Portál AbcLinuxu, 10. května 2025 06:09
Řešení dotazu:
Tri nedele jo?
No hlavne na LDAP serveru (AD) nesmis mit strukturu uzivatelu pro Exchange ale pro qmail (kterou pouziva i postfix). Ale ono je s tim SASL to nastavovani takovy pofiderni, ze to nepodoruje primo postfix, ale jestli to dobre chapu, tak v postfixu jen nastavis at pouzije nejakou knihovnu pro SASL a v konfiguraku ty knihovny pak nastavis at se pouzije LDAP db. A taky se SASL pouziva jen pro pripojeni pres IP, pro lokalni unix socket to jde posilat bez autentizace (mozna to jde nekde nastavit ale).relay_recipient_maps = hash:/etc/postfix/relay_recipientsa ciste maily poslal do Exxhange... Necmene u tebe bych tipoval, ze mas spatne nastavene overovani dovecotu pres pam, videl bych problem primo v /etc/pam.d/dovecot Ja pouzivamm overovani dovecotu pres systemove ucty a pres LDAP (ale lokalni unixovy) a mam v /etc/pam.d/dovecot neco takoveho:
root@server:~# cat /etc/pam.d/dovecot # # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the # traditional Unix authentication mechanisms. # auth sufficient pam_ldap.so auth sufficient pam_unix.so nullok_secure use_first_pass # # /etc/pam.d/common-account - authorization settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authorization modules that define # the central access policy for use on the system. The default is to # only deny service to users whose accounts are expired in /etc/shadow. # account sufficient pam_ldap.so account sufficient pam_unix.so use_first_pass # # /etc/pam.d/common-session - session-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define tasks to be performed # at the start and end of sessions of *any* kind (both interactive and # non-interactive). The default is pam_unix. # session required pam_ldap.so session required pam_unix.so session required pam_mkhomedir.so skel=/etc/skel/ umask=077Zkos to pouzit, akorat zkus misto:
pam_ldap.sodat
pam_krb5.soKdyz vytvoris lokalniho uzivatele a nastavis stpravne /etc/pam.d/passwd tak ti to funguje, aspon tak ? Tak by me zajimaly logy toho PAMu, a ne jen toho dovecotu... Neco takoveho:
Jul 23 16:44:15 server dovecot-auth: pam_unix(dovecot:session): session opened for user svaca by (uid=0) Jul 23 16:44:15 server dovecot-auth: pam_unix(dovecot:session): session closed for user svaca
libpam-krb5jsem nemel nainstalovany + spatne nastaveno dovecot.conf
passdb pam {
args = allow_all_users=yes
}
allow_all_users zpusobi nefunkcnost
Uz to funguje, dekuji. Dal bych si par facek, tohle prehlidnout...
/etc/dovecot.conf
protocols = imap imaps
disable_plaintext_auth = no
log_path = /var/log/dovecot.log
info_log_path = /var/log/dovecot-info.log
log_timestamp = "%b %d %H:%M:%S "
ssl_disable = yes
mail_location = mbox:/vmail/%d/%u:INDEX/vmail/%d/%u
protocol imap {
}
protocol pop3 {
}
protocol lda {
postmaster_address = postmaster@example.com
}
auth_debug = yes
auth_debug_passwords = yes
auth default {
mechanisms = plain
passdb pam {
args = allow_all_users=yes
}
userdb static {
args = uid=vmail gid=vmail home=/vmail/%d/%u
}
user = root
}
dict {
}
plugin {
}
/etc/krb5.conf
[libdefaults]
clockskew = 300
default_realm = DOMENA.CZ
# default_etypes = des-cbc-crc
# default_etypes_des = des-cbc-crc
# dns_lookup_realm = false
# dns_lookup_kdc = false
[realms]
nemuo.cz = {
kdc = ipadresaserveru
default_domain = DOMENA.CZ
kpasswd_server = ipadresaserveru
}
[domain_realm]
.your.ad.domain = DOMENA.CZ
[logging]
default = SYSLOG:NOTICE:DAEMON
kdc = FILE:/var/log/kdc.log
kadmind = FILE:/var/log/kadmind.log
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
retain_after_close = false
minimum_uid = 0
debug = false
}
DOMENA.CZ a userxxx je zmeneno... jinak samozrejme dobre nastaveno.
#kinit mi v poradku prochazi, mohu se authentizovat vuci Active Directory
/etc/pam.d/dovecot
#%PAM-1.0
auth required pam_krb5.so no_user_check
account required pam_permit.so
v dovecot.conf mam zapnuty debug
po prihlaseni z outlook expres>
/var/log/dovecot-info.log
dovecot: Jul 23 15:00:53 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP lip=192.168.xxx.xxx rip=192.168.xxx.xxx resp=AG1hcnR$
dovecot: Jul 23 15:00:55 Info: auth(default): pam(uzivatelxxx,192.168.xxx.xxx): pam_authenticate() failed: User not known to the underlying authentication $
dovecot: Jul 23 15:00:57 Info: auth(default): client out: FAIL 1 user=uzivatelxxx
v outlook expres mam imap, ip adresu serveru a jmeno, heslo nastaveno a ulozeno. Hodi error code Kód: 800cccd1 - neprosla authentizace
Diky za jakykoliv help.
PAM beru jako nutne zlo .. LDAP neni problem, jen je potreba vedet (respektive pochopit ten zaklad) pak uz je to totalni sranda ... Nicmene ja bych prti AD nic neoveroval, AD bych nahradil sambou (v malych firmach to neni problem) + OpenLDAP = sprava treba pomoci weboveho LAMu je sranda. Pokud AD nemuzes nehradit tak porad je moznost posadit linux postu vedle a adminovat to zvlast. Ja proste MS neverim ani pozdrav, natoz AD.
Jinak jako POP3 a IMAP ROZHODNE doporucuju dovecot. Dovecot je SPICKA. JE ukrutne rychly a proste mi celkove pripada lepsi jak courier, vsechny servery co jsem mel na courieru uz jsem prekopal na dovecot ...
1. LAM je o 100 procent privetivejsi nez phpldapadmin HLAVNE neni tak zabugovany
2. 150 polozek ? 1x jmeno 1x heslo 1x homeadresar 1x profil 1x skupinu aostatni si doplni sam. = klikas min, nez v AD ..
No a ? Edtra hesla nejsou problem, je to i bezpecnejsi ...
Stejne DRTIVA skupina uzivatelu bude mit jako heslo nejake krestni jmeno nebo jmeno psa. U AD to nevadi, ale na poste trochu jo, tor kdyz k ni mas webmail. ... ))
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.