Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread N0K



On Monday 06 February 2006 08:45, Tom Collins wrote:
 


On Feb 6, 2006, at 4:14 AM, N0K wrote:
   


  I have using vpopmail-5.4.13, qmail + smtp-auth
(http://members.elysium.pl/brush/qmail-smtpd-auth/dist/qmail-smtpd-
auth-0.31.tar.gz).

  Do i need to patch vchkpw or any similar things ?
 


You're using an outdated SMTP AUTH patch.  Try the one included in
vpopmail's contrib directory.

But, that reminds me, I could update vchkpw to try swapping the
challenge and response parameter order (the underlying problem) if the
correct way fails.  This would allow it to continue working with the
old patches that passed them in the wrong order.
   



my two cents:
the old patch should die.  it's really, really, really bad.  Leave vchkpw how 
it is :)


-Jeremy

 

Hello, and thanks for the reply, i have quit smtp auth old patch and i 
have patched with vpopmail/contrib patch, but now, i get the next error:


tsuki:/var/qmail/supervise# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 tsuki.fujitsu.es ESMTP
ehlo tsuki.fujitsu.es
250-tsuki.fujitsu.es
250-PIPELINING
250-8BITMIME
250-SIZE 0
250 AUTH LOGIN PLAIN CRAM-MD5
AUTH LOGIN
334 VXNlcm5hbWU6
YnJvZHJpasffZ3sVlemJAZnVqaXRzdS5l - username in base64
334 UGFzc3dvcmQ6
MTIzMDhA - pass in base64
454 oops, unable to write pipe and I can't auth (#4.3.0)

Im going to past my qmail-smtpd/run too:

tsuki:/var/qmail/supervise# cat qmail-smtpd/run
#!/bin/sh

QMAILDUID=`id -u qmaild`

NOFILESGID=`id -g qmaild`

MAXSMTPD=`cat /var/qmail/control/concurrencyincoming` (this is 20)



exec /usr/bin/softlimit -m 400 /usr/bin/tcpserver -H -R -l 0 -c 
$MAXSMTPD -x /etc/tcp.smtp.cdb -u $QMAILDUID -g $NOFILESGID 0 smtp 
/var/qmail/bin/qmail-smtpd fujitsu.es /home/vpopmail/bin/vchkpw 
/bin/true 21



Regards,
N0K.


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread John Simpson

On 2006-02-07, at 0623, N0K wrote:
Hello, and thanks for the reply, i have quit smtp auth old patch  
and i have patched with vpopmail/contrib patch, but now, i get the  
next error:


tsuki:/var/qmail/supervise# telnet localhost 25
...
AUTH LOGIN
334 VXNlcm5hbWU6
YnJvZHJpasffZ3sVlemJAZnVqaXRzdS5l - username in base64
334 UGFzc3dvcmQ6
MTIzMDhA - pass in base64
454 oops, unable to write pipe and I can't auth (#4.3.0)


qmail-smtpd is trying to run the checkpassword program, and can't.

check the permissions on your checkpassword program (specified on  
your qmail-smtpd command line- if the example you sent is accurate,  
this will be /home/vpopmail/bin/vchkpw.) and here's the part a lot  
of people forget- also check the permissions of each directory which  
contains it. for example, if the program is /home/vpopmail/bin/ 
vchkpw, you need to make sure that /home, /home/vpopmail, and / 
home/vpopmail/bin all have AT LEAST x permission for group and  
other (i.e. chmod go+x /home /home/vpopmail /home/vpopmail/bin.)


the next problem you're going to run into is that (according to the  
smtp run script you sent) qmail-smtpd is running as the userid  
qmaild, and in order for vchkpw to read the vpasswd.cdb files and  
do its job, it has to be run as either the vpopmail user, or as root.  
the easiest way to make this happen is to make the vchkpw binary  
setuid, like so:


# chmod 6711 /home/vpopmail/bin/vchkpw

however, this could potentially be dangerous if normal users have  
access to run commands on the machine- a user could run vchkpw over  
and over, for example, in an attempt to do brute-force guessing of  
other peoples' passwords. there are other options- a popular one is  
to make qmail-smtpd run as the vpopmail user, however if you're using  
qmail-scanner, simscan or any other QMAILQUEUE program, this will  
also cause those programs to run as the vpopmail user as well. i'm  
not saying this is a good or a bad thing, just something to be aware  
of- as long as you understand what's going on, it can be handled.


