Frontend couldn't authenticate to backend server: authentication failure

[Jean-Christophe Delaye]

Dear all,

I'm trying to complete setup Cyrus Murder : 1 frontend with mupdate and
1 backend (initial config).
Machines are running Solaris 11.3 (for ZFS, HA clustering and zone
capabilities), SASL 2.1.27(rc8) and Cyrus 3.0.7.

Services seems running fine on both master/frontend (hostname cassandra)
and backend (hostname imap1).
I can create mailboxes on backend and location is maintained on the
mupdate server.

Backend#
***@imap1:# ./ctl_mboxlist -C /global/cyrus1/etc/imapd.conf -d

user.delaye 0 default delaye lrswipkxtecdan
user.delaye.INBOX.JCD 0 default delaye lrswipkxtecdan
user.delaye.Trash 0 default delaye lrswipkxtecdan
user.standard 0 default standard lrswipkxtecdan delaye
lrswipkxtecdan titi lrswipkxtecdan
user.standart 0 default standart lrswipkxtecdan

Master#
[***@cassandra sbin]# ./ctl_mboxlist -C /global/cyrus/etc/imapd.conf -d
user.delaye 1 imap1.eurecom.fr!default delaye lrswipkxtecdan
user.delaye.INBOX.JCD 1 imap1.eurecom.fr!default delaye
lrswipkxtecdan
user.delaye.Trash 1 imap1.eurecom.fr!default delaye
lrswipkxtecdan
user.standard 1 imap1.eurecom.fr!default standard lrswipkxtecdan
delaye lrswipkxtecdan titi lrswipkxtecdan
user.standart 1 imap1.eurecom.fr!default standart lrswipkxtecdan

From client, connection to backend is ok

# telnet imap1 imap
Trying 192.168.106.208...
Connected to imap1.eurecom.fr.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE
MUPDATE=mupdate://cassandra.eurecom.fr/ STARTTLS AUTH=PLAIN SASL-IR]
imap1.eurecom.fr Cyrus IMAP 3.0.7 server ready
001 login standard XXXXXXX
001 OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE ACL RIGHTS=kxten QUOTA
MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT CHILDREN
MULTIAPPEND BINARY CATENATE CONDSTORE ESEARCH SEARCH=FUZZY SORT
SORT=MODSEQ SORT=DISPLAY SORT=UID THREAD=ORDEREDSUBJECT
THREAD=REFERENCES THREAD=REFS ANNOTATEMORE ANNOTATE-EXPERIMENT-1
METADATA LIST-EXTENDED LIST-STATUS LIST-MYRIGHTS LIST-METADATA WITHIN
QRESYNC SCAN XLIST XMOVE MOVE SPECIAL-USE CREATE-SPECIAL-USE DIGEST=SHA1
X-REPLICATION URLAUTH URLAUTH=BINARY
MUPDATE=mupdate://cassandra.eurecom.fr/ LOGINDISABLED COMPRESS=DEFLATE
X-QUOTA=STORAGE X-QUOTA=MESSAGE X-QUOTA=X-ANNOTATION-STORAGE
X-QUOTA=X-NUM-FOLDERS IDLE] User logged in
SESSIONID=<cyrus1-11584-1527864026-1-553541307793954667>
A001 SELECT INBOX
* 0 EXISTS
* 0 RECENT
* FLAGS (\Answered \Flagged \Draft \Deleted \Seen)
* OK [PERMANENTFLAGS (\Answered \Flagged \Draft \Deleted \Seen \*)] Ok
* OK [UIDVALIDITY 1527674348] Ok
* OK [UIDNEXT 1] Ok
* OK [HIGHESTMODSEQ 3] Ok
* OK [URLMECH INTERNAL] Ok
* OK [ANNOTATIONS 65536] Ok
A001 OK [READ-WRITE] Completed

The problem seems to be the proxy connections through frontend to the
server with a backend role.

