LDAP and dovecot

[dovecot]

At my company I have users who are now becoming remote and using their mobile devices for email. I use Solaris 10 10/09 s10x_u8wos_08a X86 as an operating system and I now need a more secure email solution than the generic sendmail / imap solution.

I want to use dovecot and postfix because I have read good reports on these products for ease of setup and use. I need to use both with SSL certificates and username / passwords for both receiving and sending emails.

I am having difficulty getting dovecot to work with my ldap password solution. I have read all the documentation, there is a lot of it, and find it confusing. But I have tried very hard to get the solution to work.

I have not compiled postfix because I want to use the dovecot authentication solution it mentions. Therefore I need to get dovecot to work first.

I have dovecot 2.2.10 & postfix 2.11.1 with openldap 2.4.33.

I have tested dovecot with /etc/passwd /etc/shadow password authentication and password flat files. Those work, but not what I need. I need to use ldap so the users only have to set one password.

Below is the information I have.

I have created self signed SSL certificates for testing purposes. We will get real SSL certificates once everything is operational.

*********

I compiled dovecot with the following command:

./configure --prefix=/usr/local/tools/dovecot --with-ssl=openssl --with-solr --with-zlib --with-bzlib --with-ldap=yes

-------------------------------------------
dovecot -n
# 2.2.10: /usr/local/tools/dovecot/etc/dovecot/dovecot.conf
# OS: SunOS 5.10 i86pc
base_dir = /dovecot/var/run/dovecot
log_path = /dovecot/log/log
log_timestamp = "%Y-%m-%d %H:%M:%S "
mail_debug = yes
mail_location = mbox:~/posta:INBOX=/var/mail/%u:LAYOUT=maildir++:INDEX=~/posta/index:CONTROL=~/posta/control
passdb {
args = /dovecot/etc/dovecot/tests/ldap.settings
driver = ldap
}
protocols = imap
service imap-login {
inet_listener imap {
port = 143
}
inet_listener imaps {
port = 993
}
}
ssl_cert = </dovecot/certs/dovecot.pem
ssl_key = </dovecot/certs/dovecot.key
ssl_prefer_server_ciphers = yes
userdb {
args = /dovecot/etc/dovecot/tests/ldap.settings
driver = ldap
}
protocol imap {
imap_client_workarounds = tb-extra-mailbox-sep
}
-------------------------------------------

/dovecot/etc/dovecot/tests/ldap.settings
hosts = ldap.outputservices.com
tls = no
ldap_version = 3
base = dc=ldap,dc=outputservices,dc=com
-------------------------------------------

If I use ldap for passwords:
2014-09-18 09:44:23 master: Info: Dovecot v2.2.10 starting up for imap
2014-09-18 09:44:33 auth: Fatal: LDAP: Buggy LDAP library returned wrong fd: 1
2014-09-18 09:44:33 master: Error: service(auth): command startup failed, throttling for 2 secs
2014-09-18 09:44:33 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>
, rip=137.106.101.127, lip=137.106.76.215, TLS handshaking, session=<d1Nt3FgD1wCJamV/>
2014-09-18 09:44:48 master: Warning: Killed with signal 15 (by pid=18992 uid=0 code=kill)
-------------------------------------------

If I use a flat file for passwords:
2014-09-18 09:42:23 master: Info: Dovecot v2.2.10 starting up for imap
2014-09-18 09:43:05 imap-login: Info: Login: user=<dave>, method=PLAIN, rip=137.106.101.127, lip=137.106.76.215, mpid=16769, TLS, se
ssion=<vAny1VgDywCJamV/>
2014-09-18 09:43:05 imap(dave): Debug: Effective uid=6010, gid=131, home=/export/home/sun/dave
2014-09-18 09:43:05 imap(dave): Debug: maildir++: root=/export/home/sun/dave/posta, index=/export/home/sun/dave/posta/index, indexpv
t=, control=/export/home/sun/dave/posta/control, inbox=/var/mail/dave, alt=
2014-09-18 09:43:10 imap(dave): Info: Disconnected: Logged out in=223 out=1122
2014-09-18 09:43:22 master: Warning: Killed with signal 15 (by pid=17115 uid=0 code=kill)
-------------------------------------------

If I use /etc/passwd /etc/shadow for passwords:
2014-09-18 09:39:56 master: Info: Dovecot v2.2.10 starting up for imap
2014-09-18 09:40:14 imap-login: Info: Login: user=<dave>, method=PLAIN, rip=137.106.101.127, lip=137.106.76.215, mpid=13053, TLS, se
ssion=<uaT5zFgDwACJamV/>
2014-09-18 09:40:14 imap(dave): Debug: Effective uid=6010, gid=131, home=/export/home/sun/dave
2014-09-18 09:40:14 imap(dave): Debug: maildir++: root=/export/home/sun/dave/posta, index=/export/home/sun/dave/posta/index, indexpv
t=, control=/export/home/sun/dave/posta/control, inbox=/var/mail/dave, alt=
2014-09-18 09:41:01 imap(dave): Info: Disconnected: Logged out in=219 out=1118
2014-09-18 09:41:33 master: Warning: Killed with signal 15 (by pid=14765 uid=0 code=kill)
-------------------------------------------

