Can't log in to my IMAP server

oscarBravo

I'm running an IMAP server on Debian testing. After running apt-get dist-upgrade, I can't log on to the IMAP server anymore. Syslog shows an IMAP authentication failure.

I have a hunch this has something to do with PAM, but I don't know much about PAM. I can log on via SSH with no problem, it's just IMAP. Any pointers on where to start looking?

BenH

Dumb questions, but:

Have all the services restarted correctly?

Has anything bad happened to your APT database?

If your lucky, it'll just be a case of the server not restarting after the reboot.

Best,

Ben

oscarBravo

Hm. Looks like an imapd process is being spawned by the attempt to connect, but is dying as soon as the authentication fails. From syslog:

Aug 25 17:37:46 debby imapd[697]: AUTHENTICATE LOGIN failure host=homeboy.home.cunnane.net [192.168.0.21]
Aug 25 17:37:50 debby imapd[697]: AUTHENTICATE LOGIN failure host=homeboy.home.cunnane.net [192.168.0.21]
Aug 25 17:37:55 debby imapd[697]: Logout user=paul host=homeboy.home.cunnane.net [192.168.0.21]

Next time I tried, the imapd process id was 707. This would be consistent with inetd, right?

Typedef

Edit whatever imap.conf file it is you're using, so that naffness like pam is turned off and you use just normal passwd based authentication.

Or the otherway around.

That error message is just telling you that the event occured, you'll have to mess about with the config file (or command line opts) to get more meaningful error output from syslog or whatever logging facility your IMAP Daemon uses.

oscarBravo

I don't have an imap.conf anywhere, it looks like uw-imapd is intent on just using PAM no matter what.

Other PAM-enabled daemons are working fine. FTP works perfectly, for example. What's bugging me now is that IMAP seems to be ignoring the PAM configuration. I tried a basic configuration:

auth     required   pam_unix.so
account  required   pam_unix.so
password required   pam_unix.so
session  required   pam_unix.so

which doesn't work; I tried putting random garbage in that file, which doesn't work. I get a message in auth.log saying "Login disabled" - I've no idea what that means.

Reading /usr/share/doc/uw-imapd/README.Debian, it says "[This package has] been compiled with CRAM-MD5 SASL support. See [libcclient]/md5.txt for additional information. NOTE: If your users seem to have problems logging in, this is the first thing to check."

md5.txt tells me the CRAM-MD5 authentication database is in /etc/cram-md5.pwd - but I don't have that file! I'm getting steadily more confused here...

oscarBravo

Sorted. I set up the client to use SSL, and it's working now. The annoying thing is that I tried that earlier, and it didn't work! I suppose I must have tweaked something on the server in the meantime.

Seems the "login disabled" message indicated that plaintext passwords are not allowed.

Now all I have to worry about is the server's temporary SSL cert expiring in a year's time! :rolleyes:

Rew

Most of the major distros seem to be shipping with SSL only IMAP servers. Probably a good thing but their docs arn't the best hence us poor users get all confused

Took me a hour or 2 to figure it out on a SuSE box