I've taken some time to try to reproduce my problem on my sandbox. I was able to consistently reproduce it...
In the following scenario: dovecot -> stunnel -> ldap server when the ldap server is restarted, dovecot can no longer connect to the LDAP server through stunnel.
When I have dovecot connect directly to the ldap server (without SSL/TLS) and restart the server, dovecot works properly. It can continue to authenticate when the LDAP server becomes available again.
So I'd like to try to not use stunnel with dovecot. But how do I configure dovecot-ldap.conf to connect directly to the LDAP server with SSL/TLS?
I've tried:
hosts = ldaps://ldap.server.com and hosts = ldap.server.com:636
But neither work.
I didn't see another directive to use to turn SSL/TLS on in the conf file or in the docs.
Thanks, -jared
On Mar 30, 2004, at 1:30 PM, Jared wrote:
I upgraded dovecot two weeks ago from 0.99.10-0.rc2 to 0.99.10.4-1woody1 (both from the woody backport packages from braincells.com).
Dovecot is using LDAP on a separate machine for authentication.
(through stunnel if it matters)At 4:00 am, the LDAP server stops, dumps the ldap database, and then starts back up. Because the LDAP server is stopped, anyone who tries to authenticate during the few seconds will be denied. This isn't a big deal since it's 4:00 am. However, twice in the past two weeks, it appears that if dovecot can't connect to the LDAP server, it loses the ability until dovecot is restarted. It's only happened since I upgraded, and it's only happened twice, presumably when someone was trying to check their mail at the precise moment the LDAP server is down.
I get the following entry in mail.err:
Mar 30 04:00:18 akbar dovecot-auth: LDAP: ldap_result() failed: Can't contact LDAP server Mar 30 04:00:19 akbar dovecot-auth: LDAP: Can't connect to server: localhost Mar 30 04:00:50 akbar last message repeated 36 times . . .
The two times it has happened, ldap is responding properly (all other services we provide which use LDAP still work), stunnel on the dovecot machine is still running, and dovecot is still running, accepting IMAP and POP connections, but failing at the authentication phase.
Is there some change or bug in dovecot which would make this happen?
Or is there a problem with my set up?Thanks in advance for any ideas.
-jared