LINUX.ORG.RU
ФорумAdmin

dovecot 2 + postfix + Active Directory pam auth

 ,


0

1

Добрый день. Просьба оказать посильную помощь в настройке сабжа. На данный момент имею две проблемы:

Aug 22 14:49:09 s1mx1ls postfix/smtpd[5095]: connect from unknown[192.168.3.150]
Aug 22 14:49:09 s1mx1ls postfix/smtpd[5095]: warning: xsasl_cyrus_server_get_mechanism_list: no applicable SASL mechanisms
Aug 22 14:49:09 s1mx1ls postfix/smtpd[5095]: fatal: no SASL authentication mechanisms
Aug 22 14:49:10 s1mx1ls postfix/master[4999]: warning: process /usr/libexec/postfix/smtpd pid 5095 exit status 1
Aug 22 14:49:10 s1mx1ls postfix/master[4999]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling
Aug 22 14:49:10 s1mx1ls postfix/master[4999]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling
2.
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011lip=192.168.0.7#011rip=192.168.3.150#011lport=143#011rport=52744#011resp=AGVyZXNoZXRuaWtvdgBScXh6ODBtbg==
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libauthdb_ldap.so
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libmech_gssapi.so
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: pam(real-user-ad,192.168.3.150): lookup service=dovecot
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: pam(real-user-ad,192.168.3.150): #1/1 style=1 msg=Password:
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: client out: OK#0111#011user=real-user-ad
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: master in: REQUEST#0111874198529#0115083#0111#0118b942bc9ace756ed53f9751cd68d769d
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: passwd(real-user-ad,192.168.3.150): lookup
Aug 22 14:45:16 s1mx1ls dovecot: auth: Debug: master out: USER#0111874198529#011real-user-ad#011system_groups_user=real-user-ad#011uid=20001#011gid=20009#011home=/home/DOMAIN/real-user-ad
Aug 22 14:45:16 s1mx1ls dovecot: imap-login: Login: user=<real-user-ad>, method=PLAIN, rip=192.168.3.150, lip=192.168.0.7, mpid=5092, secured
Aug 22 14:45:16 s1mx1ls dovecot: imap: Debug: Loading modules from directory: /usr/lib64/dovecot
Aug 22 14:45:16 s1mx1ls dovecot: imap: Debug: Module loaded: /usr/lib64/dovecot/lib20_autocreate_plugin.so
Aug 22 14:45:16 s1mx1ls dovecot: imap(real-user-ad): Error: chdir(/home/DOMAIN/real-user-ad) failed: No such file or directory
Aug 22 14:45:16 s1mx1ls dovecot: imap(real-user-ad): Debug: Effective uid=20001, gid=20009, home=/home/DOMAIN/real-user-ad
Aug 22 14:45:16 s1mx1ls dovecot: imap(real-user-ad): Debug: Home dir not found: /home/DOMAIN/real-user-ad
Aug 22 14:45:16 s1mx1ls dovecot: imap(real-user-ad): Debug: maildir++: root=/raid10/vmail/real-user-ad/Maildir, index=, control=, inbox=/raid10/vmail/real-user-ad/Maildir
Aug 22 14:45:16 s1mx1ls dovecot: imap(real-user-ad): Debug: Namespace : Permission lookup failed from /raid10/vmail/real-user-ad/Maildir
Aug 22 14:45:16 s1mx1ls dovecot: imap(real-user-ad): Debug: Namespace : Using permissions from /raid10/vmail/real-user-ad/Maildir: mode=0700 gid=-1
Aug 22 14:45:16 s1mx1ls dovecot: imap(real-user-ad): Error: user real-user-ad: Initialization failed: Initializing mail storage from mail_location setting failed: mkdir(/raid10/vmail/real-user-ad/Maildir) failed: Permission denied (euid=20001(real-user-ad) egid=20009(domain users), euid is not dir owner)
Aug 22 14:45:16 s1mx1ls dovecot: imap(real-user-ad): Error: Invalid user settings. Refer to server log for more information.