--
| John M. Simpson - KG4ZOW - Programmer At Large |
| http://www.jms1.net/   [EMAIL PROTECTED] |
--
| Mac OS X proves that it's easier to make UNIX  |
| pretty than it is to make Windows secure.  |
--




PGP.sig
Description: This is a digitally signed message part


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread N0K

   Thanks for the answer


qmail-smtpd is trying to run the checkpassword program, and can't.

check the permissions on your checkpassword program (specified on  
your qmail-smtpd command line- if the example you sent is accurate,  
this will be /home/vpopmail/bin/vchkpw.) and here's the part a lot  
of people forget- also check the permissions of each directory which  
contains it. for example, if the program is /home/vpopmail/bin/ 
vchkpw, you need to make sure that /home, /home/vpopmail, and / 
home/vpopmail/bin all have AT LEAST x permission for group and  
other (i.e. chmod go+x /home /home/vpopmail /home/vpopmail/bin.)


drwxrwsr-x   5 root staff  4096 2006-02-06 15:55 home
drwxr-xr-x  8 vpopmail vchkpw  4096 2006-02-06 15:55 vpopmail
drwxr-xr-x 2 vpopmail vchkpw 4096 2006-02-06 15:58 bin



the next problem you're going to run into is that (according to the  
smtp run script you sent) qmail-smtpd is running as the userid  
qmaild, and in order for vchkpw to read the vpasswd.cdb files and  
do its job, it has to be run as either the vpopmail user, or as root.


   I already saw that error, and now this is the run file:
tsuki:/var/qmail/supervise/qmail-smtpd# cat run
#!/bin/sh

QMAILDUID=`id -u vpopmail`

NOFILESGID=`id -g vpopmail`

MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`



exec /usr/bin/softlimit -m 600 /usr/bin/tcpserver -H -R -l 0 -c 
$MAXSMTPD -x /etc/tcp.smtp.cdb -u $QMAILDUID -g $NOFILESGID 0 smtp 
/var/qmail/bin/qmail-smtpd fujitsu.es /home/vpopmail/bin/vchkpw 
/bin/true 21



the easiest way to make this happen is to make the vchkpw binary  
setuid, like so:


# chmod 6711 /home/vpopmail/bin/vchkpw


-rws--s--x 1 vpopmail vchkpw 73124 2006-02-06 15:55 
/home/vpopmail/bin/vchkpw




however, this could potentially be dangerous if normal users have  
access to run commands on the machine- a user could run vchkpw over  
and over, for example, in an attempt to do brute-force guessing of  
other peoples' passwords. there are other options- a popular one is  
to make qmail-smtpd run as the vpopmail user, however if you're using  
qmail-scanner, simscan or any other QMAILQUEUE program, this will  
also cause those programs to run as the vpopmail user as well. i'm  
not saying this is a good or a bad thing, just something to be aware  
of- as long as you understand what's going on, it can be handled.



   For the moment only want see smtp auth run.
   But the result is the same:

tsuki:/var/qmail/supervise/qmail-smtpd# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 tsuki.fujitsu.es ESMTP
ehlo prueba
250-tsuki.fujitsu.es
250-PIPELINING
250-8BITMIME
250-SIZE 0
250 AUTH LOGIN PLAIN CRAM-MD5
auth login
334 VXNlcm5hbWU6
Cgp0b2xerylQHRlcF3QuY29t
334 UGFzc3dvcmQ6
CgasoxMaajMw
454 oops, unable to write pipe and I can't auth (#4.3.0)


Regards.


