Hi all,
I am trying to compile the latest UW-IMAP with OpenSSL 0.9.8d, but the
compilation fails. However the compilation succeeds with any OpenSSL
version from the 0.9.7x branch. Here is the error produced:

# make slx SSLDIR=/usr/local/openssl098 SSLCERTS=/opt/certs/imap

.....

make[2]: Entering directory `/opt/packages/TARBALLS/imap-2004g/mtest'
`cat ../c-client/CCTYPE` -I../c-client `cat ../c-client/CFLAGS` -c -o
mtest.o mtest.c
`cat ../c-client/CCTYPE` -I../c-client `cat ../c-client/CFLAGS` -o
mtest mtest.o ../c-client/c-client.a `cat ../c-client/LDFLAGS`
.../c-client/c-client.a(osdep.o)(.text+0x643f): In function
`ssl_onceonlyinit':
/opt/packages/TARBALLS/imap-2004g/c-client/osdep.c:268: warning: the
use of `tmpnam' is dangerous, better use `mkstemp'
mtest.o(.text+0x2e0): In function `smtptest':
/opt/packages/TARBALLS/imap-2004g/mtest/mtest.c:767: warning: the
`gets' function is dangerous and should not be used.
/usr/local/openssl098/lib/libcrypto.a(dso_dlfcn.o)(.text+0x27d): In
function `dlfcn_bind_func':
: undefined reference to `dlsym'
/usr/local/openssl098/lib/libcrypto.a(dso_dlfcn.o)(.text+0x2f9): In
function `dlfcn_bind_func':
: undefined reference to `dlerror'
/usr/local/openssl098/lib/libcrypto.a(dso_dlfcn.o)(.text+0x36d): In
function `dlfcn_bind_var':
: undefined reference to `dlsym'
/usr/local/openssl098/lib/libcrypto.a(dso_dlfcn.o)(.text+0x3e1): In
function `dlfcn_bind_var':
: undefined reference to `dlerror'
/usr/local/openssl098/lib/libcrypto.a(dso_dlfcn.o)(.text+0x44c): In
function `dlfcn_unload':
: undefined reference to `dlclose'
/usr/local/openssl098/lib/libcrypto.a(dso_dlfcn.o)(.text+0x4f5): In
function `dlfcn_load':
: undefined reference to `dlopen'
/usr/local/openssl098/lib/libcrypto.a(dso_dlfcn.o)(.text+0x546): In
function `dlfcn_load':
: undefined reference to `dlclose'
/usr/local/openssl098/lib/libcrypto.a(dso_dlfcn.o)(.text+0x56f): In
function `dlfcn_load':
: undefined reference to `dlerror'

It isn't an incompatibility. Rather, it looks like OpenSSL 0.9.8d
requires the dl library. Try adding EXTRALDFLAGS=-ldl to your build.

That is, do a "make clean", then rebuild with:
make slx SSLDIR=/usr/local/openssl098 SSLCERTS=/opt/certs/imap EXTRALDFLAGS=-ldl

Also, is slx really the correct build for your system? Most modern Linux
systems use PAM authentication, and thus you should use (at least) lnp for
the build. The dl library *is* included already with lnp builds.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

> It isn't an incompatibility. Rather, it looks like OpenSSL 0.9.8d
> requires the dl library. Try adding EXTRALDFLAGS=-ldl to your build.
>
> That is, do a "make clean", then rebuild with:
> make slx SSLDIR=/usr/local/openssl098 SSLCERTS=/opt/certs/imap EXTRALDFLAGS=-ldl
>
> Also, is slx really the correct build for your system? Most modern Linux
> systems use PAM authentication, and thus you should use (at least) lnp for
> the build. The dl library *is* included already with lnp builds.

