Bug#1010658: mutt: SMTP SASL authentication broken (base64 encoding?)
Vaclav Ovsik
Version: 2.2.3-2
Severity: normal
Dear Maintainer,
after Mutt upgrade from version 2.1.4-1 to version 2.2.3-2 SASL
authentication stopped working.
Debug from Mutt version 2.2.3:
[2022-05-06 10:33:19] Mutt/2.2.3 (2022-04-12) debugging at level 7
…
[2022-05-06 10:33:37] Looking up smtp.seznam.cz...
[2022-05-06 10:33:37] Connecting to smtp.seznam.cz...
[2022-05-06 10:33:37] Connected to smtp.seznam.cz:587 on fd=5
[2022-05-06 10:33:38] 5< 220 2.0.0 Seznam SMTP server waiting for your HELO/EHLO
[2022-05-06 10:33:38] 5> EHLO bobekpc.i.cz^M
[2022-05-06 10:33:38] 5< 250-Email.Seznam.cz - Email zdarma na cely zivot ESMTP
[2022-05-06 10:33:38] 5< 250-AUTH LOGIN PLAIN
[2022-05-06 10:33:38] 5< 250-8BITMIME
[2022-05-06 10:33:38] 5< 250-PIPELINING
[2022-05-06 10:33:38] 5< 250-SIZE 52428800
[2022-05-06 10:33:38] 5< 250-ENHANCEDSTATUSCODES
[2022-05-06 10:33:38] 5< 250-STARTTLS
[2022-05-06 10:33:38] 5< 250 X-SZNEXTENSIONS
[2022-05-06 10:33:38] 5> STARTTLS^M
[2022-05-06 10:33:38] 5< 220 Ready to start TLS
[2022-05-06 10:33:38] SSL/TLS connection using TLS1.3 (ECDHE-RSA/AES-256-GCM/AEAD)
[2022-05-06 10:33:39] 5> EHLO bobekpc.i.cz^M
[2022-05-06 10:33:39] 5< 250-Email.Seznam.cz - Email zdarma na cely zivot ESMTP
[2022-05-06 10:33:39] 5< 250-AUTH LOGIN PLAIN
[2022-05-06 10:33:39] 5< 250-8BITMIME
[2022-05-06 10:33:39] 5< 250-PIPELINING
[2022-05-06 10:33:39] 5< 250-SIZE 52428800
[2022-05-06 10:33:39] 5< 250-ENHANCEDSTATUSCODES
[2022-05-06 10:33:39] 5< 250 X-SZNEXTENSIONS
[2022-05-06 10:33:39] smtp_auth_gsasl: using mech PLAIN
[2022-05-06 10:33:39] Authenticating (PLAIN)...
[2022-05-06 10:33:39] 5> AUTH PLAIN^M
[2022-05-06 10:33:39] 5< 334 Send base64(login\0login\0password)
[2022-05-06 10:33:39] gsasl_step64() failed (8): Base 64 coding error in SASL library
[2022-05-06 10:33:39] 5> *^M
[2022-05-06 10:33:39] smtp_auth_gsasl: PLAIN failed
[2022-05-06 10:33:39] SASL authentication failed
Debug from Mutt version 2.1.4:
[2022-05-06 10:58:03] Mutt/2.1.4 (2021-12-11) debugging at level 7
…
[2022-05-06 10:58:16] Looking up smtp.seznam.cz...
[2022-05-06 10:58:16] Connecting to smtp.seznam.cz...
