OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: postfix authentication against Active Directory

From: Victor Duchovni (Victor.DuchovniMorganStanley.com)
Date: Mon Aug 01 2005 - 14:04:14 CDT


On Mon, Aug 01, 2005 at 02:58:22PM -0300, Juliano Dapper wrote:

> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31045]:
> dict_ldap_debug: ldap_new_socket: 9
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31045]:
> dict_ldap_debug: ldap_prepare_socket: 9
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31045]:
> dict_ldap_debug: ldap_connect_to_host: Trying 172.22.2.11:389
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31045]:
> dict_ldap_debug: ldap_connect_timeout: fd: 9 tm: 60 async: 0
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31045]:
> dict_ldap_debug: ldap_ndelay_on: 9
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_create
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_url_parse_ext(ldap://172.22.2.11:389)
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_bind
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_simple_bind
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_sasl_bind
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_send_initial_request
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_new_connection
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_int_open_connection
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_connect_to_host: 172.22.2.11
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_new_socket: 10
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_prepare_socket: 10
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_connect_to_host: Trying 192.168.1.1:389
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_connect_timeout: fd: 10 tm: 60 async: 0
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31044]:
> dict_ldap_debug: ldap_ndelay_on: 10
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31045]:
> dict_ldap_debug: ldap_is_sock_ready: 9
> Aug 1 14:46:33 openldap2 postfix/trivial-rewrite[31045]:
> dict_ldap_debug: ldap_ndelay_off: 9
> Aug 1 14:46:33 openldap2 postfix/smtpd[31040]: warning: premature
> end-of-input on private/rewrite socket while reading input attribute
> name

Crash in the LDAP library. DLL hell perhaps between SASLv1 in LDAP
and SASLv2 in Postfix. Or other integration problem.

It is also possible that LDAP is initializing SASL twice in the
same address space, which could be problematic.

I strongly recommend building your own stripped to bare-bones client
LDAP library for use with Postfix. See LDAP_README.

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomopostfix.org?body=unsubscribe%20postfix-users>