IMAP frontend authenticating proxy with GSSAPI/Kerberos SSO
Gert van Dijk
gertvdijk+dovecot at gmail.com
Thu Aug 1 12:26:00 EEST 2019
Hi,
My IMAP backend server is lacking SSO authentication, so I am
trying to set up Dovecot in front of it as an authenticating proxy.
Fortunately, my backend server provides a way to ignore the
password provided and will simply trust the username given to
be authenticated, using plain login authentication. I'm struggling
with setting this up, as it seems to me that as soon as I enable
GSSAPI/Kerberos SSO in Dovecot it ignores my passdb proxy
settings and it creates a local mail store instead.
Is this behavior intentional, and why?
See also my Q on Serverfault.com [1], where some user has
reported this set up to be working with the same backend server
and provided some hints, but I believe I'm hitting a combination
that cannot be working with this version.
Dovecot version: v2.3.4.1 (from Debian Buster)
dovecot -n (I'm using only a single flat file dovecot.conf):
=====
# dovecot -n
# 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.4 ()
# OS: Linux 4.15.0-46-generic x86_64 Debian 10.0 overlay
# Hostname: imap.sub.mydomain.tld
auth_debug = yes
auth_default_realm = MY-REALM.DOMAIN.TLD
auth_gssapi_hostname = imap.sub.mydomain.tld
auth_krb5_keytab = /etc/dovecot/imap.keytab
auth_mechanisms = gssapi
auth_realms = MY-REALM.DOMAIN.TLD
auth_username_format = %n
auth_verbose = yes
log_path = /dev/stderr
mail_gid = 65534
mail_location = mbox:/tmp
mail_uid = 65534
passdb {
args = proxy=y host=127.0.0.1 port=1143 pass=#hidden_use-P_to_show#
driver = static
}
protocols = imap
ssl = required
ssl_cert = </etc/dovecot-ssl/cert.crt
ssl_cipher_list =
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl_key = # hidden, use -P to show it
ssl_min_protocol = TLSv1.2
ssl_prefer_server_ciphers = yes
=====
My comments are lost with "dovecot -n", so here I repeat some why's.
=====
# uid/gid of nobody or else:
# imap(username)<15><6SCG0QOPgtcKAAYE>: Error: Couldn't drop
privileges: User is missing UID (see mail_uid setting)
mail_uid = 65534
mail_gid = 65534
# Have to set dummy mail_location or else:
# Error: mail_location not set and autodetection failed: Mail storage
autodetection failed with home=(not set)
mail_location = mbox:/tmp
=====
(Ideally, I don't want to set any local storage storage, Dovecot should
just be a proxy in my case.)
Log, debug enabled, with client connecting:
=====
master: Info: Dovecot v2.3.4.1 (f79e8e7e4) starting up for imap
auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
auth: Debug: Module loaded:
/usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so
auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so
auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat
auth: Debug: auth client connected (pid=9)
auth: Debug: client in: AUTH 1 GSSAPI service=imap
secured=tls session=9WOjSwWP8toKAAYE lip=9.9.9.9
rip=1.2.3.4 lport=143 rport=56050
local_name=sub.mydomain.tld
ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256 ssl_cipher_bits=128
ssl_pfs=KxECDHE ssl_protocol=TLSv1.2
auth: Debug: gssapi(?,1.2.3.4,<9WOjSwWP8toKAAYE>): Obtaining
credentials for imap at sub.mydomain.tld
auth: Debug: client passdb out: CONT 1
auth: Debug: client in: CONT<hidden>
auth: Debug: gssapi(username,1.2.3.4,<9WOjSwWP8toKAAYE>): security
context state completed.
auth: Debug: client passdb out: CONT 1 YIGZBgkqhki[...]7Bm1G
auth: Debug: client in: CONT<hidden>
auth: Debug: gssapi(username,1.2.3.4,<9WOjSwWP8toKAAYE>): Negotiated
security layer
auth: Debug: client passdb out: CONT 1 BQQF/w[...]yjNOo=
auth: Debug: client in: CONT<hidden>
auth: Debug: static(username,1.2.3.4,<9WOjSwWP8toKAAYE>): lookup
auth: Info: static(username,1.2.3.4,<9WOjSwWP8toKAAYE>): No password
returned (and no nopassword)
auth: Debug: client passdb out: OK 1 user=username
original_user=username at MY-REALM.DOMAIN.TLD
auth: Debug: master in: REQUEST 3940810753 9 1
740b6a075ea21dbe10397f3734262bbe session_pid=12
request_auth_token
auth: Debug: master userdb out: USER 3940810753 username
auth_token=d1503de7036a68a85ea9db25f32bc9df3ebf08a8
auth_user=username at MY-REALM.DOMAIN.TLD
imap-login: Info: Login: user=<username>, method=GSSAPI, rip=1.2.3.4,
lip=9.9.9.9, mpid=12, TLS, session=<9WOjSwWP8toKAAYE>
=====
The good news is that everything related to Kerberos/GSSAPI
authentication seems to work fine!
Noteworthy in the above output I think is the line
"auth: Debug: client passdb out: ..." which does not mention
any proxy related settings any longer which aligns with my
observations:
- The client is then logged into an empty mailbox in local
storage. Not okay.
- No attempt to connect to my backend server is made
(checked with tcpdump). Not okay.
Somehow I start to believe that as soon as I set
auth_mechanisms = gssapi, any args/field in passdb are
ignored. Is that a bug or am I looking at a feature?
What else have I tried:
- Using imapc proxy [2], but that example config does not work
in my Dovecot version with the error:
auth: Error: prefetch(username,1.2.3.4,): userdb lookup not
possible with only userdb prefetch
- Using a passdb with master=yes and pass=yes.
passdb {
driver = static
args = proxy=y host=127.0.0.1 port=1143 pass=dummypass
master = yes
pass = yes
}
This fails with the error:
auth: Fatal: Master passdb can't have pass=yes if there are no passdbs
master: Error: service(auth): command startup failed, throttling for 2 secs
imap-login: Info: Disconnected: Auth process broken (disconnected
before auth was ready, waited 0 secs): user=<>, rip=1.2.3.4,
lip=9.9.9.9, session=<0i46qgWPntsKAAYE>
imap-login: Warning: Timeout leak: 0x7efe483e8120
(auth-server-connection.c:397)
Any help or clues are very much appreciated. Thanks!
[1]: https://serverfault.com/q/951010/135437
[2]: https://wiki.dovecot.org/HowTo/ImapcProxy
Gert van Dijk
More information about the dovecot
mailing list