Help! My Panther server ate imap kerberos :(

[n9yty]

I had just set up kerberos last week on our Panther XServe, and all was working fine.

Today, without changing anything, IMAP just stopped working. I can still get tickets for host/ ftp/ and afpserver/ services, but imap/ refuses to give me a ticket.

In the log file, I see the following entries:

Feb 12 21:16:30 hostname imap[5783]: Cannot open principal file
Feb 12 21:16:30 hostname imap[5783]: No service principal found for: imap_principal
Feb 12 21:16:30 hostname imap[5783]: badlogin: [my.ip.here] GSSAPI

I made sure that the principal file (/etc/krb5.keytab) is readable by group mail, so I don’t know why it cannot open it. Using kadmin I see the principal and using kutil I can read the keytab and see the right entries for the imap/ service. Just to be sure, I removed them from the system and used sso_util to put them back, still no change even after several reboots.

I also verified /etc/MailServicesOther.plist to be sure that it had the required cyrus imap_principal key, and the value is correct. I verified the /etc/imapd.conf file to verify the servername value matches the principal name, no change.

What can cause this to happen in the middle of the day on a system that was functioning just fine? Any hints on what to look for next?

[n9yty]

Yup, forward and backwards, all DNS seems to be working just fine.

Also, additional note, the afpserver/ service is working fine on the same machine, so I don’t know why imap/ died. I have several other host/ entries for various machines and ssh is working fine to them with kerberos.

Further note… I can issue a `kvno imap/f.q.d.n` and get an imap/ ticket issued, but cyrus still fails to use this. No matter what I do, I can’t remove the errors in the log:

Feb 12 23:38:33 localhost imap[2085]: Cannot open principal file
Feb 12 23:38:33 localhost imap[2085]: No service principal found for: imap_principal

Frustrating!!

[n9yty]

Well, in frustration (and for no gain) I deleted the /etc/krb5.keytab and also deleted the principals from the kdc. I then used sso_util configure to put them back, and it did get them installed back in both places.

No change. Every other service (host, ftp, afpserver) works on this server, but NOT imap, and an attempted gssapi imap connection just pauses and then prompts for regular dialog (not kerberos) password, and does not get me an imap ticket. I can issue a kvno command to get an imap ticket with the right information.

So, it seems like for some reason the Cyrus mail server has just decided to NOT deal with gssapi/kerberos authentications. I think it’s related to that log message about not being able to open the principals database, but I can’t fathom why that would have changed in the middle of the day when no other changes were being made to the server. From my workstation I can issue a `kvno` command to verify the imap/ entry is in the prinicpal database, and all the information looks correct, a key is issued, and so on, but the Cyrus server still will not see/use it.

grumble grumble grumble…..

We are planning on an upgrade from this Panther server to Leopard this summer, it would just be nice to have this working with what we have. Even more frustrating that I had just gotten it working and it lasted less than a week. 🙁

[adinman]

I’m working on a server with what looks like an identical problem to this – all kerberos particulars are in order, imap was authenticating fine, then one day it just died. Same symptoms, same errors. Checking the notify me of replies option and hoping…for now we’re downshifted to password auth.

[xmiller]

Same problem here. This mail server (as an OD replica) was running just fine for over a year when one morning, poof, no more kerberos logins. Now, I’ve got to reconfig each client to use another auth method. No fun!

[Author]

Posts