web-dev-qa-db-ja.com

Dovecot SASL authが機能しない

前述のように、Thunderbirdに接続しようとすると、Dovecot authが失敗します。着信メールと発信メールは正常に機能します。

私は例えば参照としてのこのチュートリアル（およびその他多数）： https://serverfault.com/questions/ask 。 Ubuntu 12.04の場合は問題ないはずですが、 （残念ながら、一部のレガシーのものがLXCコンテナーに移行されるまでアップグレードできません）。

私はauthをテストしました：

root@mail ~ # doveadm auth prta
Password:
passdb: prta auth succeeded
extra fields:
user=prta

SMTP：

root@mail ~ # telnet localhost 25
Trying 127.0.0.1...
Connected to mail.prteamwork.com.
Escape character is '^]'.
220 mail.prteamwork.com ESMTP Postfix
ehlo localhost
250-mail.prteamwork.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

提出：

root@mail ~ # telnet localhost 587
Trying 127.0.0.1...
Connected to mail.prteamwork.com.
Escape character is '^]'.
220 mail.prteamwork.com ESMTP Postfix
ehlo localhost
250-mail.prteamwork.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

IMAP：

root@mail ~ # telnet localhost 143
Trying 127.0.0.1...
Connected to mail.prteamwork.com.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE 
  IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.

動作するようです...

しかし、Thunderbird（IMAP：153 STARTTLSおよびSMTP：587 STARTTLS）に接続しようとすると、mail.logで認証が失敗します。

Jun 22 19:59:03 mail postfix/submission/smtpd[10100]: connect from    
  78-27-114-110.bb.dnainternet.fi[78.27.114.110]
Jun 22 19:59:03 mail dovecot: imap-login: Aborted login (no auth 
  attempts): rip=78.27.114.110, lip=188.40.118.13
Jun 22 19:59:03 mail postfix/submission/smtpd[10100]: improper command 
  pipelining after EHLO from 
  78-27-114-110.bb.dnainternet.fi[78.27.114.110]: QUIT\r\n
Jun 22 19:59:03 mail postfix/submission/smtpd[10100]: disconnect from 
  78-27-114-110.bb.dnainternet.fi[78.27.114.110]
Jun 22 19:59:25 mail dovecot: imap-login: Disconnected (auth failed, 3 
  attempts): user=<prta>, method=PLAIN, rip=78.27.114.110, 
  lip=188.40.118.13, TLS
Jun 22 19:59:45 mail dovecot: imap-login: Disconnected (auth failed, 3 
  attempts): user=<[email protected]>, method=PLAIN, rip=78.27.114.110, 
  lip=188.40.118.13, TLS
Jun 22 19:59:50 mail postfix/submission/smtpd[10100]: connect from 
  78-27-114-110.bb.dnainternet.fi[78.27.114.110]
Jun 22 19:59:50 mail postfix/submission/smtpd[10317]: connect from 
  78-27-114-110.bb.dnainternet.fi[78.27.114.110]
Jun 22 19:59:50 mail postfix/submission/smtpd[10321]: connect from 
  78-27-114-110.bb.dnainternet.fi[78.27.114.110]
Jun 22 19:59:50 mail postfix/submission/smtpd[10322]: connect from 
  78-27-114-110.bb.dnainternet.fi[78.27.114.110]
Jun 22 19:59:50 mail dovecot: imap-login: Aborted login (no auth 
  attempts): rip=78.27.114.110, lip=188.40.118.13
Jun 22 19:59:50 mail dovecot: imap-login: Aborted login (no auth 
  attempts): rip=78.27.114.110, lip=188.40.118.13

これがdovecot.confです：

disable_plaintext_auth = no
mail_privileged_group = mail
mail_location = mbox:~/mail:INBOX=/var/mail/%u
userdb {
driver = passwd
}

passdb {
args = %s
driver = pam
}
protocols = " imap"

protocol imap {
mail_plugins = " autocreate"
}
plugin {
autocreate = Trash
autocreate2 = Sent
autosubscribe = Trash
autosubscribe2 = Sent
}

service auth {
unix_listener /var/spool/postfix/private/auth {
#group = postfix
mode = 0660
#user = postfix
}
}

auth_mechanisms = plain login

ssl=required
ssl_cert = </etc/ssl/certs/mail.prteamwork.pem
ssl_key = </etc/ssl/private/mail.prteamwork.key

Postix main.cfgは次のとおりです。

#Base config
myhostname = mail.prteamwork.com
myorigin = /etc/mailname
mydestination = $myhostname, $mydomain, localhost, localhost.$mydomain
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
relay_domains = $mydestination
syslog_name=postfix/submission
#Aliases / Recipients
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
#SSL/TLS
smtpd_tls_cert_file=/etc/ssl/certs/mail.prteamwork.pem
smtpd_tls_key_file=/etc/ssl/private/mail.prteamwork.key
smtpd_use_tls=yes
smtpd_tls_auth_only = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_security_level=may
smtp_tls_security_level=may
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_wrappermode=no
smtpd_sasl_type=dovecot
smtpd_sasl_path=private/auth
smtpd_sasl_auth_enable=yes
milter_macro_daemon_name=ORIGINATING
#Security and Anti-Spam cinfig
policy-spf_time_limit = 3600s
smtpd_helo_required = yes

smtpd_recipient_restrictions = reject_non_fqdn_recipient     
  reject_unknown_recipient_domain permit
  _mynetworks permit_sasl_authenticated reject_unauth_destination    
  check_policy_service unix:private/policy-spf check_policy_service 
  inet:127.0.0.1:10023

smtpd_helo_restrictions = permit_mynetworks reject_non_fqdn_helo_hostname 
  reject_invalid_helo_hostname

smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated 
  reject_unknown_client_hostname

smtpd_data_restrictions = reject_unauth_pipelining

#DKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

そしてPostixmaster.cfではSMTPと送信が有効になっています+ SPFが追加されました：

...
smtp      inet  n       -       -       -       -       smtpd
#smtp      inet  n       -       -       -       1       postscreen
#smtpd     pass  -       -       -       -       -       smtpd
#dnsblog   unix  -       -       -       -       0       dnsblog
#tlsproxy  unix  -       -       -       -       0       tlsproxy
submission inet n       -       -       -       -       smtpd
#  -o syslog_name=postfix/submission
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
...  
policy-spf unix - n n - - spawn
   user=nobody argv=/usr/sbin/postfix-policyd-spf-Perl

私は本当にいくつかのgruの助けをいただければ幸いです、私はこれで完全に立ち往生しています：/

敬具、

テメクスター

postfixdovecotimapsasl
3
temexter

提出用のすべてのパラメーターはまだコメントアウトされています：

submission inet n       -       -       -       -       smtpd
#  -o syslog_name=postfix/submission
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING

すべての#を削除してコメントを外すと、他のすべての設定の中でsmtpd_sasl_auth_enable=yesになります。

2
Esa Jokinen

解決しました。 Ubuntu12.04。 PAM認証には異なる引数が必要なようです。

passdb {
  driver = pam
  args = failure_show_msg=yes
}

ない

args = %s
0
temexter