Postfix-Dovecot

Linux-haladó

Sziasztok a problémám ez lenne, amikor becsatlakozok IMAPS-n a mail szerverrel (user oldali certificate authentication) az az oldal működik, de ha küldeni szeretnék levelet akkor a thunderbird:

Login to server XX.XX.XX.XX failed
Enter New Password Cancel Retry

Küldés:


Aug 23 11:42:48 mobil2 postfix/smtpd[13147]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
Aug 23 11:42:48 mobil2 postfix/smtpd[13147]: connect from unknown[XX.XX.XX.XX]
Aug 23 11:42:48 mobil2 postfix/smtpd[13147]: Anonymous TLS connection established from unknown[XX.XX.XX.XX]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)
Aug 23 11:42:48 mobil2 postfix/smtpd[13147]: warning: unknown[XX.XX.XX.XX]: SASL PLAIN authentication failed: Client didn't present valid SSL certificate
Aug 23 11:42:48 mobil2 dovecot: auth: PLAIN(?,XX.XX.XX.XX): Client didn't present valid SSL certificate
Aug 23 11:42:48 mobil2 postfix/smtpd[13147]: warning: unknown[XX.XX.XX.XX]: SASL LOGIN authentication failed: Client didn't present valid SSL certificate
Aug 23 11:42:48 mobil2 dovecot: auth: LOGIN(?,XX.XX.XX.XX): Client didn't present valid SSL certificate

Fogadás:

Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: unknown state [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client hello A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server hello A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate request A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Valid certificate: /C=hu/ST=pest/L=bp/O=vallalat/OU=it/CN=vallalat Mobil CA/emailAddress=admin@vallalat.hu
Aug 23 11:45:35 mobil2 dovecot: imap-login: Valid certificate: /C=hu/ST=pest/O=vallalat/OU=it/CN=user@mobil2.vallalat.hu/emailAddress=user@mobil2.vallalat.hu
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read finished A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write finished A [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x20, ret=1: SSL negotiation finished successfully [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: imap-login: Warning: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [XX.XX.XX.XX]
Aug 23 11:45:35 mobil2 dovecot: auth-worker: mysql(localhost): Connected to database mail
Aug 23 11:45:35 mobil2 dovecot: imap-login: Login: user=, method=PLAIN, rip=XX.XX.XX.XX, lip=mailszerverip, mpid=13321, TLS

postfix:

postconf -n
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = amavis:[127.0.0.1]:10024
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
enable_original_recipient = no
header_checks = regexp:/etc/postfix/header_checks
inet_interfaces = all
mailbox_size_limit = 0
maximal_backoff_time = 8000s
maximal_queue_lifetime = 7d
minimal_backoff_time = 1000s
mydestination = localhost
myhostname = mobil2.vallalat.hu
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mynetworks_style = host
myorigin = /etc/hostname
readme_directory = no
recipient_delimiter = +
smtp_helo_timeout = 60s
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_delay_reject = yes
smtpd_hard_error_limit = 12
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit
smtpd_recipient_limit = 16
smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_tls_all_clientcerts permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit
smtpd_soft_error_limit = 3
smtpd_tls_CAfile = /etc/ssl/mobil/CA/cacrl.pem
smtpd_tls_ask_ccert = yes
smtpd_tls_cert_file = /etc/ssl/mobil/CA/mobil/mail.pem
smtpd_tls_key_file = /etc/ssl/mobil/CA/mobil/mail.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_req_ccert = no
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 450
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf, mysql:/etc/postfix/mysql_virtual_alias_domainaliases_maps.cf
virtual_gid_maps = static:8
virtual_mailbox_base = /home/vmail
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf, mysql:/etc/postfix/mysql_virtual_mailbox_domainaliases_maps.cf
virtual_transport = dovecot
virtual_uid_maps = static:150


Dovecot
# 2.0.19: /etc/dovecot/dovecot.conf
# OS: Linux 3.2.0-52-generic x86_64 Ubuntu 12.04.2 LTS ext4

auth_mechanisms = plain login
auth_ssl_require_client_cert = yes
auth_verbose = yes
first_valid_uid = 150
last_valid_uid = 150
mail_gid = mail
mail_location = maildir:/home/vmail/%d/%n
mail_uid = vmail
pass
args = /etc/dovecot/dovecot-sql.conf.ext
driver = sql

postmaster_address = admin@vallalat.hu
protocols = " imap pop3"
service
unix_listener /var/spool/postfix/private/auth
group = postfix
mode = 0660
user = postfix

unix_list
group = mail
mode = 0600
user = vmail

ssl_ca = etc/ssl/mobil/CA/cacrl.p
ssl_cert = etc/ssl/mobil/CA/mobil/mail.p
ssl_key = etc/ssl/mobil/CA/mobil/mail.k
ssl_verify_client_cert = yes
user
args = /etc/dovecot/dovecot-sql.conf.ext
driver = sql

verbose_ssl = yes

protocol !smtp
auth_ssl_require_client_cert = yes

Dovecot írja hogy előfordulhat ilyen hiba:
http://wiki2.dovecot.org/SSL/DovecotConfiguration

