Dovecot authentication through proxy
Daniel Niewerth
daniel at niewerth.it
Mon Jan 27 11:56:37 EET 2020
Hi everybody,
I run two redundant Dovecot servers with a shared Maildir on a GlusterFS volume and a SQL authentication backend based on a mirrored MariaDB database.
Because of the splitbrain situation I would like to add two Dovecot Director as proxies.
Since a few days I am trying to get the setup running.
In the meantime I have achieved that the clients can successfully authenticate on the proxy and that the client connections are forwarded to the backend servers.
Unfortunately I still have the problem that no authentication attempts are made on the backend servers.
Can someone explain me how to solve this problem?
I have read that it is eventually possible to work with Master Users.
But I guess that won't work for me, because I use the mailcrypt plugin and the client password is also the password for the encryption key.
Best regards
Daniel
### Proxy Log ###
###############
Jan 23 19:48:21 vsrv-***-prx01 dovecot: auth-worker(20760): Debug: sql(***@***.**,192.168.1.100,<sNTHFdOcbeDAqAFk>): Finished passdb lookup
Jan 23 19:48:21 vsrv-***-prx01 dovecot: auth-worker(20760): Debug: conn unix:auth-worker (pid=20753,uid=112): auth-worker<1>: Finished
Jan 23 19:48:21 vsrv-***-prx01 dovecot: auth: Debug: sql(***@***.**,192.168.1.100,<sNTHFdOcbeDAqAFk>): username changed ***@***.** -> ***
Jan 23 19:48:21 vsrv-***-prx01 dovecot: auth: Debug: sql(***,192.168.1.100,<sNTHFdOcbeDAqAFk>): username changed *** -> ***@***.**
Jan 23 19:48:21 vsrv-***-prx01 dovecot: auth: Debug: sql(***@***.**,192.168.1.100,<sNTHFdOcbeDAqAFk>): Finished passdb lookup
Jan 23 19:48:21 vsrv-***-prx01 dovecot: auth: Debug: auth(***@***.**,192.168.1.100,<sNTHFdOcbeDAqAFk>): Auth request finished
Jan 23 19:48:21 vsrv-***-prx01 dovecot: auth: Debug: client passdb out: OK#0111#011user=***@***.**#011proxy#011ssl=any-cert#011starttls=any-cert#011lip=192.168.20.49#011lport=993#011pass=<hidden>
Jan 23 19:48:21 vsrv-***-prx01 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: lip
Jan 23 19:48:21 vsrv-***-prx01 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: lport
### Backend Log ###
###################
Jan 23 18:48:51 vsrv-***-mta01 dovecot: imap-login: Disconnected (no auth attempts in 30 secs): user=<>, rip=192.168.20.49, lip=192.168.20.28, TLS handshaking: Connection closed, session=<r9yRF9OcZODAqBQx>
Jan 23 18:48:51 vsrv-***-mta01 dovecot: imap-login: Disconnected (no auth attempts in 30 secs): user=<>, rip=192.168.20.49, lip=192.168.20.28, TLS handshaking: Connection closed, session=<4C+SF9OcauDAqBQx>
Jan 23 18:48:51 vsrv-***-mta01 dovecot: imap-login: Disconnected (no auth attempts in 30 secs): user=<>, rip=192.168.20.49, lip=192.168.20.28, TLS handshaking: Connection closed, session=<KDGSF9OcZuDAqBQx>
Jan 23 18:48:51 vsrv-***-mta01 dovecot: imap-login: Disconnected (no auth attempts in 30 secs): user=<>, rip=192.168.20.49, lip=192.168.20.28, TLS handshaking: Connection closed, session=<lwKTF9OcbuDAqBQx>
### Proxy Config ###
####################
# 2.3.9.2 (cf2918cac): /etc/dovecot/dovecot.conf
# OS: Linux 4.15.0-74-generic x86_64 Ubuntu 18.04.3 LTS
# Hostname: vsrv-***-prx01
auth_debug = yes
director_mail_servers = 192.168.20.28 192.168.20.29
director_servers = 192.168.20.49:9090 192.168.20.58:9090
disable_plaintext_auth = no
mail_location = mbox:~/mail:INBOX=/var/mail/%u
namespace inbox {
inbox = yes
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix =
}
passdb {
args = /etc/dovecot/dovecot-sql.conf