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread John Simpson

On 2006-02-07, at 0703, N0K wrote:

   For the moment only want see smtp auth run.
   But the result is the same:

tsuki:/var/qmail/supervise/qmail-smtpd# telnet localhost 25
...
auth login
334 VXNlcm5hbWU6
Cgp0b2xerylQHRlcF3QuY29t
334 UGFzc3dvcmQ6
CgasoxMaajMw
454 oops, unable to write pipe and I can't auth (#4.3.0)


specifically, this is happening not because the exec() is failing,  
but because qmail-smtpd is trying to send the userid, password, or  
CRAM challenge (which is null in this case of auth login) through  
the pipe to the checkpassword program, and the write operation is  
encountering some kind of error.


the only thing i can think is that vchkpw may be crashing as soon as  
it runs- and i don't know of any reliable way to test whether this is  
the case, or if so, to isolate the reason that vchkpw is crashing.  
maybe you're running out of memory- if you're using some kind of  
ulimit or softlimit program, try raising the limit (or doing away  
with the program entirely.)


the only other thing i can suggest is that it's morning here in the  
US, a lot of people will be coming into the office soon and  
presumably will be reading this thread. maybe one of them has an idea  
how to test this, or has some other idea what may be causing the  
problem.


--
| John M. Simpson - KG4ZOW - Programmer At Large |
| http://www.jms1.net/   [EMAIL PROTECTED] |
--
| Mac OS X proves that it's easier to make UNIX  |
| pretty than it is to make Windows secure.  |
--




PGP.sig
Description: This is a digitally signed message part


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Rick Macdougall

John Simpson wrote:

On 2006-02-07, at 0703, N0K wrote:

   For the moment only want see smtp auth run.
   But the result is the same:

tsuki:/var/qmail/supervise/qmail-smtpd# telnet localhost 25
...
auth login
334 VXNlcm5hbWU6
Cgp0b2xerylQHRlcF3QuY29t
334 UGFzc3dvcmQ6
CgasoxMaajMw
454 oops, unable to write pipe and I can't auth (#4.3.0)


Just an FYI to the original poster, the new patch does not require the 
host name in the run file of qmail-smtpd.  If it is there, it will make 
you an open relay.  It's not part of the problem above I believe but I 
thought you should be made aware of it.


Regards,

Rick



Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread John Simpson

On 2006-02-07, at 0759, Rick Macdougall wrote:


Just an FYI to the original poster, the new patch does not require  
the host name in the run file of qmail-smtpd.  If it is there, it  
will make you an open relay.  It's not part of the problem above I  
believe but I thought you should be made aware of it.


that's actually a good idea. does it use control/me to generate CRAM  
challenges?


--
| John M. Simpson - KG4ZOW - Programmer At Large |
| http://www.jms1.net/   [EMAIL PROTECTED] |
--
| Mac OS X proves that it's easier to make UNIX  |
| pretty than it is to make Windows secure.  |
--




PGP.sig
Description: This is a digitally signed message part


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Rick Macdougall

John Simpson wrote:

On 2006-02-07, at 0759, Rick Macdougall wrote:


Just an FYI to the original poster, the new patch does not require the 
host name in the run file of qmail-smtpd.  If it is there, it will 
make you an open relay.  It's not part of the problem above I believe 
but I thought you should be made aware of it.


that's actually a good idea. does it use control/me to generate CRAM 
challenges?


No idea, I just know I got nailed by that one on an upgrade a few years ago.

Rick



Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread N0K

Rick Macdougall wrote:


John Simpson wrote:


On 2006-02-07, at 0759, Rick Macdougall wrote:



Just an FYI to the original poster, the new patch does not require 
the host name in the run file of qmail-smtpd.  If it is there, it 
will make you an open relay.  It's not part of the problem above I 
believe but I thought you should be made aware of it.



that's actually a good idea. does it use control/me to generate CRAM 
challenges?



No idea, I just know I got nailed by that one on an upgrade a few 
years ago.


