Re: [Dovecot] Trouble with proxy_maybe and auth_default_realm

On 12/29/2011 12:23 PM, Gedalya wrote:

Hello,

I'm using proxy_maybe and auth_default_realm. It seems that when a user logs in without the domain name, relying on auth_default_realm, and the "host" field points to the local server, I get the Proxying loops to itself error. It does work as expected - log on to the local server without proxying, if the user does include the domain name in the login.

(IP's and domain name masked below)

No domain:

Dec 29 11:49:07 imap01 dovecot: pop3-login: Error: Proxying loops to itself: user=, method=PLAIN, rip=00.00.52.18, lip=00.00.241.140 Dec 29 11:49:27 imap01 dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=, method=PLAIN, rip=00.00.52.18, lip=00.00.241.140

With domain:

Dec 29 11:52:13 imap01 dovecot: pop3-login: Login: user=, method=PLAIN, rip=00.00.52.18, lip=00.00.241.140, mpid=19969 Dec 29 11:52:18 imap01 dovecot: pop3(jedi@---.com): Disconnected: Logged out top=0/0, retr=0/0, del=0/1, size=731

Otherwise, e.g. when the proxy host is indeed another host, auth_default_domain works fine, including or not including the domain seems to make no difference, and everything works.

I'm using mysql, and I'm able to get around this problem including the following in the password query: IF(host='' or host='00.00.241.140', NULL, 'Y') as proxy_maybe

# dovecot --version 2.0.15

# dovecot -n # 2.0.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.3 auth_default_realm = ----.com auth_mechanisms = plain login cram-md5 ntlm auth_username_format = %Lu auth_verbose = yes auth_verbose_passwords = plain dict { quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no login_greeting = How can I help you? mail_gid = vmail mail_uid = vmail passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 lmtp service lmtp { inet_listener lmtp { address = 0.0.0.0 port = 7025 } } ssl_cert =

----- dovecot-sql.conf.ext ---- driver = mysql connect = host=localhost dbname=email user=email default_pass_scheme = PLAIN password_query = SELECT password,
IF('%s' = 'pop3', host_pop3, host) as host,
IF(host='' or host='00.00.241.140', NULL, 'Y') as proxy_maybe,
concat(userid, '@', domain) as destuser,
password as pass,
'/stor/mail/domains/%d/%n' AS userdb_home,
'maildir:/stor/mail/domains/%d/%n/Maildir' as userdb_mail,
concat('*:storage=', quota_mb, 'M') as userdb_quota_rule,
'vmail' AS userdb_uid, 'vmail' AS userdb_gid
FROM email WHERE userid = '%n' AND domain = '%d' user_query = SELECT '/stor/mail/domains/%d/%n' AS home,
'maildir:/stor/mail/domains/%d/%n/Maildir' as mail,
concat('*:storage=', quota_mb, 'M') as quota_rule,
'vmail' AS uid, 'vmail' AS gid
FROM email WHERE userid = '%n' AND domain = '%d'

OK, it turns out the problem went away when I removed the destuser field from the password query - it turned out to be unnecessary anyhow. My requirements are to allow users to log in using non-plaintext mechanisms such as CRAM-MD5, while my IMAP backends are non-dovecot and do not have a master user feature. Passwords are stored in the database in plaintext and presumably what I need to do is fetch the plaintext password from the database and simply use the user's own username and password when logging in to the backend. The wiki page on this subject only discusses a master-user setup, and my misunderstanding of that page lead me to think I need the destuser field. This turns out to be a simple setup, the only field involved being the "pass" field, and should probably be documented on the wiki.

Either way, proxy_maybe doesn't work with auth_default_realm and destuser, even if destuser ends up containing the exact same username that would be constructed by auth_default_realm.