The frontend is forwarding the imap requests to the backend using
proxy_authname username

saslauthd[18753] :auth success: [user=mailproxy] [service=imap] [realm=]
[mech=shadow]

From client(s), connection to frontend is the issue

001 login standard xxxxxxx
001 OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE ACL RIGHTS=kxten QUOTA
MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT CHILDREN
MULTIAPPEND BINARY CATENATE CONDSTORE ESEARCH SEARCH=FUZZY SORT
SORT=MODSEQ SORT=DISPLAY SORT=UID THREAD=ORDEREDSUBJECT
THREAD=REFERENCES THREAD=REFS ANNOTATEMORE ANNOTATE-EXPERIMENT-1
METADATA LIST-EXTENDED LIST-STATUS LIST-MYRIGHTS LIST-METADATA WITHIN
QRESYNC SCAN XLIST XMOVE MOVE SPECIAL-USE CREATE-SPECIAL-USE DIGEST=SHA1
X-REPLICATION URLAUTH URLAUTH=BINARY
MUPDATE=mupdate://cassandra.eurecom.fr/ LOGINDISABLED COMPRESS=DEFLATE
X-QUOTA=STORAGE X-QUOTA=MESSAGE X-QUOTA=X-ANNOTATION-STORAGE
X-QUOTA=X-NUM-FOLDERS IDLE] User logged in
SESSIONID=<cyrus-17553-1527863251-1-12888262518610106734>

Once I get connected and authenticated, I launch the command
“select inbox”, but I receive the message
A001 SELECT INBOX
A001 NO Server(s) unavailable to complete operation

In the log files there is an error from both frontend and backend

From frontend:
cassandra cyrus/imap[19868]:
couldn't authenticate to backend server: authentication failure

From backend:
imap1 cyrus1/master
about to exec /opt/cyrus-imapd_3.0.7-cyrus1/libexec/imapd

imap1 cyrus1/imap[11632]: SASL could not find auxprop plugin, was
searching for '[all]'
badlogin: cassandra.eurecom.fr [192.168.106.61] PLAIN [SASL(-4): no
mechanism available: Password verification failed]

It seems to me that the imap process on the backend is unable to use the
correct sasl authentication library. (I've compiled imapd with standard
dynamic sasl).

Any help would be appreciated. I have spent several days working in
this problem without getting any progress at all.

Here are my configuration files (cyr_info conf)

On the backend:

admins: cyrus1 cyrus postman
allowallsubscribe: yes
allowplaintext: yes
allowusermoves: yes
auditlog: yes
configdirectory: /global/cyrus1/var/mail
defaultpartition: default
duplicate_db_path: /var/run/cyrus1/deliver.db
hashimapspool: yes
debug: yes
httpmodules: caldav carddav
idlesocket: /var/run/cyrus1/idle
mboxname_lockpath: /var/run/cyrus1_lock
mupdate_authname: postman
mupdate_password: xxxxxxx
mupdate_server: cassandra.eurecom.fr
mupdate_username: postman
popminpoll: 1
proc_path: /var/run/cyrus1_proc
proxy_authname: mailproxy
proxy_password: yyyyyyyy
proxyservers: mailproxy cyrus1 cyrus
ptscache_db_path: /var/run/cyrus1/ptscache.db
servername: imap1.eurecom.fr
sievedir: /global/cyrus1/var/sieve
statuscache_db_path: /var/run/cyrus1/statuscache.db
syslog_prefix: cyrus1
tls_sessions_db_path: /var/run/cyrus1/tls_sessions.db
sasl_saslauthd_path: /global/cyrus1/var/state/saslauthd/mux
sasl_mech_list: plain
sasl_auto_transition: no
sasl_pwcheck_method: saslauthd
partition-default: /global/cyrus1/mail
lmtp_admins: mailproxy cyrus1 cyrus


on the frontend/mupdate master:

admins: cyrus cyrus1 postman
allowallsubscribe: yes
allowplaintext: yes
allowusermoves: yes
auditlog: yes
configdirectory: /global/cyrus/var/mail
defaultpartition: default
duplicate_db_path: /var/run/cyrus/deliver.db
force_sasl_client_mech: PLAIN
hashimapspool: yes
debug: yes
httpmodules: caldav carddav
idlesocket: /var/run/cyrus/idle
mboxname_lockpath: /var/run/cyrus_lock
mupdate_authname: postman
mupdate_password: xxxxxxx
mupdate_server: cassandra.eurecom.fr
mupdate_username: postman
popminpoll: 1
proc_path: /var/run/cyrus_proc
proxy_authname: mailproxy
proxy_password: yyyyyyyyy
ptscache_db_path: /var/run/cyrus/ptscache.db
servername: cassandra.eurecom.fr
sievedir: /global/cyrus/var/sieve
statuscache_db_path: /var/run/cyrus/statuscache.db
syslog_prefix: cyrus
cassandra_mechs: PLAIN
sasl_saslauthd_path: /global/cyrus/var/state/saslauthd/mux
imap1_mechs: PLAIN
sasl_mech_list: plain
sasl_auto_transition: no
sasl_pwcheck_method: saslauthd
partition-default: /global/cyrus/mail





----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
To Unsubscribe:
https://lists.andrew.cmu.edu/mailman

[Dan White]

Post by Jean-Christophe Delaye
I'm trying to complete setup Cyrus Murder : 1 frontend with mupdate and
1 backend (initial config).
# telnet imap1 imap
Trying 192.168.106.208...
Connected to imap1.eurecom.fr.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE
MUPDATE=mupdate://cassandra.eurecom.fr/ STARTTLS AUTH=PLAIN SASL-IR]
001 login standard XXXXXXX
A001 SELECT INBOX
* 0 EXISTS
* 0 RECENT
* FLAGS (\Answered \Flagged \Draft \Deleted \Seen)
* OK [PERMANENTFLAGS (\Answered \Flagged \Draft \Deleted \Seen \*)] Ok
* OK [UIDVALIDITY 1527674348] Ok
* OK [UIDNEXT 1] Ok
* OK [HIGHESTMODSEQ 3] Ok
* OK [URLMECH INTERNAL] Ok
* OK [ANNOTATIONS 65536] Ok
A001 OK [READ-WRITE] Completed

Note that you have 'mailproxy' configured as the proxy_authname on your
frontend. Use imtest to simulate your frontend:

imtest -m plain -a mailproxy imap1.eurecom.fr
imtest -m plain -a mailproxy -u <some_user> imap1.eurecom.fr

Post by Jean-Christophe Delaye
The problem seems to be the proxy connections through frontend to the
server with a backend role.
From client(s), connection to frontend is the issue
001 login standard xxxxxxx
X-QUOTA=X-NUM-FOLDERS IDLE] User logged in
Once I get connected and authenticated, I launch the command
“select inbox”, but I receive the message
A001 SELECT INBOX
A001 NO Server(s) unavailable to complete operation
In the log files there is an error from both frontend and backend
couldn't authenticate to backend server: authentication failure
imap1 cyrus1/master
about to exec /opt/cyrus-imapd_3.0.7-cyrus1/libexec/imapd
imap1 cyrus1/imap[11632]: SASL could not find auxprop plugin, was
searching for '[all]'

The above error is probably not important.

Post by Jean-Christophe Delaye
badlogin: cassandra.eurecom.fr [192.168.106.61] PLAIN [SASL(-4): no
mechanism available: Password verification failed]

Check that the plain mechanism is available on the backend with
'pluginviewer', and verify your mailproxy credentials.