Rick



   I have change the run smtp file:

#!/bin/sh

VPOPUID=`id -u vpopmail`

VPOPGID=`id -g vpopmail`

MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`

LOCAL=`head -1 /var/qmail/control/me`

exec /usr/bin/tcpserver -v -R  -x /etc/tcp.smtp.cdb -c $MAXSMTPD -u 
$VPOPUID -g  $VPOPGID 0 smtp /var/qmail/bin/qmail-smtpd 
/var/vpopmail/bin/vchkpw  /bin/true 21


   Error is the same:

tsuki:/var/qmail/supervise/qmail-smtpd# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
tcpserver: status: 1/20
tcpserver: pid 28975 from 127.0.0.1
tcpserver: ok 28975 localhost:127.0.0.1:25 localhost:127.0.0.1::54057
220 tsuki.fujitsu.es ESMTP
ehlo tsuki.fujitsu.es
250-tsuki.fujitsu.es
250-PIPELINING
250-8BITMIME
250-SIZE 0
250 AUTH LOGIN PLAIN CRAM-MD5
AUTH LOGIN
334 VXNlcm5hbWU6
Cgp0ba2xlQHRlc3QwRuY29t
334 UGFzc3dvcmQ6
CgoxMaajMtw
454 oops, unable to write pipe and I can't auth (#4.3.0)
quit
221 tsuki.fujitsu.es
tcpserver: end 28975 status 0
tcpserver: status: 0/20
Connection closed by foreign host.


   But, at the begining i had install qmail+vpopmail+smtp auth in 
another server, and i get this error in smtp auth (454 oops, unable to 
write pipe and I can't auth (#4.3.0) ) then i install 
qmail+vpopmail+smtpauth in another server and i get the same problem, so 
i think this is a comun problem. Then i think when you install 
qmail+vpopmail+smtpauth, you always get unable to write pipe error.


   i have patch qmail with vpopmail/contrib smtp auth, qmail-103.patch 
(for dns) and errno.patch (for compile error with errno.h).


   Any other idea ?

   Regards,
   N0K.




Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Rick Macdougall

N0K wrote:

Rick Macdougall wrote:


John Simpson wrote:


On 2006-02-07, at 0759, Rick Macdougall wrote:



Just an FYI to the original poster, the new patch does not require 
the host name in the run file of qmail-smtpd.  If it is there, it 
will make you an open relay.  It's not part of the problem above I 
believe but I thought you should be made aware of it.



that's actually a good idea. does it use control/me to generate CRAM 
challenges?



No idea, I just know I got nailed by that one on an upgrade a few 
years ago.


Rick



   I have change the run smtp file:

#!/bin/sh

VPOPUID=`id -u vpopmail`

VPOPGID=`id -g vpopmail`

MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`

LOCAL=`head -1 /var/qmail/control/me`

exec /usr/bin/tcpserver -v -R  -x /etc/tcp.smtp.cdb -c $MAXSMTPD -u 
$VPOPUID -g  $VPOPGID 0 smtp /var/qmail/bin/qmail-smtpd 
/var/vpopmail/bin/vchkpw  /bin/true 21


   Error is the same:

tsuki:/var/qmail/supervise/qmail-smtpd# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
tcpserver: status: 1/20
tcpserver: pid 28975 from 127.0.0.1
tcpserver: ok 28975 localhost:127.0.0.1:25 localhost:127.0.0.1::54057
220 tsuki.fujitsu.es ESMTP
ehlo tsuki.fujitsu.es
250-tsuki.fujitsu.es
250-PIPELINING
250-8BITMIME
250-SIZE 0
250 AUTH LOGIN PLAIN CRAM-MD5
AUTH LOGIN
334 VXNlcm5hbWU6
Cgp0ba2xlQHRlc3QwRuY29t
334 UGFzc3dvcmQ6
CgoxMaajMtw
454 oops, unable to write pipe and I can't auth (#4.3.0)
quit
221 tsuki.fujitsu.es
tcpserver: end 28975 status 0
tcpserver: status: 0/20
Connection closed by foreign host.