опровержение

#ls -l /home/DOMAIN/
drwxr-xr-x 2 real-user-ad domain users 4096 Aug 21 13:20 real-user-ad
# ls -l /raid10/
drwxr-xr-x 2 vmail vmail  4096 Aug 21 19:45 vmail

уже каша в голове, а решение на горизонте не видно. Конфиг postfix

[root@s1mx1ls ~]# cat /etc/postfix/main.cf | grep -v '^#' | grep -v '^$'
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = mx1.maildomain.ru
mydomain = maildomain.ru
inet_interfaces = all
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost
unknown_local_recipient_reject_code = 550
mynetworks_style = host
mynetworks = 192.168.0.0/16, 127.0.0.0/8
relay_domains = $mydestination
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.6.6/samples
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
smtpd_client_restrictions =  permit_mynetworks,
                             permit_sasl_authenticated,
                             reject_unknown_client_hostname
                                permit

smtpd_helo_restrictions =       permit_mynetworks,
                                permit_sasl_authenticated,
                                reject_invalid_helo_hostname,
                                reject_non_fqdn_helo_hostname,
                                reject_unknown_helo_hostname
                                permit

smtpd_sender_restrictions =     permit_mynetworks,
                                permit_sasl_authenticated
                                check_sender_access ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf, ldap:/etc/postfix/ldap_virtual_alias_maps.cf
                                reject_authenticated_sender_login_mismatch,
                                reject_unknown_sender_domain,
                                reject_unlisted_sender,
                                reject_unverified_sender
                                permit

smtpd_recipient_restrictions =  permit_mynetworks,
                                permit_sasl_authenticated,
                                reject_unauth_destination,
                                check_recipient_access ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf,
                                reject_unlisted_recipient,
                                reject_unknown_recipient_domain,
                                reject_non_fqdn_recipient,
                                reject_unverified_recipient
                                permit

smtpd_etrn_restrictions = reject
smtpd_reject_unlisted_sender = yes
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
show_user_unknown_table_name = no
address_verify_sender = <>
unverified_sender_reject_code = 550
smtpd_helo_required = yes
smtp_always_send_ehlo = yes
smtpd_hard_error_limit = 8
smtpd_sasl_auth_enable = yes
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
virtual_alias_maps = ldap:/etc/postfix/ldap_virtual_alias_maps.cf
virtual_mailbox_domains = maildomain.ru
virtual_mailbox_maps = ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf
virtual_gid_maps = static:400
virtual_uid_maps = static:400
virtual_minimum_uid = 400

dovecot
]# doveconf -n
# 2.0.9: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-358.14.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) ext4
auth_debug = yes
auth_debug_passwords = yes
auth_gssapi_hostname = $ALL
auth_krb5_keytab = /etc/krb5.keytab
auth_mechanisms = plain login gssapi
auth_realms = DOMAIN.LOCAL
auth_use_winbind = yes
auth_username_format = %n
auth_verbose = yes
base_dir = /var/run/dovecot/
disable_plaintext_auth = no
listen = *
login_trusted_networks = 192.168.0.0/16
mail_chroot = /raid10/vmail
mail_debug = yes
mail_gid = 400
mail_location = maildir:/raid10/vmail/%u/Maildir
mail_uid = 400
mbox_write_locks = fcntl
passdb {
  driver = pam
}
plugin {
  autocreate = Trash
  autocreate2 = Spam
}
service auth {
  unix_listener auth-userdb {
    group = vmail
    mode = 0660
    user = vmail
  }
  user = $default_internal_user
}
ssl = no
userdb {
  driver = passwd
}
userdb {
  args = uid=400 gid=400 home=/raid10/vmail/%u/Maildir
  driver = static
}
verbose_ssl = yes
protocol imap {
  imap_idle_notify_interval = 2 mins
  mail_max_userip_connections = 10
  mail_plugins = " autocreate"
}

в конечном итоге хочу получить smtp и imap сервер берущий пользователей из Active Directory, с авторизацией по доменному логину и паролю.

Effective uid=20001, gid=20009, home=/home/DOMAIN/real-user-ad
..
mail_gid = 400
mail_uid = 400

Создано с uid=20001, читает с uid=400, где-то нужно исправлять.

