4.10-Kolab-2.4.10-1
C: STARTTLS
S: OK Begin TLS negotiation now
verify error:num=19:self signed certificate in certificate chain
TLS connection established: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
S: * SASL PLAIN LOGIN
S: * OK clone-machine-target Cyrus sync server v2.4.10-Kolab-2.4.10-1
Please enter your password:
C: AUTHENTICATE PLAIN Y3lydXMAY3lydXMAY3lydXNhZG1pbnJlcGxpY2E=
S: OK Success (tls protection)
Authenticated.
Security strength factor: 256

but /usr/lib/cyrus-imapd/sync_client -r fails to.



SITE CONFIGURATION


------------------- Master
[root@clone-machine ~]# cat /etc/imapd.conf
configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
sasl_mech_list: PLAIN
sasl_minimum_layer: 0
tls_cert_file: /etc/pki/cyrus-imapd/cyrus-imapd-my.pem
tls_key_file: /etc/pki/cyrus-imapd/cyrus-imapd-my.pem
tls_ca_file: /etc/pki/tls/certs/cacert.pem
guid_mode: sha1
delete_mode: immediate
sync_host: 10.10.0.178
sync_authname: cyrus
syncpassword: xxxxxxxxxxxxx
sync_log: 1
allowplaintext: 1
tcp_keepalive: 1

[root@clone-machine ~]# cat /etc/cyrus.conf |grep -v \#

START {
  recover	cmd="ctl_cyrusdb -r"

  idled		cmd="idled"

  syncclient    cmd="/usr/lib/cyrus-imapd/sync_client -r"
}

SERVICES {
  imap		cmd="imapd" listen="imap" prefork=5 provide_uuid=1
  imaps		cmd="imapd -s" listen="imaps" prefork=1 provide_uuid=1


  lmtpunix	cmd="lmtpd" listen="/var/lib/imap/socket/lmtp" prefork=1
provide_uuid=1

}

EVENTS {
  checkpoint	cmd="ctl_cyrusdb -c" period=30

  delprune	cmd="cyr_expire -D 7 -E 3 -X 7" at=0400

  tlsprune	cmd="tls_prune" at=0400
}



------------------- Replica
[root@clone-machine-target ~]# cat /etc/imapd.conf
configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
sasl_mech_list: PLAIN
tls_cert_file: /etc/pki/cyrus-imapd/cyrus-imapd-my.pem
tls_key_file: /etc/pki/cyrus-imapd/cyrus-imapd-my.pem
tls_ca_file: /etc/pki/tls/certs/cacert.pem
allowplaintext: 1
tcp_keepalive: 1

[root@clone-machine-target ~]# cat /etc/cyrus.conf |grep -v \#

START {
  recover	cmd="ctl_cyrusdb -r"

  idled		cmd="idled"

}

SERVICES {
  imap		cmd="imapd" listen="imap" prefork=5 provide_uuid=1
  imaps		cmd="imapd -s" listen="imaps" prefork=1 provide_uuid=1


  lmtpunix	cmd="lmtpd" listen="/var/lib/imap/socket/lmtp" prefork=1
provide_uuid=1


  syncserver       cmd="/usr/lib/cyrus-imapd/sync_server" listen="csync"
}

EVENTS {
  checkpoint	cmd="ctl_cyrusdb -c" period=30

  delprune	cmd="cyr_expire -D 7 -E 3 -X 7" at=0400

  tlsprune	cmd="tls_prune" at=0400
}

Using my own self-signed certificates and my own CA on both machines.
CN points to a hosts FQDNs defined in /etc/hosts as master.localdomain
and replica.localdomain.


PAM configuration:

[root@clone-machine ~]# cat /etc/pam.d/{csync,imap,lmtp}
#%PAM-1.0
auth       required     pam_nologin.so
auth       include      system-auth
account    include      system-auth
session    include      system-auth
#%PAM-1.0
auth       required     pam_nologin.so
auth       include      system-auth
account    include      system-auth
session    include      system-auth
#%PAM-1.0
auth       required     pam_nologin.so
auth       include      system-auth
account    include      system-auth
session    include      system-auth


selinux disabled
iptables disabled

I've tried the following options with no success and positive changes
in regard to replication:
- sasl_minimum_layer: 0
- syncserver       cmd="/usr/lib/cyrus-imapd/sync_server -p 1" listen="csync"
- removing sasl_mech_list completely while setting allowplaintext to false


SOFTWARE INSTALLED
[root@clone-machine ~]# yum list installed |grep cyrus
cyrus-imapd.x86_64                       2.4.10-1               installed
cyrus-imapd-debuginfo.x86_64             2.4.10-1               installed
cyrus-imapd-devel.x86_64                 2.4.10-1               installed
cyrus-imapd-perl.x86_64                  2.4.10-1               installed
cyrus-imapd-utils.x86_64                 2.4.10-1               installed
cyrus-sasl.x86_64                        2.1.22-4               installed
cyrus-sasl-devel.x86_64                  2.1.22-4               installed
cyrus-sasl-lib.x86_64                    2.1.22-4               installed
cyrus-sasl-plain.x86_64                  2.1.22-4               installed

using a Kolab SRPM for cyrus-imapd as divulged in synctest output. I
also tried Invoca SRPM (same tests only running Invoca build).

I'm hoping to get any help because I've spent most of the day reading
mailing list archives, trying to find at least a hint but nothing
seems to help. I need your fresh look at this whole setup people.

Thanks in advance for your time.
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/


[Index of Archives]     [Cyrus SASL]     [Squirrel Mail]     [Asterisk PBX]     [Video For Linux]     [Photo]     [Yosemite News]     [gtk]     [KDE]     [Gimp on Windows]     [Steve's Art]

  Powered by Linux