LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 11-12-2010, 03:20 PM   #1
sarajevo
Member
 
Registered: Apr 2005
Distribution: Debian, OpenBSD,Fedora,RedHat
Posts: 228
Blog Entries: 1

Rep: Reputation: 31
Dovecot authentication over TLS to LDAP directory


Hi all,

I think I did my homework, but stuck on an small part...so if someone know and has a time, please write.
So I have Centos ( and Postfix+ldap+dovecot ) TLS works with Postfix and LDAP. When I open evolution mail client I can browse ldap tree and search for users, send-receive mails ...all fine

But, when I set up

security ssf=112

in /etc/openldap/slapd.conf I cannot authorize users when connecting using evolution mail client.

At same time
Code:
ldapsearch -LLL -x -W -D 'cn=Manager,dc=abc,dc=com' -H ldap://mail1.abc.com -ZZ '(uid=*)'
works without problems , and I can list content of ldap tree.

and also

ldapsearch -x does not return anything -- so tls for ldap works.



How I understand it, it stucks when dovecot try to get information about passwords for users from LDAP, now I am trying to understand how to "learn" dovecot to talk over tls/ssl with ldap directory ?

Thanks in advance for any hint

/etc/dovecot.conf
Code:
protocols = imaps
ssl_disable = no
ssl_cert_file = /etc/pki/tls/certs/mail1.abc.com.cert
ssl_key_file = /etc/pki/tls/private/mail1.abc.com.key 
mail_location = maildir:/home/vmail/%u/Maildir/,%u/Maildir
protocol imap {
}
protocol pop3 {
}
protocol lda {
}
auth_username_format = %Lu
auth default {
  mechanisms = plain
passdb ldap { 
     args = /etc/dovecot-ldap.conf 
   }
  passdb pam {
  }
 userdb static {
       args = uid=507 gid=507 home=/home/vmail/%u
}
  user = root
}
dict {
}
plugin {
}
/etc/dovecot-ldap.conf
Code:
hosts = 192.168.11.113
base = ou=People,dc=abc,dc=com
ldap_version = 3
/etc/postfix/ldap-users.conf

Code:
server_host = 192.168.11.113
search_base = ou=People,dc=abc,dc=com
version = 3
bind = yes
query_filter = (&(objectClass=person)(mail=%s))
result_attribute = uid

Last edited by sarajevo; 11-12-2010 at 03:54 PM.
 
Old 11-13-2010, 08:34 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977
well in line with the docs - http://wiki.dovecot.org/AuthDatabase/LDAP - you haven't enabled tls within the ldap config there, so dovecot has no reason to try anything else that plain text access to LDAP
 
Old 11-13-2010, 09:49 AM   #3
sarajevo
Member
 
Registered: Apr 2005
Distribution: Debian, OpenBSD,Fedora,RedHat
Posts: 228

Original Poster
Blog Entries: 1

Rep: Reputation: 31
Quote:
Originally Posted by acid_kewpie View Post
well in line with the docs - http://wiki.dovecot.org/AuthDatabase/LDAP - you haven't enabled tls within the ldap config there, so dovecot has no reason to try anything else that plain text access to LDAP
Thanks for comment

I tried your suggestion as well....Error I have in that case is
Code:
Nov 13 16:02:51 mail1 dovecot: auth(default): LDAP: ldap_start_tls_s() failed: Can't contact LDAP server
But ldap server is runnig ..
Regards
 
Old 11-13-2010, 02:17 PM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977Reputation: 1977
Quote:
Originally Posted by sarajevo View Post
Thanks for comment

I tried your suggestion as well....Error I have in that case is
Code:
Nov 13 16:02:51 mail1 dovecot: auth(default): LDAP: ldap_start_tls_s() failed: Can't contact LDAP server
But ldap server is runnig ..
Regards
Ok, so verify that you can telnet to port 389 on the iop you have defined. Also check the lap server logs for evidence of your connection attempt. You might also wish to run tcpdump on the client while you connect to see the network traffic occurring.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] TLS / SASL authentication, dovecot and postfix - does this config look correct? TonyAR Linux - Server 2 10-14-2010 12:40 PM
dovecot SSL/TLS non-PAM config went awry molafish Linux - Software 1 03-20-2009 12:59 AM
Simple Mailserver with sendmail, dovecot and SSL/TLS dsh Linux - Server 0 10-16-2008 03:11 PM
Dovecot - TLS doesnt work while SSL does extasic Linux - Server 2 10-07-2008 06:57 PM
Problem with Dovecot & TLS nukoso Linux - Server 1 06-09-2008 06:20 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 07:48 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration