I am currently trying to augment my mailsystem by allowing servers that received mails from me within the last ten seconds to perform ident lookups. While the needed iptables rules are working flawlessly, I am facing problems with the installed authd package.
in.authd from the command line yields the desired results:
# in.authd -t60 --xerror --os -E 993,53558 993 , 53558 : USERID : OTHER :[U2FsdGVkX19EFvZ6dxXLJJl2oKKW/PVOKmX5ER0WWWs=]
However, when trying the same over a network socket, I get a delay of up to 10 seconds followed by an error:
# time echo 993, 53558 | nc localhost 113 993 , 53558 : ERROR :NO-USER real 0m5.036s user 0m0.003s sys 0m0.007s
The delay made me believe there were a permission issue leading to a timeout. Looking at the source code of authd, this could happen if reading from
/proc/net/tcp* fails or if lookups on those files fail repeatedly. But:
# finger ident Login: ident Name: Directory: / Shell: /sbin/nologin Never logged in. No mail. No Plan.
# id ident uid=98(ident) gid=98(ident) groups=98(ident)
In light of this, invoking
in.authd as the ident user works as expected:
# sudo -u ident in.authd -t60 --xerror --os -E 993,53558 993 , 53558 : USERID : OTHER :[U2FsdGVkX1/CxIcvTsEmTnhLSGjnwZ/X9TCwQ4ovZXk=]
# ls -alZ /proc/net/tcp* -r--r--r--. root root system_u:object_r:proc_net_t:s0 /proc/net/tcp -r--r--r--. root root system_u:object_r:proc_net_t:s0 /proc/net/tcp6
Nothing suspicious here:
# grep ident /var/log/audit/audit.log | audit2why Nothing to do # grep auth /var/log/audit/audit.log | audit2why Nothing to do
I am a bit out of ideas. This happens also when I allow
in.authd to be started as root.
journalctl is not overly helpful as it just logs the unit in question going into failed state:
# journalctl -ln5 --unit=auth@* systemd: Started Authd Ident Protocol Requests Server ([::1]:55841). systemd: Starting Authd Ident Protocol Requests Server ([::1]:55841)... systemd: auth@7-::1:113-::1:55841.service: main process exited, code=exited, status=1/FAILURE systemd: Unit auth@7-::1:113-::1:55841.service entered failed state. systemd: auth@7-::1:113-::1:55841.service failed.
in.authd into "debug" mode (if you can call it that) doesn't reveal any additional informations. I am short of enforcing a username via
--username as I am rather concerned with the delay than correctness of the output. Granted, in the day and age of mass hosting of virtual users, the returned values will hardly be correct in the first place, but I really like the idea of returning something meaningful here. Any help is appreciated.