dovecot - Nov 2008 - Dovecot auth-worker permission denied.

Hello,

    I am trying to get dovecot to use virtual users and authenticate using
PAM+kerberos against Active Directory and I am running into some problems.

    I followed the tutorials from the wiki page from:
http://www.linuxmail.info/active-directory-dovecot-pam-authentication/

And here is what I get from the /var/log/mail log:
Nov 26 15:12:27 housigma20 dovecot: auth(default): client in: AUTH      1
PLAIN   service=pop3    secured lip=127.0.0.1   rip=127.0.0.1   lport=110
rport=36327     resp=AGxpbnV4dABob3VzdG9u
Nov 26 15:12:27 housigma20 dovecot: auth-worker(default):
pam(linuxt,127.0.0.1): lookup service=dovecot
Nov 26 15:12:27 housigma20 dovecot: auth-worker(default):
pam(linuxt,127.0.0.1): pam_authenticate() failed: Permission denied
Nov 26 15:12:29 housigma20 dovecot: auth(default): client out: FAIL     1
user=linuxt
Nov 26 15:12:31 housigma20 dovecot: pop3-login: Aborted login (auth failed,
1 attempts): user=<linuxt>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1,
secured

Any ideas..? Other than this:
http://www.dovecot.org/list/dovecot/2008-July/032455.html

Thanks...!

/etc/pam.d/dovecot:
auth     sufficient     pam_krb5.so no_user_check validate
account  sufficient     pam_permit.so


Here is my dovecot ?n and version:
# 1.1.6: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.16.60-0.21-xenpae i686 SUSE Linux Enterprise Server 10
(i586) 
protocols: pop3 pop3s imap imaps
login_dir: /var/run/dovecot/login
login_executable(default): /usr/lib/dovecot/imap-login
login_executable(imap): /usr/lib/dovecot/imap-login
login_executable(pop3): /usr/lib/dovecot/pop3-login
mail_privileged_group: mail
mail_location: maildir:~/Maildir/
mail_executable(default): /usr/lib/dovecot/imap
mail_executable(imap): /usr/lib/dovecot/imap
mail_executable(pop3): /usr/lib/dovecot/pop3
mail_plugin_dir(default): /usr/lib/dovecot/modules/imap
mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap
mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3
imap_client_workarounds(default): delay-newmail outlook-idle netscape-eoh
imap_client_workarounds(imap): delay-newmail outlook-idle netscape-eoh
imap_client_workarounds(pop3):
pop3_client_workarounds(default):
pop3_client_workarounds(imap):
pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh
auth default:
  mechanisms: plain login
  debug: yes
  debug_passwords: yes
  passdb:
    driver: pam
  userdb:
    driver: static
    args: uid=1004 gid=1002 home=/home/vmail/%d/%Lu
  socket:
    type: listen
    client:
      path: /var/spool/postfix/private/auth
      mode: 432
      user: postfix
      group: postfix

On Wed, 2008-11-26 at 15:52 -0600, Romer Ventura wrote:
>     I followed the tutorials from the wiki page from:
> http://www.linuxmail.info/active-directory-dovecot-pam-authentication/
I don't know much about Kerberos, but:
> Nov 26 15:12:27 housigma20 dovecot: auth-worker(default):
> pam(linuxt,127.0.0.1): pam_authenticate() failed: Permission denied
PAM plugin fails by giving "Permission denied" error. Perhaps
PAM's own
logs would show something more? /var/log/auth.log or something similar.

dovecot-auth processes are running as root anyway I guess? Then there
really shouldn't be any permission problems, so I guess it's some kind
of a PAM/Kerberos misconfiguration.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20081130/83be7a94/attachment-0002.bin>

There is nothing being logged by PAM, that's the only error I see


On 11/29/08 8:24 PM, "Timo Sirainen" <tss at iki.fi> wrote:
> On Wed, 2008-11-26 at 15:52 -0600, Romer Ventura wrote:
>>     I followed the tutorials from the wiki page from:
>> http://www.linuxmail.info/active-directory-dovecot-pam-authentication/
> 
> I don't know much about Kerberos, but:
> 
>> Nov 26 15:12:27 housigma20 dovecot: auth-worker(default):
>> pam(linuxt,127.0.0.1): pam_authenticate() failed: Permission denied
> 
> PAM plugin fails by giving "Permission denied" error. Perhaps
PAM's own
> logs would show something more? /var/log/auth.log or something similar.
> 
> dovecot-auth processes are running as root anyway I guess? Then there
> really shouldn't be any permission problems, so I guess it's some
kind
> of a PAM/Kerberos misconfiguration.
>