Attachment #10696 for bug #21383

View | Details | Raw Unified | Return to bug 21383
Collapse All | Expand All





PORTNAME=	cyrus-sasl
PORTVERSION=	1.5.24
PORTREVISION=	1
CATEGORIES=	security
MASTER_SITES=	ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/ \
		${MASTER_SITE_LOCAL} \


INSTALLS_SHLIB=	yes

.include <bsd.port.pre.mk>

Y2K=		http://asg.web.cmu.edu/cyrus/imapd/y2k.html

MAN3=		sasl.3 sasl_authorize_t.3 sasl_callbacks.3 sasl_checkpass.3 \

		sasl_setprop.3 sasl_usererr.3
MAN8=		sasldblistusers.8 saslpasswd.8

USE_AUTOMAKE=	YES
USE_LIBTOOL=	YES
AUTOHEADER=	autoheader
AUTOMAKE=	automake --add-missing --include-deps

CONFIGURE_ARGS=	--sysconfdir=${PREFIX}/etc \
		--with-plugindir=${PREFIX}/lib/sasl \
		--with-dbpath=${PREFIX}/etc/sasldb \

		--with-pwcheck=/var/pwcheck \
		--with-rc4=openssl

SCRIPTS_ENV=	WRKDIRPREFIX="${WRKDIRPREFIX}" \
		PREFIX="${PREFIX}" \
		TOUCH="${TOUCH}" \
		MKDIR="${MKDIR}"

# JavaSASL needs someone to look at to get it to build
#JAVADIR=        jdk1.1.8
#JAVALIBDIR=     ${PREFIX}/${JAVADIR}/lib/i386/green_threads/


		EBONES=${EBONES} \
		NOPORTDOCS=${NODOCS}

pre-fetch:
	@${SETENV} ${SCRIPTS_ENV} ${SH} ${SCRIPTDIR}/configure.sasl

pre-configure:
	@(cd ${WRKSRC} && ${AUTOHEADER})

# Create Cyrus user and group
pre-install:
	@${SH} ${PKGDIR}/INSTALL ${PKGNAME} PRE-INSTALL

post-install:
	@${SED} -e "/%%PREFIX%%/s##${PREFIX}#g" ${FILESDIR}/pwcheck.sh \
		> ${PREFIX}/etc/rc.d/pwcheck.sh
	@${CHMOD} 755 ${PREFIX}/etc/rc.d/pwcheck.sh
	${INSTALL} -d -m 700 -o cyrus -g cyrus /var/pwcheck

.for file in ${DOC2}
	@${INSTALL_DATA} ${WRKSRC}/doc/${file} ${PREFIX}/share/doc/SASL
.endfor
	@${INSTALL_DATA} ${FILESDIR}/Sendmail.README ${PREFIX}/share/doc
.for file in ${HTDOCS}
	@${INSTALL_DATA} ${WRKSRC}/doc/${file}.html ${PREFIX}/share/doc/SASL/html
.endfor
.endif
	@PKG_PREFIX=${PREFIX} BATCH=${BATCH} ${SH} ${PKGDIR}/INSTALL ${PKGNAME} POST-INSTALL
	@${CAT} ${PKGMESSAGE}

.if exists(${WRKDIRPREFIX}${.CURDIR}/Makefile.inc)
post-clean:
	@${RM} -f ${WRKDIRPREFIX}${.CURDIR}/Makefile.inc

.if exists(${WRKDIRPREFIX}${.CURDIR}/Makefile.inc)
.include "${WRKDIRPREFIX}${.CURDIR}/Makefile.inc"
.elif ${PREFIX} != ${LOCALBASE}
# Save PREFIX so that it can be used during make install
.BEGIN:
	@echo "PREFIX=	${PREFIX}" > ${WRKDIRPREFIX}${.CURDIR}/Makefile.inc
.endif

.include <bsd.port.mk>




How to enable SMTP AUTH with FreeBSD default Sendmail 8.11

1. Edit /usr/src/usr.sbin/sendmail/Makefile, and change the line:

    LDADD= -lutil -lwrap
into
    LDADD+= -lutil -lwrap

    NOTE: This change is in 5.0-CURRENT and will be MFC'd to
    4.1-STABLE later.

2) Add the following to  /etc/make.conf:

# Add SMTP AUTH support to Sendmail
.if ${.CURDIR} == "/usr/src/usr.sbin/sendmail"
CFLAGS+=-DSASL -I/usr/local/include/sasl -L/usr/local/lib
LDADD+=-lsasl
.endif

3) Rebuild FreeBSD (make buildworld, ...)

4) Create /usr/local/lib/sasl/Sendmail.conf with the following.

   pwcheck_method: pwcheck


Line 1 Link Here

(-)cyrus-sasl/files/md5 (-1 / +1 lines)
1	MD5 (cyrus-sasl-1.5.24.tar.gz) = aedc0f8b594e2a13503b375ed78f62b7	1	MD5 (cyrus-sasl-1.5.24.tar.gz) = ac3837c071c258b80021325936db2583




--- configure.in.orig	Thu Jul 20 21:35:01 2000
+++ configure.in	Sat Sep 16 13:58:02 2000
@@ -66,8 +66,9 @@
 dnl check for -R, etc. switch
 CMU_GUESS_RUNPATH_SWITCH

 
 AM_DISABLE_STATIC
 
@@ -310,6 +311,88 @@
 fi
 AM_CONDITIONAL(PWCHECK, test "$with_pwcheck" != no)
 
+dnl MySQL
+AC_ARG_WITH(mysql,  [ --with-mysql=PATH        enable authentication from MySQL database [no] ],
+  with_mysql=$withval,
+  with_mysql=no)
+
+if test -z "$with_mysql"; then
+  for mysqlloc in lib/mysql lib
+  do
+    if test -f ${prefix}/${mysqlloc}/libmysqlclient.a; then
+      with_mysql="${prefix}"
+      break
+    elif test -f /usr/local/${mysqlloc}/libmysqlclient.a; then
+      with_mysql="/usr/local"
+      break
+    elif test -f /usr/${mysqlloc}/libmysqlclient.a; then
+      with_mysql="/usr"
+      break
+    fi
+  done
+fi
+
+LIB_MYSQL=""
+case "$with_mysql" in
+    no) true;;
+    ""|yes) AC_CHECK_LIB(mysqlclient, mysql_select_db,
+		AC_DEFINE(HAVE_MYSQL)
+		LIB_MYSQL="-lmysqlclient",
+		with_mysql=no);;
+    *)	if test -d ${with_mysql}/include/mysql; then
+	  CPPFLAGS="$CPPFLAGS -I${with_mysql}/include/mysql"
+	else
+	  CPPFLAGS="$CPPFLAGS -I${with_mysql}/include"
+	fi
+	if test -d ${with_mysql}/lib/mysql; then
+	  LDFLAGS="$LDFLAGS -L${with_mysql}/lib/mysql"
+	fi
+	AC_DEFINE(HAVE_MYSQL)
+	LIB_MYSQL="-lmysqlclient";;
+esac
+AC_SUBST(LIB_MYSQL)
+
+dnl LDAP
+AC_ARG_WITH(ldap, [  --with-ldap=PATH         enable authentication from LDAP [no] ],
+  with_ldap=$withval,
+  with_ldap=no)
+
+if test -z "$with_ldap"; then
+  for ldaploc in lib/ldap lib
+  do
+    if test -f ${prefix}/${ldaploc}/libldap.a; then
+      with_ldap="${prefix}"
+      break
+    elif test -f /usr/local/${ldaploc}/libldap.a; then
+      with_ldap="/usr/local"
+      break
+    elif test -f /usr/${ldaploc}/libldap.a; then
+      with_ldap="/usr"
+      break
+    fi
+  done
+fi
+
+LIB_LDAP=""
+case "$with_ldap" in
+    no) true;;
+    ""|yes) AC_CHECK_LIB(ldap, ldap_open,
+                AC_DEFINE(HAVE_LDAP)
+		LIB_LDAP="-lldap -llber",
+                with_ldap=no);;
+    *)  if test -d ${with_ldap}/include/ldap; then
+          CPPFLAGS="${CPPFLAGS} -I${with_ldap}/include/ldap"
+        else
+          CPPFLAGS="${CPPFLAGS} -I${with_ldap}/include"
+        fi
+	if test -d ${with_ldap}/lib/ldap; then
+	  LDFLAGS="$LDFLAGS -L${with_ldap}/lib/ldap"
+	fi
+        AC_DEFINE(HAVE_LDAP)
+        LIB_LDAP="-lldap -llber";;
+esac
+AC_SUBST(LIB_LDAP)
+
 dnl CRAM-MD5
 AC_ARG_ENABLE(cram, [  --enable-cram           enable CRAM-MD5 authentication [yes] ],
   cram=$enableval,
@@ -434,11 +517,15 @@
   fi
 
   if test "$with_des" != no; then
+    case "$host_os" in
+	freebsd*)
+	    COM_ERR="-lcom_err"
+	    ;;
+    esac
     AC_CHECK_HEADER(krb.h,
-      AC_CHECK_LIB(krb, krb_mk_priv, COM_ERR="",
-	AC_CHECK_LIB(krb, krb_mk_priv, COM_ERR="-lcom_err",
-                     AC_WARN(No Kerberos V4 found); krb4=no, -ldes -lcom_err),
-        -ldes),
+      AC_CHECK_LIB(krb, krb_mk_priv,:,
+		   AC_WARN(No Kerberos V4 found); krb4=no,
+		   -ldes $COM_ERR),
       AC_WARN(No Kerberos V4 found); krb4=no)
   else
     AC_WARN(No DES library found for Kerberos V4 support)




