Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Bug#1010915: mutt: GSSAPI SMTP authentication no longer works

236 views
Skip to first unread message

brian m. carlson

unread,
May 12, 2022, 10:10:03 PM5/12/22
to
Package: mutt
Version: 2.2.4-1
Severity: important

I use Kerberos on my personal network at home, and therefore I use
GSSAPI authentication for IMAP and SMTP. While GSSAPI with IMAP works
fine, recently, GSSAPI with SMTP stopped working. I suspect this is
related to the move to gsasl.

When it fails, mutt merely says "SASL authentication failed". What
Postfix (Debian bullseye) reports is this:

May 13 01:52:52 ring postfix/submission/smtpd[2307029]: Anonymous TLS connection established from <server>: TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)
May 13 01:52:53 ring postfix/submission/smtpd[2307029]: warning: <server>: SASL GSSAPI authentication aborted
May 13 01:52:54 ring postfix/submission/smtpd[2307029]: lost connection after AUTH from <server>
May 13 01:52:54 ring postfix/submission/smtpd[2307029]: disconnect from <server> ehlo=2 starttls=1 auth=0/1 commands=3/4

I've filed this as important because it prevents me from sending emails,
which is an important functionality of any mail client. Downgrading to
2.0.5-4.1 works.

-- Package-specific info:
Mutt 2.2.4 (2022-04-30)
Copyright (C) 1996-2022 Michael R. Elkins and others.
Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'.
Mutt is free software, and you are welcome to redistribute it
under certain conditions; type `mutt -vv' for details.

System: Linux 5.16.0-6-amd64 (x86_64)
ncurses: ncurses 6.3.20220423 (compiled with 6.3)
libidn2: 2.3.2 (compiled with 2.3.2)
hcache backend: tokyocabinet 1.4.48

Compiler:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/11/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 11.3.0-1' --with-bugurl=file:///usr/share/doc/gcc-11/README.Bugs --enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++,m2 --prefix=/usr --with-gcc-major-version-only --program-suffix=-11 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --enable-bootstrap --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-plugin --enable-default-pie --with-system-zlib --enable-libphobos-checking=release --with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch --disable-werror --enable-cet --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-offload-targets=nvptx-none=/build/gcc-11-m8KK5z/gcc-11-11.3.0/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-11-m8KK5z/gcc-11-11.3.0/debian/tmp-gcn/usr --without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu --with-build-config=bootstrap-lto-lean --enable-link-serialization=2
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.3.0 (Debian 11.3.0-1)

Configure options: --build=x86_64-linux-gnu --prefix=/usr '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules '--libdir=${prefix}/lib/x86_64-linux-gnu' --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-mailpath=/var/mail --enable-compressed --enable-debug --enable-fcntl --enable-hcache --enable-gpgme --enable-imap --enable-smtp --enable-pop --enable-sidebar --enable-dotlock --disable-fmemopen --with-curses --with-gnutls --with-gss --with-idn2 --with-mixmaster --with-gsasl --without-gdbm --without-bdb --without-qdbm --with-tokyocabinet build_alias=x86_64-linux-gnu 'CFLAGS=-g -O2 -ffile-prefix-map=/build/mutt-ziEvPb/mutt-2.2.4=. -fstack-protector-strong -Wformat -Werror=format-security' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2'

Compilation CFLAGS: -Wall -pedantic -Wno-long-long -g -O2 -ffile-prefix-map=/build/mutt-ziEvPb/mutt-2.2.4=. -fstack-protector-strong -Wformat -Werror=format-security