DiMoN ★★★ ()
Последнее исправление: DiMoN (всего исправлений: 2)
Ответ на: комментарий от DiMoN

uid=20001 - это uid пользователя real-user-ad домена, но в домене много пользователей, и у каждого свой uid... от 20001 и по нарастающей uid=400 - это uid пользователя vmail

openmsk ()
Ответ на: комментарий от blind_oracle

в конфиге прописано:

mail_gid = 400

mail_uid = 400

т.е. пользователь vmail. Я правильно понимаю что под этим пользователем и выполняется imap права # ls -l /raid10/

drwxr-xr-x 2 vmail vmail 4096 Aug 21 19:45 vmail

openmsk ()
Ответ на: комментарий от openmsk

Эти уиды-гиды могут оверрайдится данными из userdb, судя по

Effective uid=20001, gid=20009, home=/home/DOMAIN/real-user-ad
То используются эти gid-uid.

blind_oracle ★★★★★ ()
Ответ на: комментарий от hizel

я то забуду, я уже не понимаю как это давекоту объяснить, и прошу меня ткнуть в нужную строку

openmsk ()
Ответ на: комментарий от openmsk

В postfix добавьте

smtpd_sasl_path = private/auth
Секцию auth dovecota приведите к такому виду:
auth default {
  mechanisms = plain gssapi
  passdb pam {
    args = dovecot
  }
  user = root
  socket listen {
    master {
      path = /var/run/dovecot/auth-master
      mode = 0600
      user = vmail
    }
    client {
      path = /var/spool/postfix/private/auth
      mode = 0660
      user = postfix
      group = postfix
    }
  }
}

menzoberronzan ()
Ответ на: комментарий от menzoberronzan

dovecot 2 ругается на наличии секций user, socket, master, client... в итоге сейчас имеем:

[root@ dovecot]# doveconf -n
# 2.0.9: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-358.14.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) ext4
auth_debug = yes
auth_debug_passwords = yes
auth_gssapi_hostname = $ALL
auth_krb5_keytab = /etc/krb5.keytab
auth_mechanisms = plain login gssapi
auth_realms = DOMAIN.LOCAL
auth_use_winbind = yes
auth_username_format = %n
auth_verbose = yes
base_dir = /var/run/dovecot/
disable_plaintext_auth = no
first_valid_gid = 2000
first_valid_uid = 2000
last_valid_gid = 40000000
last_valid_uid = 40000000
listen = *
login_trusted_networks = 192.168.0.0/16
mail_chroot = /raid10/vmail
mail_debug = yes
mail_gid = 400
mail_location = maildir:/raid10/vmail/%u/Maildir
mail_uid = 400
mbox_write_locks = fcntl
passdb {
  args = dovecot
  driver = pam
}
plugin {
  autocreate = Trash
  autocreate2 = Spam
}
postmaster_address = postmaster@maildomain.ru
service auth-worker {
  user = $default_internal_user
}
service auth {
  unix_listener auth-userdb {
    group = vmail
    mode = 0660
    user = vmail
  }
  user = $default_internal_user
}
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_key = </etc/pki/dovecot/private/dovecot.pem
verbose_ssl = yes
protocol lda {
  mail_plugins =
}
protocol imap {
  imap_idle_notify_interval = 2 mins
  mail_max_userip_connections = 10
  mail_plugins = " autocreate"
}

и при попытке залогиниться через telnet

 telnet imap.domain.local 143
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=
LOGIN AUTH=GSSAPI] Dovecot ready.
a login real-user-ad real-password
* BYE Internal error occurred. Refer to server log for more information.