   But, at the begining i had install qmail+vpopmail+smtp auth in 
another server, and i get this error in smtp auth (454 oops, unable to 
write pipe and I can't auth (#4.3.0) ) then i install 
qmail+vpopmail+smtpauth in another server and i get the same problem, so 
i think this is a comun problem. Then i think when you install 
qmail+vpopmail+smtpauth, you always get unable to write pipe error.


   i have patch qmail with vpopmail/contrib smtp auth, qmail-103.patch 
(for dns) and errno.patch (for compile error with errno.h).


   Any other idea ?

   Regards,
   N0K.




Perhaps try Bill's toaster patch instead.  http://www.shupp.org

Rick



Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread N0K




Perhaps try Bill's toaster patch instead.  http://www.shupp.org

Rick

   u i was using qmail-1.03, now i have install netqmail-1.05 for 
toaster patch, i have patch with this patch and still!!! get the same 
error :(


   Any other idea ?

   Regards.


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Rick Macdougall

N0K wrote:




Perhaps try Bill's toaster patch instead.  http://www.shupp.org

Rick

   u i was using qmail-1.03, now i have install netqmail-1.05 for 
toaster patch, i have patch with this patch and still!!! get the same 
error :(


   Any other idea ?


No, sorry.  I use Bill's patch all the time and smtp-auth works just 
fine here, with or with cram-md5


Rick



Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread N0K

Rick Macdougall wrote:


N0K wrote:





Perhaps try Bill's toaster patch instead.  http://www.shupp.org

Rick

   u i was using qmail-1.03, now i have install netqmail-1.05 for 
toaster patch, i have patch with this patch and still!!! get the same 
error :(


   Any other idea ?



No, sorry.  I use Bill's patch all the time and smtp-auth works just 
fine here, with or with cram-md5


Rick

   I have done this manual http://shupp.org/toaster/ and now all run 
fine, i have to compare with my old installation for see my mistake.


   Thanks to all for the help.

   Regards,
   N0K.


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Erwin Hoffmann

Hi,

(if your Q has not been answered ...).


At 12:23 07.02.2006 +0100, you wrote:


On Monday 06 February 2006 08:45, Tom Collins wrote:



On Feb 6, 2006, at 4:14 AM, N0K wrote:



  I have using vpopmail-5.4.13, qmail + smtp-auth
(http://members.elysium.pl/brush/qmail-smtpd-auth/dist/qmail-smtpd-
auth-0.31.tar.gz).

  Do i need to patch vchkpw or any similar things ?


You're using an outdated SMTP AUTH patch.  Try the one included in
vpopmail's contrib directory.

But, that reminds me, I could update vchkpw to try swapping the
challenge and response parameter order (the underlying problem) if the
correct way fails.  This would allow it to continue working with the
old patches that passed them in the wrong order.



my two cents:
the old patch should die.  it's really, really, really bad.  Leave vchkpw 
how it is :)


-Jeremy


Hello, and thanks for the reply, i have quit smtp auth old patch and i 
have patched with vpopmail/contrib patch, but now, i get the next error:


tsuki:/var/qmail/supervise# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 tsuki.fujitsu.es ESMTP
ehlo tsuki.fujitsu.es
250-tsuki.fujitsu.es
250-PIPELINING
250-8BITMIME
250-SIZE 0
250 AUTH LOGIN PLAIN CRAM-MD5
AUTH LOGIN
334 VXNlcm5hbWU6
YnJvZHJpasffZ3sVlemJAZnVqaXRzdS5l - username in base64
334 UGFzc3dvcmQ6
MTIzMDhA - pass in base64
454 oops, unable to write pipe and I can't auth (#4.3.0)

Im going to past my qmail-smtpd/run too:

tsuki:/var/qmail/supervise# cat qmail-smtpd/run
#!/bin/sh

QMAILDUID=`id -u qmaild`

NOFILESGID=`id -g qmaild`

MAXSMTPD=`cat /var/qmail/control/concurrencyincoming` (this is 20)


exec /usr/bin/softlimit -m 400 /usr/bin/tcpserver -H -R -l 0 -c 
$MAXSMTPD -x /etc/tcp.smtp.cdb -u $QMAILDUID -g $NOFILESGID 0 smtp 
/var/qmail/bin/qmail-smtpd fujitsu.es /home/vpopmail/bin/vchkpw /bin/true


Remove the hostname fujitso.es from the call to qmail-smtpd.