With the above settings if a client connects which doesn't present a certificate signed by one of the CAs in the ssl_ca file, Dovecot won't let the user log in. This could present a problem if you're using Dovecot to provide SASL authentication for an MTA (such as Postfix) which is not capable of supplying client certificates for SASL authentication. If you need Dovecot to provide SASL authentication to an MTA without requiring client certificates and simultaneously provide IMAP service to clients while requiring client certificates, you can put auth_ssl_require_client_cert = yes inside of a protocol block as shown below to make an exemption for SMTP SASL clients (such as Postfix).

protocol !smtp {
auth_ssl_require_client_cert = yes

Beleírtam, de továbbra is ez a gond...

Ebben kérném segítségeteket.

  • 25244 megtekintés

( Skuzzy | 2013. 08. 23., p – 14:09 )

Nem egyértelműm, hogy a másik helyről ki is szedted?

Fix IP-d van otthon, vagy smarthostot kapsz a szolgáltatódtól?
Ez utóbbi esetben kéne tudni, hogy van-e SSL-es smarthost, és kell-e auth. Ha csak auth kell, az nem gond, de ha 465-ös porton SMTP-SSL van, akkor kelleni fog Neked egy stunnel is kliens módba a kapcsolódáshoz.
Ha meg se smarthostod, se fix ip-d akkor nem tudom, hogyan akarsz küldeni levelet, mert mindenki el fog hajítani dinamikus ip-n ülő smtp-vel.

Szóval infó kéne még :)
--
PtY - www.onlinedemo.hu

Rosszul tudod.
MX ahhoz kell, hogy a levél megtaláljon. Ha küldeni akarsz, akkor fix ip, vagy smarthost (ami meg fix ip-n van).
Szerintem mielőtt nekiállsz, olvasd el a vonatkozó rfc-ket, mert a levelezés kényes dolog, nem annyi, hogy az outlookban megnyomom a send-et.
--
PtY - www.onlinedemo.hu

Nem így sem, hanem így nem.
Ha a neten van a géped, akkor vélhetően van egy internetszolgáltatód.
Ha van internetszolgáltatód, vélhetően ad smtp-t - na, ő lesz a smarthostod, úgyhogy ha smarthostos beállítást csinálsz, tudsz küldeni levelet.
Ha még sincs smarthostod, akkor csinálj egy gmail fiókot, és máris van smarthostod, userneved, jelszavad, és egy nagyszerű 465-ös porton sasoló SMTP-SSL kapcsolatod. Erre csinálsz Magadnak stunnellel egy lokális SSL nélküli SMTP-t mondjuk a 2525-ös portra, a postfixet meg úgy állítod be, hogy a smarthost a 127.0.0.1:2525 legyen, és smtp authot is bekonfigolsz.
Ha csak küldeni akarsz, akkor Dovecot nem kell (MX sem).
Ha evvel megvagy, akkor akár parancssorból is küldhetsz megfelelően megkomponált levelet.
--
PtY - www.onlinedemo.hu

( knzoltan | 2014. 02. 10., h – 16:54 )

Sziasztok,

Ennek mi lehet az oka?

postfix/master fatal fifo_listen remove public/pickup permission denied

próbáltam így: postfix set-permissions, de nem oldja meg a problémát.

(Nem nagyon merek most állítgatni jogosultságokat kérdés nélkül a /var/spool/postfix könyvtárban)

Köszi

-- Zoli

A hibaüzenetben szereplő file nálad hogy néz ki? Elvileg az egy named pipe lenne. Mivel törölni akarja, ezért nézd meg a könyvtár jogosultságát is.

Így néz ki alapesetben (Debian Wheezy): 


# ls -ld /var/spool/postfix{,/public{,/pickup}}
drwxr-xr-x 20 root    root     4096 Mar 14  2013 /var/spool/postfix
drwx--s---  2 postfix postdrop 4096 Feb  9 14:30 /var/spool/postfix/public
prw--w--w-  1 postfix postdrop    0 Feb 10 19:36 /var/spool/postfix/public/pickup
#

Egyébként mi történt a rendszeren ezt a jelenséget megelőzően?