I'm working on getting authentication for Postfix smtpd clients
working with Dovecot. I've got both plain text and GSSAPI mechanisms
working. Winbind also works for shell access and the command line
test work fine.
If I can get NTLM authentication working I can use Postfix as a drop
in replacement for a MS MTA I want get rid of.
I'm hoping the community might be able to offer some insight into what
I'm missing to get NTLM authentication working with Dovecot and
Postfix. Something related to winbind I suspect.
When I use the NTLM mechanism I get this in my maillog file. Nothing
seems to show up in the winbind files for this.
---- log file from NTLM mechanism used ----
Jun 26 17:02:53 SBSMTPNV05 postfix/smtpd[2221]: connect from
nvit01b.mydomain.com[10.20.2.0]
Jun 26 17:02:53 SBSMTPNV05 dovecot: auth: Debug: client in:
AUTH#0112#011NTLM#011service=smtp#011nologin#011lip=10.20.4.12#011rip=10.20.2.0#011resp=TlRM...AJun
26 17:02:53 SBSMTPNV05 dovecot: auth: Debug: client out:
CONT#0112#011TlRM....A
Jun 26 17:02:53 SBSMTPNV05 dovecot: auth: Debug: client in:
CONT#0112#011TlRM....QJun 26 17:02:53 SBSMTPNV05 dovecot: auth:
winbind(?,10.20.2.0): user
not authenticated: NT_STATUS_UNSUCCESSFUL
Jun 26 17:02:55 SBSMTPNV05 postfix/smtpd[2221]: warning:
nvit01b.mydomain.com[10.20.2.0]: SASL NTLM authentication failed:
TlRM....A
Jun 26 17:02:55 SBSMTPNV05 dovecot: auth: Debug: client out: FAIL#0112
Jun 26 17:02:59 SBSMTPNV05 postfix/smtpd[2221]: disconnect from
nvit01b.mydomain.com[10.20.2.0]
------------------------------------------
---- log file from GSSAPI mechanism used -----
Jun 26 17:02:08 SBSMTPNV05 postfix/smtpd[2221]: connect from
nvit01b.mydomain.com[10.20.2.0]
Jun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug: auth client connected
(pid=2221)
Jun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug: client in:
AUTH#0111#011GSSAPI#011service=smtp#011nologin#011lip=10.20.4.12#011rip=10.20.2.0#011resp=YIIN....
Jun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug: ....g=Jun 26 17:02:08
SBSMTPNV05 dovecot: auth: Debug: gssapi(?,10.20.2.0):
Obtaining credentials for smtp@
Jun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug:
gssapi(myusername at MYDOMAIN.COM,10.20.2.0): security context state
completed.
Jun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug: client out:
CONT#0111#011YIGVB....EJun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug: client
in: CONT#0111#011
Jun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug:
gssapi(myusername at MYDOMAIN.COM,10.20.2.0): Negotiated security layer
Jun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug: client out:
CONT#0111#011BQQF/w....MJun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug: client
in:
CONT#0111#011BQQE/w....u
Jun 26 17:02:08 SBSMTPNV05 dovecot: auth: Debug: client out:
OK#0111#011user=myusername
Jun 26 17:02:08 SBSMTPNV05 postfix/smtpd[2221]: AE80A80592:
client=nvit01b.mydomain.com[10.20.2.0], sasl_method=GSSAPI,
sasl_username=myusername
Jun 26 17:02:08 SBSMTPNV05 postfix/cleanup[2219]: AE80A80592:
message-id=<51CB8100.1010103 at example.com>
Jun 26 17:02:08 SBSMTPNV05 postfix/qmgr[1999]: AE80A80592:
from=<matthew at example.com>, size=2178, nrcpt=1 (queue active)
Jun 26 17:02:08 SBSMTPNV05 postfix/smtpd[2221]: disconnect from
nvit01b.mydomain.com[10.20.2.0]
Jun 26 17:02:09 SBSMTPNV05 postfix/smtp[2220]: AE80A80592:
to=<utegrad at gmail.com>,
relay=gmail-smtp-in.l.google.com[74.125.129.27]:25, delay=0.93,
delays=0.09/0/0.15/0.69, dsn=2.0.0, status=sent (250 2.0.0 OK
1372291329 y9si419401pay.83 - gsmtp)
Jun 26 17:02:09 SBSMTPNV05 postfix/qmgr[1999]: AE80A80592: removed
----------------------------------------------
---- log file from plain text mechanism -----
Jun 26 17:01:08 SBSMTPNV05 postfix/smtpd[2209]: connect from
nvit01b.mydomain.com[10.20.2.0]
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: Loading modules from
directory: /usr/lib64/dovecot/auth