Compile options:
-DOMAIN
+DEBUG
-HOMESPOOL +USE_SETGID +USE_DOTLOCK +DL_STANDALONE +USE_FCNTL -USE_FLOCK
+USE_POP +USE_IMAP +USE_SMTP
-USE_SSL_OPENSSL +USE_SSL_GNUTLS -USE_SASL +USE_GSASL +USE_GSS +HAVE_GETADDRINFO
+HAVE_REGCOMP -USE_GNU_REGEX
+HAVE_COLOR +HAVE_START_COLOR +HAVE_TYPEAHEAD +HAVE_BKGDSET
+HAVE_CURS_SET +HAVE_META +HAVE_RESIZETERM +HAVE_FUTIMENS
+CRYPT_BACKEND_CLASSIC_PGP +CRYPT_BACKEND_CLASSIC_SMIME +CRYPT_BACKEND_GPGME
-EXACT_ADDRESS -SUN_ATTACHMENT
+ENABLE_NLS -LOCALES_HACK +HAVE_WC_FUNCS +HAVE_LANGINFO_CODESET +HAVE_LANGINFO_YESEXPR
+HAVE_ICONV -ICONV_NONTRANS -HAVE_LIBIDN +HAVE_LIBIDN2 +HAVE_GETSID +USE_HCACHE
+USE_SIDEBAR +USE_COMPRESSED +USE_INOTIFY
-ISPELL
SENDMAIL="/usr/sbin/sendmail"
MAILPATH="/var/mail"
PKGDATADIR="/usr/share/mutt"
SYSCONFDIR="/etc"
EXECSHELL="/bin/sh"
MIXMASTER="mixmaster"

To contact the developers, please mail to <mutt...@mutt.org>.
To report a bug, please contact the Mutt maintainers via gitlab:
https://gitlab.com/muttmua/mutt/issues


-- System Information:
Debian Release: bookworm/sid
APT prefers stable-security
APT policy: (500, 'stable-security'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.16.0-6-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages mutt depends on:
ii libc6 2.33-7
ii libgnutls30 3.7.4-2
ii libgpg-error0 1.45-2
ii libgpgme11 1.16.0-1.2
ii libgsasl7 1.10.0-5+b1
ii libgssapi-krb5-2 1.19.2-2+b1
ii libidn2-0 2.3.2-2
ii libncursesw6 6.3+20220423-2
ii libtinfo6 6.3+20220423-2
ii libtokyocabinet9 1.4.48-15
ii zlib1g 1:1.2.11.dfsg-4

Versions of packages mutt recommends:
ii locales 2.33-7
ii mailcap 3.70+nmu1
ii sensible-utils 0.0.17

Versions of packages mutt suggests:
ii aspell 0.60.8-4
ii ca-certificates 20211016
ii esmtp-run [mail-transport-agent] 1.2-18
ii gnupg 2.3.1-1
ii ispell 3.4.05-1
ii openssl 3.0.0~~alpha4-1
ii urlview 0.9-22

Versions of packages mutt is related to:
ii mutt 2.2.4-1

-- no debconf information

--
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA
signature.asc

Gábor Gombás

unread,
May 13, 2022, 12:50:03 PM5/13/22
to
Package: mutt
Version: 2.2.3-2
Followup-For: Bug #1010915

Hi,

I've run into this issue too, and it is clearly gsasl which is broken:

[2022-05-13 17:40:38] smtp_authenticate: Trying method GSSAPI LOGIN PLAIN
[2022-05-13 17:40:38] mutt_gsasl_get_mech() returned no usable mech
[2022-05-13 17:40:38] No authenticators available

Gabor

-- Package-specific info:
Mutt 2.2.3 (2022-04-12)
Copyright (C) 1996-2022 Michael R. Elkins and others.
Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'.
Mutt is free software, and you are welcome to redistribute it
under certain conditions; type `mutt -vv' for details.

System: Linux 5.17.5-00001-g6be07be25066 (x86_64)
ncurses: ncurses 6.3.20220423 (compiled with 6.3)
libidn2: 2.3.2 (compiled with 2.3.2)
hcache backend: tokyocabinet 1.4.48

Compiler:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/11/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 11.2.0-20' --with-bugurl=file:///usr/share/doc/gcc-11/README.Bugs --enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++,m2 --prefix=/usr --with-gcc-major-version-only --program-suffix=-11 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --enable-bootstrap --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-plugin --enable-default-pie --with-system-zlib --enable-libphobos-checking=release --with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch --disable-werror --enable-cet --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-offload-targets=nvptx-none=/build/gcc-11-GT6Wjf/gcc-11-11.2.0/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-11-GT6Wjf/gcc-11-11.2.0/debian/tmp-gcn/usr --without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu --with-build-config=bootstrap-lto-lean --enable-link-serialization=2
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.2.0 (Debian 11.2.0-20)