It will work at a glacne.

regards.
--eh.

Dr. Erwin Hoffmann | FEHCom | http://www.fehcom.de/
Wiener Weg 8, 50858 Cologne | T: +49 221 484 4923 | F: ...24



Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Jeremy Kitchen
On Tuesday 07 February 2006 03:23, N0K wrote:
 454 oops, unable to write pipe and I can't auth (#4.3.0)

 exec /usr/bin/softlimit -m 400 /usr/bin/tcpserver -H -R -l 0 -c
 $MAXSMTPD -x /etc/tcp.smtp.cdb -u $QMAILDUID -g $NOFILESGID 0 smtp
 /var/qmail/bin/qmail-smtpd fujitsu.es /home/vpopmail/bin/vchkpw
 ^^-- remove that 
 /bin/true 21

the 'underlined' portion of the above script is a remnant from your old patch.  
The elysium.pl patch requires the hostname between qmail-smtpd and the 
checkpassword program.  This caused issues as many people either forgot to 
put it in, or didn't RTFM enough, and ended up creating an open relay.

-Jeremy

-- 
Jeremy Kitchen ++ [EMAIL PROTECTED]

In the beginning was The Word and The Word was Content-type: text/plain
  -- The Word of Bob.


pgpKYKie0hhHM.pgp
Description: PGP signature


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Jeremy Kitchen
On Tuesday 07 February 2006 04:59, Rick Macdougall wrote:
 John Simpson wrote:
  On 2006-02-07, at 0703, N0K wrote:
 For the moment only want see smtp auth run.
 But the result is the same:
 
  tsuki:/var/qmail/supervise/qmail-smtpd# telnet localhost 25
  ...
  auth login
  334 VXNlcm5hbWU6
  Cgp0b2xerylQHRlcF3QuY29t
  334 UGFzc3dvcmQ6
  CgasoxMaajMw
  454 oops, unable to write pipe and I can't auth (#4.3.0)

 Just an FYI to the original poster, the new patch does not require the
 host name in the run file of qmail-smtpd.  If it is there, it will make
 you an open relay.  It's not part of the problem above I believe but I
 thought you should be made aware of it.

actually, this is incorrect.

the OLD patch required the hostname, and if it was absent, you were an open 
relay.

The new patch does not require the hostname, and if present, authentication 
will simply fail, as is the case here.

-Jeremy

-- 
Jeremy Kitchen ++ [EMAIL PROTECTED]

In the beginning was The Word and The Word was Content-type: text/plain
  -- The Word of Bob.


pgpHCYgoGjlq3.pgp
Description: PGP signature


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Rick Macdougall

Jeremy Kitchen wrote:

On Tuesday 07 February 2006 04:59, Rick Macdougall wrote:

John Simpson wrote:

On 2006-02-07, at 0703, N0K wrote:

   For the moment only want see smtp auth run.
   But the result is the same:

tsuki:/var/qmail/supervise/qmail-smtpd# telnet localhost 25
...
auth login
334 VXNlcm5hbWU6
Cgp0b2xerylQHRlcF3QuY29t
334 UGFzc3dvcmQ6
CgasoxMaajMw
454 oops, unable to write pipe and I can't auth (#4.3.0)

Just an FYI to the original poster, the new patch does not require the
host name in the run file of qmail-smtpd.  If it is there, it will make
you an open relay.  It's not part of the problem above I believe but I
thought you should be made aware of it.


actually, this is incorrect.

the OLD patch required the hostname, and if it was absent, you were an open 
relay.