--- acconfig.h.orig	Wed Jul  5 11:59:25 2000
+++ acconfig.h	Fri Sep 15 20:56:28 2000
@@ -84,6 +84,12 @@
 /* do we have PAM for plaintext password checking? */
 #undef HAVE_PAM
 
+/* do we have MySQL for plaintext password checking? */
+#undef HAVE_MYSQL
+
+/* do we have LDAP for plaintext password checking? */
+#undef HAVE_LDAP
+
 /* what flavor of GSSAPI are we using? */
 #undef HAVE_GSS_C_NT_HOSTBASED_SERVICE
 

Line 0 Link Here

(-)cyrus-sasl/patches/patch-ah (+9 lines)
	1	--- lib/Makefile.am.orig Thu Jul 20 21:35:02 2000
	2	+++ lib/Makefile.am Fri Sep 15 20:56:28 2000
	3	@@ -53,5 +53,5 @@
	4	EXTRA_libsasl_la_SOURCES = db_none.c db_ndbm.c db_gdbm.c db_berkeley.c db_testw32.c
	5	libsasl_la_LDFLAGS = -version-info $(sasl_version)
	6	libsasl_la_DEPENDENCIES = $(SASL_DB_BACKEND) @LTLIBOBJS@
	7	-libsasl_la_LIBADD = @LTLIBOBJS@ $(SASL_DB_BACKEND) $(SASL_DB_LIB) $(SASL_DL_LIB) $(PLAIN_LIBS)
	8	+libsasl_la_LIBADD = @LTLIBOBJS@ $(SASL_DB_BACKEND) $(SASL_DB_LIB) $(SASL_DL_LIB) $(PLAIN_LIBS) ${LIB_LDAP} ${LIB_MYSQL}
	9	# PLAIN_LIBS are linked in for sasl_checkpass




--- lib/checkpw.c.orig	Wed Jul 19 20:24:13 2000
+++ lib/checkpw.c	Sat Sep 16 21:07:33 2000
@@ -95,10 +95,19 @@
 #include <sys/un.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
-#endif
+#endif /* HAVE_UNISTD_H */
 
 extern int errno;
-#endif
+#endif /* HAVE_PWCHECK */
+
+#ifdef HAVE_MYSQL
+#include <mysql.h>
+#endif /* HAVE_MYSQL */
+
+#ifdef HAVE_LDAP
+#include <lber.h>
+#include <ldap.h>
+#endif /* HAVE_LDAP */
 
 #ifdef HAVE_KRB
 
@@ -170,12 +179,20 @@
     memcpy (&temp_key, "kerberos", 8);
     des_fixup_key_parity (&temp_key);
     des_key_sched (&temp_key, schedule);
+#ifdef __FreeBSD__
+    des_cbc_cksum ((const unsigned char *)password, &ivec, passlen, schedule, &ivec);
+#else
     des_cbc_cksum ((des_cblock *)password, &ivec, passlen, schedule, &ivec);
+#endif
 
     memcpy (&temp_key, &ivec, sizeof temp_key);
     des_fixup_key_parity (&temp_key);
     des_key_sched (&temp_key, schedule);
+#ifdef __FreeBSD__
+    des_cbc_cksum ((const unsigned char *)password, key, passlen, schedule, &ivec);
+#else
     des_cbc_cksum ((des_cblock *)password, key, passlen, schedule, &ivec);
+#endif
 
     des_fixup_key_parity (key);
 
@@ -210,10 +227,17 @@
     return (str);
 }
 
+#ifdef __FreeBSD__
+static int use_key(const char *user __attribute__((unused)),
+                   char *instance __attribute__((unused)),
+                   const char *realm __attribute__((unused)),
+                   const void *key, des_cblock *returned_key)
+#else
 static int use_key(char *user __attribute__((unused)), 
 		   char *instance __attribute__((unused)), 
 		   char *realm __attribute__((unused)), 
 		   void *key, des_cblock *returned_key)
+#endif
 {
     memcpy (returned_key, key, sizeof(des_cblock));
     return 0;
@@ -838,7 +862,7 @@
 
 
 /* pwcheck daemon-authenticated login */
-static int pwcheck_verify_password(sasl_conn_t *conn,
+static int pwcheck_verify_password(sasl_conn_t *conn __attribute__((unused)),
 				   const char *userid, 
 				   const char *passwd,
 				   const char *service __attribute__((unused)),
@@ -853,8 +877,10 @@
     static char response[1024];
     int start, n;
     char pwpath[1024];
+#if 0	/* Not used */
     sasl_getopt_t *getopt;
     void *context;
+#endif
 
