parser / kerberos problem

[IreneF]

Hey!

At the beginning of my cerb4-testing-career I was able to pull mails properly from my pop3-account.
But for a while - after updating from svn - I get this error message:

Warning: imap_open() [function.imap-open]: Couldn't open stream {mail.wu-wien.ac.at:110/pop3/notls}INBOX in /srv/www/html/cerb4/plugins/cerberusweb.core/cron.classes.php on line 348
Failed with error: Kerberos error: No credentials cache found (try running kinit) for server1.wu-wien.ac.at
Notice: Unknown: Kerberos error: No credentials cache found (try running kinit) for server1.wu-wien.ac.at (errflg=1) in Unknown on line 0

I tried it with all possible configurations: imap, pop, with / without ssl, always the same error.
We tried to deposit a hostkey for that server on the kerberos-server, but that doesn't help.

Any hint / idea how to solve that?

Thank you!
Irene

[jstanden]

Hey Irene!

I'm having to use Google, since we're not running Kerberos on our mail servers, but for that error I consistently see advice like:


No credentials cache file foundCause: Kerberos could not find the credentials cache (/tmp/krb5cc_uid).
Solution: Make sure that the credential file exists and is readable. If it isn't, try performing the kinit again.


A couple comments said to check the ownership of the file in /tmp. A couple others said to make sure the /tmp partition isn't full.

If I get some extra time this weekend I'll try setting up Kerberos on one of my development machines.

[IreneF]

Hi Jeff!

Thanks for you answer.
/tmp is not full.
Changing the permissions doesn't help (I even set them to 777 for testing purposes.)

Irene

[jstanden]

Hey Irene,

I haven't had a chance to set up Kerberos and try to reproduce this yet. Did you guys have any luck in the meantime?

[IreneF]

No, unfortunately not :(
We have no idea what causes the problem.

[IreneF]

Hi!

I haven't yet been able to solve the problem.
The point is that I _don't_ want to use kerberos for authentication, I'd like to use plain auth. As our mail server says for the properties auth=gssapi I guess the function imap_open wants to use this auth. I don't know how to tell the function to use only plain authentication.

Google told me about some bugs in conjunction with RHEL and this problem but as this reports are rather old (2005) I'm not sure if that explains the problem. (We are using a RHEL 5 server.)

Do you have any idea how to solve that?
Cerb4 is getting more and more interesting to me but I can't test it soundly.

Thank you,
Irene

[dfroberg]

Similar quirks with kerberos & php when trying to connect to an exchange 2007 machine...
Related?

[Hildy]

Possibly, but I'm not sure. I believe that Irene's problem is related to IMail (mail server)... There's an issue where it reports a response to the CAPA command that makes Swift try a particular type of authentication that IMail doesn't actually support.

I've got an open ticket on this same issue with a test login, so I should be able to track it down, but I don't know if that'll fix it for you, Danny. If we *are* able to force Swift to ignore the CAPA output and just use plain USER/PASS, then I'll let up how.

Also, if you've got a test account I can try accessing on your server to check with, Danny, I can use that to confirm if it works for Exchange, too. If so, send an email to support@cerberusweb.com and have them forward it to me.

[IreneF]

I don't know if this is really related: http://bugs.php.net/bug.php?id=33500 but there is also mentioned that the problem occurs with an Exchange Server.

[IreneF]

Is really nobody able to help me?

[dfroberg]

Also, if you've got a test account I can try accessing on your server to check with, Danny, I can use that to confirm if it works for Exchange, too. If so, send an email to support@cerberusweb.com and have them forward it to me.

Irene I just noticed that Hildy had asked me this, I'll see if we can set this up and find some kind of solution.

[IreneF]

It would be great if you could find a solution, thank you!
If you need an exchange account too to test with I can try to get one.

Irene

[CWasko]

I also have this problem too. I'm running Fedora for Cerberus and I was trying to check emails against my Exchange 2007 SP1 box, but it didn't work. My work around was to use another POP server I have here, but emails are getting flung all around. I'd really love to see this solved too.

[bjarke]

I have a similar problem where Cerb cannot connect to an Exchange 2007 Server using either POP3 or IMAP.

IMAP/POP3 works fine when connecting to a Courier-IMAP server.

[Hildy]

I'll be checking this out... bjarke, I'm not sure it's the same problem, if yours is the ticket I saw this morning, but I'll take a look.

[chris.brentano]

I had this same issue with HelpSpot, and when looking at Cerberus 4 ran into the same issue. Ian over at HelpSpot indicated that it's something with UW's c-client responding to Exchange 2007's advertising of Kerberos services, or something along those lines. He also indicated that recompiling c-client without Kerb support may work around the issue, but I haven't been successful doing so.

[chris.brentano]

Okay, I was able to work around this by compiling c-client without Kerberos support, and then re-compile PHP 5.2.5 against that and all works.

