0

I am currently trying to augment my mailsystem by allowing servers that received mails from me within the last ten seconds to perform ident lookups. While the needed iptables rules are working flawlessly, I am facing problems with the installed authd package.

Calling in.authd from the command line yields the desired results:

# in.authd -t60 --xerror --os -E 993,53558
993 , 53558 : USERID : OTHER :[U2FsdGVkX19EFvZ6dxXLJJl2oKKW/PVOKmX5ER0WWWs=]

However, when trying the same over a network socket, I get a delay of up to 10 seconds followed by an error:

# time echo 993, 53558 | nc localhost 113
993 , 53558 : ERROR :NO-USER

real    0m5.036s
user    0m0.003s
sys 0m0.007s

The delay made me believe there were a permission issue leading to a timeout. Looking at the source code of authd, this could happen if reading from /proc/net/tcp* fails or if lookups on those files fail repeatedly. But:

Unix Permissions

Ident User

# finger ident
Login: ident                    Name: 
Directory: /                            Shell: /sbin/nologin
Never logged in.
No mail.
No Plan.

Group Memberships

# id ident
uid=98(ident) gid=98(ident) groups=98(ident)

In light of this, invoking in.authd as the ident user works as expected:

# sudo -u ident in.authd -t60 --xerror --os -E 993,53558
993 , 53558 : USERID : OTHER :[U2FsdGVkX1/CxIcvTsEmTnhLSGjnwZ/X9TCwQ4ovZXk=]

File Permissions

# ls -alZ /proc/net/tcp*
-r--r--r--. root root system_u:object_r:proc_net_t:s0  /proc/net/tcp
-r--r--r--. root root system_u:object_r:proc_net_t:s0  /proc/net/tcp6

SELinux

Nothing suspicious here:

# grep ident /var/log/audit/audit.log | audit2why
Nothing to do
# grep auth /var/log/audit/audit.log | audit2why
Nothing to do

I am a bit out of ideas. This happens also when I allow in.authd to be started as root. journalctl is not overly helpful as it just logs the unit in question going into failed state:

# journalctl -ln5 --unit=auth@*
systemd[1]: Started Authd Ident Protocol Requests Server ([::1]:55841).
systemd[1]: Starting Authd Ident Protocol Requests Server ([::1]:55841)...
systemd[1]: auth@7-::1:113-::1:55841.service: main process exited, code=exited, status=1/FAILURE
systemd[1]: Unit auth@7-::1:113-::1:55841.service entered failed state.
systemd[1]: auth@7-::1:113-::1:55841.service failed.

Putting in.authd into "debug" mode (if you can call it that) doesn't reveal any additional informations. I am short of enforcing a username via --username as I am rather concerned with the delay than correctness of the output. Granted, in the day and age of mass hosting of virtual users, the returned values will hardly be correct in the first place, but I really like the idea of returning something meaningful here. Any help is appreciated.

0

May others not fall into the same trap. Everything is actually fine. From the testing section of the authd documentation:

Execute "telnet localhost auth" and type the two ports separated by a comma. The two ports selected must have a foreign address of localhost, or 127.0.0.1 as well as a matching local address. If they do not, a NO-USER error will be returned.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.