December 2012 - dovecot

[Dovecot] Thunderbird SSL/TLS client authentication fails
by Roger Hunen 03 Dec '12

03 Dec '12

Hi, This is my first post to the list, so greetings to you all! I am seeking your help with SSL/TLS client authentication. I currently have the following setup: * Server: - Debian Squeeze (fully patched) - OpenSSL 0.9.8o - Dovecot v2.1.10 (Debian backport package from Wheezy) - SSL listener on port 993 with the Dovecot selfsigned certificate that was created during installation - Virtual users (user(a)domain.net) with password in passwd style file * Client: - Windows XP SP3 (fully patched) - Thunderbird 17.0 - IMAP account using "Normal password" authentication - Roundcube webmail (to be added soon) This works just fine :) ==> I now want to set Thunderbird to use "TLS certificate" authentication so that I can safely expose port 993 to the internet for mobile use. The idea is that clients with a trusted client certificate do not need a password so that I can change my password for Roundcube without having to change passwords on other IMAP clients (Roundcube will connect to localhost without SSL). To do so I did the following: - use XCA (v0.9.3, Windows version) to setup a private root CA with a CRL - export root CA certificate and CRL in PEM format and join them into a ca.pem file (order: certificate, CRL) - configure Dovecot to use the ca.pem file and require a client certificate - use XCA to generate a private key and certificate for commonName=user(a)mydomain.net - import certificate and private key into Thunderbird - change IMAP account setting in Thunderbird to use "TLS Certificate" authentication - When prompted, select the imported certificate to be used for authentication. Unfortunately the authentication fails :( Using "verbose_ssl=yes" I can see in the Dovecot logfile that Thunderbird connects and that the SSL handshake completes successfully. "Valid certificate" is logged for both client certificate and root CA certificate. This looks "so far so good" to me :) The Dovecot log has the following lines at the point of failure: imap-login: Warning: SSL alert: where=0x4004, ret=256: warning close notify [<IP>] imap-login: Warning: SSL alert: where=0x4008, ret=256: warning close notify [<IP>] imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=<IP>, lip=<IP>, TLS, session=<ID> (IP address and TLS session ID removed) The last log line ("user=<>") suggests that Dovecot does not try to use the commonName from the client certificate as the username even though (I think) I have configured Dovecot to do so. The relevant lines in the Dovecot configuration are: <config> auth_mechanisms = plain auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes disable_plaintext_auth = yes protocols = imap ssl = yes ssl_ca = </etc/dovecot/ssl/ca.pem ssl_cert = </etc/ssl/certs/dovecot.pem ssl_cert_username_field = commonName ssl_key = </etc/ssl/private/dovecot.pem ssl_parameters_regenerate = 0 ssl_require_crl = yes ssl_verify_client_cert = yes service imap-login { chroot = login process_min_avail = 1 service_count = 1 inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } </config> Observation: with "auth_ssl_require_client_cert = yes" Dovecot requires Thunderbird to send the client certificate even when Thunderbird uses "Normal password" authentication (authentication only fails if I delete the certificate from Thunderbird). So the SSL part looks OK to me. It seems that Dovecot is waiting for the client to logon over the established SSL/TLS connection instead of taking the username from the commonName in the certificate. ==> What could be going wrong here? I can post full config and logfile lines if you wnt to. Except for some possible oversight on my behalf there is nothing secret in there (I just didn't want to add too many lines to this already long post). Regards, -Roger

2 2

[Dovecot] Connection closed by foreign host.
by 张昊 03 Dec '12

03 Dec '12

hi, when i telnet 127.0.0.1 110,input the username and password,echo the error: Connection closed by foreign host. THE CONFIG: [root@www fuse-dfs]# dovecot -n # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-71.el6.i686 i686 CentOS Linux release 6.0 (Final) listen = * login_trusted_networks = 10.12.0.0/16 mail_location = mbox:~/mail:INBOX=/var/mail/%u mbox_write_locks = fcntl passdb { driver = pam } protocols = pop3 ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } THE LOG: Dec 3 14:29:13 www dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<zhanghao(a)zhanghao.com>, method=PLAIN, rip=10.12.3.1, lip=10.12.3.101, secured Dec 3 14:29:17 www dovecot: auth: Error: userdb(zhanghao,10.12.3.1): user not found from userdb passwd Dec 3 14:29:17 www dovecot: pop3: Error: Authenticated user not found from userdb, auth lookup id=3926917121 (client-pid=8774 client-id=1) Dec 3 14:29:17 www dovecot: pop3-login: Internal login failure (pid=8774 id=1) (auth failed, 1 attempts): user=<zhanghao>, method=PLAIN, rip=10.12.3.1, lip=10.12.3.101, mpid=8775, secured thank you very much! Best Regards 北京信联云通科技有限责任公司 Beijing Octopus link Co. Ltd 北京市海淀区北四环中路257号科群大厦西区 607 技术服务部张昊手机：13810705782 Email: support(a)octlink.com

