OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Postfix SMTP AUTH sasl authentication fails
From: Darren Nickerson (darren.nickersoniworkwell.com)
Date: Sat Jun 17 2000 - 11:05:47 CDT

>>>>> On Sat, 17 Jun 2000, "Liviu" == Liviu Daia wrote:

  Liviu> That's your problem: you need openssl for cyrus-sasl to be able to do
  Liviu> CRAM-MD5 authentication --- it even says so at compile time (I'm not
  Liviu> sure why it still advertises it though).

Are you sure? Here's how SASL configured itself without openssl:

[snip]
checking DB path to use... /etc/sasldb
checking for db.h... yes
checking for db_open in -ldb... yes
checking DB library to use... berkeley
checking for dlopen in -ldl... yes
checking for syslog... yes
checking for crypt... no
checking for crypt in -lcrypt... yes
checking for connect... yes
checking for pam_start in -lpam... yes
checking for security/pam_appl.h... yes
checking PAM support... yes
checking CRAM-MD5... enabled <----- ENABLED!!
checking SCRAM-MD5... disabled
checking for des_pcbc_encrypt in -ldes... yes
checking DIGEST-MD5... enabled <----- ENABLED!!
checking KERBEROS_V4... disabled
checking for gssapi.h... no
checking for gssapi/gssapi.h... no
configure: warning: Disabling GSSAPI
checking GSSAPI... disabled
checking ANONYMOUS... enabled
checking PLAIN... enabled
checking LOGIN... disabled
checking SRP... disabled
checking for rc4_init in -lrc4... no
checking for RSAPublicEncrypt in -lrsaref... no
checking for RC4_set_key in -lcrypto... no
configure: warning: SSL2: Disabling rc4 support <----- DISABLED
checking rc4 support... no
checking for dirent.h that defines DIR... yes
checking for opendir in -ldir... no
checking for ANSI C header files... yes
checking for strchr... yes
[snip]

Clearly there's a problem after it configures this way:

> Jun 16 14:57:11 alden1 saslpasswd: unable to dlopen
> /usr/lib/sasl/libdigestmd5.so: /usr/lib/sasl/libdigestmd5.so:
> undefined symbol: des_key_sched

But it's not obvious to me from this that I needed openssl for the features I was trying to implement.

-Darren