<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-CH" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="FR-CH">Hello List,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CH"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="FR-CH">Pardon me for bumping this topic, but does anyone had (positive ?) experience with dovecot proxying using LOGIN proxy_mech instead of PLAIN ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CH">I tried to resolve this on my own but I have not path to follow yet. I’m not even sure if this is supposed to work </span><span lang="FR-CH" style="font-family:"Segoe UI Emoji",sans-serif">😊</span><span lang="FR-CH"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CH"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="FR-CH">Kind regards<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;color:#C00000;mso-fareast-language:#2000">--SR</span></b><span lang="EN-US" style="color:black;mso-fareast-language:#2000"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:#2000">From:</span></b><span lang="EN-US" style="mso-fareast-language:#2000"> dovecot <dovecot-bounces@dovecot.org>
<b>On Behalf Of </b>Sébastien Riccio via dovecot<br>
<b>Sent:</b> samedi, 21 septembre 2019 12:33<br>
<b>To:</b> dovecot@dovecot.org<br>
<b>Subject:</b> Dovecot proxying to some backend using LOGIN proxy_mech<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello<span lang="FR-CH"> list</span>,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am currently testing a setup for a PoC wit this configuration.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- 1 x Frontend dovecot for proxying IMAP/POP3/LMTP/ManageSieve/Submission<o:p></o:p></p>
<p class="MsoNormal">- 2 x Backend dovecot with local mail storage<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The frontend does the user authentification and communicate with the backends using a master password<o:p></o:p></p>
<p class="MsoNormal">The fronted accepts PLAIN and LOGIN auth mechanisms and talk with backends using PLAIN auth mechanism (with the master password).<o:p></o:p></p>
<p class="MsoNormal">This works very well, it's cool.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Then, I've added to this setup an existing mail server (running another mailserver software) as a 3rd backend, and would like the frontend to also proxy for this, but this time not using master password.<o:p></o:p></p>
<p class="MsoNormal">This is working for IMAP/POP3 when it uses PLAIN auth, but not for Submission. The backend server in this case only accepts LOGIN auth and not PLAIN on port 587.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So I found out there is a field in the passdb we can add (proxy_mech), and I've set it to LOGIN.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The frontend seems to now use LOGIN auth mech to talk to this 3rd backend, but the authentication still fails.<o:p></o:p></p>
<p class="MsoNormal">According to the backend logs, tt seems dovecot proxy is now using LOGIN auth, but sends garbage as username and/or password.<o:p></o:p></p>
<p class="MsoNormal">Also IMAP that was working when using PLAIN doesn't work anymore with LOGIN.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Might this be a bug or this setup shouldn't be supported at all ?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Passdb MySQL table on frontend:<o:p></o:p></p>
<p class="MsoNormal">mysql> describe users;<o:p></o:p></p>
<p class="MsoNormal">+-------------+--------------+------+-----+---------+-------+<o:p></o:p></p>
<p class="MsoNormal">| Field | Type | Null | Key | Default | Extra |<o:p></o:p></p>
<p class="MsoNormal">+-------------+--------------+------+-----+---------+-------+<o:p></o:p></p>
<p class="MsoNormal">| user | varchar(255) | NO | PRI | NULL | |<o:p></o:p></p>
<p class="MsoNormal">| domain | varchar(255) | NO | PRI | NULL | |<o:p></o:p></p>
<p class="MsoNormal">| password | varchar(255) | YES | | NULL | |<o:p></o:p></p>
<p class="MsoNormal">| displayname | varchar(255) | YES | | NULL | |<o:p></o:p></p>
<p class="MsoNormal">| host | varchar(16) | NO | | NULL | |<o:p></o:p></p>
<p class="MsoNormal">| usemaster | tinyint(1) | NO | | 1 | |<o:p></o:p></p>
<p class="MsoNormal">| proxy_mech | varchar(20) | YES | | NULL | |<o:p></o:p></p>
<p class="MsoNormal">| starttls | varchar(20) | YES | | NULL | |<o:p></o:p></p>
<p class="MsoNormal">+-------------+--------------+------+-----+---------+-------+<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">mailstore-01/02 are dovecot backends<o:p></o:p></p>
<p class="MsoNormal">otherhost is the other mailserver I also would like to proxy through dovecot proxy<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">+---------+-----------------+-----------------------------------------+----------------+--------------+-----------+------------+----------+<o:p></o:p></p>
<p class="MsoNormal">| user | domain | password | displayname | host | usemaster | proxy_mech | starttls |<o:p></o:p></p>