driver = sql
}
passdb {
driver = pam
}
protocols = " imap"
service director {
inet_listener {
port = 9090
}
unix_listener login/director {
mode = 0666
}
}
service imap-login {
executable = imap-login director
}
service pop3-login {
executable = pop3-login director
}
ssl = required
ssl_cert = </etc/dovecot/private/***-**-fullchain.pem
ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kE$
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
ssl_prefer_server_ciphers = yes
userdb {
args = /etc/dovecot/dovecot-sql.conf
driver = sql
}
protocol lmtp {
auth_socket_path = director-userdb
}
### Backend Config ###
######################
# 2.3.9.2 (cf2918cac): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.9 (db4e9a2f)
# OS: Linux 4.15.0-72-generic x86_64 Ubuntu 18.04.3 LTS
# Hostname: vsrv-**-mta01.**.**.***.**
auth_debug = yes
auth_mechanisms = plain login
mail_attribute_dict = file:%h/Maildir/dovecot-attributes
mail_fsync = always
mail_gid = vmail
mail_home = /var/vmail/mailboxes/%d/%n
mail_location = maildir:~/mail:LAYOUT=fs
mail_nfs_index = yes
mail_nfs_storage = yes
mail_plugins = " notify mail_crypt"
mail_privileged_group = vmail
mail_uid = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve
mmap_disable = yes
namespace inbox {
inbox = yes
location =
mailbox Drafts {
auto = subscribe
special_use = \Drafts
}
mailbox Sent {
auto = subscribe
special_use = \Sent
}
mailbox Spam {
auto = subscribe
special_use = \Junk
}
mailbox Trash {
auto = subscribe
special_use = \Trash
}
prefix =
}
passdb {
args = /etc/dovecot/dovecot-sql.conf
driver = sql
}
plugin {
imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve
imapsieve_mailbox1_causes = COPY
imapsieve_mailbox1_name = Spam
imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve
imapsieve_mailbox2_causes = COPY
imapsieve_mailbox2_from = Spam
imapsieve_mailbox2_name = *
mail_crypt_curve = brainpoolP512r1
mail_crypt_require_encrypted_user_key = # hidden, use -P to show it
mail_crypt_save_version = 2
quota = maildir:User quota
quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space.
sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve
sieve_before = /var/vmail/sieve/global/spam-global.sieve
sieve_global_extensions = +vnd.dovecot.pipe
sieve_pipe_bin_dir = /usr/bin
sieve_plugins = sieve_imapsieve sieve_extprograms
}
protocols = imap lmtp sieve
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0660
user = postfix
}
unix_listener auth-userdb {
group = vmail
mode = 0660
user = vmail
}
}
service imap-login {
inet_listener imap {
port = 143
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
mode = 0660
user = postfix
}
user = vmail
}
service managesieve-login {
inet_listener sieve {
port = 4190
}
}
ssl = required
ssl_cert = </etc/letsencrypt/live/******/fullchain.pem
ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
ssl_prefer_server_ciphers = yes
userdb {
args = /etc/dovecot/dovecot-sql.conf
driver = sql
}
protocol imap {
imap_idle_notify_interval = 29 mins
mail_max_userip_connections = 20
mail_plugins = " notify mail_crypt quota imap_quota imap_sieve"
}
protocol lmtp {
mail_plugins = " notify mail_crypt sieve"
postmaster_address = postmaster@***.**
}
--
This email was Malware checked by vsrv-dus6-fwl01
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20200127/4df07400/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5440 bytes
Desc: not available
URL: <https://dovecot.org/pipermail/dovecot/attachments/20200127/4df07400/attachment-0001.bin>
More information about the dovecot
mailing list