[GH-ISSUE #472] Cypht only checks/acknowledges the first-offered SMTP authentication method #380

New issue

Open

opened 2026-02-25 21:34:53 +03:00 by kerem · 4 comments

kerem commented

2026-02-25 21:34:53 +03:00

Owner

Originally created by @rawhide-kobayashi on GitHub (Apr 29, 2021).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/472

Originally assigned to: @jasonmunro on GitHub.

Maybe a bit less of a bug, more of a design oversight, but anyway.

Cypht will fail to authenticate, despite valid authentication methods being available, if the first one listed is not supported by Cypht. For example, this authentication message works with Thunderbird and Roundcube, but not with Cypht.

Does not work:
250-AUTH GSSAPI PLAIN
Works:
250-AUTH PLAIN GSSAPI

Receiving the first string causes Cypht to immediately drop the connection with no further information provided to the SMTP server. Receiving the second causes it to proceed with PLAIN auth, as would normally be expected in both cases.

Steps to reproduce

Implement Postfix with SASL authentication
Provide multiple mechanisms to SASL for SMTP
Make the first option in the list an option supported by SASL and other mail clients, but unsupported by Cypht, such as GSSAPI
...
Profit

For me, this is "solved" by changing the order of authentication methods in saslauthd's smtp mech_list config line from "GSSAPI PLAIN to "PLAIN GSSAPI". However, the way AUTH is parsed appears to be fundamentally flawed. I'm no PHP wiz, but I believe the problem area is likely here: https://github.com/jasonmunro/cypht/blob/master/modules/smtp/hm-smtp.php#L316

Originally created by @rawhide-kobayashi on GitHub (Apr 29, 2021). Original GitHub issue: https://github.com/cypht-org/cypht/issues/472 Originally assigned to: @jasonmunro on GitHub. Maybe a bit less of a bug, more of a design oversight, but anyway. Cypht will fail to authenticate, despite valid authentication methods being available, if the first one listed is not supported by Cypht. For example, this authentication message works with Thunderbird and Roundcube, but not with Cypht. Does not work: 250-AUTH GSSAPI PLAIN Works: 250-AUTH PLAIN GSSAPI Receiving the first string causes Cypht to immediately drop the connection with no further information provided to the SMTP server. Receiving the second causes it to proceed with PLAIN auth, as would normally be expected in both cases. ### Steps to reproduce 1. Implement Postfix with SASL authentication 2. Provide multiple mechanisms to SASL for SMTP 3. Make the first option in the list an option supported by SASL and other mail clients, but unsupported by Cypht, such as GSSAPI 4. ... 5. Profit For me, this is "solved" by changing the order of authentication methods in saslauthd's smtp mech_list config line from "GSSAPI PLAIN to "PLAIN GSSAPI". However, the way AUTH is parsed appears to be fundamentally flawed. I'm no PHP wiz, but I believe the problem area is likely here: https://github.com/jasonmunro/cypht/blob/master/modules/smtp/hm-smtp.php#L316

kerem added the

bug

smtp

labels

2026-02-25 21:34:53 +03:00

kerem commented

2026-02-25 21:34:53 +03:00

Author

Owner

@jasonmunro commented on GitHub (Jun 8, 2021):

I cannot reproduce this yet. Seems to be doing the right thing in selecting only the first supported mech in my tests. Thanks for the report and I will try to reproduce again and let you know!

@jasonmunro commented on GitHub (Jun 8, 2021): I cannot reproduce this yet. Seems to be doing the right thing in selecting only the first supported mech in my tests. Thanks for the report and I will try to reproduce again and let you know!

kerem commented

2026-02-25 21:34:53 +03:00

Author

Owner

@marclaporte commented on GitHub (Jul 31, 2022):

@rawhide-kobayashi Any chance you could join us on https://gitter.im/cypht-org/community to help reproduce this?

Thanks!

@marclaporte commented on GitHub (Jul 31, 2022): @rawhide-kobayashi Any chance you could join us on https://gitter.im/cypht-org/community to help reproduce this? Thanks!

kerem commented

2026-02-25 21:34:53 +03:00

Author

Owner

@marclaporte commented on GitHub (May 7, 2024):

@rawhide-kobayashi

Please retest, as a lot has changed since you reported this issue. Notably, we now have 3 active branches and recently released Cypht 2.0.0

@marclaporte commented on GitHub (May 7, 2024): @rawhide-kobayashi Please retest, as a lot has changed since you reported this issue. Notably, we now have 3 active branches and recently released Cypht 2.0.0 - https://github.com/cypht-org/cypht/releases/tag/v2.0.0 - https://github.com/cypht-org/cypht/wiki/Lifecycle

kerem commented

2026-02-25 21:34:53 +03:00

Author

Owner

@marclaporte commented on GitHub (Sep 28, 2024):

@rawhide-kobayashi Last call :-)

Please test latest stable:
https://github.com/cypht-org/cypht/releases/

@marclaporte commented on GitHub (Sep 28, 2024): @rawhide-kobayashi Last call :-) Please test latest stable: https://github.com/cypht-org/cypht/releases/