As I continue to test freeipa-server-4.9.3-1, on Fedora 33 with
dovecot-2.3.14-1 I've run into the following issues with web mail and
Dovecot integration.
I followed
https://www.freeipa.org/page/Dovecot_IMAPS_Integration_with_FreeIPA_using_Si...
but
I couldn't get web mail to login until I used the suggestion from
https://blog.delouw.ch/2017/02/19/integrate-dovecot-imap-with-freeipa-using-...
and
changed logins auth_mechanisms = plain gssapi login which allowed logins of
FreeIPA Kerberos users.
even with auth_mechanisms = plain gssapi login, I could then no longer
login to SquirrelMail webmail with any local Unix (non-Kerberized) users.
The dovecot logs show:
auth: Error: policy(localuser@ourdomain.edu,127.0.0.1,):
Policy server HTTP error: connect(x.x.x.x:8084) failed: Connection refused
auth: Debug: policy(localuser@ourdomain.edu,127.0.0.1,):
Policy report action finished
auth: Debug: http-client[1]: request [Req2: POST
https://x.x.x.x:8084/?command=report]: Destroy (requests left=1)
auth: Debug: http-client[1]: request [Req2: POST
https://x.x.x.x:8084/?command=report]: Free (requests left=0)
auth: Debug: http-client: conn x.x.x.x[2]: Connection close
auth: Debug: http-client: conn x.x.x.x[2]: Connection disconnect
auth: Debug: http-client: conn x.x.x.x[2]: Disconnected: connect() failed:
Connection refused (fd=23)
auth: Debug: http-client: conn x.x.x.x[2]: Detached peer
auth: Debug: http-client: conn x.x.x.x[2]: Connection destroy
auth: Debug: http-client: host x.x.x.x: Idle host timed out
auth: Debug: http-client: host x.x.x.x: Host destroy
auth: Debug: http-client: host x.x.x.x: Host session destroy
auth: Debug: http-client[1]: queue https://x.x.x.x:8084: Destroy
auth: Debug: client passdb out: FAIL 1 user=localuser@ourdomain.edu
original_user=localuser
imap-login: Debug: Ignoring unknown passdb extra field: original_user
imap-login: Info: Aborted login (auth failed, 1 attempts in 3 secs): user=<
localuser@ourdomain.edu>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1,
secured, session=
- If a user was over quota there was no way to tell on the webmail page
that they were over quota but the dovecot logs show imap(ouruser): Error:
mkdir(/path/to/ouruser/mail/.imap) failed: Disk quota exceeded.
Would there be a security risk if the web page displayed a warning that
could be generalized to inform the user to either check their quota or
password reset being needed?