     if (reply) { *reply = NULL; }
 
@@ -902,6 +928,260 @@
 
 #endif
 
+#ifdef HAVE_MYSQL
+/* DMZ mysql auth 12/29/1999
+ * Updated to 1.5.24 by SWH 09/12/2000
+ */
+#ifdef USE_CRYPT_PASSWORD
+#define QUERY_STRING    "select %s from %s where %s = '%s' and %s = password('%s')"
+#else
+#define QUERY_STRING    "select %s from %s where %s = '%s' and %s = '%s'"
+#endif
+
+static int mysql_verify_password(sasl_conn_t *conn,
+				const char *userid,
+				const char *password,
+				const char *service __attribute__((unused)),
+				const char *user_realm __attribute__((unused)),
+				const char **reply)
+{
+   unsigned int numrows;
+   MYSQL mysql,*sock;
+   MYSQL_RES *result;
+   char qbuf[300];
+   char *db_user="",
+        *db_passwd="",
+        *db_host="",
+        *db_uidcol="",
+        *db_pwcol="",
+        *db_database="",
+        *db_table="";
+   sasl_getopt_t *getopt;
+   void *context;
+ 
+   if (!userid || !password) {
+       return SASL_BADPARAM;
+   }
+   if (reply) { *reply = NULL; }
+ 
+   /* check to see if the user configured a mysqluser/passwd/host/etc */
+   if (_sasl_getcallback(conn, SASL_CB_GETOPT, &getopt, &context) == SASL_OK) {
+       getopt(context, NULL, "mysql_user", (const char **) &db_user, NULL);
+       if (!db_user) db_user = "";
+       getopt(context, NULL, "mysql_passwd", (const char **) &db_passwd, NULL);
+       if (!db_passwd) db_passwd = "";
+       getopt(context, NULL, "mysql_host", (const char **) &db_host, NULL);
+       if (!db_host) db_host = "";
+       getopt(context, NULL, "mysql_database", (const char **) &db_database, NULL);
+       if (!db_database) db_database = "";
+       getopt(context, NULL, "mysql_table", (const char **) &db_table, NULL);
+       if (!db_table) db_table = "";
+       getopt(context, NULL, "mysql_uidcol", (const char **) &db_uidcol, NULL);
+       if (!db_uidcol) db_uidcol = "";
+       getopt(context, NULL, "mysql_pwdcol", (const char **) &db_pwcol, NULL);
+       if (!db_pwcol) db_pwcol = "";
+    }
+
+    if (!(sock = mysql_connect(&mysql,db_host,db_user,db_passwd)))
+    {
+      if (reply) { *reply = "cannot connect to MySQL server"; }
+      return SASL_FAIL;
+    }
+
+    if (mysql_select_db(sock,db_database) < 0)
+    {
+      mysql_close(sock);
+      if (reply) { *reply = "cannot select MySQL database"; }
+      return SASL_FAIL;
+    }
+    /* select DB_UIDCOL from DB_TABLE where DB_UIDCOL = 'userid' AND DB_PWCOL = password('password') */
+    sprintf(qbuf,QUERY_STRING,db_uidcol,db_table,db_uidcol,userid,db_pwcol,password);
+    if (mysql_query(sock,qbuf) < 0 || !(result=mysql_store_result(sock)))
+    {
+      mysql_close(sock);
+      return SASL_FAIL;
+    }
+
+    if (result) //There were some rows found
+    {
+           if ((numrows = mysql_affected_rows(&mysql)) != 1)
+           {
+                   mysql_free_result(result);
+                   mysql_close(sock);
+		   if ((numrows > 1) && (reply)) { *reply = "Detected duplicate entries for user"; }
+                   return SASL_BADAUTH;
+           } else {
+                   mysql_free_result(result);
+                   mysql_close(sock);
+                   return SASL_OK;
+	   }
+    }
+    mysql_free_result(result);
+    mysql_close(sock);
+    return SASL_BADAUTH;
+}
+#endif /* HAVE_MYSQL */
+
+#ifdef HAVE_LDAP
+/* simon@surf.org.uk LDAP auth 07/11/2000
+ * Updated to 1.5.24 by SWH 09/12/2000
+ */
+
+#define LDAP_SERVER	"localhost"
+#define LDAP_BASEDN	"o=JOFA, c=UK"
+#define LDAP_UIDATTR	"uid"
+
+#ifndef TRUE
+# define TRUE		1
+# define FALSE		0
+#endif
+
+static int ldap_isdigits(char *value)
+{
+    char *ptr;
+    int num = TRUE;
+
+    for (ptr = value; *ptr != '\0' && num != FALSE; ptr++) {
+	if (!isdigit(*ptr))
+	    num = FALSE;
+    }
+
+    return num;
+}
+
+static int ldap_verify_password(sasl_conn_t *conn,
+				const char *userid,
+				const char *password,
+				const char *service __attribute__((unused)),
+				const char *user_realm __attribute__((unused)),
+				const char **reply)
+{
+
+    LDAP *ld;
+    LDAPMessage *result;
+    LDAPMessage *entry;
+    char *attrs[2];
+    char filter[200]; 
+    char *dn,
+	 *ldap_server="",
+	 *ldap_basedn="",
+	 *ldap_uidattr="",
+	 *port_num="";
+    int ldap_port = LDAP_PORT;
+    int count;
+    sasl_getopt_t *getopt;
+    void *context;
+
+    /* If the password is NULL, reject the login...
+     * Otherwise the bind will succed as a reference bind. Not good...
+     */
+    if (strcmp(password,"") == 0)
+    {
+	return SASL_BADPARAM;
+    }
+
+   if (reply) { *reply = NULL; }
+
+   /* check to see if the user configured a mysqluser/passwd/host/etc */
+   if (_sasl_getcallback(conn, SASL_CB_GETOPT, &getopt, &context) == SASL_OK) {
+	getopt(context, NULL, "ldap_server", (const char **) &ldap_server, NULL);
+	if (!ldap_server) ldap_server = LDAP_SERVER;
+	getopt(context, NULL, "ldap_basedn", (const char **) &ldap_basedn, NULL);
+	if (!ldap_basedn) {
+	    if (reply) { *reply = "ldap_basedn not defined"; }
+	    return SASL_BADPARAM;
+	}
+	getopt(context, NULL, "ldap_uidattr", (const char **) &ldap_uidattr, NULL);
+	if (!ldap_uidattr) ldap_uidattr = LDAP_UIDATTR;
+	getopt(context, NULL, "ldap_port", (const char **) &port_num, NULL);
+	if (!port_num) {
+	    ldap_port = LDAP_PORT;
+	} else if (!ldap_isdigits(port_num)) {
+	    if (reply) { *reply = "ldap_port - invalid value"; }
+	    return SASL_BADPARAM;
+	} else {
+	    ldap_port = atoi(port_num);
+	}
+    }
+
+    /* Open the LDAP connection. */
+    if ((ld = ldap_open(ldap_server, ldap_port)) == NULL)
+    {
+	if (reply) { *reply = "cannot connect to LDAP server"; }
+	return SASL_FAIL;
+    }
+
+    /* Bind anonymously so that you can find the DN of the appropriate user. */
+    if (ldap_simple_bind_s(ld,"","") != LDAP_SUCCESS)
+    {
+	ldap_unbind(ld);
+	if (reply) { *reply = "cannot bind to LDAP server"; }
+	return SASL_FAIL;
+    }
+
+    /* Generate a filter that will return the entry with a matching UID */
+    sprintf(filter,"(%s=%s)", ldap_uidattr,userid);
+
+    /* Just return country...This doesn't actually matter, since we will
+     * not read the attributes and values, only the DN
+     */
+    attrs[0] = "c";
+    attrs[1] = NULL;
+
+    /* Perform the search... */
+    if (ldap_search_s(ld,ldap_basedn,LDAP_SCOPE_SUBTREE,filter,attrs,1,&result) != LDAP_SUCCESS )
+    {
+	ldap_unbind(ld);
+	return SASL_BADAUTH;
+    }
+
+    /* If the entry count is not equal to one, either the UID was not unique or
+     * there was no match
+     */
+    if ((count = ldap_count_entries(ld,result)) != 1)
+    {
+	ldap_msgfree(result);
+	ldap_unbind(ld);
+	if ((count > 1) && (reply)) { *reply = "Detected duplicate entries for user"; }
+	return SASL_BADAUTH;
+    }
+
+    /* Get the first entry */
+    if ((entry = ldap_first_entry(ld,result)) == NULL)
+    {
+	ldap_msgfree(result);
+	ldap_unbind(ld);
+	return SASL_BADAUTH;
+    }
+
+    /* Get the DN of the entry */
+    if ((dn = ldap_get_dn(ld,entry)) == NULL)
+    {
+	ldap_msgfree(entry);
+	ldap_unbind(ld);
+	return SASL_BADAUTH;
+    }
+
+    /* Now bind as the DN with the password supplied earlier...
+     * Successful bind means the password was correct, otherwise the
+     * password is invalid.
+     */
+    if (ldap_simple_bind_s(ld,dn,(char *)password) != LDAP_SUCCESS)
+    {
+	free(dn);
+	ldap_msgfree(entry);
+	ldap_unbind(ld);
+	return SASL_BADAUTH;
+    }
+
+    free(dn);
+    ldap_msgfree(entry);
+    ldap_unbind(ld);
+    return SASL_OK;
+}
+
+#endif /* HAVE_LDAP */
+
 struct sasl_verify_password_s _sasl_verify_password[] = {
     { "sasldb", &sasldb_verify_password },
 #ifdef HAVE_KRB
@@ -921,6 +1201,12 @@
 #endif
 #ifdef HAVE_PWCHECK
     { "pwcheck", &pwcheck_verify_password },
+#endif
+#ifdef HAVE_MYSQL
+    { "mysql", &mysql_verify_password },
+#endif
+#ifdef HAVE_LDAP
+    { "ldap", &ldap_verify_password },
 #endif
     { NULL, NULL }
 };




--- doc/sysadmin.html.orig	Wed Jul 12 21:59:51 2000
+++ doc/sysadmin.html	Fri Sep 15 20:56:28 2000
@@ -171,6 +171,43 @@
 <dt><i>pwcheck</i><dd> checks passwords with the use of a seperate,
   helper daemon. <b>needs to be documented.</b><p>
 
+<dt><i>mysql</i><dd> A MySQL database can be used for plaintext
+  password checking by setting "pwcheck_method" to "mysql".<p>
+
+  <p>The following SASL options are used for MySQL Authentication:<p>
+
+  <dl>
+    <dd>mysql_user: &lt;user&gt;</dd>
+    <dd>mysql_passwd: &lt;cleartext pw&gt;</dd>
+    <dd>mysql_host: &lt;host&gt;</dd>
+    <dd>mysql_database: &lt;database&gt;</dd>
+    <dd>mysql_table: &lt;table&gt;</dd>
+    <dd>mysql_uidcol: &lt;username col&gt;</dd>
+    <dd>mysql_pwdcol: &lt;password col&gt;</dd>
+  </dl>
+
+  <p>MySQL pwcheck_method created by <a href="mailto:dmz@dmzs.com">David Matthew Zendzian</a>
+  the original patch may be found at <a href="http://www.dmzs.com/~dmz/projects/cyrus/">http://www.dmzs.com/~dmz/projects/cyrus/</a>.<p>
+
+<dt><i>ldap</i><dd> A LDAP server can be used for plaintext password
+  checking by setting "pwcheck_method" to "ldap".<p>
+
+  <p>The following SASL options are used for LDAP Authentication:<p>
+
+  <dl>
+    <dd>ldap_server: &lt;LDAP Server [localhost]&gt;
+    <dd>ldap_basedn: &lt;LDAP base dn&gt;
+    <dd>ldap_uidattr: &lt;LDAP uid attribute [uid]&gt;
+    <dd>ldap_port: &lt;LDAP port [389]&gt;
+  </dl>
+
+  <p>It is a requirement that "ldap_basedn" be set to the appropriate
+  value for your site<br>
+  (ex. ldap_basedn: o=surf, c=UK)<p>
+
+  <p>LDAP pwcheck_method created by <a href="mailto:simon@surf.org.uk">Simon@surf.org.uk</a>
+  the original patch may be found at <a href="http://www.surf.org.uk/">http://www.surf.org.uk/</a>.<p>
+
 <dt><i>write your own</i><dd> Last, but not least, the most flexible
   method of authentication for PLAIN is to write your own.  If you do
   so, any application that calls the "<tt>sasl_checkpass()</tt>"




--- plugins/kerberos4.c.orig	Wed Apr 19 11:18:48 2000
+++ plugins/kerberos4.c	Sat Sep 16 18:49:20 2000
@@ -696,8 +696,13 @@
 
     /* decrypt; verify checksum */
 
+#ifdef __FreeBSD__
+    des_pcbc_encrypt((const unsigned char *)in,
+		     (unsigned char *)in,
+#else
     des_pcbc_encrypt((des_cblock *)in,
 		     (des_cblock *)in,
+#endif
 		     clientinlen,
 		     text->init_keysched,
 		     &text->session,
@@ -1192,8 +1197,13 @@
     }
     sout[len]=0;
     