The new patch does not require the hostname, and if present, authentication 
will simply fail, as is the case here.


Uhh, no.  Try it yourself and check the cert.org lists.  Having the host 
name with the new patch makes you an open relay.  I'll admit I'm wrong 
sometimes but I was listed on a whack of rbls for just this case a few 
years ago.  Any signature will match and mail will be relayed.


Regards,

Rick





Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-07 Thread Jeremy Kitchen
On Tuesday 07 February 2006 17:42, Rick Macdougall wrote:
 Jeremy Kitchen wrote:
  On Tuesday 07 February 2006 04:59, Rick Macdougall wrote:
  John Simpson wrote:
  On 2006-02-07, at 0703, N0K wrote:
 For the moment only want see smtp auth run.
 But the result is the same:
 
  tsuki:/var/qmail/supervise/qmail-smtpd# telnet localhost 25
  ...
  auth login
  334 VXNlcm5hbWU6
  Cgp0b2xerylQHRlcF3QuY29t
  334 UGFzc3dvcmQ6
  CgasoxMaajMw
  454 oops, unable to write pipe and I can't auth (#4.3.0)
 
  Just an FYI to the original poster, the new patch does not require the
  host name in the run file of qmail-smtpd.  If it is there, it will make
  you an open relay.  It's not part of the problem above I believe but I
  thought you should be made aware of it.
 
  actually, this is incorrect.
 
  the OLD patch required the hostname, and if it was absent, you were an
  open relay.
 
  The new patch does not require the hostname, and if present,
  authentication will simply fail, as is the case here.

 Uhh, no.  Try it yourself and check the cert.org lists.  Having the host
 name with the new patch makes you an open relay.  I'll admit I'm wrong
 sometimes but I was listed on a whack of rbls for just this case a few
 years ago.  Any signature will match and mail will be relayed.

perhaps then, we are talking about different patches.  I'm referring to the 
one from Dr. Hoffman at http://fehcom.de/qmail/smtpauth.html.  I can assure 
you that Dr. Hoffman's patch is NOT an open relay if you supply the hostname.

Either that or you're thinking about the OLD patch where if you do NOT supply 
the hostname, you become an open relay.

With Dr. Hoffman's patch, if you supply the hostname, you get the behavior 
described earlier in this thread (454 oops, unable to write pipe and I can't 
auth (#4.3.0))

If you can show me a URL that contradicts this, please do, and I will stand 
corrected :)

-Jeremy

-- 
Jeremy Kitchen ++ [EMAIL PROTECTED]

In the beginning was The Word and The Word was Content-type: text/plain
  -- The Word of Bob.


pgpDBRZbNJWyb.pgp
Description: PGP signature


Re: [vchkpw] cram-md5 smtp auth failure.

2006-02-06 Thread Jeremy Kitchen
On Monday 06 February 2006 08:45, Tom Collins wrote:
 On Feb 6, 2006, at 4:14 AM, N0K wrote:
 I have using vpopmail-5.4.13, qmail + smtp-auth
  (http://members.elysium.pl/brush/qmail-smtpd-auth/dist/qmail-smtpd-
  auth-0.31.tar.gz).
 
 Do i need to patch vchkpw or any similar things ?

 You're using an outdated SMTP AUTH patch.  Try the one included in
 vpopmail's contrib directory.

 But, that reminds me, I could update vchkpw to try swapping the
 challenge and response parameter order (the underlying problem) if the
 correct way fails.  This would allow it to continue working with the
 old patches that passed them in the wrong order.

my two cents:
the old patch should die.  it's really, really, really bad.  Leave vchkpw how 
it is :)

-Jeremy

-- 
Jeremy Kitchen ++ [EMAIL PROTECTED]

In the beginning was The Word and The Word was Content-type: text/plain
  -- The Word of Bob.


pgpXQLqSdKpZf.pgp
Description: PGP signature