[2022-05-06 10:58:16] Connected to smtp.seznam.cz:587 on fd=5
[2022-05-06 10:58:17] 5< 220 2.0.0 Seznam SMTP server waiting for your HELO/EHLO
[2022-05-06 10:58:17] 5> EHLO bobekpc.i.cz^M
[2022-05-06 10:58:17] 5< 250-Email.Seznam.cz - Email zdarma na cely zivot ESMTP
[2022-05-06 10:58:17] 5< 250-AUTH LOGIN PLAIN
[2022-05-06 10:58:17] 5< 250-8BITMIME
[2022-05-06 10:58:17] 5< 250-PIPELINING
[2022-05-06 10:58:17] 5< 250-SIZE 52428800
[2022-05-06 10:58:17] 5< 250-ENHANCEDSTATUSCODES
[2022-05-06 10:58:17] 5< 250-STARTTLS
[2022-05-06 10:58:17] 5< 250 X-SZNEXTENSIONS
[2022-05-06 10:58:17] 5> STARTTLS^M
[2022-05-06 10:58:17] 5< 220 Ready to start TLS
[2022-05-06 10:58:17] SSL/TLS connection using TLS1.3 (ECDHE-RSA/AES-256-GCM/AEAD)
[2022-05-06 10:58:18] 5> EHLO bobekpc.i.cz^M
[2022-05-06 10:58:18] 5< 250-Email.Seznam.cz - Email zdarma na cely zivot ESMTP
[2022-05-06 10:58:18] 5< 250-AUTH LOGIN PLAIN
[2022-05-06 10:58:18] 5< 250-8BITMIME
[2022-05-06 10:58:18] 5< 250-PIPELINING
[2022-05-06 10:58:18] 5< 250-SIZE 52428800
[2022-05-06 10:58:18] 5< 250-ENHANCEDSTATUSCODES
[2022-05-06 10:58:18] 5< 250 X-SZNEXTENSIONS
[2022-05-06 10:58:18] SASL local ip: 10.2.36.5;43614, remote ip:77.75.78.48;587
[2022-05-06 10:58:18] External SSF: 256
[2022-05-06 10:58:18] External authentication name: my-login-name
[2022-05-06 10:58:18] mutt_sasl_cb_authname: getting authname for smtp.seznam.cz:587
[2022-05-06 10:58:18] mutt_sasl_cb_authname: getting user for smtp.seznam.cz:587
[2022-05-06 10:58:18] mutt_sasl_cb_pass: getting password for my-log...@smtp.seznam.cz:587
[2022-05-06 10:58:18] Authenticating (PLAIN)...
[2022-05-06 10:58:18] 5> AUTH PLAIN <<<base64-encoded-data-removed>>>^M
[2022-05-06 10:58:18] 5< 235 2.2.0 Authentication succeeded
[2022-05-06 10:58:18] SASL protection strength: 0
[2022-05-06 10:58:18] SASL protection buffer size: 65536
Thanks for maintaining Mutt
Regards
--
Zito
-- Package-specific info:
Mutt 2.2.3 (2022-04-12)
Copyright (C) 1996-2022 Michael R. Elkins and others.
Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'.
Mutt is free software, and you are welcome to redistribute it
under certain conditions; type `mutt -vv' for details.
System: Linux 5.17.0-1-amd64 (x86_64)
ncurses: ncurses 6.3.20220423 (compiled with 6.3)
libidn2: 2.3.2 (compiled with 2.3.2)
hcache backend: tokyocabinet 1.4.48
Compiler:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/11/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 11.2.0-20' --with-bugurl=file:///usr/share/doc/gcc-11/README.Bugs --enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++,m2 --prefix=/usr --with-gcc-major-version-only --program-suffix=-11 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --enable-bootstrap --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-plugin --enable-default-pie --with-system-zlib --enable-libphobos-checking=release --with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch --disable-werror --enable-cet --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-offload-targets=nvptx-none=/build/gcc-11-GT6Wjf/gcc-11-11.2.0/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-11-GT6Wjf/gcc-11-11.2.0/debian/tmp-gcn/usr --without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu --with-build-config=bootstrap-lto-lean --enable-link-serialization=2
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.2.0 (Debian 11.2.0-20)
Configure options: --build=x86_64-linux-gnu --prefix=/usr '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules '--libdir=${prefix}/lib/x86_64-linux-gnu' --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-mailpath=/var/mail --enable-compressed --enable-debug --enable-fcntl --enable-hcache --enable-gpgme --enable-imap --enable-smtp --enable-pop --enable-sidebar --enable-dotlock --disable-fmemopen --with-curses --with-gnutls --with-gss --with-idn2 --with-mixmaster --with-gsasl --without-gdbm --without-bdb --without-qdbm --with-tokyocabinet build_alias=x86_64-linux-gnu 'CFLAGS=-g -O2 -ffile-prefix-map=/build/mutt-OjBqXe/mutt-2.2.3=. -fstack-protector-strong -Wformat -Werror=format-security' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2'