As you suggest, I tried building imap as 'lnp' instead of 'slx'. The
compilation finishes successfully, without having to include the extra
flags. But now my mail client is unable to authenticate (it says 'login
failure'). Does enabling PAM support require any special configuration
for the system as well?

grpprod writes:

>> It isn't an incompatibility. Rather, it looks like OpenSSL 0.9.8d
>> requires the dl library. Try adding EXTRALDFLAGS=-ldl to your build.
>>
>> That is, do a "make clean", then rebuild with:
>> make slx SSLDIR=/usr/local/openssl098 SSLCERTS=/opt/certs/imap EXTRALDFLAGS=-ldl
>>
>> Also, is slx really the correct build for your system? Most modern Linux
>> systems use PAM authentication, and thus you should use (at least) lnp for
>> the build. The dl library *is* included already with lnp builds.
>
> As you suggest, I tried building imap as 'lnp' instead of 'slx'. The
> compilation finishes successfully, without having to include the extra
> flags. But now my mail client is unable to authenticate (it says 'login
> failure'). Does enabling PAM support require any special configuration
> for the system as well?

Yes, you need to configure the imap and pop3 PAM service. See /etc/pam.d



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQBFJi1mx9p3GYHlUOIRAlIVAJ4w3BO1MauCzUoYWy96ZT +gU+YWFgCfcH69
KqEhEGuve9jZSExLcrdYh9c=
=YIRA
-----END PGP SIGNATURE-----

On Fri, 6 Oct 2006, grpprod wrote:
> As you suggest, I tried building imap as 'lnp' instead of 'slx'. The
> compilation finishes successfully, without having to include the extra
> flags. But now my mail client is unable to authenticate (it says 'login
> failure'). Does enabling PAM support require any special configuration
> for the system as well?

Yes. You need to define imap files in /etc/pam.d. I generally find that
if you don't know how to write a PAM configuration file, it works to copy
the FTP version, e.g., become root, then do
# cd /etc/pam.d
# cp ftpd imap
# cp ftpd pop
[If you're a member of the sudo church, do it the sudo way.]

Of course, it's better to learn what all that stuff in the PAM files mean,
and perhaps tune it for your system. But for busy people in a hurry,
copying this should work.

Note that the PAM file for FTP is called "ftpd", whereas for IMAP it is
called "imap" and for POP3 it is called "pop".

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

> Yes. You need to define imap files in /etc/pam.d. I generally find that
> if you don't know how to write a PAM configuration file, it works to copy
> the FTP version, e.g., become root, then do
> # cd /etc/pam.d
> # cp ftpd imap
> # cp ftpd pop
> [If you're a member of the sudo church, do it the sudo way.]
>
> Of course, it's better to learn what all that stuff in the PAM files mean,
> and perhaps tune it for your system. But for busy people in a hurry,
> copying this should work.
>
> Note that the PAM file for FTP is called "ftpd", whereas for IMAP it is
> called "imap" and for POP3 it is called "pop".

Thank you, I will examine all your suggestions. One more thing: How do
I enable imapd's TLS support? I use to run imapd/imapd via xinetd, but
it seems that only SSL in 993 is supported.

On Fri, 6 Oct 2006, grpprod wrote:
> Thank you, I will examine all your suggestions. One more thing: How do
> I enable imapd's TLS support? I use to run imapd/imapd via xinetd, but
> it seems that only SSL in 993 is supported.

TLS support is enabled automatically.

TLS does not use port 993 (or other SSL ports in other protocols). It
uses the STARTTLS command on the standard port.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

> TLS support is enabled automatically.
>
> TLS does not use port 993 (or other SSL ports in other protocols). It
> uses the STARTTLS command on the standard port.
>

I understand, besides I am already using STARTTLS in sendmail. However,
when I change my Thunderbird setting from SSL (993) to TLS (143) it
cannot connect to my server anymore. Perhaps a way to increase the log
level for imapd could . Any suggestion?

On Fri, 6 Oct 2006, grpprod wrote:
> I understand, besides I am already using STARTTLS in sendmail. However,
> when I change my Thunderbird setting from SSL (993) to TLS (143) it
> cannot connect to my server anymore. Perhaps a way to increase the log
> level for imapd could . Any suggestion?

Contact me offline from the newsgroup, and tell me the host name of your
server. I'll take a look from my end and tell you what's wrong.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.