Post by Jean-Christophe Delaye
admins: cyrus1 cyrus postman
allowallsubscribe: yes
allowplaintext: yes
allowusermoves: yes
auditlog: yes
configdirectory: /global/cyrus1/var/mail
defaultpartition: default
duplicate_db_path: /var/run/cyrus1/deliver.db
hashimapspool: yes
debug: yes
httpmodules: caldav carddav
idlesocket: /var/run/cyrus1/idle
mboxname_lockpath: /var/run/cyrus1_lock
mupdate_authname: postman
mupdate_password: xxxxxxx
mupdate_server: cassandra.eurecom.fr
mupdate_username: postman
popminpoll: 1
proc_path: /var/run/cyrus1_proc
proxy_authname: mailproxy
proxy_password: yyyyyyyy
proxyservers: mailproxy cyrus1 cyrus
ptscache_db_path: /var/run/cyrus1/ptscache.db
servername: imap1.eurecom.fr
sievedir: /global/cyrus1/var/sieve
statuscache_db_path: /var/run/cyrus1/statuscache.db
syslog_prefix: cyrus1
tls_sessions_db_path: /var/run/cyrus1/tls_sessions.db
sasl_saslauthd_path: /global/cyrus1/var/state/saslauthd/mux
sasl_mech_list: plain
sasl_auto_transition: no
sasl_pwcheck_method: saslauthd
partition-default: /global/cyrus1/mail
lmtp_admins: mailproxy cyrus1 cyrus
admins: cyrus cyrus1 postman
allowallsubscribe: yes
allowplaintext: yes
allowusermoves: yes
auditlog: yes
configdirectory: /global/cyrus/var/mail
defaultpartition: default
duplicate_db_path: /var/run/cyrus/deliver.db
force_sasl_client_mech: PLAIN
hashimapspool: yes
debug: yes
httpmodules: caldav carddav
idlesocket: /var/run/cyrus/idle
mboxname_lockpath: /var/run/cyrus_lock
mupdate_authname: postman
mupdate_password: xxxxxxx
mupdate_server: cassandra.eurecom.fr
mupdate_username: postman
popminpoll: 1
proc_path: /var/run/cyrus_proc
proxy_authname: mailproxy
proxy_password: yyyyyyyyy
ptscache_db_path: /var/run/cyrus/ptscache.db
servername: cassandra.eurecom.fr
sievedir: /global/cyrus/var/sieve
statuscache_db_path: /var/run/cyrus/statuscache.db
syslog_prefix: cyrus
cassandra_mechs: PLAIN
sasl_saslauthd_path: /global/cyrus/var/state/saslauthd/mux
imap1_mechs: PLAIN
sasl_mech_list: plain
sasl_auto_transition: no
sasl_pwcheck_method: saslauthd
partition-default: /global/cyrus/mail

[ellie timoney]

Note, if I choose login mech , it works !

I feel like I've seen something like this before. If I recall correctly, the DIGEST-MD5 mech doesn't support proxy authentication, so if anything in your stack has this enabled (possibly by default), it can wind up trying to use that and then failing.

Our Cassandane infrastructure explicitly sets "sasl_mech_list: LOGIN PLAIN" in the imapd.conf files it uses, and judging by commit history it does this specifically to exclude DIGEST-MD5.

sasl_option: 0
Any SASL option can be set by preceding it with sasl_. This file over‐
rides the SASL configuration file.

I guess you can also set it directly in your SASL configuration file, but I don't know enough about SASL to make a recommendation either way.

Cheers,

ellie

[Jean-Christophe Delaye]

!!!
Please be aware that the password for mailproxy was exposed below in
uuencoded form.
!!!

Thanks, this is an (internal) lab platform !

I finally focus on the fact that authentication fails if userid and
authid differ.

So, my primary setup was (without sasldb)

<none>

I recompiled sasl with sasldb

then auxprop was not empty
Installed and properly configured auxprop mechanisms are:
sasldb
List of auxprop plugins follows
Plugin "sasldb" , API version: 8
supports store: yes

and now everything works fine:

[***@cassandra etc]# /opt/cyrus-imapd_3.0.7-cyrus/bin/imtest -m plain
-a mailproxy -u delaye imap1.eurecom.fr
S: * OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE
MUPDATE=mupdate://cassandra.eurecom.fr/ STARTTLS AUTH=PLAIN SASL-IR]
imap1.eurecom.fr Cyrus IMAP 3.0.7 server ready
Please enter your password:
......
Authenticated.
Security strength factor: 0
* BYE idle for too long
Connection closed.

Thanks for your help.

