lelapin - Hi all! I'm jumping through some hoop...
# troubleshootingn
nitnelave
11/03/2023, 6:21 PMYes, that is correct, and by design. We do not store a hash of the user's password, only enough data to have an interactive zero-knowledge proof that the user has the same password than when he registered
nitnelave
11/03/2023, 6:21 PM(btw, nice avatar!)
nitnelave
11/03/2023, 6:21 PM(big fan of Lewis Trondheim)
l
lelapin
11/03/2023, 6:22 PMah, right, the opaque thing (:) thx)
lelapin
11/03/2023, 6:23 PMok, hm so i guess i'll have to write a custom pam module using the graphql api?! uh
n
nitnelave
11/03/2023, 6:23 PMHaha hopefully not!
nitnelave
11/03/2023, 6:23 PMYou can send the password cleartext over LDAP to validate
nitnelave
11/03/2023, 6:24 PMBut you won't be able to do the validation yourself, LLDAP has to be the one doing it
l
lelapin
11/03/2023, 6:26 PMAh! I forgot this. Ok, i'm gonna try to write the simplest config i can for pam_ldap and report back if it works
n
nitnelave
11/03/2023, 6:26 PMAfter 30s of reading, it seems like setting up pam (with sssd maybe?) to authenticate to LLDAP, and then using that for opensmtpd would be the way to go
nitnelave
11/03/2023, 6:27 PMAnd I know that many people will be interested in a PAM config
l
lelapin
11/03/2023, 6:27 PMindeed, that's what they seem to prefer (i looked into the ldap-table thing, but it's brittle and weird and kindof not for this)
lelapin
11/03/2023, 6:28 PMbtw i'm trying nslcd from nss-pam-ldap (it's basically sssd but only for ldap)
n
nitnelave
11/03/2023, 6:28 PMIf you need help setting it up, getting the attributes working, feel free to ask
nitnelave
11/03/2023, 6:28 PMI'm not in front of a computer but I can answer questions
l
lelapin
11/18/2023, 10:22 PMHey, i got back to working on this again and finally got it to work (at least with pamtester, will do the real test with opensmtpd tomorrow). Custom attributes weren't needed (very glad!), the only pitfall is to disable some ldap extension for password policy (control oid 1.3.6.1.4.1.42.2.27.8.5.1).
pam_authc_ppolicy no/etc/nslcd.confn
nitnelave
11/18/2023, 10:23 PMOh, wow, we can get PAM without custom attributes? That's great news 🎉
l
lelapin
11/18/2023, 10:25 PMYes indeed! I guess it will confuse a lot of pam users (like logind) because without custom attributes there will be missing env vars, but for basic users of the
auth