Dovecot Master User: Access user's mailbox without owner's password
Marcio Merlone
marcio.merlone at a1.ind.br
Tue Nov 19 14:03:13 EET 2019
Sounds a lot like my problem, which I described some days ago here on
the list, but no luck. Please report to the list if you make any progress.
Regards,
Em 14/11/2019 10:41, Dav Rdrz via dovecot escreveu:
> Hi, I hope you're all right. I describe below the scenario where the
> problem occurs.
> I'm trying to activate a master user [1] to be able to access all the
> boxes of all users by imap.
> I have configured the dovecot-master-users [2] file with the
> appropriate permissions.
> When I try to access, for example with roundcube, through
> user at mydomain.com*my_master_user at not-exist.com
> I see in the log, that it seems to ignore the master-user (*) and
> tries to authenticate the Active Directory but with the master user's
> password. Then it shows in the log the messages
>
> auth: Info: ldap(user at mydomain.com,127.0.0.1,<6sFGXE6XLwB/AAAB> )
> invalid credentials
> auth: Debug: client passdb out: FAIL 1 user=user at mydomain.com
>
> I have other test cases, but I need to validate the master user login that way.
>
> I would appreciate any comments you can make and I am waiting to
> answer any questions.
>
> Regards,
>
> [1] https://doc.dovecot.org/configuration_manual/authentication/master_users/
> [2] https://docs.iredmail.org/dovecot.master.user.html
>
> ---------------------------------------------------------------------------------------
>
> root at mail-01:/etc/dovecot# cat /etc/issue
> Ubuntu 14.04.5 LTS \n \l
>
> root at mail-01:/etc/dovecot# dpkg -l | grep dovecot | awk {'print $2" "$3'}
> dovecot-core 1:2.2.9-1ubuntu2.6
> dovecot-imapd 1:2.2.9-1ubuntu2.6
> dovecot-ldap 1:2.2.9-1ubuntu2.6
> dovecot-lmtpd 1:2.2.9-1ubuntu2.6
> dovecot-managesieved 1:2.2.9-1ubuntu2.6
> dovecot-mysql 1:2.2.9-1ubuntu2.6
> dovecot-pop3d 1:2.2.9-1ubuntu2.6
> dovecot-sieve 1:2.2.9-1ubuntu2.6
>
> root at mail-01:/etc/dovecot# cat dovecot.conf | grep -v '#' | grep -v -e
> '^$' | sed "s/REALDOMAIN/mydomain/g"
> listen = * [::]
> mail_plugins = quota mailbox_alias acl
> protocols = pop3 imap sieve lmtp
> mail_uid = 2000
> mail_gid = 2000
> first_valid_uid = 2000
> last_valid_uid = 2000
> log_path = /var/log/dovecot.log
> auth_verbose = yes
> auth_debug = yes
> ssl_protocols = !SSLv2 !SSLv3
> ssl = required
> verbose_ssl = no
> ssl_ca = </etc/ssl/certs/mydomain.com.ca-bundle
> ssl_cert = </etc/ssl/certs/mydomain.com.crt
> ssl_key = </etc/ssl/private/mydomain.com.key
> ssl_cipher_list =
> ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
> ssl_dh_parameters_length = 2048
> ssl_prefer_server_ciphers = yes
> disable_plaintext_auth = no
> mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/
> auth_default_realm = mydomain.com
> auth_mechanisms = PLAIN LOGIN
> service auth {
> unix_listener /var/spool/postfix/private/dovecot-auth {
> user = postfix
> group = postfix
> mode = 0666
> }
> unix_listener auth-master {
> user = vmail
> group = vmail
> mode = 0666
> }
> unix_listener auth-userdb {
> user = vmail
> group = vmail
> mode = 0660
> }
> }
> service lmtp {
> user = vmail
> process_min_avail = 5
> executable = lmtp -L
> unix_listener /var/spool/postfix/private/dovecot-lmtp {
> user = postfix
> group = postfix
> mode = 0600
> }
> inet_listener lmtp {
> address = 127.0.0.1
> port = 24
> }
> }
> auth_master_user_separator = *
> passdb {
> driver = passwd-file
> args = /etc/dovecot/dovecot-master-users
> master = yes
> }
> userdb {
> args = /etc/dovecot/dovecot-ldap.conf
> driver = ldap
> }
> passdb {
> args = /etc/dovecot/dovecot-ldap.conf
> driver = ldap
> }
> plugin {
> auth_socket_path = /var/run/dovecot/auth-master
> quota = dict:user::proxy::quotadict
> quota_rule = *:storage=3G
> quota_warning = storage=100%% quota-warning 100 %u
> quota_warning2 = storage=95%% quota-warning 95 %u
> quota_warning3 = storage=90%% quota-warning 90 %u
> quota_warning4 = storage=85%% quota-warning 85 %u
> quota_grace = 10%%
> acl = vfile
> acl_shared_dict = proxy::acl