Configure options: --build=x86_64-linux-gnu --prefix=/usr '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules '--libdir=${prefix}/lib/x86_64-linux-gnu' --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-mailpath=/var/mail --enable-compressed --enable-debug --enable-fcntl --enable-hcache --enable-gpgme --enable-imap --enable-smtp --enable-pop --enable-sidebar --enable-dotlock --disable-fmemopen --with-curses --with-gnutls --with-gss --with-idn2 --with-mixmaster --with-gsasl --without-gdbm --without-bdb --without-qdbm --with-tokyocabinet build_alias=x86_64-linux-gnu 'CFLAGS=-g -O2 -ffile-prefix-map=/build/mutt-OjBqXe/mutt-2.2.3=. -fstack-protector-strong -Wformat -Werror=format-security' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2'

Compilation CFLAGS: -Wall -pedantic -Wno-long-long -g -O2 -ffile-prefix-map=/build/mutt-OjBqXe/mutt-2.2.3=. -fstack-protector-strong -Wformat -Werror=format-security
APT policy: (990, 'stable'), (500, 'stable-updates'), (500, 'stable-security'), (103, 'testing'), (102, 'unstable'), (101, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.17.5-00001-g6be07be25066 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages mutt depends on:
ii libc6 2.33-7
ii libgnutls30 3.7.4-2
ii libgpg-error0 1.45-2
ii libgpgme11 1.16.0-1.2
ii libgsasl7 1.10.0-5+b1
ii libgssapi-krb5-2 1.19.2-2+b1
ii libidn2-0 2.3.2-2
ii libncursesw6 6.3+20220423-2
ii libtinfo6 6.3+20220423-2
ii libtokyocabinet9 1.4.48-15
ii zlib1g 1:1.2.11.dfsg-4

Versions of packages mutt recommends:
ii locales 2.33-7
ii mailcap 3.70+nmu1
ii sensible-utils 0.0.17

Versions of packages mutt suggests:
ii aspell 0.60.8-4
ii ca-certificates 20211016
ii gnupg 2.2.35-2
ii openssl 1.1.1o-1
ii postfix [mail-transport-agent] 3.6.4-1+b2
pn urlview <none>

Versions of packages mutt is related to:
ii mutt 2.2.3-2

-- no debconf information

brian m. carlson

unread,
May 13, 2022, 7:40:03 PM5/13/22
to
On 2022-05-13 at 22:52:29, Kevin J. McCarthy wrote:
> On Fri, 13 May 2022 15:02:38 -0700 "Kevin J. McCarthy" <ke...@8t8.us> wrote:
> > Thanks for the bug report. Yes, it most definitely is. I'll take a
> > look to see what I can find. Perhaps I've missed setting up some
> > callback information that gsasl needs.
> >
> > Would you be able to test a patch if/when I create one? If so, please
> > make sure you are subscribed to this ticket and I'll work on something
> > this weekend.
>
> Brian and Gábor, I did indeed miss a callback value needed by GSSAPI:
> hostname. The Mutt IMAP/GSSAPI auth code is using the server hostname
> for this field, contradicting the gsasl documentation which says to
> supply the "local host name". I'm trying the server hostname below.

Oh, yeah, that would do it. Kerberos definitely wants to have the
hostname.

> If possible could you try either the git branch
> 'kevin/gsasl-gssapi-fixes' on GitLab
> <https://gitlab.com/muttmua/mutt/-/commits/kevin/gsasl-gssapi-fixes> or
> alternatively try recompiling the source Debian package with the below
> patch applied?

I built the Debian package with the patch applied below. It didn't
quite apply cleanly with patch -p1, but I copied and pasted the change.
It does appear to work, and I'm using the patched version to send this.

Thanks so much for the fast turnaround time.
signature.asc
0 new messages