Can't use saslauthd to authenticate both postfix and cyrus due to /var/run/saslauthd being on tmpfs

[Roberto Maurizzi]

Binary package hint: sasl2-bin

The problem is quite complex, and has at least 2 easy workarounds. Maybe updating some docs or comments in /etc/default/saslauthd can be enough.

Scenario

I've set up a server with users in LDAP. Both postfix and cyrus need to authenticate the users, and using saslauthd you have 2 options:

1) run smtpd without chroot
2) move saslauthd socket from /var/run/saslauthd to /var/spool/postfix/var/run/saslauthd (as suggested in /etc/default/saslauthd) and then create a softlink in the old location of the socket so that cyrus can talk to saslauthd

The problem with 1) is that I'd prefer to keep the added security provided by the chroot.
The problem with 2) is that /var/run is in tmpfs, and the softlink doesn't survive a reboot. The 'easy fix' to this is, if a "-m /new/socket/dir" is given to saslauthd, the init script should create a link from the new location to /var/run/saslauthd

Since this problem is exactly the same of syslog(s) not being usable from chroots without additional listening socket, the "real" fix would be to patch saslauthd to support additional sockets.

Ciao,
   Roberto

[Roberto Maurizzi (r-maurizzi)]

This exact problems is reported in #79371. I didn't spot it because the original title is about the PID of saslauthd.

[Scott Kitterman (kitterman)]

As I read this, you are saying that if you want to use saslauthd in a non-standard configuration, then you have to change the init script to make it work. Is that correct?

[Roberto Maurizzi (r-maurizzi)]

Sorry for the late reply...

Yes, basically I have to add a softlink to the new location of saslauthd socket in the init script, since it gets "purged" with the whole ram-based /var/run filesystem.

The situation is:
- I have to have the saslauthd socket inside postfix chroot
- If I move the socket there, all the other users of the socket can't find it
- If I create a softlink in the old location, it gets deleted at reboot, since /var/run is in tmpfs

I have either to create 2 sockets like for syslogd, or to re-create the softlink at every reboot.

[Adam Sommer (asommer)]

Hello,

Another option you could try is to use Dovecot SASL with Postfix for authentication. We are in the process of updating the "official" documentation to use Dovecot SASL. A couple of reasons for the change is because of the Postfix chroot and also Dovecot is the default MDA. For instructions on using Dovecot SASL see:

  https://help.ubuntu.com/community/PostfixDovecotSASL

You an use Dovecot SASL for Postfix SMTP authentication and Cyrus SASL, in it's default configuration, for the other services. Just another idea anyway, also if the Dovecot SASL page is unclear or could use some more information feel free to edit it accordingly.

Thanks,
Adam

[Christopher DeMarco (demarco)]

There is an undocumented option to imapd.conf ``sasl_saslauthd_path'' which instructs the daemon to look in a non-standard location for the socket. I've opened a bug upstream with the Cyrus maintainers. Perhaps Ubuntu should update the imapd and imap.conf manpages to reflect this useful option?

[Scott Kitterman (kitterman)]

if you could provide draft language for the change, we should be able to do
that.

[xteejx (xteejx-deactivatedaccount)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. You reported this bug a while ago and there hasn't been any activity in it recently. We were wondering if this is still an issue for you. Can you try with the latest Ubuntu release? Thanks in advance.

[Scott Kitterman (kitterman)]

Teej: Do you have a reason to believe this is fixed? Did you try to
replicate it?

[xteejx (xteejx-deactivatedaccount)]

This bug hadn't been updated in 5 months, I was checking if it was still active. If this could be tested in Jaunty/Karmic it would be great, as it MAY have been fixed, but I wouldn't like to say for sure. I would try to reproduce but do not have any server to try it on. Should this be marked Medium so it's more visible to developers? :)

[xteejx (xteejx-deactivatedaccount)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Thanks again!