[Dovecot] Dovecot+PAM advice please?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hi all,
sorry to bother you with this. I'm trying to set up an experimental system (which may become production if it ever gets off the ground) and it's not working.
The short version: I'm trying to get Dovecot 1.2.4 to authenticate against a customised PAM module. In short, we're using a specialised OTP radius backend. One of my colleagues has coded up a PAM module for this backend. The IMAP service is on HP-UX11.23, IA64.
The module is compiles into /usr/lib/security/hpux32 and is called "pam_cached_radius.so.0.0". The entry in /etc/pam.conf is: cached-radius auth required pam_cached_radius.so.0.0
The PAM module compiles OK, and my colleague's test suite (run, both as root and as our local "dovecot" user) works fine.
When I use the following options in dovecot.conf: auth default { user = root mechanisms = plain passdb pam { args = cached-radius } userdb passwd { } }
it fails leaving only the log entry below in syslog.
Sep 14 09:15:15 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0 Sep 14 09:15:22 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0
(Always 2 entries).
I appreciate that this probably isn't a dovecot issue per se, but it is suspicious that our test suite works and divecot can't access the module.
I'd be most grateful if anyone could offer some possible avenues of investigation. Thanks, SAW
Steven-Ashley Woltering, MBCS, Systems Analyst, ECMWF, Shinfield Park, Reading, RG2 9AX, UK Tel.: +44 1189 499473 (internal x2473) Email: Steven.Woltering@ecmwf.int -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iD8DBQFKrhHch854NVK99FMRAnUiAJ9nOhLkGPFLGhEnhIwbk5V5RvGfPACghZUc 8HWimxrolkqhBkkjPD4AtQw= =WmSS -----END PGP SIGNATURE-----
On Sep 14, 2009, at 5:50 AM, S. A. Woltering wrote:
Sep 14 09:15:15 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0 Sep 14 09:15:22 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0
See if setting auth_process_size=0 helps?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Timo Sirainen wrote:
On Sep 14, 2009, at 5:50 AM, S. A. Woltering wrote:
Sep 14 09:15:15 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0 Sep 14 09:15:22 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0
See if setting auth_process_size=0 helps?
That's one setting I've carried over from my previous (non-OTP/Radius) setup. It doesn't affect the outcome, sadly.
This is seriously mystifying me... Thanks for the suggestion, though. SAW
Steven-Ashley Woltering, MBCS, Systems Analyst, ECMWF, Shinfield Park, Reading, RG2 9AX, UK Tel.: +44 1189 499473 (internal x2473) Email: Steven.Woltering@ecmwf.int -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iD8DBQFKrlc1h854NVK99FMRAgUpAJ9hgIDpDLbHHNDDEmTJWkQBf9F/iQCdHkga Rj8IYEIqkwp/DTXARPHviGA= =FGPs -----END PGP SIGNATURE-----
On Sep 14, 2009, at 10:46 AM, S. A. Woltering wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Timo Sirainen wrote:
On Sep 14, 2009, at 5:50 AM, S. A. Woltering wrote:
Sep 14 09:15:15 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0 Sep 14 09:15:22 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0
See if setting auth_process_size=0 helps? That's one setting I've carried over from my previous (non-OTP/Radius) setup. It doesn't affect the outcome, sadly.
This is seriously mystifying me...
Maybe Some symbol conflict? Or something else in the running
environment. If nothing else works, you could try to run dovecot-auth
directly and see if it works there. And if not, start dropping out
code until you find out what drop exactly makes it work.
On Sep 14, 2009, at 10:51 AM, Timo Sirainen wrote:
Maybe Some symbol conflict? Or something else in the running
environment. If nothing else works, you could try to run dovecot- auth directly and see if it works there. And if not, start dropping
out code until you find out what drop exactly makes it work.
Oh, and I was thinking that the code dropping would be done to dovecot- auth. But maybe it's easier to do for your PAM module.
On Sep 14, 2009, at 10:52 AM, Timo Sirainen wrote:
On Sep 14, 2009, at 10:51 AM, Timo Sirainen wrote:
Maybe Some symbol conflict? Or something else in the running
environment. If nothing else works, you could try to run dovecot- auth directly and see if it works there. And if not, start dropping
out code until you find out what drop exactly makes it work.Oh, and I was thinking that the code dropping would be done to
dovecot-auth. But maybe it's easier to do for your PAM module.
Last thought: Does your PAM module require some library? Perhaps that
doesn't get auto-loaded.
participants (2)
-
S. A. Woltering
-
Timo Sirainen