-a mailproxy imap1.eurecom.fr
S: * OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE
MUPDATE=mupdate://cassandra.eurecom.fr/ STARTTLS AUTH=PLAIN SASL-IR]
imap1.eurecom.fr Cyrus IMAP 3.0.7 server ready
C: A01 AUTHENTICATE PLAIN <removed>
Authenticated.
Security strength factor: 0
. LIST "" "*"
. OK Completed (0.000 secs)

Post by Dan White
imtest -m plain -a mailproxy -u <some_user> imap1.eurecom.fr

-a mailproxy -u delaye imap1.eurecom.fr
S: * OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE
MUPDATE=mupdate://cassandra.eurecom.fr/ STARTTLS AUTH=PLAIN SASL-IR]
imap1.eurecom.fr Cyrus IMAP 3.0.7 server ready
C: A01 AUTHENTICATE PLAIN <removed>
S: A01 NO no mechanism available
Authentication failed. generic failure
Security strength factor: 0
Note, if I choose  login mech , it works !
-a mailproxy -u delaye imap1.eurecom.fr
S: * OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE
MUPDATE=mupdate://cassandra.eurecom.fr/ STARTTLS AUTH=PLAIN SASL-IR]
imap1.eurecom.fr Cyrus IMAP 3.0.7 server ready
C: L01 LOGIN mailproxy {7}
S: + go ahead
Authenticated.

You may need 'sasl_minimum_layer: 0' within imapd.conf, on the backend.
If that doesn't work, please include syslog output for the above two
authentication attempts.

/opt/cyrus-sasl_2.1.27-cyrus1/sbin/pluginviewer -m plain
<none>
 SCRAM-SHA-1 SCRAM-SHA-256 DIGEST-MD5 EXTERNAL CRAM-MD5 PLAIN ANONYMOUS
 PLAIN
List of server plugins follows
Plugin "plain" [loaded],        API version: 4
 SCRAM-SHA-1 SCRAM-SHA-256 DIGEST-MD5 EXTERNAL CRAM-MD5 PLAIN ANONYMOUS
List of client plugins follows
Plugin "plain" [loaded],        API version: 4
mailproxy credentials are ok !
/opt/cyrus-sasl_2.1.27-cyrus1/sbin/pluginviewer
<none>
 SCRAM-SHA-1 SCRAM-SHA-256 DIGEST-MD5 EXTERNAL CRAM-MD5 PLAIN ANONYMOUS
 SCRAM-SHA-1 SCRAM-SHA-256 DIGEST-MD5 CRAM-MD5 PLAIN ANONYMOUS
List of server plugins follows
Plugin "scram" [loaded],        API version: 4
Plugin "scram" [loaded],        API version: 4
Plugin "digestmd5" [loaded],    API version: 4
Plugin "crammd5" [loaded],      API version: 4
Plugin "plain" [loaded],        API version: 4
Plugin "anonymous" [loaded],    API version: 4
 SCRAM-SHA-1 SCRAM-SHA-256 DIGEST-MD5 EXTERNAL CRAM-MD5 PLAIN ANONYMOUS
 SCRAM-SHA-1 SCRAM-SHA-256 DIGEST-MD5 EXTERNAL CRAM-MD5 PLAIN ANONYMOUS
List of client plugins follows
Plugin "scram" [loaded],        API version: 4
Plugin "scram" [loaded],        API version: 4
Plugin "digestmd5" [loaded],    API version: 4
Plugin "EXTERNAL" [loaded],     API version: 4
Plugin "crammd5" [loaded],      API version: 4
Plugin "plain" [loaded],        API version: 4
Plugin "anonymous" [loaded],    API version: 4

Post by Dan White

Post by Jean-Christophe Delaye
allowplaintext: yes
proxyservers: mailproxy cyrus1 cyrus
sasl_saslauthd_path: /global/cyrus1/var/state/saslauthd/mux
sasl_mech_list: plain
sasl_auto_transition: no
sasl_pwcheck_method: saslauthd
proxy_authname: mailproxy
proxy_password: yyyyyyyyy
sasl_saslauthd_path: /global/cyrus/var/state/saslauthd/mux
sasl_mech_list: plain
sasl_auto_transition: no
sasl_pwcheck_method: saslauthd