+#ifdef __FreeBSD__
+    des_pcbc_encrypt((const unsigned char *)sout,
+		     (unsigned char *)sout,
+#else
     des_pcbc_encrypt((des_cblock *)sout,
 		     (des_cblock *)sout,
+#endif
 		     len,
 		     text->init_keysched,
 		     (des_cblock *)text->session,

Lines 7-17 Link Here

(-)cyrus-sasl/pkg/INSTALL (-2 / +28 lines)
7		7
8	#set -vx	8	#set -vx
9		9
		10	PKG_BATCH=${BATCH:=NO}
		11
		12	PKG_PREFIX=${PKG_PREFIX:=/usr/local}
		13
10	#	14	#
11	# create 'cyrus' user and group before installing	15	# create 'cyrus' user and group before installing
12	#	16	#
13		17
14	create() {	18	create_user() {
15	if [ ! -x /usr/sbin/pw ]; then	19	if [ ! -x /usr/sbin/pw ]; then
16	echo "*** Please add a user and a group named \`cyrus' before installing this package."	20	echo "*** Please add a user and a group named \`cyrus' before installing this package."
17	exit 69	21	exit 69
Lines 65-73 Link Here
65	fi	69	fi
66	}	70	}
67		71
		72	create_sasldb() {
		73	if [ ! -f ${PGK_PREFIX}/etc/sasldb.db ]; then
		74	touch ${PGK_PREFIX}/etc/sasldb.db
		75	chown cyrus:mail ${PGK_PREFIX}/etc/sasldb.db
		76	chmod 640 ${PGK_PREFIX}/etc/sasldb.db
		77	fi
		78	}
		79
		80	# This should really be installed by Sendmail
		81
		82	sendmail_conf() {
		83	if [ ! -f ${PKG_PREFIX}/lib/sasl/Sendmail.conf ]; then
		84	echo "pwcheck_method: pwcheck" > ${PKG_PREFIX}/lib/sasl/Sendmail.conf
		85	fi
		86	}
		87
68	case $2 in	88	case $2 in
69	PRE-INSTALL)	89	PRE-INSTALL)
70	create	90	create_user
		91	;;
		92	POST-INSTALL)
		93	if [ "${PKG_BATCH}" = "NO" ]; then
		94	create_sasldb
		95	sendmail_conf
		96	fi
71	;;	97	;;
72		98
73	esac	99	esac




PREFIX/etc/cyrusdb.db now needs to be created
before applications that depend on SASL are used.

	su cyrus
	PREFIX/sbin/saslpasswd -c userid

You will also need to start the pwcheck daemon:

	PREFIX/etc/rc.d/pwcheck.sh start

Read the documentation in PREFIX/share/doc/SASL

How to enable SMTP AUTH with system Sendmail 8.11 - Sendmail.README

How to use LDAP or MySQL for passwords - see html/sysadmin.html

Lines 1-5 Link Here

(-)cyrus-sasl/pkg/PLIST (-3 / +10 lines)
1	@unexec %D/etc/rc.d/pwcheck.sh stop ; echo "pwcheck stopped."	1	@unexec %D/etc/rc.d/pwcheck.sh stop ; echo "pwcheck stopped."
2	etc/rc.d/pwcheck.sh	2	etc/rc.d/pwcheck.sh
		3	@comment remove ../etc/sasldb.db only if it exists and has a zero size.
		4	@unexec [ -f %D/etc/sasldb.db -a ! -s %D/etc/sasldb.db ] && rm %D/etc/sasldb.db
3	include/sasl/hmac-md5.h	5	include/sasl/hmac-md5.h
4	include/sasl/md5.h	6	include/sasl/md5.h
5	include/sasl/md5global.h	7	include/sasl/md5global.h
Lines 31-37 Link Here
31	lib/sasl/libplain.a	33	lib/sasl/libplain.a
32	lib/sasl/libplain.so	34	lib/sasl/libplain.so
33	lib/sasl/libplain.so.1	35	lib/sasl/libplain.so.1
34	@dirrm lib/sasl	36	@comment Sendmail.conf should be installed/uninstalled by Sendmail 8.11.
		37	@comment We install it here because Sendmail 8.11 is in the base system.
		38	@unexec echo "pwcheck_method: pwcheck" > %B/Sendmail.conf.tmp
		39	@unexec if cmp -s %B/Sendmail.conf %B/Sendmail.conf.tmp; then rm -f %B/Sendmail.conf %B/Sendmail.conf.tmp; else rm -f %B/Sendmail.conf.tmp fi
35	sbin/sasldblistusers	40	sbin/sasldblistusers
36	sbin/saslpasswd	41	sbin/saslpasswd
37	sbin/pwcheck	42	sbin/pwcheck
Lines 41-46 Link Here
41	%%NOPORTDOCS%%share/doc/SASL/INSTALL	46	%%NOPORTDOCS%%share/doc/SASL/INSTALL
42	%%NOPORTDOCS%%share/doc/SASL/NEWS	47	%%NOPORTDOCS%%share/doc/SASL/NEWS
43	%%NOPORTDOCS%%share/doc/SASL/README	48	%%NOPORTDOCS%%share/doc/SASL/README
		49	%%NOPORTDOCS%%share/doc/SASL/Sendmail.README
44	%%NOPORTDOCS%%share/doc/SASL/TODO	50	%%NOPORTDOCS%%share/doc/SASL/TODO
45	%%NOPORTDOCS%%share/doc/SASL/draft-leach-digest-sasl-05.txt	51	%%NOPORTDOCS%%share/doc/SASL/draft-leach-digest-sasl-05.txt
46	%%NOPORTDOCS%%share/doc/SASL/draft-newman-auth-scram-03.txt	52	%%NOPORTDOCS%%share/doc/SASL/draft-newman-auth-scram-03.txt
Lines 55-66 Link Here
55	%%NOPORTDOCS%%share/doc/SASL/html/sysadmin.html	61	%%NOPORTDOCS%%share/doc/SASL/html/sysadmin.html
56	%%NOPORTDOCS%%@dirrm share/doc/SASL/html	62	%%NOPORTDOCS%%@dirrm share/doc/SASL/html
57	%%NOPORTDOCS%%@dirrm share/doc/SASL	63	%%NOPORTDOCS%%@dirrm share/doc/SASL
		64	@dirrm lib/sasl
58	@mode u=rwx,go=	65	@mode u=rwx,go=
59	@cwd /var	66	@cwd /var
60	@exec mkdir pwcheck	67	@exec mkdir pwcheck
61	@exec chown cyrus:cyrus pwcheck	68	@exec chown cyrus:cyrus pwcheck
62	@exec chmod go= pwcheck	69	@exec chmod go= pwcheck
63	@comment This file gets create by the pwcheck program	70	@comment This file gets created by the pwcheck program
64	@unexec rm -f pwcheck/pwcheck	71	@unexec rm -f /var/pwcheck/pwcheck
65	@dirrm pwcheck	72	@dirrm pwcheck
66	@cwd %%PREFIX%%	73	@cwd %%PREFIX%%




#!/bin/sh
# $FreeBSD$

if [ -f ${WRKDIRPREFIX}${CURDIR}/Makefile.inc ]; then
	exit
fi

if [ "${BATCH}" ]; then
	exit
else
	/usr/bin/dialog --title "Additional pwcheck methods" --clear \
		--checklist "\n\
Please select desired options:" -1 -1 16 \
MySQL		"MySQL password Authentication" OFF \
OpenLDAP	"OpenLDAP password Authentication" OFF \
2> /tmp/checklist.tmp.$$

	retval=$?

	if [ -s /tmp/checklist.tmp.$$ ]; then
		set `cat /tmp/checklist.tmp.$$`
	fi
	rm -f /tmp/checklist.tmp.$$

	case $retval in
		0)	if [ -z "$*" ]; then
				echo "Nothing selected"
			fi
			;;
		1)	echo "Cancel pressed."
			exit 1
			;;
	esac
fi

${MKDIR} ${WRKDIRPREFIX}${CURDIR}
exec > ${WRKDIRPREFIX}${CURDIR}/Makefile.inc

echo "PREFIX=	${PREFIX}"

while [ "$1" ]; do
	case $1 in
		\"MySQL\")
			echo "LIB_DEPENDS+=	mysqlclient.6:\${PORTSDIR}/databases/mysql322-client"
			echo "CONFIGURE_ARGS+=--with-mysql=\${PREFIX}"
			;;
		\"OpenLDAP\")
			echo "LIB_DEPENDS+=	ldap.1:\${PORTSDIR}/net/openldap"
			echo "LIB_DEPENDS+=	lber.1:\${PORTSDIR}/net/openldap"
			echo "CONFIGURE_ARGS+=--with-ldap=\${PREFIX}"
			;;
		*)
			echo "Invalid option(s): $*" > /dev/stderr
			rm -f ${WRKDIRPREFIX}${CURDIR}/Makefile.inc
			exit 1
			;;
	esac
	shift
done