I am using openldap 2.4.33. I compiled it using the following command:

./configure --enable-crypt --enable-ldap --enable-perl --prefix=/usr/local/openldap

In the slapd.conf file I have placed the following:

access to attrs=userPassword
by dn="cn=dovecot,dc=ldap,dc=outputservices,dc=com" read
by anonymous auth
by self write
by * none
-------------------------------------------

In the ldap database I have the following dovecot user information:

dn: uid=dovecot,ou=People,dc=ldap,dc=outputservices,dc=com
uid: dovecot
cn: Dovecot Email User
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
uidNumber: 505
gidNumber: 505
homeDirectory: /tmp
structuralObjectClass: account
entryUUID: f85d1e02-13e3-1033-9c4a-b7d2075f7ecd
creatorsName: cn=admin,dc=ldap,dc=outputservices,dc=com
createTimestamp: 20140117165553Z
loginShell: /bin/tcsh
entryCSN: 20140725160856.481921Z#000000#000#000000
modifiersName: cn=admin,dc=ldap,dc=outputservices,dc=com
modifyTimestamp: 20140725160856Z
-------------------------------------------

In the /etc/passwd file I have the following information:

dovecot:x:505:505:Dovecot IMAP Server:/tmp:/bin/false
dovenull:x:506:506:Dovecot IMAP Server:/tmp:/bin/false
-------------------------------------------

I need assistance on this and also once I get dovecot running with ldap, I could use proper assistance with the postfix solution also. I want to stop solaris versions of sendmail and use dovecot & postfix. I am also a little confused on the mail_location setting. We use thunderbird as an email client and it sets the "local folders" just fine. But with imap it puts the Sent, Trash, Draft folders in the users "home" directory. With dovecot I have to put them in a different folder, I called it posta for now. It then makes them . Files. (.Sent, .Trash ?)

[Philipp]

Post by dovecot
/dovecot/etc/dovecot/tests/ldap.settings
hosts = ldap.outputservices.com
tls = no
ldap_version = 3
base = dc=ldap,dc=outputservices,dc=com
-------------------------------------------

This will likely also need later on:
scope = subtree #since ou=People subtree used
user_filter = (uid=%Ln)

Post by dovecot
2014-09-18 09:44:33 auth: Fatal: LDAP: Buggy LDAP library returned wrong fd: 1

That's the current problem, might happen that dovecot dynamically
doesnt load
the installed openldap libraries - or from a wrong ELFCLASS (32/64).
Check with file(1) and ldd(1) on the dovecot binary, linked libraries
and adjust library
loadpaths with crle(1) (note differences for 32/64bit).

HTH,
Philipp

[dovecot]

I was able to decipher the error after looking at some other web pages.

I found I have to compile using the openldap libraries instead of the default Solaris ldap libraries.

LDFLAGS='-L/usr/local/openldap/lib -R/usr/local/openldap/lib' \
./configure --prefix=/tmp/tocevod --with-ssl=openssl --with-solr --with-zlib --with-bzlib --with-ldap=yes

ldd on the ....libexec/dovecot/auth files shows the proper openldap libraries.


libdovecot.so.0 => /usr/local/tools/dovecot/lib/dovecot/libdovecot.so.0
libpam.so.1 => /usr/lib/libpam.so.1
libldap-2.4.so.2 => /usr/local/openldap/lib/libldap-2.4.so.2
libsasl.so.1 => /usr/lib/libsasl.so.1
libssl.so.0.9.7 => /usr/sfw/lib/libssl.so.0.9.7
libcrypto.so.0.9.7 => /usr/sfw/lib/libcrypto.so.0.9.7
liblber-2.4.so.2 => /usr/local/openldap/lib/liblber-2.4.so.2
libresolv.so.2 => /usr/lib/libresolv.so.2
libgen.so.1 => /usr/lib/libgen.so.1
librt.so.1 => /usr/lib/librt.so.1
libnsl.so.1 => /usr/lib/libnsl.so.1
libsocket.so.1 => /usr/lib/libsocket.so.1
libsendfile.so.1 => /usr/lib/libsendfile.so.1
libc.so.1 => /usr/lib/libc.so.1
libgcc_s.so.1 => /usr/sfw/lib/libgcc_s.so.1
libcmd.so.1 => /usr/lib/libcmd.so.1
libmd.so.1 => /usr/lib/libmd.so.1
libaio.so.1 => /usr/lib/libaio.so.1
libmp.so.2 => /usr/lib/libmp.so.2
libscf.so.1 => /usr/lib/libscf.so.1
libdoor.so.1 => /usr/lib/libdoor.so.1
libuutil.so.1 => /usr/lib/libuutil.so.1
libssl_extra.so.0.9.7 => /usr/sfw/lib/libssl_extra.so.0.9.7
libcrypto_extra.so.0.9.7 => /usr/sfw/lib/libcrypto_extra.so.0.9.7
libm.so.2 => /usr/lib/libm.so.2

I am not able to authenticate to my ldap server.