Подключение к узлу утеряно.
в лог падает
Aug 23 12:56:49 s1mx1ls dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth
Aug 23 12:56:49 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libauthdb_ldap.so
Aug 23 12:56:49 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so
Aug 23 12:56:49 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libmech_gssapi.so
Aug 23 12:56:49 s1mx1ls dovecot: auth: Debug: auth client connected (pid=4265)
Aug 23 12:56:56 s1mx1ls dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011lip=192.168.0.7#011rip=192.168.0.64#011lport=143#011rport=63063#011resp=AGVyZXNoZXRuaWtvdgBScXh6ODBtbg==
Aug 23 12:56:56 s1mx1ls dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth
Aug 23 12:56:56 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libauthdb_ldap.so
Aug 23 12:56:56 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so
Aug 23 12:56:56 s1mx1ls dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libmech_gssapi.so
Aug 23 12:56:56 s1mx1ls dovecot: auth: Debug: pam(real-user-ad,192.168.0.64): lookup service=dovecot
Aug 23 12:56:56 s1mx1ls dovecot: auth: Debug: pam(real-user-ad,192.168.0.64): #1/1 style=1 msg=Password:
Aug 23 12:57:01 s1mx1ls dovecot: auth: Debug: client out: OK#0111#011user=real-user-ad
Aug 23 12:57:01 s1mx1ls dovecot: auth: Debug: master in: REQUEST#0113040870401#0114265#0111#0112946ad7252a720ad3ccb3dfde6ebc2a3
Aug 23 12:57:01 s1mx1ls dovecot: auth: Debug: master out: USER#0113040870401#011real-user-ad
Aug 23 12:57:01 s1mx1ls dovecot: imap-login: Login: user=<real-user-ad>, method=PLAIN, rip=192.168.0.64, lip=192.168.0.7, mpid=4274, secured
Aug 23 12:57:01 s1mx1ls dovecot: imap: Debug: Loading modules from directory: /usr/lib64/dovecot
Aug 23 12:57:01 s1mx1ls dovecot: imap: Debug: Module loaded: /usr/lib64/dovecot/lib20_autocreate_plugin.so
Aug 23 12:57:01 s1mx1ls dovecot: imap(real-user-ad): Error: user real-user-ad: Couldn't drop privileges: Mail access for users with UID 400 not permitted (see first_valid_uid in config file).
Aug 23 12:57:01 s1mx1ls dovecot: imap(real-user-ad): Error: Internal error occurred. Refer to server log for more information.

openmsk ()
Ответ на: комментарий от openmsk

приведи к общей группе пользователя dovecot и пользователей почты

fbiagent ★★★ ()
Ответ на: комментарий от menzoberronzan

Подтверждаю - наиболее вероятна причина большого значения first_valid_uid - буквально на днях боролся с похожей ситуацией, правда там ещё SELinux изрядно мешал... Пока до конца поставленную задачу не победил (не сумел SSO/GSSAPI), но почта уже вполне сносно работает - даже заметку в личном блоге написал на эту тему http://www.bubnov.su/node/72

anonymous ()
Ответ на: комментарий от menzoberronzan

изменил first_valid_gid = 2000 first_valid_uid = 2000 на uid/gid пользователя vmail и понеслось)

Aug 24 10:47:47 s1mx1ls dovecot: imap(real-user-ad): Debug: Effective uid=400, gid=400, home=
Aug 24 10:47:47 s1mx1ls dovecot: imap(real-user-ad): Debug: maildir++: root=/raid10/vmail/real-user-ad/Maildir, index=, control=, inbox=/raid10/vmail/real-user-ad/Maildir
Aug 24 10:47:47 s1mx1ls dovecot: imap(real-user-ad): Debug: Namespace : Permission lookup failed from /raid10/vmail/real-user-ad/Maildir
Aug 24 10:47:47 s1mx1ls dovecot: imap(real-user-ad): Debug: Namespace : Using permissions from /raid10/vmail/real-user-ad/Maildir: mode=0700 gid=-1

указанной папки до входа пользователя небыло. после входа папка создалась в правами

drwx------ 3 vmail vmail 4096 Aug 24 10:47 real-user-ad 
drwx------ 2 400 400 4096 Aug 24 10:47 Maildir
в файле /etc/dovecot/conf.d/10-mail.conf изменил значение mail_uid и mail_gid с 400 на vmail и папка создалась с правами на пользователя vmail