Compilation CFLAGS: -Wall -pedantic -Wno-long-long -g -O2 -ffile-prefix-map=/build/mutt-OjBqXe/mutt-2.2.3=. -fstack-protector-strong -Wformat -Werror=format-security
Compile options:
-DOMAIN
+DEBUG
-HOMESPOOL +USE_SETGID +USE_DOTLOCK +DL_STANDALONE +USE_FCNTL -USE_FLOCK
+USE_POP +USE_IMAP +USE_SMTP
-USE_SSL_OPENSSL +USE_SSL_GNUTLS -USE_SASL +USE_GSASL +USE_GSS +HAVE_GETADDRINFO
+HAVE_REGCOMP -USE_GNU_REGEX
+HAVE_COLOR +HAVE_START_COLOR +HAVE_TYPEAHEAD +HAVE_BKGDSET
+HAVE_CURS_SET +HAVE_META +HAVE_RESIZETERM +HAVE_FUTIMENS
+CRYPT_BACKEND_CLASSIC_PGP +CRYPT_BACKEND_CLASSIC_SMIME +CRYPT_BACKEND_GPGME
-EXACT_ADDRESS -SUN_ATTACHMENT
+ENABLE_NLS -LOCALES_HACK +HAVE_WC_FUNCS +HAVE_LANGINFO_CODESET +HAVE_LANGINFO_YESEXPR
+HAVE_ICONV -ICONV_NONTRANS -HAVE_LIBIDN +HAVE_LIBIDN2 +HAVE_GETSID +USE_HCACHE
+USE_SIDEBAR +USE_COMPRESSED +USE_INOTIFY
-ISPELL
SENDMAIL="/usr/sbin/sendmail"
MAILPATH="/var/mail"
PKGDATADIR="/usr/share/mutt"
SYSCONFDIR="/etc"
EXECSHELL="/bin/sh"
MIXMASTER="mixmaster"
To contact the developers, please mail to <mutt...@mutt.org>.
To report a bug, please contact the Mutt maintainers via gitlab:
https://gitlab.com/muttmua/mutt/issues
-- System Information:
Debian Release: bookworm/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 5.17.0-1-amd64 (SMP w/6 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages mutt depends on:
ii libc6 2.33-7
ii libgnutls30 3.7.4-2
ii libgpg-error0 1.45-2
ii libgpgme11 1.16.0-1.2
ii libgsasl7 1.10.0-5+b1
ii libgssapi-krb5-2 1.19.2-2+b1
ii libidn2-0 2.3.2-2
ii libncursesw6 6.3+20220423-1
ii libtinfo6 6.3+20220423-1
ii libtokyocabinet9 1.4.48-15
ii zlib1g 1:1.2.11.dfsg-4
Versions of packages mutt recommends:
ii locales 2.33-7
ii mailcap 3.70+nmu1
ii sensible-utils 0.0.17
Versions of packages mutt suggests:
ii aspell 0.60.8-4
ii ca-certificates 20211016
ii gnupg 2.2.35-2
ii ispell 3.4.05-1
ii openssl 1.1.1n-1
ii postfix [mail-transport-agent] 3.6.4-1+b2
ii urlview 0.9-22
Versions of packages mutt is related to:
ii mutt 2.2.3-2
-- no debconf information
Kevin J. McCarthy
> According to my understanding of RFC4954, the "server challenge" 334
> response must either be blank (i.e., "334 "), or if there is data it
> must be base64 encoded.
I'm still interested to hear if 'set smtp_authenticators=login' works
for you, just to make sure there isn't another issue I need to be aware
of.
However, in the mean time I've pushed a commit up to branch
'kevin/gsasl-smtp-plain-workarounds' on gitlab:
<https://gitlab.com/muttmua/mutt/-/commit/85379c5a01168154f74a7d9841d1eab152b1b6b0.patch>
Would you be willing to try that patch - either via compiling from git,
or modifying the deb package and adding the patch to it?
thank you,
-Kevin
Václav Ovsík
I have added
set smtp_authenticators=login
and things works now!
[2022-05-12 16:47:53] 5< 250-PIPELINING
[2022-05-12 16:47:53] 5< 250-SIZE 52428800
[2022-05-12 16:47:53] 5< 250-ENHANCEDSTATUSCODES
[2022-05-12 16:47:53] 5< 250 X-SZNEXTENSIONS
[2022-05-12 16:47:53] smtp_authenticate: Trying method login
[2022-05-12 16:47:53] smtp_auth_gsasl: using mech LOGIN
[2022-05-12 16:47:53] Authenticating (LOGIN)...
[2022-05-12 16:47:53] 5> AUTH LOGIN
[2022-05-12 16:47:53] 5< 334 VXNlcm5hbWU6
[2022-05-12 16:47:53] 5> <<<base64-encoded-username>>>
[2022-05-12 16:47:53] 5< 334 UGFzc3dvcmQ6
…
So the problem is with the SMTP server side?
Thank you very much!
--
Zito