Return to bug 21383

Lines 7-12 Link Here

(-)cyrus-sasl/Makefile (-11 / +23 lines)
7		7
8	PORTNAME= cyrus-sasl	8	PORTNAME= cyrus-sasl
9	PORTVERSION= 1.5.24	9	PORTVERSION= 1.5.24
		10	PORTREVISION= 1
10	CATEGORIES= security	11	CATEGORIES= security
11	MASTER_SITES= ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/ \	12	MASTER_SITES= ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/ \
12	${MASTER_SITE_LOCAL} \	13	${MASTER_SITE_LOCAL} \
Lines 19-26 Link Here
19		20
20	INSTALLS_SHLIB= yes	21	INSTALLS_SHLIB= yes
21		22
22	.include <bsd.port.pre.mk>
23
24	Y2K= http://asg.web.cmu.edu/cyrus/imapd/y2k.html	23	Y2K= http://asg.web.cmu.edu/cyrus/imapd/y2k.html
25		24
26	MAN3= sasl.3 sasl_authorize_t.3 sasl_callbacks.3 sasl_checkpass.3 \	25	MAN3= sasl.3 sasl_authorize_t.3 sasl_callbacks.3 sasl_checkpass.3 \
Lines 32-39 Link Here
32	sasl_setprop.3 sasl_usererr.3	31	sasl_setprop.3 sasl_usererr.3
33	MAN8= sasldblistusers.8 saslpasswd.8	32	MAN8= sasldblistusers.8 saslpasswd.8
34		33
35	USE_AUTOCONF= YES	34	USE_AUTOMAKE= YES
36	USE_LIBTOOL= YES	35	USE_LIBTOOL= YES
		36	AUTOHEADER= autoheader
		37	AUTOMAKE= automake --add-missing --include-deps
		38
37	CONFIGURE_ARGS= --sysconfdir=${PREFIX}/etc \	39	CONFIGURE_ARGS= --sysconfdir=${PREFIX}/etc \
38	--with-plugindir=${PREFIX}/lib/sasl \	40	--with-plugindir=${PREFIX}/lib/sasl \
39	--with-dbpath=${PREFIX}/etc/sasldb \	41	--with-dbpath=${PREFIX}/etc/sasldb \
Lines 43-49 Link Here
43	--with-pwcheck=/var/pwcheck \	45	--with-pwcheck=/var/pwcheck \
44	--with-rc4=openssl	46	--with-rc4=openssl
45		47
46	# JavaSASL is currently Broken	48	SCRIPTS_ENV= WRKDIRPREFIX="${WRKDIRPREFIX}" \
		49	PREFIX="${PREFIX}" \
		50	TOUCH="${TOUCH}" \
		51	MKDIR="${MKDIR}"
		52
		53	# JavaSASL needs someone to look at to get it to build
47	#JAVADIR= jdk1.1.8	54	#JAVADIR= jdk1.1.8
48	#JAVALIBDIR= ${PREFIX}/${JAVADIR}/lib/i386/green_threads/	55	#JAVALIBDIR= ${PREFIX}/${JAVADIR}/lib/i386/green_threads/
49		56
Lines 93-104 Link Here
93	EBONES=${EBONES} \	100	EBONES=${EBONES} \
94	NOPORTDOCS=${NODOCS}	101	NOPORTDOCS=${NODOCS}
95		102
		103	pre-fetch:
		104	@${SETENV} ${SCRIPTS_ENV} ${SH} ${SCRIPTDIR}/configure.sasl
		105
		106	pre-configure:
		107	@(cd ${WRKSRC} && ${AUTOHEADER})
		108
96	# Create Cyrus user and group	109	# Create Cyrus user and group
97	pre-install:	110	pre-install:
98	@${SH} ${PKGDIR}/INSTALL ${PKGNAME} PRE-INSTALL	111	@${SH} ${PKGDIR}/INSTALL ${PKGNAME} PRE-INSTALL
99		112
100	post-install:	113	post-install:
101	@${SED} -e "/%%PREFIX%%/s##${PREFIX}#g" ${FILESDIR}/pwcheck.sh \	114	@${SED} -e "/%%PREFIX%%/s##${PREFIX}#g" ${FILESDIR}/pwcheck.sh \
102	> ${PREFIX}/etc/rc.d/pwcheck.sh	115	> ${PREFIX}/etc/rc.d/pwcheck.sh
103	@${CHMOD} 755 ${PREFIX}/etc/rc.d/pwcheck.sh	116	@${CHMOD} 755 ${PREFIX}/etc/rc.d/pwcheck.sh
104	${INSTALL} -d -m 700 -o cyrus -g cyrus /var/pwcheck	117	${INSTALL} -d -m 700 -o cyrus -g cyrus /var/pwcheck
Lines 110-129 Link Here
110	.for file in ${DOC2}	123	.for file in ${DOC2}
111	@${INSTALL_DATA} ${WRKSRC}/doc/${file} ${PREFIX}/share/doc/SASL	124	@${INSTALL_DATA} ${WRKSRC}/doc/${file} ${PREFIX}/share/doc/SASL
112	.endfor	125	.endfor
		126	@${INSTALL_DATA} ${FILESDIR}/Sendmail.README ${PREFIX}/share/doc
113	.for file in ${HTDOCS}	127	.for file in ${HTDOCS}
114	@${INSTALL_DATA} ${WRKSRC}/doc/${file}.html ${PREFIX}/share/doc/SASL/html	128	@${INSTALL_DATA} ${WRKSRC}/doc/${file}.html ${PREFIX}/share/doc/SASL/html
115	.endfor	129	.endfor
116	.endif	130	.endif
		131	@PKG_PREFIX=${PREFIX} BATCH=${BATCH} ${SH} ${PKGDIR}/INSTALL ${PKGNAME} POST-INSTALL
		132	@${CAT} ${PKGMESSAGE}
117		133
118	.if exists(${WRKDIRPREFIX}${.CURDIR}/Makefile.inc)
119	post-clean:	134	post-clean:
120	@${RM} -f ${WRKDIRPREFIX}${.CURDIR}/Makefile.inc	135	@${RM} -f ${WRKDIRPREFIX}${.CURDIR}/Makefile.inc
121		136
		137	.if exists(${WRKDIRPREFIX}${.CURDIR}/Makefile.inc)
122	.include "${WRKDIRPREFIX}${.CURDIR}/Makefile.inc"	138	.include "${WRKDIRPREFIX}${.CURDIR}/Makefile.inc"
123	.elif ${PREFIX} != ${LOCALBASE}
124	# Save PREFIX so that it can be used during make install
125	.BEGIN:
126	@echo "PREFIX= ${PREFIX}" > ${WRKDIRPREFIX}${.CURDIR}/Makefile.inc
127	.endif	139	.endif
128		140
129	.include <bsd.port.post.mk>	141	.include <bsd.port.mk>

Line 0 Link Here

(-)cyrus-sasl/files/Sendmail.README (+25 lines)
	1	How to enable SMTP AUTH with FreeBSD default Sendmail 8.11
	2
	3	1. Edit /usr/src/usr.sbin/sendmail/Makefile, and change the line:
	4
	5	LDADD= -lutil -lwrap
	6	into
	7	LDADD+= -lutil -lwrap
	8
	9	NOTE: This change is in 5.0-CURRENT and will be MFC'd to
	10	4.1-STABLE later.
	11
	12	2) Add the following to /etc/make.conf:
	13
	14	# Add SMTP AUTH support to Sendmail
	15	.if ${.CURDIR} == "/usr/src/usr.sbin/sendmail"
	16	CFLAGS+=-DSASL -I/usr/local/include/sasl -L/usr/local/lib
	17	LDADD+=-lsasl
	18	.endif
	19
	20	3) Rebuild FreeBSD (make buildworld, ...)
	21
	22	4) Create /usr/local/lib/sasl/Sendmail.conf with the following.
	23
	24	pwcheck_method: pwcheck
	25