openmsk ()
Ответ на: комментарий от openmsk

текущая конфигурация

[root@s1mx1ls vmail]# doveconf -N
# 2.0.9: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-358.14.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) ext4
auth_debug = yes
auth_debug_passwords = yes
auth_gssapi_hostname = $ALL
auth_krb5_keytab = /etc/krb5.keytab
auth_mechanisms = plain login gssapi
auth_realms = DOMAIN.LOCAL
auth_use_winbind = yes
auth_username_format = %n
auth_verbose = yes
auth_winbind_helper_path = /usr/bin/ntlm_auth
base_dir = /var/run/dovecot/
disable_plaintext_auth = no
first_valid_gid = 400
first_valid_uid = 400
last_valid_gid = 20000
last_valid_uid = 20000
listen = *
login_greeting = Dovecot ready.
login_trusted_networks = 192.168.0.0/16
mail_debug = yes
mail_gid = vmail
mail_location = maildir:/raid10/vmail/%u/Maildir
mail_uid = vmail
mbox_write_locks = fcntl
passdb {
  args = dovecot
  driver = pam
}
postmaster_address = postmaster@maildomain.ru
protocols = imap pop3 lmtp
service auth-worker {
  user = $default_internal_user
}
service auth {
  unix_listener auth-userdb {
    group = vmail
    mode = 0660
    user = vmail
  }
  user = $default_internal_user
}
ssl = yes
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_key = </etc/pki/dovecot/private/dovecot.pem
verbose_ssl = yes
protocol lda {
  mail_plugins =
}
protocol imap {
  imap_idle_notify_interval = 2 mins
  mail_max_userip_connections = 10
  mail_plugins = " autocreate"
}
[root@s1mx1ls vmail]#

[root@s1mx1ls vmail]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
disable_vrfy_command = yes
home_mailbox = /raid10/vmail/
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailbox_command = /usr/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT"
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = maildomain.ru
myhostname = mx1.maildomain.ru
mynetworks = 192.168.0.0/16, 127.0.0.0/8
mynetworks_style = host
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_hard_error_limit = 8
unknown_local_recipient_reject_code = 550
unverified_sender_reject_code = 550
virtual_alias_maps = ldap:/etc/postfix/ldap_virtual_alias_maps.cf
virtual_gid_maps = static:400
virtual_mailbox_domains = maildomain.ru
virtual_mailbox_maps = ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf
virtual_minimum_uid = 400
virtual_transport = dovecot
virtual_uid_maps = static:400

попытка отправить письмо:

[root@s1mx1ls vmail]# telnet localhost 25
Trying ::1...
Connected to localhost.
Escape character is '^]'.
220 mx1.maildomain.ru ESMTP Postfix
HELO gmail.com
250 mx1.maildomain.ru
mail from:openmsk@gmail.com
250 2.1.0 Ok
rcpt to:realuserad@maildomain.ru
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
hi.
.
250 2.0.0 Ok: queued as C59E1E04A9
quit
221 2.0.0 Bye
Connection closed by foreign host.
в лог упало:
Aug 24 12:51:09 s1mx1ls postfix/smtpd[5992]: connect from localhost[::1]
Aug 24 12:52:13 s1mx1ls postfix/smtpd[5992]: C59E1E04A9: client=localhost[::1]
Aug 24 12:52:22 s1mx1ls postfix/cleanup[5997]: C59E1E04A9: message-id=<20130824085213.C59E1E04A9@mx1.maildomain.ru>
Aug 24 12:52:22 s1mx1ls postfix/qmgr[2857]: C59E1E04A9: from=<openmsk@gmail.com>, size=358, nrcpt=1 (queue active)
Aug 24 12:52:23 s1mx1ls dovecot: auth: Debug: master in: USER#0111#011real-user-ad@maildomain.ru#011service=lda
Aug 24 12:52:23 s1mx1ls dovecot: auth: Debug: password(real-user-ad): passdb doesn't support credential lookups
Aug 24 12:52:23 s1mx1ls dovecot: auth: Error: static(real-user-ad): passdb doesn't support lookups, can't verify user's existence
Aug 24 12:52:23 s1mx1ls dovecot: auth: Debug: master out: FAIL#0111
Aug 24 12:52:23 s1mx1ls dovecot: lda: Error: user real-user-ad@maildomain.ru: Auth USER lookup failed
Aug 24 12:52:23 s1mx1ls dovecot: lda: Debug: auth input:
Aug 24 12:52:23 s1mx1ls dovecot: lda: Debug: auth input:
Aug 24 12:52:23 s1mx1ls dovecot: lda: Fatal: Internal error occurred. Refer to server log for more information.
Aug 24 12:52:23 s1mx1ls postfix/pipe[5998]: C59E1E04A9: to=<real-user-ad@maildomain.ru>, relay=dovecot, delay=27, delays=27/0.01/0/0.07, dsn=4.3.0, status=deferred (temporary failure)
Aug 24 12:52:30 s1mx1ls postfix/smtpd[5992]: disconnect from localhost[::1]

