Dear All,

I'm trying to set SMTP-AUTH for sendmail using DIGEST M5 and CRAM M5
but authentication fails.

Here is a description :

Current configuration of the system:
------------------------------------------------------------------
1) OS
Red Hat Enterprise Linux AS release 4 (Nahant Update 4)

2) SASL
cyrus-sasl-2.1.19-5.EL4
cyrus-sasl-md5-2.1.19-5.EL4

3) SENDMAIL
sendmail-8.13.1-3.RHEL4.5
sendmail-cf-8.13.1-3.RHEL4.5

4) /etc/mail/sendmail.mc
....
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5
LOGIN PLAIN')dnl
....

5) /usr/lib/sasl2/Sendmail.conf
pwcheck_method:auxprop

Note:
Here is one of my confusion:
The original content of this file was "pwcheck_method:saslauthd",
but I changed it
to "pwcheck_method:auxprop" and restarted sendmail. As I read,
this file is used only during
sendmail installation(compiling), so I doubt my change would
really change sendmail
behaviour even I restart it.
Please comment.

6) /etc/sasldb2
- permission: 640
- owner: root:root
- Created a user with "saslpasswd2 -c -u <domain> <userid>" and
enter the passwd


Problem Description
-------------------------------
I tested this config:

telnet localhost 25
....
ehlo localhost
....
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH DIGEST-MD5 CRAM-MD5
250-DELIVERBY
250
auth digest-md5
334
bm9uY2U9InMyWjdvaWZtd05DVlgrSXF3czZPNmZPWEprMHRwWU 1kcTd2MHdCZ1pra009IixyZWFsbT0id2QyMDExLnVzLm9yYWNs ZS5jb20iLHFvcD0iYXV0aCxhdXRoLWludCxhdXRoLWNvbmYiLG NpcGhlcj0icmM0LTQwLHJjNC01NixyYzQsZGVzLDNkZXMiLG1h eGJ1Zj04MTkyLGNoYXJzZXQ9dXRmLTgsYWxnb3JpdGhtPW1kNS 1zZXNz

- To prepare the response for "auth digest-md5" , I ran
"printf '<userid>\0<userid>\0<passwd>' | mmencode"
The userid is the one I passed to "saslpasswd2" command. Then, I
entered the string, but the authentication failed:

c2llYmVsAHNpZWJsZQB3ZWxjb21lMQ==
535 5.7.0 authentication failed

I checked /var/log/maillog and here is the message:
....
sendmail[31261]: l0PNm9aQ031261: AUTH failure (digest-md5):
authentication failure (-13) SASL(-13): authentication failure:
required parameters missing
....

I was unable to find a solution to this problem so far; please me!


Thank you in advance,
Silviu

ss wrote:
> Dear All,
>
> I'm trying to set SMTP-AUTH for sendmail using DIGEST M5 and CRAM M5
> but authentication fails.
>
> Here is a description :
>
> Current configuration of the system:
> ------------------------------------------------------------------
> 1) OS
> Red Hat Enterprise Linux AS release 4 (Nahant Update 4)
>
> 2) SASL
> cyrus-sasl-2.1.19-5.EL4
> cyrus-sasl-md5-2.1.19-5.EL4
>
> 3) SENDMAIL
> sendmail-8.13.1-3.RHEL4.5
> sendmail-cf-8.13.1-3.RHEL4.5
>
> 4) /etc/mail/sendmail.mc
> ...
> define(`confAUTH_OPTIONS', `A p')dnl
> TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
> define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5
> LOGIN PLAIN')dnl
> ...
>
> 5) /usr/lib/sasl2/Sendmail.conf
> pwcheck_method:auxprop
>
> Note:
> Here is one of my confusion:
> The original content of this file was "pwcheck_method:saslauthd",
> but I changed it
> to "pwcheck_method:auxprop" and restarted sendmail. As I read,
> this file is used only during
> sendmail installation(compiling), so I doubt my change would
> really change sendmail
> behaviour even I restart it.
> Please comment.
>
> 6) /etc/sasldb2
> - permission: 640
> - owner: root:root
> - Created a user with "saslpasswd2 -c -u <domain> <userid>" and
> enter the passwd
>
>
> Problem Description
> -------------------------------
> I tested this config:
>
> telnet localhost 25
> ...
> ehlo localhost
> ...
> 250-ENHANCEDSTATUSCODES
> 250-PIPELINING
> 250-8BITMIME
> 250-SIZE
> 250-DSN
> 250-ETRN
> 250-AUTH DIGEST-MD5 CRAM-MD5
> 250-DELIVERBY
> 250
> auth digest-md5
> 334
> bm9uY2U9InMyWjdvaWZtd05DVlgrSXF3czZPNmZPWEprMHRwWU 1kcTd2MHdCZ1pra009IixyZWFsbT0id2QyMDExLnVzLm9yYWNs ZS5jb20iLHFvcD0iYXV0aCxhdXRoLWludCxhdXRoLWNvbmYiLG NpcGhlcj0icmM0LTQwLHJjNC01NixyYzQsZGVzLDNkZXMiLG1h eGJ1Zj04MTkyLGNoYXJzZXQ9dXRmLTgsYWxnb3JpdGhtPW1kNS 1zZXNz
>
> - To prepare the response for "auth digest-md5" , I ran
> "printf '<userid>\0<userid>\0<passwd>' | mmencode"

This is a response suitable for teh PLAIN mechanism, but its not even
close to a valid DIGEST-MD5 response.

If you want to do this by hand, its going to be difficult and you'll
need to reaf RFC2831.

You'd be better off compiling the smtptest utility that comes with Cyrus
SASL.


> The userid is the one I passed to "saslpasswd2" command. Then, I
> entered the string, but the authentication failed:
>
> c2llYmVsAHNpZWJsZQB3ZWxjb21lMQ==
> 535 5.7.0 authentication failed
>
> I checked /var/log/maillog and here is the message:
> ...
> sendmail[31261]: l0PNm9aQ031261: AUTH failure (digest-md5):
> authentication failure (-13) SASL(-13): authentication failure:
> required parameters missing
> ...
>
> I was unable to find a solution to this problem so far; please me!
>
>
> Thank you in advance,
> Silviu
>


--
Kenneth Murchison
Systems Programmer
Project Cyrus Developer/Maintainer
Carnegie Mellon University

Thank you!
I'll give it a try.