Lines 1-5 Link Here

(-)cyrus-sasl/patches/patch-ab (-2 / +111 lines)
1	--- configure.in.orig Thu Aug 3 14:34:08 2000	1	--- configure.in.orig Thu Jul 20 21:35:01 2000
2	+++ configure.in Thu Aug 3 14:39:24 2000	2	+++ configure.in Sat Sep 16 13:58:02 2000
3	@@ -66,8 +66,9 @@	3	@@ -66,8 +66,9 @@
4	dnl check for -R, etc. switch	4	dnl check for -R, etc. switch
5	CMU_GUESS_RUNPATH_SWITCH	5	CMU_GUESS_RUNPATH_SWITCH
Lines 12-14 Link Here
12		12
13	AM_DISABLE_STATIC	13	AM_DISABLE_STATIC
14		14
		15	@@ -310,6 +311,88 @@
		16	fi
		17	AM_CONDITIONAL(PWCHECK, test "$with_pwcheck" != no)
		18
		19	+dnl MySQL
		20	+AC_ARG_WITH(mysql, [ --with-mysql=PATH enable authentication from MySQL database [no] ],
		21	+ with_mysql=$withval,
		22	+ with_mysql=no)
		23	+
		24	+if test -z "$with_mysql"; then
		25	+ for mysqlloc in lib/mysql lib
		26	+ do
		27	+ if test -f ${prefix}/${mysqlloc}/libmysqlclient.a; then
		28	+ with_mysql="${prefix}"
		29	+ break
		30	+ elif test -f /usr/local/${mysqlloc}/libmysqlclient.a; then
		31	+ with_mysql="/usr/local"
		32	+ break
		33	+ elif test -f /usr/${mysqlloc}/libmysqlclient.a; then
		34	+ with_mysql="/usr"
		35	+ break
		36	+ fi
		37	+ done
		38	+fi
		39	+
		40	+LIB_MYSQL=""
		41	+case "$with_mysql" in
		42	+ no) true;;
		43	+ ""\|yes) AC_CHECK_LIB(mysqlclient, mysql_select_db,
		44	+ AC_DEFINE(HAVE_MYSQL)
		45	+ LIB_MYSQL="-lmysqlclient",
		46	+ with_mysql=no);;
		47	+ *) if test -d ${with_mysql}/include/mysql; then
		48	+ CPPFLAGS="$CPPFLAGS -I${with_mysql}/include/mysql"
		49	+ else
		50	+ CPPFLAGS="$CPPFLAGS -I${with_mysql}/include"
		51	+ fi
		52	+ if test -d ${with_mysql}/lib/mysql; then
		53	+ LDFLAGS="$LDFLAGS -L${with_mysql}/lib/mysql"
		54	+ fi
		55	+ AC_DEFINE(HAVE_MYSQL)
		56	+ LIB_MYSQL="-lmysqlclient";;
		57	+esac
		58	+AC_SUBST(LIB_MYSQL)
		59	+
		60	+dnl LDAP
		61	+AC_ARG_WITH(ldap, [ --with-ldap=PATH enable authentication from LDAP [no] ],
		62	+ with_ldap=$withval,
		63	+ with_ldap=no)
		64	+
		65	+if test -z "$with_ldap"; then
		66	+ for ldaploc in lib/ldap lib
		67	+ do
		68	+ if test -f ${prefix}/${ldaploc}/libldap.a; then
		69	+ with_ldap="${prefix}"
		70	+ break
		71	+ elif test -f /usr/local/${ldaploc}/libldap.a; then
		72	+ with_ldap="/usr/local"
		73	+ break
		74	+ elif test -f /usr/${ldaploc}/libldap.a; then
		75	+ with_ldap="/usr"
		76	+ break
		77	+ fi
		78	+ done
79	+fi
80	+
81	+LIB_LDAP=""
82	+case "$with_ldap" in
83	+ no) true;;
84	+ ""\|yes) AC_CHECK_LIB(ldap, ldap_open,
85	+ AC_DEFINE(HAVE_LDAP)
86	+ LIB_LDAP="-lldap -llber",
87	+ with_ldap=no);;
88	+ *) if test -d ${with_ldap}/include/ldap; then
89	+ CPPFLAGS="${CPPFLAGS} -I${with_ldap}/include/ldap"
90	+ else
91	+ CPPFLAGS="${CPPFLAGS} -I${with_ldap}/include"
92	+ fi
93	+ if test -d ${with_ldap}/lib/ldap; then
94	+ LDFLAGS="$LDFLAGS -L${with_ldap}/lib/ldap"
95	+ fi
96	+ AC_DEFINE(HAVE_LDAP)
97	+ LIB_LDAP="-lldap -llber";;
98	+esac
99	+AC_SUBST(LIB_LDAP)
100	+
101	dnl CRAM-MD5
102	AC_ARG_ENABLE(cram, [ --enable-cram enable CRAM-MD5 authentication [yes] ],
103	cram=$enableval,
104	@@ -434,11 +517,15 @@
105	fi
106
107	if test "$with_des" != no; then
108	+ case "$host_os" in
109	+ freebsd*)
110	+ COM_ERR="-lcom_err"
111	+ ;;
112	+ esac
113	AC_CHECK_HEADER(krb.h,
114	- AC_CHECK_LIB(krb, krb_mk_priv, COM_ERR="",
115	- AC_CHECK_LIB(krb, krb_mk_priv, COM_ERR="-lcom_err",
116	- AC_WARN(No Kerberos V4 found); krb4=no, -ldes -lcom_err),
117	- -ldes),
118	+ AC_CHECK_LIB(krb, krb_mk_priv,:,
119	+ AC_WARN(No Kerberos V4 found); krb4=no,
120	+ -ldes $COM_ERR),
121	AC_WARN(No Kerberos V4 found); krb4=no)
122	else
123	AC_WARN(No DES library found for Kerberos V4 support)

Line 0 Link Here

(-)cyrus-sasl/patches/patch-ag (+15 lines)
	1	--- acconfig.h.orig Wed Jul 5 11:59:25 2000
	2	+++ acconfig.h Fri Sep 15 20:56:28 2000
	3	@@ -84,6 +84,12 @@
	4	/* do we have PAM for plaintext password checking? */
	5	#undef HAVE_PAM
	6
	7	+/* do we have MySQL for plaintext password checking? */
	8	+#undef HAVE_MYSQL
	9	+
	10	+/* do we have LDAP for plaintext password checking? */
	11	+#undef HAVE_LDAP
	12	+
	13	/* what flavor of GSSAPI are we using? */
	14	#undef HAVE_GSS_C_NT_HOSTBASED_SERVICE
	15

