Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1273580 - Several cyrus-sasl modules log multiple unsuppressible auth.debug messages per auth
Summary: Several cyrus-sasl modules log multiple unsuppressible auth.debug messages pe...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: cyrus-sasl
Version: 7.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: rc
: ---
Assignee: Jakub Jelen
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-10-20 18:02 UTC by Patrick Wagner
Modified: 2018-06-19 06:18 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1187097
Environment:
Last Closed: 2018-06-19 06:17:47 UTC
Target Upstream Version:


Attachments (Terms of Use)
Proposed patch (SQL module only) by Viktor Dukhovni (11.93 KB, text/plain)
2015-10-20 18:02 UTC, Patrick Wagner
no flags Details

Description Patrick Wagner 2015-10-20 18:02:56 UTC
Created attachment 1084855 [details]
Proposed patch (SQL module only) by Viktor Dukhovni

+++ This bug was initially created as a clone of Bug #1187097 +++

Many cyrus-sasl auth backends include verbose auth.debug logging that cannot be suppressed due to incorrect invocations of the log() function (NULL is passed instead of the connection handle. 
Bug #1187097 fixed this for the gssapi module only. 
I was personally affected by the issue in the case of the SQL module and initially brought it up on the postfix-users mailing list (where Viktor Dukhovni helpfully created the attached patch, fixing the issue for the SQL backend only), and I filed bug #3906 on upstream Cyrus bugzilla: https://bugzilla.cyrusimap.org/show_bug.cgi?id=3906

Due to known unresponsive upstream this should be fixed downstream - this bug report might serve to fix "just" the SQL module, or all modules affected?


Version-Release number of selected component (if applicable):
rpmquery cyrus-sasl cyrus-sasl-sql           
cyrus-sasl-2.1.26-17.el7.x86_64
cyrus-sasl-sql-2.1.26-17.el7.x86_64

How reproducible:
always

Steps to Reproduce:
authenticate against a program that utilizes cyrus-sasl auth, with cyrus-sasl having a SQL backend configured for auth.

Actual results:
Several lines of auth.debug messages are logged to systemd journal (and subsequently, other syslog daemons) every time an auth attempt is made:
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql auxprop plugin using mysql engine
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
userPassword sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
userPassword sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
cmusaslsecretPLAIN sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'

Expected results:
No generation of auth.debug messages

Comment 2 Jakub Jelen 2015-10-22 08:10:13 UTC
Thank you for the report. The referenced bugzilla was fixed only in Fedora so far and as we agree, the connection callbacks are not propagated in some other modules then in original report. The sql is one of them.

I am in touch with upstream about this problem, so I will try to add this bug to discussion.

Comment 4 Jakub Jelen 2017-07-19 12:56:39 UTC
This is already resolved upstream:

https://github.com/cyrusimap/cyrus-sasl/issues/401

Fixing that in future RHEL makes sense.


Note You need to log in before you can comment on or make changes to this bug.