implement authentication via K_AUTH

[omar-polo]

This is the continuation of OpenSMTPD/OpenSMTPD-extras#64.

Since proc tables can know do the authentication themselves, it should be possible to handle K_AUTH, receive the plaintext password from smtpd and let the LDAP server do the authentication, instead of the current way of requiring the LDAP server to send us the hashed password.

[likle]

Hey @omar-polo, are you already working on this, or would you like some help with it? I currently see two small challenges in implementing this. First, I believe K_AUTH might not be usable yet, if that gets confirmed. Second, binding the user to verify the password could be problematic due to the single connection and asynchronous nature of table-ldap. One possible solution might be to open a new connection for each request?

[omar-polo]

Hello, sorry about the delay. I'm not actively working on ldap as I'm not really using it, I merely ported the existing code to the new way filters work by changing the API of the transport protocol. There is one user, that doesn't have a github account, but is active on both irc and the mailing list that is working quite a lot, which goes by the nickname "satanist".

I'd like to get the K_AUTH issue fixed as soon as possible, but for the other issue I can't really comment at the moment, I'm afraid.

[z411]

I created my own quick and dirty table handler in sh for reference thanks to this post and smtpd-tables(7) man page, it offloads the ldap handling to ldap(1) available in OpenBSD's base. It can do both lookups and auth, but for my case it's hardcoded to handle e-mail as input and vmail as output (not for use in production!)

While I can use this until table-ldap gets K_AUTH implemented, I can see OpenSMTPD sending the password in lowercase, so it'd be nice if this is mitigated upstream (tracked in OpenSMTPD/OpenSMTPD#1268) as I am generally not a fan of custom patching OpenBSD's base.

As an aside, when a user is not found I reply found|nonexistent so smtpd to resolve to a nonexistent user and responds 550 Invalid recipient, instead of not-found, which makes smtpd respond with 524 5.2.4 Mailing list expansion problem (this happens with static tables as well). I'm not sure if this is expected, but it contradicts what's said here.

#!/bin/sh

ldaphost="ldap://10.0.1.50"
binddn="cn=bind,dc=omaera,dc=org"
bindpw="verysecure"
bindbase="ou=users,dc=omaera,dc=org"
bindfilter="(&(mail=%s)(memberOf=cn=mail_users,ou=groups,dc=omaera,dc=org))"
vmail="vmail"

get_lookup() {
        user="$1"
        the_filter=$(printf "$bindfilter" "$user")

        ldap search -H "$ldaphost" \
             -D "$binddn" -w "$bindpw" -b "$bindbase" \
             "$the_filter" | grep "^dn:" | cut -d' ' -f2- || echo
}

get_auth() {
        the_dn="$1"
        the_pw="$2"

        ldap search -H "$ldaphost" \
                -D "$the_dn" -w "$the_pw" -b "$the_dn" \
                "" > /dev/null 2>&1
}

do_lookup() {
        [ -z "$1" ] || [ -z $2 ] && return 1
        uid="$1"
        user="$2"

        dn=$(get_lookup "$user")
        if [ ! -z "$dn" ]; then
                echo "lookup-result|$uid|found|$vmail"
        else
                echo "lookup-result|$uid|found|nonexistent"
        fi
}

do_auth() {
        [ -z "$1" ] || [ -z "$2" ] && return 1

        uid="$1"
        user="${2%%:*}"
        passwd="${2#*:}"

        dn=$(get_lookup "$user")
        if [ -n "$dn" ] && get_auth "$dn" "$passwd"; then
                echo "check-result|$uid|found"
        else
                echo "check-result|$uid|not-found"
        fi
}

while IFS='|' read -r f1 f2 f3 f4 f5 f6 f7 f8 rest; do
    if [ "$f1" = "config" ] && [ "$f2" = "ready" ]; then
        echo "register|auth"
        echo "register|alias"
        echo "register|ready"
        continue
    fi
    if [ "$f5" = "check" ]; then
        do_auth "$f7" "$f8" &
        continue
    fi
    if [ "$f5" = "lookup" ]; then
        case "$f8" in
                *@?*) do_lookup "$f7" "$f8" & ;;
                *) echo "lookup-result|$f7|not-found" ;;
        esac
        continue
    fi
done
wait

As mentioned by @likle indeed a slow ldap server blocking the loop would be problematic, which is why I'm spawning a subshell for those.