Thank you all.

[dovecot]

I am sorry.

I am NOW able to authenticate to my ldap server.

Thank you all.

[Remko Lodder]

Post by dovecot
I am sorry.
I am NOW able to authenticate to my ldap server.
Thank you all.

So what changed, for the records :)

Remko
--
/"\ Best regards, | remko at FreeBSD.org
\ / Remko Lodder | remko at EFnet
X http://www.evilcoder.org/ |
/ \ ASCII Ribbon Campaign | Against HTML Mail and News

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://dovecot.org/pipermail/dovecot/attachments/20140920/c62f2fdc/attachment-0001.sig>

[dovecot]

For the record. I compiled dovecot to use the openldap libraries my openldap server uses.
My email server and ldap server are on two different machines. So I just copied over my ldap
libraries and placed them in the correct place and then compiled dovecot.

I saw this clue in a different web page. Something about Solaris ldap libraries being bad.

CPPFLAGS=-I/usr/local/openldap/include \

LDFLAGS='-L/usr/local/openldap/lib -R/usr/local/openldap/lib' \

./configure --prefix=/usr/local/tools/dovecot --with-ssl=openssl --with-solr --with-zlib --with-bzlib --with-ldap=yes

This now allows me to authenticate with my openldap server.

I am NOW able to authenticate to my ldap server.

So my final configuration is:

dovecot -n
# 2.2.10: /usr/local/tools/dovecot/etc/dovecot/dovecot.conf
# OS: SunOS 5.10 i86pc
base_dir = /dovecot/var/run/dovecot
log_path = /dovecot/log/log
mail_location = mbox:~/posta:INBOX=/var/mail/%u:LAYOUT=maildir++:INDEX=~/posta/index:CONTROL=~/posta/control
passdb {
args = /dovecot/etc/dovecot/conf.d/ldap.settings
driver = ldap
}
protocols = imap
service imap-login {
inet_listener imap {
port = 143
}
inet_listener imaps {
port = 993
}
}
ssl_cert = </dovecot/certs/dovecot.pem
ssl_key = </dovecot/certs/dovecot.key
ssl_prefer_server_ciphers = yes
userdb {
args = /dovecot/etc/dovecot/conf.d/ldap.settings
driver = ldap
}



/dovecot/etc/dovecot/conf.d/ldap.settings
hosts = ldap.outputservices.com
tls = no
auth_bind = yes
ldap_version = 3
base = dc=ldap,dc=outputservices,dc=com

Thank you all.

[Dave Ryan]

Thank you all for your assistance.

I was able to locate another web site that mentioned I needed to compile dovecot with my openldap libraries.

I then compiled dovecot in the following manner:

CPPFLAGS=-I/usr/local/openldap/include \
LDFLAGS='-L/usr/local/openldap/lib -R/usr/local/openldap/lib' \
./configure --prefix=/tmp/tocevod --with-ssl=openssl --with-solr --with-zlib --with-bzlib --with-ldap=yes

This then included the openldap libraries. I tested access and now it works.

ldd on /dovecot/libexec/dovecot/auth showed the openldap libraries.

libdovecot.so.0 => /usr/local/tools/dovecot/lib/dovecot/libdovecot.so.0
libpam.so.1 => /usr/lib/libpam.so.1
libldap-2.4.so.2 => /usr/local/openldap/lib/libldap-2.4.so.2
libsasl.so.1 => /usr/lib/libsasl.so.1
libssl.so.0.9.7 => /usr/sfw/lib/libssl.so.0.9.7
libcrypto.so.0.9.7 => /usr/sfw/lib/libcrypto.so.0.9.7
liblber-2.4.so.2 => /usr/local/openldap/lib/liblber-2.4.so.2
libresolv.so.2 => /usr/lib/libresolv.so.2
libgen.so.1 => /usr/lib/libgen.so.1
librt.so.1 => /usr/lib/librt.so.1
libnsl.so.1 => /usr/lib/libnsl.so.1
libsocket.so.1 => /usr/lib/libsocket.so.1
libsendfile.so.1 => /usr/lib/libsendfile.so.1
libc.so.1 => /usr/lib/libc.so.1
libgcc_s.so.1 => /usr/sfw/lib/libgcc_s.so.1
libcmd.so.1 => /usr/lib/libcmd.so.1
libmd.so.1 => /usr/lib/libmd.so.1
libaio.so.1 => /usr/lib/libaio.so.1
libmp.so.2 => /usr/lib/libmp.so.2
libscf.so.1 => /usr/lib/libscf.so.1
libdoor.so.1 => /usr/lib/libdoor.so.1
libuutil.so.1 => /usr/lib/libuutil.so.1
libssl_extra.so.0.9.7 => /usr/sfw/lib/libssl_extra.so.0.9.7
libcrypto_extra.so.0.9.7 => /usr/sfw/lib/libcrypto_extra.so.0.9.7
libm.so.2 => /usr/lib/libm.so.2

Thanks again.