openmsk ()
Ответ на: комментарий от openmsk

lda не знает где смотреть юзеров. Поправьте

protocol lda {
  mail_plugins =
}

на

protocol lda {
  auth_socket_path = /var/run/dovecot/auth-userdb
  log_path = /home/vmail/dovecot-deliver.log # поможет дебажить работу lda в будущем
  mail_plugins = 
}

menzoberronzan ()
Ответ на: комментарий от menzoberronzan
[root@s1mx1ls init.d]# cat /raid10/vmail/dovecot-deliver.log
Aug 24 14:15:56 lda: Error: user real-user-ad@maildomain.ru: Auth USER lookup failed
Aug 24 14:15:56 lda: Debug: auth input:
Aug 24 14:15:56 lda: Fatal: Internal error occurred. Refer to server log for more information.
maillog:
Aug 24 14:15:56 s1mx1ls dovecot: auth: Debug: password(real-user-ad): passdb doesn't support credential lookups
Aug 24 14:15:56 s1mx1ls dovecot: auth: Error: static(real-user-ad): passdb doesn't support lookups, can't verify user's existence
Aug 24 14:15:56 s1mx1ls dovecot: auth: Debug: master out: FAIL#0111
Aug 24 14:15:56 s1mx1ls postfix/pipe[6566]: A8BECE04B9: to=<real-user-ad@maildomain.ru>, relay=dovecot, delay=33, delays=33/0.01/0/0.09, dsn=4.3.0, status=deferred (temporary failure)
A
openmsk ()
Ответ на: комментарий от openmsk

1.) В системе юзер real-user-ad есть?

getent passwd | grep real-user-ad

2.) /etc/pam.d/dovecot файл имеется в наличии?
passdb {
  args = dovecot
  driver = pam
}
cat /etc/pam.d/dovecot
3.) Дайте вывод
ls -la /var/run/dovecot/auth-userdb

menzoberronzan ()
Ответ на: комментарий от menzoberronzan

1. нет, в системе пользователя real-ad-user нет, он берется из Active Directory (настраивалось так: http://openmsk.livejournal.com/5020.html ) 2. файл в наличии, его содержимое:

cat /etc/pam.d/dovecot
#%PAM-1.0
auth    sufficient      pam_krb5.so
account sufficient      pam_krb5.so
auth       required     pam_nologin.so
auth       include      password-auth
account    include      password-auth
session    include      password-auth
auth    required        pam_unix.so nullok
account required        pam_unix.so
3. файл на месте, его права:
[root@s1mx1ls init.d]# ls -la /var/run/dovecot/auth-userdb
srw-rw---- 1 vmail vmail 0 Aug 24 14:15 /var/run/dovecot/auth-userdb 

openmsk ()
Ответ на: комментарий от openmsk
[root@s1mx1ls init.d]# id real-user-ad
uid=20001(real-user-ad) gid=20009(domain users) groups=20009(domain users),20015(ts-acl-term),20014(domain admins),20013(vpn-users),20012(gl-rw-advertizing),20011(inet_full),20010(unix-admin),20007(группа с запрещением репликации паролей rodc),20001(BUILTIN\users),20000(BUILTIN\administrators)
openmsk ()
Ответ на: комментарий от menzoberronzan

пасиб, помогло. только сейчас (в минимальном конфиге) postfix позволяет отправлять как с аутентификацией пользователя, так и без неё.

[root@s1mx1ls ~]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
disable_vrfy_command = yes
home_mailbox = /raid10/vmail/
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailbox_command = /usr/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT"
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = maildomain.ru
myhostname = mx1.maildomain.ru
mynetworks = 192.168.0.0/16, 127.0.0.0/8
mynetworks_style = host
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_hard_error_limit = 8
unknown_local_recipient_reject_code = 550
unverified_sender_reject_code = 550
virtual_alias_maps = ldap:/etc/postfix/ldap_virtual_alias_maps.cf
virtual_gid_maps = static:400
virtual_mailbox_domains = maildomain.ru
virtual_mailbox_maps = ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf
virtual_minimum_uid = 400
virtual_transport = dovecot
virtual_uid_maps = static:400
добавил в конфиг:
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous

после рестарта постфикса и довекота в логе:

