Bug 1273580 - Several cyrus-sasl modules log multiple unsuppressible auth.debug messages per auth
Several cyrus-sasl modules log multiple unsuppressible auth.debug messages pe...
Status: ASSIGNED
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: cyrus-sasl (Show other bugs)
7.1
Unspecified Unspecified
unspecified Severity medium
: rc
: ---
Assigned To: Jakub Jelen
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-10-20 14:02 EDT by Patrick Wagner
Modified: 2017-11-23 07:33 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1187097
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch (SQL module only) by Viktor Dukhovni (11.93 KB, text/plain)
2015-10-20 14:02 EDT, Patrick Wagner
no flags Details

  None (edit)
Description Patrick Wagner 2015-10-20 14:02:56 EDT
Created attachment 1084855 [details]
Proposed patch (SQL module only) by Viktor Dukhovni

+++ This bug was initially created as a clone of Bug #1187097 +++

Many cyrus-sasl auth backends include verbose auth.debug logging that cannot be suppressed due to incorrect invocations of the log() function (NULL is passed instead of the connection handle. 
Bug #1187097 fixed this for the gssapi module only. 
I was personally affected by the issue in the case of the SQL module and initially brought it up on the postfix-users mailing list (where Viktor Dukhovni helpfully created the attached patch, fixing the issue for the SQL backend only), and I filed bug #3906 on upstream Cyrus bugzilla: https://bugzilla.cyrusimap.org/show_bug.cgi?id=3906

Due to known unresponsive upstream this should be fixed downstream - this bug report might serve to fix "just" the SQL module, or all modules affected?


Version-Release number of selected component (if applicable):
rpmquery cyrus-sasl cyrus-sasl-sql           
cyrus-sasl-2.1.26-17.el7.x86_64
cyrus-sasl-sql-2.1.26-17.el7.x86_64

How reproducible:
always

Steps to Reproduce:
authenticate against a program that utilizes cyrus-sasl auth, with cyrus-sasl having a SQL backend configured for auth.

Actual results:
Several lines of auth.debug messages are logged to systemd journal (and subsequently, other syslog daemons) every time an auth attempt is made:
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql auxprop plugin using mysql engine
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
userPassword sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
userPassword sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
cmusaslsecretPLAIN sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'

Expected results:
No generation of auth.debug messages
Comment 2 Jakub Jelen 2015-10-22 04:10:13 EDT
Thank you for the report. The referenced bugzilla was fixed only in Fedora so far and as we agree, the connection callbacks are not propagated in some other modules then in original report. The sql is one of them.

I am in touch with upstream about this problem, so I will try to add this bug to discussion.
Comment 4 Jakub Jelen 2017-07-19 08:56:39 EDT
This is already resolved upstream:

https://github.com/cyrusimap/cyrus-sasl/issues/401

Fixing that in future RHEL makes sense.

Note You need to log in before you can comment on or make changes to this bug.