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: Module loaded:
/usr/lib64/dovecot/auth/libauthdb_ldap.so
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: Module loaded:
/usr/lib64/dovecot/auth/libdriver_sqlite.so
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: Module loaded:
/usr/lib64/dovecot/auth/libmech_gssapi.so
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: auth client connected
(pid=2209)
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: client in:
AUTH#0111#011PLAIN#011service=smtp#011nologin#011lip=10.20.4.12#011rip=10.20.2.0#011secured#011resp=AG1sYXJzZW4ASWRvbnR3YW50Mg=Jun
26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: Loading modules from
directory: /usr/lib64/dovecot/auth
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: Module loaded:
/usr/lib64/dovecot/auth/libauthdb_ldap.so
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: Module loaded:
/usr/lib64/dovecot/auth/libdriver_sqlite.so
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug: Module loaded:
/usr/lib64/dovecot/auth/libmech_gssapi.so
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug:
pam(myusername,10.20.2.0): lookup service=dovecot
Jun 26 17:01:08 SBSMTPNV05 dovecot: auth: Debug:
pam(myusername,10.20.2.0): #1/1 style=1 msg=Password:
Jun 26 17:01:09 SBSMTPNV05 dovecot: auth: Debug: client out:
OK#0111#011user=myusername
Jun 26 17:01:09 SBSMTPNV05 postfix/smtpd[2209]: 82C3780592:
client=nvit01b.mydomain.com[10.20.2.0], sasl_method=PLAIN,
sasl_username=myusername
Jun 26 17:01:09 SBSMTPNV05 postfix/cleanup[2219]: 82C3780592:
message-id=<51CB80C4.6020107 at example.com>
Jun 26 17:01:09 SBSMTPNV05 postfix/qmgr[1999]: 82C3780592:
from=<matthew at example.com>, size=2728, nrcpt=1 (queue active)
Jun 26 17:01:09 SBSMTPNV05 postfix/smtpd[2209]: disconnect from
nvit01b.mydomain.com[10.20.2.0]
Jun 26 17:01:10 SBSMTPNV05 postfix/smtp[2220]: 82C3780592:
to=<utegrad at gmail.com>,
relay=gmail-smtp-in.l.google.com[74.125.129.27]:25, delay=1.3,
delays=0.05/0.04/0.46/0.74, dsn=2.0.0, status=sent (250 2.0.0 OK
1372291270 sb1si125565pbb.232 - gsmtp)
Jun 26 17:01:10 SBSMTPNV05 postfix/qmgr[1999]: 82C3780592: removed
---------------------------------------------
Here's some of the supporting configuration information:
---- postconf -n -----------
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 1
debug_peer_list html_directory = no
inet_interfaces = all
inet_protocols = ipv4
line_length_limit = 6144
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
myhostname = srvsbsmtp05.mydomain.com
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_recipient_restrictions permit_sasl_authenticated,reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous,noplaintext
smtpd_sasl_type = dovecot
unknown_local_recipient_reject_code = 550
----------------------------------
---- doveconf -n ----
# 2.0.9: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-358.11.1.el6.x86_64 x86_64 CentOS release 6.4 (Final)
auth_debug_passwords = yes
auth_mechanisms = plain gssapi ntlm login
auth_use_winbind = yes
listen = *
mbox_write_locks = fcntl
passdb {
driver = pam
}
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0666
user = postfix
}
}
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_key = </etc/pki/dovecot/private/dovecot.pem
userdb {
driver = passwd
}
-----------------------
---- Samba configuration ----
[global]
workgroup = MYDOMAIN
realm = MYDOMAIN.COM
server string = Samba Server Version %v
security = ADS
kerberos method = system keytab
log file = /var/log/samba/log.%m
max log size = 50
printcap name = /dev/null
domain master = No
template shell = /bin/bash
winbind separator = +
winbind use default domain = Yes
idmap config * : range = 10000-50000
idmap config * : backend = tdb
printing = bsd
cups options = raw
print command = lpr -r -P'%p' %s
lpq command = lpq -P'%p'
lprm command = lprm -P'%p' %j
------------------------------
