My setup is mildly complex. I am using openldap in conjunction with passwd files for authentication. The OS is a mostly fresh FreeBSD 5.3. For this set of tests I have two users, bvanzant and bvantest. bvanzant is in the passwd file and bvantest is in the LDAP directory. Both users can login via ssh without any problems.

bvanzant can login via IMAP without any problems.
bvantest cannot:

* OK Welcome to Binc IMAP Copyright (C) 2002-2004 Andreas Aardal Hanssen at 2005-02-01 23:35:57 PST
a001 login bvantest password
* BYE The server died unexpectedly. Please contact your system administrator for more information.


I am using checkpassword-pam as some sort of a last ditch effort to make using pam easier. I saw checkpassword-ldap in the archives from last month but it's not what I'm looking to do. Pam should be doing the dirty work for me.

Here is checkpassword-pam working for bvantest:

bash-3.00# echo -e "bvantest\0password\0`date`\0" | checkpassword-pam -s imap --debug --stdout -- /usr/bin/id 3<&0

Reading username and password
Username 'bvantest'
Password read successfully
Initializing PAM library using service name 'imap'
PAM library initialization succeeded
conversation(): msg[0], style PAM_PROMPT_ECHO_OFF, msg = "Password: "
Authentication passed
Account management succeeded
Setting PAM credentials succeeded
PAM session opened
PAM session closed
Terminating PAM library
Executing /usr/bin/id
uid=5001 gid=5001 groups=5001

bash-3.00# echo $? 0

After running checkpassword-pam this is in the auth.log:
Feb 2 00:09:22 outside imap[14261]: pam_ldap: error trying to bind as user "cn=Bob Van Test,ou=people,dc=tacomaterritory,dc=com" (Invalid credentials)


checkpassword returns ok so I'm ignoring that at this point.

How can I tell what exactly "unexpectedly" is? The system administrator is stumped ;-) Unfortunately the bincimap log has absolutely nothing useful in it and neither does auth.log.

-Bob

Reply via email to