1 0

[Dovecot] IMAP+SSL
by jugree＠lavabit.com 03 Dec '12

03 Dec '12

Hi. I've already posted on the list (0), but I can't access that account. I don't want to hijack that thread that's why I decided to create this one. > Please don't trim the doveconf -n output... > It shows the version of dovecot (so no one has to ask)... I'm using 1.2.15. (0) http://dovecot.org/pipermail/dovecot/2012-November/069665.html

1 0

[Dovecot] 回复： 2.1.12 - Pigeonhole 0.3.3 build failed: /usr/bin/ld: cannot find -lssl -lcrypto
by Sam DWH 01 Dec '12

01 Dec '12

Did you installed openssh? Tobias Hachmer <lists(a)kokelnet.de>编写： >Hello list, > >Although timos bugfix release this morning I can't build pigeonhole 0.3.3 for >dovecot 2.1.12 successfully. I don't know if it is a new bug or if I do >something wrong but with dovecot 2.1.10 all worked fine, with the same configure >options. > >configure options (out of debian/rules for building debian package): > >./configure --with-dovecot=/usr/lib/dovecot \ > --host=$(DEB_HOST_GNU_TYPE) \ > --build=$(DEB_BUILD_GNU_TYPE) \ > --prefix=/usr \ > --sysconfdir=/etc \ > --libexecdir=\$${prefix}/lib \ > --localstatedir=/var \ > --mandir=\$${prefix}/share/man \ > --infodir=\$${prefix}/share/info \ > --with-moduledir=\$${prefix}/lib/dovecot/modules > > >buildlogextraction with error, the full log is available here: >https://launchpadlibrarian.net/124478979/buildlog_ubuntu-precise- >amd64.dovecot-2.1-pigeonhole_0.3.3-7~kokelnet~precise_FAILEDTOBUILD.txt.gz > >Thanks in advance for any help, >Tobias Hachmer > >Making all in lib-sieve-tool >make[4]: Entering directory `/build/buildd/dovecot-2.1- >pigeonhole-0.3.3/src/lib-sieve-tool' >/bin/bash ../../libtool --tag=CC --mode=compile x86_64-linux-gnu-gcc - >DHAVE_CONFIG_H -I. -I../.. -I../../src/lib-sieve -I/usr/include/dovecot - >D_FORTIFY_SOURCE=2 -std=gnu99 -g -O2 -fstack-protector --param=ssp-buffer- >size=4 -Wformat -Wformat-security -Wall -W -Wmissing-prototypes -Wmissing- >declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast >-fno-builtin-strftime -Wstrict-aliasing=2 -MT sieve-tool.lo -MD -MP -MF >.deps/sieve-tool.Tpo -c -o sieve-tool.lo sieve-tool.c >libtool: compile: x86_64-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../.. - >I../../src/lib-sieve -I/usr/include/dovecot -D_FORTIFY_SOURCE=2 -std=gnu99 -g >-O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security - >Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar- >subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict- >aliasing=2 -MT sieve-tool.lo -MD -MP -MF .deps/sieve-tool.Tpo -c sieve-tool.c >-fPIC -DPIC -o .libs/sieve-tool.o >libtool: compile: x86_64-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../.. - >I../../src/lib-sieve -I/usr/include/dovecot -D_FORTIFY_SOURCE=2 -std=gnu99 -g >-O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security - >Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar- >subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict- >aliasing=2 -MT sieve-tool.lo -MD -MP -MF .deps/sieve-tool.Tpo -c sieve-tool.c >-o sieve-tool.o >/dev/null 2>&1 >mv -f .deps/sieve-tool.Tpo .deps/sieve-tool.Plo >/bin/bash ../../libtool --tag=CC --mode=compile x86_64-linux-gnu-gcc - >DHAVE_CONFIG_H -I. -I../.. -I../../src/lib-sieve -I/usr/include/dovecot - >D_FORTIFY_SOURCE=2 -std=gnu99 -g -O2 -fstack-protector --param=ssp-buffer- >size=4 -Wformat -Wformat-security -Wall -W -Wmissing-prototypes -Wmissing- >declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast >-fno-builtin-strftime -Wstrict-aliasing=2 -MT mail-raw.lo -MD -MP -MF >.deps/mail-raw.Tpo -c -o mail-raw.lo mail-raw.c >libtool: compile: x86_64-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../.. - >I../../src/lib-sieve -I/usr/include/dovecot -D_FORTIFY_SOURCE=2 -std=gnu99 -g >-O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security - >Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar- >subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict- >aliasing=2 -MT mail-raw.lo -MD -MP -MF .deps/mail-raw.Tpo -c mail-raw.c -fPIC >-DPIC -o .libs/mail-raw.o >libtool: compile: x86_64-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../.. - >I../../src/lib-sieve -I/usr/include/dovecot -D_FORTIFY_SOURCE=2 -std=gnu99 -g >-O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security - >Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar- >subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict- >aliasing=2 -MT mail-raw.lo -MD -MP -MF .deps/mail-raw.Tpo -c mail-raw.c -o >mail-raw.o >/dev/null 2>&1 >mv -f .deps/mail-raw.Tpo .deps/mail-raw.Plo >/bin/bash ../../libtool --tag=CC --mode=link x86_64-linux-gnu-gcc - >std=gnu99 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat- >security -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith >-Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime - >Wstrict-aliasing=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -o libsieve-tool.la >sieve-tool.lo mail-raw.lo -lrt >libtool: link: ar cru .libs/libsieve-tool.a .libs/sieve-tool.o .libs/mail- >raw.o >libtool: link: ranlib .libs/libsieve-tool.a >libtool: link: ( cd ".libs" && rm -f "libsieve-tool.la" && ln -s "../libsieve- >tool.la" "libsieve-tool.la" ) >make[4]: Leaving directory `/build/buildd/dovecot-2.1- >pigeonhole-0.3.3/src/lib-sieve-tool' >Making all in sieve-tools >make[4]: Entering directory `/build/buildd/dovecot-2.1- >pigeonhole-0.3.3/src/sieve-tools' >x86_64-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib-sieve - >I../../src/lib-sieve-tool -I./debug -I/usr/include/dovecot - >D_FORTIFY_SOURCE=2 -std=gnu99 -g -O2 -fstack-protector --param=ssp-buffer- >size=4 -Wformat -Wformat-security -Wall -W -Wmissing-prototypes -Wmissing- >declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast >-fno-builtin-strftime -Wstrict-aliasing=2 -MT sievec.o -MD -MP -MF >.deps/sievec.Tpo -c -o sievec.o sievec.c >mv -f .deps/sievec.Tpo .deps/sievec.Po >/bin/bash ../../libtool --tag=CC --mode=link x86_64-linux-gnu-gcc - >std=gnu99 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat- >security -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith >-Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime - >Wstrict-aliasing=2 -export-dynamic -Wl,-Bsymbolic-functions -Wl,-z,relro -o >sievec sievec.o ../../src/lib-sieve/libdovecot-sieve.la ../../src/lib-sieve- >tool/libsieve-tool.la -ldovecot-storage -lssl -lcrypto -ldovecot-lda - >L/usr/lib/dovecot -ldovecot -lrt >libtool: link: x86_64-linux-gnu-gcc -std=gnu99 -g -O2 -fstack-protector -- >param=ssp-buffer-size=4 -Wformat -Wformat-security -Wall -W -Wmissing- >prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 >-Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,-Bsymbolic- >functions -Wl,-z -Wl,relro -o .libs/sievec sievec.o -Wl,--export-dynamic >../../src/lib-sieve/.libs/libdovecot-sieve.so ../../src/lib-sieve- >tool/.libs/libsieve-tool.a /usr/lib/dovecot/libdovecot-storage.so -lssl - >lcrypto /usr/lib/dovecot/libdovecot-lda.so -L/usr/lib/dovecot >/usr/lib/dovecot/libdovecot.so -lrt -Wl,-rpath -Wl,/usr/lib/dovecot >/usr/bin/ld: cannot find -lssl >/usr/bin/ld: cannot find -lcrypto >collect2: ld returned 1 exit status >make[4]: *** [sievec] Error 1 >make[4]: Leaving directory `/build/buildd/dovecot-2.1- >pigeonhole-0.3.3/src/sieve-tools' >make[3]: *** [all-recursive] Error 1 >make[3]: Leaving directory `/build/buildd/dovecot-2.1-pigeonhole-0.3.3/src' >make[2]: *** [all-recursive] Error 1 >make[2]: Leaving directory `/build/buildd/dovecot-2.1-pigeonhole-0.3.3' >make[1]: *** [all] Error 2 >make[1]: Leaving directory `/build/buildd/dovecot-2.1-pigeonhole-0.3.3' >make: *** [build-stamp] Error 2

2 1