[msmtp-users] GSSAPI error in client

[rochet@...382...]

Hello to everyone, 

on a Ubuntu 14 using a freshly compiled msmtp (Martin: --with-libsecret works fine, thanks!) I get the following error: 

$ echo 'some text' | msmtp --account rochet@...382...  pleaseplease@...384...
msmtp: GNU SASL: GSSAPI error in client while negotiating security context in gss_init_sec_context() in SASL library.  This is most likely due insufficient credentials or malicious interactions.

But, it works, if I run msmtp like this:
$ echo 'some text' | msmtp --host mail.pleaseplease@...384... --user=rochet@...382... testsmtp@...385... --from=rochet@...382... --tls=on --tls-trust-file=/etc/ssl/certs/ca-certificates.crt --tls-starttls=on --auth=on

Then, msmtp asks me for a password, gets it and sends the mail. 


This is the block from .msmtprc - something must be missing, because it won't work using --acount:

account rochet@...382...
auth on
tls on
tls_starttls on
host mail.pleaseplease@...384...
user rochet@...382...
from rochet@...386...
tls_trust_file /etc/ssl/certs/ca-certificates.crt
port 587
logfile ~/.msmtp.log
password averygoodpassword


The same configuration settings work on my CentOS. So, I need to find out where the friction is. Please point me in the right direction. 

$ msmtp --version
msmtp version 1.4.32
Platform: i686-pc-linux-gnu
TLS/SSL library: GnuTLS
Authentication library: GNU SASL
Supported authentication methods:
plain scram-sha-1 cram-md5 gssapi external digest-md5 login ntlm 
IDN support: enabled

Maybe the debug output is more helpful?
$ echo 'some text' | msmtp --debug --account rochet@...382...  pleaseplease@...384...
ignoring system configuration file /usr/local/etc/msmtprc: No such file or directory
loaded user configuration file /home/user/.msmtprc
using account rochet@...382... from /home/user/.msmtprc
host                  = mail.please.work
port                  = 587
proxy host            = (not set)
proxy port            = 0
timeout               = off
protocol              = smtp
domain                = localhost
auth                  = choose
user                  = rochet@...382...
password              = *
passwordeval          = python -c "import keyring; print keyring.get_password('rochet@...382...', 'rochet')"
ntlmdomain            = (not set)
tls                   = on
tls_starttls          = on
tls_trust_file        = /etc/ssl/certs/ca-certificates.crt
tls_crl_file          = (not set)
tls_fingerprint       = (not set)
tls_key_file          = (not set)
tls_cert_file         = (not set)
tls_certcheck         = on
tls_min_dh_prime_bits = (not set)
tls_priorities        = (not set)
auto_from             = off
maildomain            = (not set)
from                  = rochet@...382...
dsn_notify            = (not set)
dsn_return            = (not set)
keepbcc               = off
logfile               = /home/user/.msmtp.log
syslog                = (not set)
aliases               = (not set)
reading recipients from the command line
<-- 220 SMTP Service Of Please Work
--> EHLO localhost
<-- 250-mail.please.work Hello [12.345.6.78]
<-- 250-SIZE 44040192
<-- 250-PIPELINING
<-- 250-DSN
<-- 250-ENHANCEDSTATUSCODES
<-- 250-STARTTLS
<-- 250-AUTH GSSAPI NTLM
<-- 250-8BITMIME
<-- 250-BINARYMIME
<-- 250 CHUNKING
--> STARTTLS
<-- 220 2.0.0 SMTP server ready
TLS certificate information:
    Owner:
        Common Name: please.work
        Organization: Please Work
        Locality: WORK
        State or Province: WORK
        Country: WORK
    Issuer:
        Common Name: Work
        Organization: Work
        Organizational unit: Work
        Country: Work
    Validity:
        Activation time: fim 11.maí 2012, 14:07:14 GMT
        Expiration time: þri 10.maí 2017, 14:07:14 GMT
    Fingerprints:
        SHA1: 00:11:22:33::44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33
        MD5:  00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:DD
--> EHLO localhost
<-- 250-mail.please.work Hello [12.345.6.78]
<-- 250-SIZE 44040192
<-- 250-PIPELINING
<-- 250-DSN
<-- 250-ENHANCEDSTATUSCODES
<-- 250-AUTH GSSAPI NTLM LOGIN
<-- 250-8BITMIME
<-- 250-BINARYMIME
<-- 250 CHUNKING
msmtp: GNU SASL: GSSAPI error in client while negotiating security context in gss_init_sec_context() in SASL library.  This is most likely due insufficient credentials or malicious interactions.
msmtp: could not send mail (account rochet@...382... from /home/user/.msmtprc)

I use the correct credentials, but I do not consider fetching my own e-mail a malicious interaction, and commandline execution not referencing --account works. 

What do I miss? 

Cheers, 

rochet

-- 
Please encrypt communication:
2048D/A0B32504 2014-01-28 [expires: 2015-12-26]
Key fingerprint = 9C69 97F3 03B9 A509 4F99  AAB0 C438 6955 A0B3 2504
nanooq (only encrypted traffic allowed) <nanooq@...382...>