#980893 [PATCH] Support SCRAM-SHA-1 etc via libgsasl

Package:
exim4
Source:
exim4
Submitter:
Simon Josefsson
Date:
2026-08-30 12:21:01 UTC
Severity:
normal
Tags:
#980893#5
Date:
2021-01-23 22:23:39 UTC
From:
To:
Hi!

The patch below links exim4-daemon-heavy to libgsasl to enable the
'gsasl' authenticator support in exim, see:

https://exim.org/exim-html-current/doc/html/spec_html/ch-the_gsasl_authenticator.html

This makes it possible to enable SCRAM-SHA-1 and SCRAM-SHA-256 in Exim
via libgsasl.

Any chance this could make it into bullseye?  Thanks :)

I have done some testing using a minimal gsasl driver, and it seems to
work.  Configuration on the server side:

root@sid:/etc/exim4# cat conf.d/auth/50-sid
gsasl:
  driver = gsasl
  public_name = SCRAM-SHA-1
  server_password = foo
  server_set_id = ${quote:$auth1}
  server_condition = yes
root@sid:/etc/exim4#

Client side works:

jas@latte:~$ LANG=C gsasl x.y.z.q 587 --no-starttls --mechanism SCRAM-SHA-1 -a jas --password foo -d
Trying 'x.y.z.q'...
220 sid ESMTP Exim 4.94 Sat, 23 Jan 2021 22:20:48 +0000
EHLO [127.0.0.1]
250-sid Hello ...
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-PIPE_CONNECT
250-AUTH SCRAM-SHA-1
250-CHUNKING
250-STARTTLS
250-PRDR
250 HELP
AUTH SCRAM-SHA-1
334
biwsbj1qYXMscj1oOEh0TmFxci9UclA4eDlrbHlOeFhQTWc=
334 cj1oOEh0TmFxci9UclA4eDlrbHlOeFhQTWdPYkNqUnQ2OFU1Y0pJblR5ZWtyam12aVEscz15QnU1N3JNN3RwenFlNUpiLGk9NDA5Ng==
Yz1iaXdzLHI9aDhIdE5hcXIvVHJQOHg5a2x5TnhYUE1nT2JDalJ0NjhVNWNKSW5UeWVrcmptdmlRLHA9V1hVWGliY05tYTVZMk9UVExqQnlmWUNJT1NVPQ==
334 dj1pNkgzeW9IWWhVTXJxdERYd3VPaURYM0t6T2s9

235 Authentication succeeded
Client authentication finished (server trusted)...
Session finished...
QUIT
221 sid closing connection
jas@latte:~$

/Simon
#980893#10
Date:
2021-01-24 17:18:13 UTC
From:
To:
[...]

Hello Simon,

I am very reluctant to link exim against another SASL library since it
is already linked against the Cyrus SASL library.

cu Andreas
#980893#15
Date:
2026-08-30 10:04:10 UTC
From:
To:
sön 2021-01-24 klockan 18:18 +0100 skrev Andreas Metzler:

Hi!  Any chance this could be revisited?  Linking to both Cyrus SASL
and GNU SASL is similar to linking to both MySQL and PostgreSQL in my
mind.  Exim already links to multiple similar libraries too, e.g.
OpenSSL/GnuTLS, libcrypto/libnettle.

/Simon