Line 0 Link Here

(-)cyrus-sasl/patches/patch-ai (+357 lines)
		1	--- lib/checkpw.c.orig Wed Jul 19 20:24:13 2000
		2	+++ lib/checkpw.c Sat Sep 16 21:07:33 2000
		3	@@ -95,10 +95,19 @@
		4	#include <sys/un.h>
		5	#ifdef HAVE_UNISTD_H
		6	#include <unistd.h>
		7	-#endif
		8	+#endif /* HAVE_UNISTD_H */
		9
		10	extern int errno;
		11	-#endif
		12	+#endif /* HAVE_PWCHECK */
		13	+
		14	+#ifdef HAVE_MYSQL
		15	+#include <mysql.h>
		16	+#endif /* HAVE_MYSQL */
		17	+
		18	+#ifdef HAVE_LDAP
		19	+#include <lber.h>
		20	+#include <ldap.h>
		21	+#endif /* HAVE_LDAP */
		22
		23	#ifdef HAVE_KRB
		24
		25	@@ -170,12 +179,20 @@
		26	memcpy (&temp_key, "kerberos", 8);
		27	des_fixup_key_parity (&temp_key);
		28	des_key_sched (&temp_key, schedule);
		29	+#ifdef __FreeBSD__
		30	+ des_cbc_cksum ((const unsigned char *)password, &ivec, passlen, schedule, &ivec);
		31	+#else
		32	des_cbc_cksum ((des_cblock *)password, &ivec, passlen, schedule, &ivec);
		33	+#endif
		34
		35	memcpy (&temp_key, &ivec, sizeof temp_key);
		36	des_fixup_key_parity (&temp_key);
		37	des_key_sched (&temp_key, schedule);
		38	+#ifdef __FreeBSD__
		39	+ des_cbc_cksum ((const unsigned char *)password, key, passlen, schedule, &ivec);
		40	+#else
		41	des_cbc_cksum ((des_cblock *)password, key, passlen, schedule, &ivec);
		42	+#endif
		43
		44	des_fixup_key_parity (key);
		45
		46	@@ -210,10 +227,17 @@
		47	return (str);
		48	}
		49
		50	+#ifdef __FreeBSD__
		51	+static int use_key(const char *user __attribute__((unused)),
		52	+ char *instance __attribute__((unused)),
		53	+ const char *realm __attribute__((unused)),
		54	+ const void key, des_cblock returned_key)
		55	+#else
		56	static int use_key(char *user __attribute__((unused)),
		57	char *instance __attribute__((unused)),
		58	char *realm __attribute__((unused)),
		59	void key, des_cblock returned_key)
		60	+#endif
		61	{
		62	memcpy (returned_key, key, sizeof(des_cblock));
		63	return 0;
		64	@@ -838,7 +862,7 @@
65
66
67	/* pwcheck daemon-authenticated login */
68	-static int pwcheck_verify_password(sasl_conn_t *conn,
69	+static int pwcheck_verify_password(sasl_conn_t *conn __attribute__((unused)),
70	const char *userid,
71	const char *passwd,
72	const char *service __attribute__((unused)),
73	@@ -853,8 +877,10 @@
74	static char response[1024];
75	int start, n;
76	char pwpath[1024];
77	+#if 0 /* Not used */
78	sasl_getopt_t *getopt;
79	void *context;
80	+#endif
81
82	if (reply) { *reply = NULL; }
83
84	@@ -902,6 +928,260 @@
85
86	#endif
87
88	+#ifdef HAVE_MYSQL
89	+/* DMZ mysql auth 12/29/1999
90	+ * Updated to 1.5.24 by SWH 09/12/2000
91	+ */
92	+#ifdef USE_CRYPT_PASSWORD
93	+#define QUERY_STRING "select %s from %s where %s = '%s' and %s = password('%s')"
94	+#else
95	+#define QUERY_STRING "select %s from %s where %s = '%s' and %s = '%s'"
96	+#endif
97	+
98	+static int mysql_verify_password(sasl_conn_t *conn,
99	+ const char *userid,
100	+ const char *password,
101	+ const char *service __attribute__((unused)),
102	+ const char *user_realm __attribute__((unused)),
103	+ const char **reply)
104	+{
105	+ unsigned int numrows;
106	+ MYSQL mysql,*sock;
107	+ MYSQL_RES *result;
108	+ char qbuf[300];
109	+ char *db_user="",
110	+ *db_passwd="",
111	+ *db_host="",
112	+ *db_uidcol="",
113	+ *db_pwcol="",
114	+ *db_database="",
115	+ *db_table="";
116	+ sasl_getopt_t *getopt;
117	+ void *context;
118	+
119	+ if (!userid \|\| !password) {
120	+ return SASL_BADPARAM;
121	+ }
122	+ if (reply) { *reply = NULL; }
123	+
124	+ /* check to see if the user configured a mysqluser/passwd/host/etc */
125	+ if (_sasl_getcallback(conn, SASL_CB_GETOPT, &getopt, &context) == SASL_OK) {
126	+ getopt(context, NULL, "mysql_user", (const char **) &db_user, NULL);
127	+ if (!db_user) db_user = "";
128	+ getopt(context, NULL, "mysql_passwd", (const char **) &db_passwd, NULL);
129	+ if (!db_passwd) db_passwd = "";
130	+ getopt(context, NULL, "mysql_host", (const char **) &db_host, NULL);
131	+ if (!db_host) db_host = "";
132	+ getopt(context, NULL, "mysql_database", (const char **) &db_database, NULL);
133	+ if (!db_database) db_database = "";
134	+ getopt(context, NULL, "mysql_table", (const char **) &db_table, NULL);
135	+ if (!db_table) db_table = "";
136	+ getopt(context, NULL, "mysql_uidcol", (const char **) &db_uidcol, NULL);
137	+ if (!db_uidcol) db_uidcol = "";
138	+ getopt(context, NULL, "mysql_pwdcol", (const char **) &db_pwcol, NULL);
139	+ if (!db_pwcol) db_pwcol = "";
140	+ }
141	+
142	+ if (!(sock = mysql_connect(&mysql,db_host,db_user,db_passwd)))
143	+ {
144	+ if (reply) { *reply = "cannot connect to MySQL server"; }
145	+ return SASL_FAIL;
146	+ }
147	+
148	+ if (mysql_select_db(sock,db_database) < 0)
149	+ {
150	+ mysql_close(sock);
151	+ if (reply) { *reply = "cannot select MySQL database"; }
152	+ return SASL_FAIL;
153	+ }
154	+ /* select DB_UIDCOL from DB_TABLE where DB_UIDCOL = 'userid' AND DB_PWCOL = password('password') */
155	+ sprintf(qbuf,QUERY_STRING,db_uidcol,db_table,db_uidcol,userid,db_pwcol,password);
156	+ if (mysql_query(sock,qbuf) < 0 \|\| !(result=mysql_store_result(sock)))
157	+ {
158	+ mysql_close(sock);
159	+ return SASL_FAIL;
160	+ }
161	+
162	+ if (result) //There were some rows found
163	+ {
164	+ if ((numrows = mysql_affected_rows(&mysql)) != 1)
165	+ {
166	+ mysql_free_result(result);
167	+ mysql_close(sock);
168	+ if ((numrows > 1) && (reply)) { *reply = "Detected duplicate entries for user"; }
169	+ return SASL_BADAUTH;
170	+ } else {
171	+ mysql_free_result(result);
172	+ mysql_close(sock);
173	+ return SASL_OK;
174	+ }
175	+ }
176	+ mysql_free_result(result);
177	+ mysql_close(sock);
178	+ return SASL_BADAUTH;
179	+}
180	+#endif /* HAVE_MYSQL */
181	+
182	+#ifdef HAVE_LDAP
183	+/* simon@surf.org.uk LDAP auth 07/11/2000
184	+ * Updated to 1.5.24 by SWH 09/12/2000
185	+ */
186	+
187	+#define LDAP_SERVER "localhost"
188	+#define LDAP_BASEDN "o=JOFA, c=UK"
189	+#define LDAP_UIDATTR "uid"
190	+
191	+#ifndef TRUE
192	+# define TRUE 1
193	+# define FALSE 0
194	+#endif
195	+
196	+static int ldap_isdigits(char *value)
197	+{
198	+ char *ptr;
199	+ int num = TRUE;
200	+
201	+ for (ptr = value; *ptr != '\0' && num != FALSE; ptr++) {
202	+ if (!isdigit(*ptr))
203	+ num = FALSE;
204	+ }
205	+
206	+ return num;
207	+}
208	+
209	+static int ldap_verify_password(sasl_conn_t *conn,
210	+ const char *userid,
211	+ const char *password,
212	+ const char *service __attribute__((unused)),
213	+ const char *user_realm __attribute__((unused)),
214	+ const char **reply)
215	+{
216	+
217	+ LDAP *ld;
218	+ LDAPMessage *result;
219	+ LDAPMessage *entry;
220	+ char *attrs[2];
221	+ char filter[200];
222	+ char *dn,
223	+ *ldap_server="",
224	+ *ldap_basedn="",
225	+ *ldap_uidattr="",
226	+ *port_num="";
227	+ int ldap_port = LDAP_PORT;
228	+ int count;
229	+ sasl_getopt_t *getopt;
230	+ void *context;
231	+
232	+ /* If the password is NULL, reject the login...
233	+ * Otherwise the bind will succed as a reference bind. Not good...
234	+ */
235	+ if (strcmp(password,"") == 0)
236	+ {
237	+ return SASL_BADPARAM;
238	+ }
239	+
240	+ if (reply) { *reply = NULL; }
241	+
242	+ /* check to see if the user configured a mysqluser/passwd/host/etc */
243	+ if (_sasl_getcallback(conn, SASL_CB_GETOPT, &getopt, &context) == SASL_OK) {
244	+ getopt(context, NULL, "ldap_server", (const char **) &ldap_server, NULL);
245	+ if (!ldap_server) ldap_server = LDAP_SERVER;
246	+ getopt(context, NULL, "ldap_basedn", (const char **) &ldap_basedn, NULL);
247	+ if (!ldap_basedn) {
248	+ if (reply) { *reply = "ldap_basedn not defined"; }
249	+ return SASL_BADPARAM;
250	+ }
251	+ getopt(context, NULL, "ldap_uidattr", (const char **) &ldap_uidattr, NULL);
252	+ if (!ldap_uidattr) ldap_uidattr = LDAP_UIDATTR;
253	+ getopt(context, NULL, "ldap_port", (const char **) &port_num, NULL);
254	+ if (!port_num) {
255	+ ldap_port = LDAP_PORT;
256	+ } else if (!ldap_isdigits(port_num)) {
257	+ if (reply) { *reply = "ldap_port - invalid value"; }
258	+ return SASL_BADPARAM;
259	+ } else {
260	+ ldap_port = atoi(port_num);
261	+ }
262	+ }
263	+
264	+ /* Open the LDAP connection. */
265	+ if ((ld = ldap_open(ldap_server, ldap_port)) == NULL)
266	+ {
267	+ if (reply) { *reply = "cannot connect to LDAP server"; }
268	+ return SASL_FAIL;
269	+ }
270	+
271	+ /* Bind anonymously so that you can find the DN of the appropriate user. */
272	+ if (ldap_simple_bind_s(ld,"","") != LDAP_SUCCESS)
273	+ {
274	+ ldap_unbind(ld);
275	+ if (reply) { *reply = "cannot bind to LDAP server"; }
276	+ return SASL_FAIL;
277	+ }
278	+
279	+ /* Generate a filter that will return the entry with a matching UID */
280	+ sprintf(filter,"(%s=%s)", ldap_uidattr,userid);
281	+
282	+ /* Just return country...This doesn't actually matter, since we will
283	+ * not read the attributes and values, only the DN
284	+ */
285	+ attrs[0] = "c";
286	+ attrs[1] = NULL;
287	+
288	+ /* Perform the search... */
289	+ if (ldap_search_s(ld,ldap_basedn,LDAP_SCOPE_SUBTREE,filter,attrs,1,&result) != LDAP_SUCCESS )
290	+ {
291	+ ldap_unbind(ld);
292	+ return SASL_BADAUTH;
293	+ }
294	+
295	+ /* If the entry count is not equal to one, either the UID was not unique or
296	+ * there was no match
297	+ */
298	+ if ((count = ldap_count_entries(ld,result)) != 1)
299	+ {
300	+ ldap_msgfree(result);
301	+ ldap_unbind(ld);
302	+ if ((count > 1) && (reply)) { *reply = "Detected duplicate entries for user"; }
303	+ return SASL_BADAUTH;
304	+ }
305	+
306	+ /* Get the first entry */
307	+ if ((entry = ldap_first_entry(ld,result)) == NULL)
308	+ {
309	+ ldap_msgfree(result);
310	+ ldap_unbind(ld);
311	+ return SASL_BADAUTH;
312	+ }
313	+
314	+ /* Get the DN of the entry */
315	+ if ((dn = ldap_get_dn(ld,entry)) == NULL)
316	+ {
317	+ ldap_msgfree(entry);
318	+ ldap_unbind(ld);
319	+ return SASL_BADAUTH;
320	+ }
321	+
322	+ /* Now bind as the DN with the password supplied earlier...
323	+ * Successful bind means the password was correct, otherwise the
324	+ * password is invalid.
325	+ */
326	+ if (ldap_simple_bind_s(ld,dn,(char *)password) != LDAP_SUCCESS)
327	+ {
328	+ free(dn);
329	+ ldap_msgfree(entry);
330	+ ldap_unbind(ld);
331	+ return SASL_BADAUTH;
332	+ }
333	+
334	+ free(dn);
335	+ ldap_msgfree(entry);
336	+ ldap_unbind(ld);
337	+ return SASL_OK;
338	+}
339	+
340	+#endif /* HAVE_LDAP */
341	+
342	struct sasl_verify_password_s _sasl_verify_password[] = {
343	{ "sasldb", &sasldb_verify_password },
344	#ifdef HAVE_KRB
345	@@ -921,6 +1201,12 @@
346	#endif
347	#ifdef HAVE_PWCHECK
348	{ "pwcheck", &pwcheck_verify_password },
349	+#endif
350	+#ifdef HAVE_MYSQL
351	+ { "mysql", &mysql_verify_password },
352	+#endif
353	+#ifdef HAVE_LDAP
354	+ { "ldap", &ldap_verify_password },
355	#endif
356	{ NULL, NULL }
357	};