<p class="MsoNormal">+---------+-----------------+-----------------------------------------+----------------+--------------+-----------+------------+----------+<o:p></o:p></p>
<p class="MsoNormal">| user1 | somedomain.com | {SHA512-CRYPT}<some_crypted_pass> | Joe Black | mailstore-01 | 1 | NULL | NULL |<o:p></o:p></p>
<p class="MsoNormal">| user2 | otherdomain.com | {SHA512-CRYPT}<some_crypted_pass> | Mr. Smith | mailstore-02 | 1 | NULL | NULL |<o:p></o:p></p>
<p class="MsoNormal">| user3 | area13.com | NULL | Donald Duck | otherhost | 0 | LOGIN | any-cert |<o:p></o:p></p>
<p class="MsoNormal">| user4 | area13.com | NULL | Thanks Obama | otherhost | 0 | LOGIN | any-cert |<o:p></o:p></p>
<p class="MsoNormal">+---------+-----------------+-----------------------------------------+----------------+--------------+-----------+------------+----------+<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="FR-CH">Passdb query :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CH"><o:p> </o:p></span></p>
<p class="MsoNormal">password_query = \<o:p></o:p></p>
<p class="MsoNormal"> SELECT concat(user, '@', domain) AS user, password, host, 'Y' AS proxy, \<o:p></o:p></p>
<p class="MsoNormal"> IF(usemaster is TRUE, '<span lang="FR-CH">supermasteruser</span>l', NULL) as master, \<o:p></o:p></p>
<p class="MsoNormal"> IF(usemaster is TRUE, '<span lang="FR-CH">supermasterpassword</span>', pass) as pass, \<o:p></o:p></p>
<p class="MsoNormal"> IF(usemaster is FALSE, 'Y', NULL) as nopassword, \<o:p></o:p></p>
<p class="MsoNormal"> proxy_mech, \<o:p></o:p></p>
<p class="MsoNormal"> starttls \<o:p></o:p></p>
<p class="MsoNormal"> FROM users WHERE user = '%n' AND domain = '%d'<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Some questions I'm asking myself:<o:p></o:p></p>
<p class="MsoNormal">Is proxying using LOGIN proxy_mech supported at all to auth on backends ?<o:p></o:p></p>
<p class="MsoNormal">Is dovecot proxying to "otherhost" supposed to decode original client auth (using PLAIN) and translate it to LOGIN format to auth with "otherhost" ?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># otherhost port 587 log<o:p></o:p></p>
<p class="MsoNormal">Without specifying proxy_mech<o:p></o:p></p>
<p class="MsoNormal">[2019.09.19] 09:27:22.167 [192.168.60.220][3070269] cmd: EHLO dovecotproxy.local.domain<o:p></o:p></p>
<p class="MsoNormal">[2019.09.19] 09:27:22.167 [192.168.60.220][3070269] rsp: 250-dovecotproxy.local.domain Hello [192.168.60.220]250-SIZE 52428800250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250-DSN250 OK<o:p></o:p></p>
<p class="MsoNormal">[2019.09.19] 09:27:22.167 [192.168.60.220][3070269] cmd: AUTH PLAIN <base64string><o:p></o:p></p>
<p class="MsoNormal">[2019.09.19] 09:27:22.167 [192.168.60.220][3070269] rsp: 504 Unrecognized authentication type.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When using proxy_mech LOGIN<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 08:24:45.201 [192.168.60.220][24148464] cmd: AUTH LOGIN =<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 08:24:45.201 [192.168.60.220][24148464] Exception: The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.
<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 08:24:45.201 [192.168.60.220][24148464] rsp: 535 Authentication failed<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># otherhost port 143 log<o:p></o:p></p>
<p class="MsoNormal">Works without specyfing proxy_mech<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When using proxy_mech LOGIN (fails)<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 03:37:20.896 [192.168.60.220][26310645] connected at 20.09.2019 03:37:20<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 03:37:20.896 [192.168.60.220][26310645] command: C CAPABILITY<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 03:37:20.896 [192.168.60.220][26310645] response: * CAPABILITY IMAP4rev1 AUTH=CRAM-MD5 AUTH=PLAIN UIDPLUS QUOTA XLIST CHILDREN ENABLE IDLE STARTTLS<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 03:37:20.896 [192.168.60.220][26310645] response: C OK CAPABILITY completed<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 03:37:20.896 [192.168.60.220][26310645] command: L AUTHENTICATE LOGIN<o:p></o:p></p>
<p class="MsoNormal">[2019.09.20] 03:37:20.927 [192.168.60.220][26310645] disconnected at 20.09.2019 03:37:20<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I hope I explained my setup so it's kinda understandable. I'm not good at explaining things :)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for your help!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">root@mailfront-01:~# dovecot --version<o:p></o:p></p>
<p class="MsoNormal">2.3.7.2 (3c910f64b)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;color:#C00000;mso-fareast-language:#2000">Sébastien RICCIO</span></b><span lang="EN-US" style="color:black;mso-fareast-language:#2000"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;color:black;mso-fareast-language:#2000">SYSTEM ADMINISTRATOR</span></b><span lang="EN-US" style="color:black;mso-fareast-language:#2000"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>