Crypt authentication error

[Anonymous]

Since upgrading to 10.4.8 one of my users can check mail and the other can’t. Authentication in other contexts seems to work fine. I’ve tried switching back and forth between crypt and open directory authentication in the advanced tab of workgroup manager, resetting passwords, and changing the authentication methods for Mail in Server Admin, all to no avail. There seems to be mention of a similar problem in the comments at
http://www.tuaw.com/2006/08/01/apple-security-update-2006-004-released/

Any ideas on how to resolve this would be greatly appreciated.

Here’s a few lines from /var/log/mailaccesss.log:
Oct 7 14:49:42 iko imap[522]: AOD: crypt authentication error: authentication failed for user: timothyr (-14091)
Oct 7 14:49:42 iko imap[522]: AOD: check pass: -14091
Oct 7 14:49:42 iko imap[522]: badlogin from: localhost [::1]. login user: timothyr (error = -6)
Oct 7 14:49:52 iko imap[522]: login: localhost [::1] jyothiv plaintext User logged in

Thanks,
-Tim

[Anonymous]

Well, I figured out what happened here; unfortunately I did not fix it in the most graceful way.

The account that was giving me problems had an entry in both the LDAP directory and the Local directory; this is my account that I use on the console, so in initial setup I had created the entry. For whatever reason, the password type in the advanced tab of the local directory was set to Crypt, and grayed out so I couldn’t change it.

I deleted the local directory entry, and everything worked. I don’t know why this became a problem after the 10.4.8 upgrade.

Unfortunately, deleting the local directory entry also deleted all of the messages in my IMAP mailboxes. This gave me a good reason to spend a beautiful Saturday afternoon cleaning up my 7GB mail account while I moved local copies of everything back to the server from my laptop.

As for the plain text login, I use a system where I tunnel everything through ssh. I have an entry in my .bashrc that looks like

alias pf='ssh -C2 -L 5900:192.168.1.5:5900 -L 2025:scarlet:25 -L 20110:scarlet:110 -L 20143:scarlet:143 -L 20993:scarlet:993 -L 2225:iko:25 -L 22110:iko:110 -L 22143:iko:143 -L 22993:iko:993 -L 22211:iko:7211 host@example.com'

Whenever I’m at a new location, I just issue the port forwarding command, and I’m hooked into my local system through an encrypted tunnel. It saves the hassle of opening up a bunch of different ports through strange firewalls. Then, in my mail client, I just point it at localhost:22143. My understanding is that this obviates the need for another layer of password encryption.

Thanks,
-Tim

[Author]

Posts