Line 0 Link Here

(-)cyrus-sasl/patches/patch-aj (+46 lines)
	1	--- doc/sysadmin.html.orig Wed Jul 12 21:59:51 2000
	2	+++ doc/sysadmin.html Fri Sep 15 20:56:28 2000
	3	@@ -171,6 +171,43 @@
	4	<dt><i>pwcheck</i><dd> checks passwords with the use of a seperate,
	5	helper daemon. <b>needs to be documented.</b><p>
	6
	7	+<dt><i>mysql</i><dd> A MySQL database can be used for plaintext
	8	+ password checking by setting "pwcheck_method" to "mysql".<p>
	9	+
	10	+ <p>The following SASL options are used for MySQL Authentication:<p>
	11	+
	12	+ <dl>
	13	+ <dd>mysql_user: <user></dd>
	14	+ <dd>mysql_passwd: <cleartext pw></dd>
	15	+ <dd>mysql_host: <host></dd>
	16	+ <dd>mysql_database: <database></dd>
	17	+ <dd>mysql_table: <table></dd>
	18	+ <dd>mysql_uidcol: <username col></dd>
	19	+ <dd>mysql_pwdcol: <password col></dd>
	20	+ </dl>
	21	+
	22	+ <p>MySQL pwcheck_method created by <a href="mailto:dmz@dmzs.com">David Matthew Zendzian</a>
	23	+ the original patch may be found at <a href="http://www.dmzs.com/~dmz/projects/cyrus/">http://www.dmzs.com/~dmz/projects/cyrus/</a>.<p>
	24	+
	25	+<dt><i>ldap</i><dd> A LDAP server can be used for plaintext password
	26	+ checking by setting "pwcheck_method" to "ldap".<p>
	27	+
	28	+ <p>The following SASL options are used for LDAP Authentication:<p>
	29	+
	30	+ <dl>
	31	+ <dd>ldap_server: <LDAP Server [localhost]>
	32	+ <dd>ldap_basedn: <LDAP base dn>
	33	+ <dd>ldap_uidattr: <LDAP uid attribute [uid]>
	34	+ <dd>ldap_port: <LDAP port [389]>
	35	+ </dl>
	36	+
	37	+ <p>It is a requirement that "ldap_basedn" be set to the appropriate
	38	+ value for your site<br>
	39	+ (ex. ldap_basedn: o=surf, c=UK)<p>
	40	+
	41	+ <p>LDAP pwcheck_method created by <a href="mailto:simon@surf.org.uk">Simon@surf.org.uk</a>
	42	+ the original patch may be found at <a href="http://www.surf.org.uk/">http://www.surf.org.uk/</a>.<p>
	43	+
	44	<dt><i>write your own</i><dd> Last, but not least, the most flexible
	45	method of authentication for PLAIN is to write your own. If you do
	46	so, any application that calls the "<tt>sasl_checkpass()</tt>"

Line 0 Link Here

(-)cyrus-sasl/patches/patch-ak (+30 lines)
	1	--- plugins/kerberos4.c.orig Wed Apr 19 11:18:48 2000
	2	+++ plugins/kerberos4.c Sat Sep 16 18:49:20 2000
	3	@@ -696,8 +696,13 @@
	4
	5	/* decrypt; verify checksum */
	6
	7	+#ifdef __FreeBSD__
	8	+ des_pcbc_encrypt((const unsigned char *)in,
	9	+ (unsigned char *)in,
	10	+#else
	11	des_pcbc_encrypt((des_cblock *)in,
	12	(des_cblock *)in,
	13	+#endif
	14	clientinlen,
	15	text->init_keysched,
	16	&text->session,
	17	@@ -1192,8 +1197,13 @@
	18	}
	19	sout[len]=0;
	20
	21	+#ifdef __FreeBSD__
	22	+ des_pcbc_encrypt((const unsigned char *)sout,
	23	+ (unsigned char *)sout,
	24	+#else
	25	des_pcbc_encrypt((des_cblock *)sout,
	26	(des_cblock *)sout,
	27	+#endif
	28	len,
	29	text->init_keysched,
	30	(des_cblock *)text->session,

Lines 1-4 Link Here

(-)cyrus-sasl/pkg/MESSAGE (-3 / +14 lines)
1	Start the pwcheck program to have clients use the SASL libraries	1	PREFIX/etc/cyrusdb.db now needs to be created
2	as a non-root user:	2	before applications that depend on SASL are used.
3		3
4	/usr/local/etc/rc.d/pwcheck.sh [start\|stop]	4	su cyrus
		5	PREFIX/sbin/saslpasswd -c userid
		6
		7	You will also need to start the pwcheck daemon:
		8
		9	PREFIX/etc/rc.d/pwcheck.sh start
		10
		11	Read the documentation in PREFIX/share/doc/SASL
		12
		13	How to enable SMTP AUTH with system Sendmail 8.11 - Sendmail.README
		14
		15	How to use LDAP or MySQL for passwords - see html/sysadmin.html

Line 0 Link Here

(-)cyrus-sasl/scripts/configure.sasl (+59 lines)
	1	#!/bin/sh
	2	# $FreeBSD$
	3
	4	if [ -f ${WRKDIRPREFIX}${CURDIR}/Makefile.inc ]; then
	5	exit
	6	fi
	7
	8	if [ "${BATCH}" ]; then
	9	exit
	10	else
	11	/usr/bin/dialog --title "Additional pwcheck methods" --clear \
	12	--checklist "\n\
	13	Please select desired options:" -1 -1 16 \
	14	MySQL "MySQL password Authentication" OFF \
	15	OpenLDAP "OpenLDAP password Authentication" OFF \
	16	2> /tmp/checklist.tmp.$$
	17
	18	retval=$?
	19
	20	if [ -s /tmp/checklist.tmp.$$ ]; then
	21	set `cat /tmp/checklist.tmp.$$`
	22	fi
	23	rm -f /tmp/checklist.tmp.$$
	24
	25	case $retval in
	26	0) if [ -z "$*" ]; then
	27	echo "Nothing selected"
	28	fi
	29	;;
	30	1) echo "Cancel pressed."
	31	exit 1
	32	;;
	33	esac
	34	fi
	35
	36	${MKDIR} ${WRKDIRPREFIX}${CURDIR}
	37	exec > ${WRKDIRPREFIX}${CURDIR}/Makefile.inc
	38
	39	echo "PREFIX= ${PREFIX}"
	40
	41	while [ "$1" ]; do
	42	case $1 in
	43	\"MySQL\")
	44	echo "LIB_DEPENDS+= mysqlclient.6:\${PORTSDIR}/databases/mysql322-client"
	45	echo "CONFIGURE_ARGS+=--with-mysql=\${PREFIX}"
	46	;;
	47	\"OpenLDAP\")
	48	echo "LIB_DEPENDS+= ldap.1:\${PORTSDIR}/net/openldap"
	49	echo "LIB_DEPENDS+= lber.1:\${PORTSDIR}/net/openldap"
	50	echo "CONFIGURE_ARGS+=--with-ldap=\${PREFIX}"
	51	;;
	52	*)
	53	echo "Invalid option(s): $*" > /dev/stderr
	54	rm -f ${WRKDIRPREFIX}${CURDIR}/Makefile.inc
	55	exit 1
	56	;;
	57	esac
	58	shift
	59	done