New version of Enable PAM_RHOST patch

[lmctv]

Originally submitted as

https://bugzilla.cyrusimap.org/show_bug.cgi?id=3468

The patch changes saslauthd's protocol ABI, I think this should lead to an increase in SONAME's ABI_VERSION field.

Contrary to what I said in the original bugzilla submission, the patch have been in production use since 5 years, on some of the systems I'm managing, in particular, on a frontend system getting more than 100 thousand login attempts each day, which makes for more than 200 million SASL login operations till now.

The protocol as implemented in testsaslauthd has been updated too, this solves
the issue Petr Lautrbach wrote about in

https://bugzilla.redhat.com/show_bug.cgi?id=683797#c12

While the changes are really limited, I'm hereby expressly authorizing
redistribution and use under the original file's license.

In detail:

1. lib/checkpw.c: 4 clause bsd-like license *cmu
2. saslauthd/auth_dce.{c,h}: 2 clause bsd-like license - *md
3. saslauthd/auth_getpwent.{c,h}: 2 clause bsd-like license - *md
4. saslauthd/auth_httpform.{c,h}: 2 clause bsd-like license - *pe
5. saslauthd/auth_krb4.{c,h}: 2 clause bsd-like license - *md
6. saslauthd/auth_krb5.{c,h}: 2 clause bsd-like license - *md
7. saslauthd/auth_ldap.{c,h}: 2 clause bsd-like license - *ib
8. saslauthd/auth_pam.{c,h}: 2 clause bsd-like license - *fk
9. saslauthd/auth_rimap.{c,h}: 2 clause bsd-like license - *md
10. saslauthd/auth_sasldb.{c,h}: 2 clause bsd-like license - *md
11. saslauthd/auth_shadow.{c,h}: 2 clause bsd-like license - *md
12. saslauthd/auth_sia.{c,h}: 2 clause bsd-like license - *md
13. saslauthd/ipc_doors.c: 2 clause bsd-like license - *md
14. saslauthd/ipc_unix.c: 2 clause bsd-like license - *md
15. saslauthd/mechanisms.h: 2 clause bsd-like license - *md
16. saslauthd/saslauthd-main.{c,h}: 2 clause bsd-like license - *md

*cmu - Carnegie Mellon University.
*md - Messaging Direct Ltd.
*pe - Pyx Engineering AG
*ib - Igor Brezac
*fk - Fabian Knittel

As for the copyright, I would be equally satisfied, at sasl project's
representative's sole option, either if it would be assigned to the respective
file's copyright owner, or if a statement was added in each of the modified .c
files declaring my own copyright on the changed portions.

[ksmurchison]

I think I'd like to hold off on this until a 2.2 release. I don't want to change the wire protocol in a patch version

[lmctv]

@ksmurchison: Fair enough; this is perfectly in-line with my suggestion to defer the integration to a soname change time.

In the meanwhile, we've been testing the patched code on the following non-linux systems:

• solaris 11
• solaris 10
• freebsd 11

and I can confirm the patched code worked correctly throughout 150,000 failed and good logins on each of the tested systems.

[cepheid666]

@ksmurchison Do you know when 2.2 might come out? The underlying problem (#346) is still an issue and it'd be great to have saslauthd log rhost in pam like other services do. Would this patch also require updates to various saslauthd-client software like sendmail, or would saslauthd pick up the rhost automatically?

Given the age of this issue (back to at least 2011), and the last comment in this thread being over 2 years old, might you reconsider implementing this in a patch version?

In any case, it would be amazing to have this fixed so blocking software like fail2ban can operate properly for things like SMTP brute-force auth attack. (I know there's a LogLevel workaround, but that comes with other prices...)

Thanks!

[lmctv]

[...] Would this patch also require updates to various saslauthd-client software like sendmail, or
would saslauthd pick up the rhost automatically?

With this patch in, the connection parameters are correctly inserted in the pam environment without any further configuration action.

[cepheid666]

With this patch in, the connection parameters are correctly inserted in the pam environment without any further configuration action.

Excellent news. So then the question is whether we might be able to get this released prior to 2.2, given how old this issue is? Or, is there an easy way to implement it without an official release? (e.g., is there a branch with this applied already, or a pre-release SVN?)

Thanks!

[quanah]

@ksmurchison any objection to this getting merged into mainline, since the 2.1 release branch is separate?

[ksmurchison]

Go for it

[cepheid666]

Can package maintainers backport this fix into RHEL/CentOS 7 and 8?

[quanah]

@cepheid666 Should probably file a bug in the RHEL bugzilla for that.

[cepheid666]

Right, will do, didn't know if the package maintainers are here also. But will do. Thanks!