> sieve_dir = %Lh/sieve
> sieve = %Lh/sieve/dovecot.sieve
> sieve_global_dir = /var/vmail/sieve
> sieve_before = /var/vmail/sieve/dovecot.sieve
> mailbox_alias_old = Sent
> mailbox_alias_new = Sent Messages
> mailbox_alias_old2 = Sent
> mailbox_alias_new2 = Sent Items
> }
> service quota-warning {
> executable = script /usr/local/bin/dovecot-quota-warning.sh
> unix_listener quota-warning {
> user = vmail
> group = vmail
> mode = 0660
> }
> }
> service dict {
> unix_listener dict {
> mode = 0660
> user = vmail
> group = vmail
> }
> }
> dict {
> quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf
> acl = mysql:/etc/dovecot/dovecot-share-folder.conf
> }
> protocol lda {
> mail_plugins = $mail_plugins sieve
> auth_socket_path = /var/run/dovecot/auth-master
> log_path = /var/log/dovecot-sieve.log
> lda_mailbox_autocreate = yes
> lda_mailbox_autosubscribe = yes
> postmaster_address = it at mydomain.com
> }
> protocol lmtp {
> info_log_path = /var/log/dovecot-lmtp.log
> mail_plugins = quota sieve
> postmaster_address = postmaster
> lmtp_save_to_detail_mailbox = yes
> recipient_delimiter = +
> }
> protocol imap {
> mail_plugins = $mail_plugins imap_quota imap_acl
> imap_client_workarounds = tb-extra-mailbox-sep
> mail_max_userip_connections = 30
> }
> protocol pop3 {
> mail_plugins = $mail_plugins
> pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
> pop3_uidl_format = %08Xu%08Xv
> mail_max_userip_connections = 30
> }
> service imap-login {
> service_count = 1
> process_limit = 500
> }
> service pop3-login {
> service_count = 1
> }
> service managesieve-login {
> inet_listener sieve {
> address = 127.0.0.1
> port = 4190
> }
> }
> namespace {
> type = private
> separator = /
> prefix =
> inbox = yes
> mailbox Sent {
> auto = subscribe
> special_use = \Sent
> }
> mailbox "Sent Messages" {
> auto = no
> special_use = \Sent
> }
> mailbox "Sent Items" {
> auto = no
> special_use = \Sent
> }
> mailbox Drafts {
> auto = subscribe
> special_use = \Drafts
> }
> mailbox Trash {
> auto = subscribe
> special_use = \Trash
> }
> mailbox "Deleted Messages" {
> auto = no
> special_use = \Trash
> }
> mailbox Junk {
> auto = subscribe
> special_use = \Junk
> }
> mailbox Spam {
> auto = no
> special_use = \Junk
> }
> mailbox "Junk E-mail" {
> auto = no
> special_use = \Junk
> }
> mailbox Archive {
> auto = subscribe
> special_use = \Archive
> }
> mailbox Archives {
> auto = no
> special_use = \Archive
> }
> }
> namespace {
> type = shared
> separator = /
> prefix = Shared/%%u/
> location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%u
> subscriptions = yes
> list = children
> }
>
> root at mail-01:/etc/dovecot# cat dovecot-ldap.conf | sed
> "s/realdomain/mydomain/g"
> hosts = active-directory:389
> ldap_version = 3
> auth_bind = yes
> dn = domain\vmail
> dnpass = Str0ngP4ssw0rd
> base = ou=Organizational Unit,dc=domain,dc=com
> scope = subtree
> deref = never
> user_filter =
> (&(userPrincipalName=%n at domain.com)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
> pass_filter =
> (&(userPrincipalName=%n at domain.com)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
> #user_filter =
> (&(mail=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
> #pass_filter =
> (&(mail=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
> pass_attrs = userPassword=password
> default_pass_scheme = CRYPT
> user_attrs = \
> #=mail=master_user, \
> #mail=user, \
> =user=%Ln at mydomain.com, \
> =home=/var/vmail/vmail1/mydomain.com/%Ln/Maildir/, \
> =mail=maildir:/var/vmail/vmail1/mydomain.com/%Ln/Maildir/, \
> maxStorage=quota_rule=*:bytes=%$
>
>
> root at mail-01:/etc/dovecot# ls -al dovecot-master-users
> -r-x------ 1 dovecot dovecot 120 Nov 13 14:45 dovecot-master-users
--
*Marcio Merlone*
TI - Administrador de redes
*A1 Engenharia - Unidade Corporativa*
Fone: +55 41 3616-3797
Cel: +55 41 99689-0036
https://a1.ind.br/ <https://a1.ind.br>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20191119/8848b2f0/attachment.html>
More information about the dovecot
mailing list