Here's my steps (I'm using CentOS 5.1 on a i386):

Download the latest IMAP Toolkit release at ftp://ftp.cac.washington.edu/mail/imap.tar.Z

Extract the files, then open up imap-2007/src/osdep/unix/Makefile and go to line 1002. Comment out the following section:


ckpgss: # Kerberos V (must have gss EXTRAAUTHENTICATOR as well)
@echo Kerberos V password authentication
$(LN) ckp_gss.c osdepckp.c



Save the file and exit. Change dirs back to the imap-2007 directory and build with the following:

make slx SSLINCLUDE=/usr/include/openssl SSLTYPE=nopwd

Once complete, download PHP 5.2.5 from php.net. Extract the files, then run configure with the following options:

./configure --without-kerberos --with-zlib --with-curl=/usr/lib --enable-dba --with-gd --enable-gd-native-ttf --with-jpeg-dir=/usr/lib --with-png-dir=/usr/lib --with-zlib-dir=/usr/lib --with-imap=/PATH-TO/imap-2007 --with-imap-ssl --enable-mbstring --with-mysql=/usr/lib/mysql --with-mysql-sock --with-mysqli --enable-soap --enable-sockets --with-pear --with-mcrypt --with-openssl --with-xml --with-apxs2=/PATH-TO/apxs --enable-memory-limit --enable-track-vars --enable-wddx --enable-ftp --enable-sysvmsg --enable-sysvem --enable-sysvshm --enable-transid --enable-cli --enable-cgi --with-ldap

There may be a bunch of package dependencies (like libmcrypt, libmcrypt-devel, openssl, openssl-devel, httpd-devel, etc.) that I won't go into here. Basically, if configure errs out and complains about a package not being installed, then install it and go from there.

Then run make, make test, and finally sudo make install.

Once it's installed, you'll need to add the following to /etc/httpd/conf/httpd.conf:

LoadModule php5_module /usr/lib/httpd/modules/libphp5.so
AddType application/x-httpd-php .php
AddType application/x-httpd-php .phtml


Then restart Apache and give it a shot. Hope that people find this useful! :cool:

[IreneF]

Thank you!

As I have all installed from rpms I don't want to switch to a manual installation (for update purposes). It would really be great if another solution for that problem could be found.

[CWasko]

Thank you!

As I have all installed from rpms I don't want to switch to a manual installation (for update purposes). It would really be great if another solution for that problem could be found.

I'm with you on this one. Back in the day, I'd be more daring to compile from source, but I really just don't have the patience for that anymore.

[dfroberg]

Hildy...

Did you get the Exchange 2007 account I sent you?

[bjarke]

I did the manual compile and install as above (on a Ubuntu server 7) which lets me create an Exchange account which verifies in setup, but running the cron jobs gives me this:


Account being parsed is Exchange
Time Limit: unlimited secs
Memory Limit: 64M
Init time: 17.650842666626 ms

Downloading message 1 (14 ms)
Total Runtime: 24.104118347168 ms
Time Limit: unlimited secs
Memory Limit: 64M

Reading 1207504048.9387.msg...
Decoding...
Fatal error: Call to undefined function mailparse_msg_parse_file() in /var/www/helpdesk/plugins/cerberusweb.core/cron.classes.php on line 111


Oddly enough the PATH tp php.ini was obscured, but I figured out where. I have the extension set in the new .ini, but a servercheck(.php) reports:

The 'GD' PHP extension (with FreeType library support) is required. Please enable them.
The 'MailParse' PHP extension is required. Please enable it.

GD (via phpinfo()) says it's installed though. I, however, cannot see that I've installed and set PHP up with mailparse.

Any pointers?

[bjarke]

Either it's me, PHP, Cerb or a curious combo, but I just reproduced the problem on another fresh install of a Ubuntu 7.10.

The fixed provided above fixed the problem with polling from Exchange, but as described above it now fails on the mailparser which seemingly does get installed during the manual setup. Also GD seems to be only half there as phpinfo() reports it being there, but servercheck.php says it's not.

(I just wanted to say I could reproduce)

[jfm]

Hi, I'm having a very similar problem. I have followed the above instructions and recompiled without kerberos support, and all works well until there an email arrives and the mail parser runs. At this point I get the following error:

Fatal error: Call to undefined function mailparse_msg_parse_file() in /var/www/helpdesk/plugins/cerberusweb.core/cron.classes.php on line 118

I've tried using both the PHP 5.2.5 and 5.2.6 source, and I get the same result with both.

I'm now stuck and need help! This is the only thing that is holding us back from purchasing a license.

Does anyone have a solution?

Cheers,

James

[Hildy]

Hey, James, have you confirmed that all the necessary extensions are still enabled/working after your recompile? Please check your helpdesk url/index.php/debug, the requirements checker, to see that eveything is still enabled.

[jfm]

Hi there,

Ok, it appears I am missing GD and mailparse. However, they are both installed, and they do both work if I use the standard version of php 5.2.6, rather than my recompiled version.

Any ideas?

[Hildy]

Well, do you get any startup errors in Apache? It could be that the GD and mailparse extensions are compiled against a different source; I don't know exactly, but I have seen them complained about before.