Aug 26 10:26:13 s1mx1ls dovecot: ssl-params: Generating SSL parameters
Aug 26 10:26:21 s1mx1ls dovecot: ssl-params: SSL parameters regeneration completed

и при теперь в лог валится

Aug 26 10:30:37 s1mx1ls postfix/smtpd[9423]: connect from hostname.domain.local[192.168.0.64]
Aug 26 10:30:37 s1mx1ls postfix/smtpd[9423]: warning: SASL: Connect to private/auth failed: Connection refused
Aug 26 10:30:37 s1mx1ls postfix/smtpd[9423]: fatal: no SASL authentication mechanisms
Aug 26 10:30:37 s1mx1ls postfix/smtpd[9423]: fatal: no SASL authentication mechanisms
Aug 26 10:30:38 s1mx1ls postfix/master[9373]: warning: process /usr/libexec/postfix/smtpd pid 9423 exit status 1
Aug 26 10:30:38 s1mx1ls postfix/master[9373]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling
Aug 26 10:30:38 s1mx1ls postfix/master[9373]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling

openmsk ()
Ответ на: комментарий от openmsk
[root@s1mx1ls ~]# grep queue_directory /etc/postfix/main.cf
queue_directory = /var/spool/postfix
btree:${queue_directory}/smtpd_scache
[root@s1mx1ls ~]# ls -ln /var/spool/postfix/private/auth
srw-rw---- 1 89 89 0 Aug 23 12:31 /var/spool/postfix/private/auth
openmsk ()
Ответ на: комментарий от openmsk

Добавление

vi /etc/dovecot/conf.d/10-master.conf
unix_listener /var/spool/postfix/private/auth {
    mode = 0666
  }
решило и эту проблему :)

только я так понимаю я включение sasl всего лишь защитил данные которые передаются от dovecota postfix'у

в идеале конечно настроить ntlm авторизацию на dovecot и postfix

openmsk ()
Ответ на: комментарий от menzoberronzan

согласен.

[root@ vmail]# grep auth_mechanisms /etc/dovecot/conf.d/*
/etc/dovecot/conf.d/10-auth.conf:auth_mechanisms = plain login ntlm gssapi
#doveconf -n
userdb {
  args = uid=vmail gid=vmail home=/raid10/vmail/ allow_all_users=yes
  driver = static
}

# cat /etc/pam.d/dovecot
#%PAM-1.0
auth    sufficient      pam_krb5.so
account sufficient      pam_krb5.so
auth       required     pam_nologin.so
auth       include      password-auth
account    include      password-auth
session    include      password-auth
auth    required        pam_unix.so nullok
account required        pam_unix.so
account  required       pam_permit.so
а вот вывод телнета
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=
LOGIN AUTH=NTLM AUTH=GSSAPI] Dovecot ready.
a capability* CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLA
IN AUTH=LOGIN AUTH=NTLM AUTH=GSSAPI
a OK Capability completed.
a authenticate GSSAPI+
в это время в логе
Aug 26 12:32:12 s1mx1ls dovecot: auth: Debug: client in: AUTH#0111#011GSSAPI#011service=imap#011secured#011lip=192.168.0.7#011rip=192.168.0.64#011lport=143#011rport=53808
Aug 26 12:32:12 s1mx1ls dovecot: auth: Debug: gssapi(?,192.168.0.64): Using all keytab entries
Aug 26 12:32:12 s1mx1ls dovecot: auth: Debug: client out: CONT#0111#011

Однако как только я пытаюсь с помощью thunderbird'ом забрать почту, в лог падает

Aug 26 12:39:06 s1mx1ls dovecot: auth: Debug: auth client connected (pid=10789)
Aug 26 12:39:06 s1mx1ls dovecot: imap-login: Disconnected (no auth attempts): rip=192.168.0.64, lip=192.168.0.7, secured
а сам thunderbird говорит: Билет Kerberos/GSSAPI небыл принят IMAP-сервером real-user-ad@maildomain.ru. Проверьте что вы вошли в Kerberos/GSSAPI realm

openmsk ()
24 января 2014 г.
21 марта 2014 г.
9 июля 2014 г.
Ответ на: комментарий от provodnik

Удалось Dovecot научить авторизовывать через GSSAPI. userdb и passdb при этом сменил с pam на ldap.

Jinto ()
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.