search for: ntml

Open-Xchange Security Advisory 2020-08-12 Affected product: Dovecot IMAP server Internal reference: DOP-1870 (Bug ID) Vulnerability type: CWE-789 (Uncontrolled Memory Allocation) Vulnerable version: 2.2 Vulnerable component: auth Fixed version: 2.3.11.3 Report confidence: Confirmed Solution status: Fix available Vendor notification: 2020-05-03 CVE reference: CVE-2020-12673 CVSS: 7.5

Has anyone gotten NTLM working with Dovecot and Outlook? I have a Samba4 domain controller / active directory running just fine on Linux Slackware64 14.1. PLAIN authenticiation works just fine if I create /etc/passwd accounts for the domain users. I've tried for over two weeks to get NTLM working from Outlook 2007 on a domain workstation without success. I end up with various permission

Open-Xchange Security Advisory 2020-08-12 Affected product: Dovecot IMAP server Internal reference: DOP-1870 (Bug ID) Vulnerability type: CWE-789 (Uncontrolled Memory Allocation) Vulnerable version: 2.2 Vulnerable component: auth Fixed version: 2.3.11.3 Report confidence: Confirmed Solution status: Fix available Vendor notification: 2020-05-03 CVE reference: CVE-2020-12673 CVSS: 7.5

Hi all I've enabled ntlm authentication in dovecot, and use dovecot sasl in postfix as well. Authentication with ntlm works well from Mac OS X Mail.app, as well as from Outlook Express, but fails with Outlook. Strangely enough, ntml authentication works in Outlook when using smtp (via postfix), but neither from imap or pop3 (both dovecot). As dovecot sasl handles all authentication against a mysql userdb, this strikes me as very strange. I've instructed my clients with Outlook to fetch mail using a ssl- encrypted c...

...is give certain people access to the machine. Preferably, just a command line login. Unfortunately, the only things I saw online for command line logins were commercial products. I thought about firing up the telnet service, but it seems to require NTLM authentication. My attempts to configure ntml were foiled - for some reason the OS thinks I don''t have admin privileges (I do). Any suggestions? I''m willing to pay money if you think there''s a commercial product out there that''s worth it (I saw rlogind from MKS Software - any good?), but I would prefer...

...t don't want to imply that they HAVE TO use mail.hprs.local. > I had a look at the NTLM mechanism, it *should* support SSP and NTLMv2. > I have to set up some kind of test environment to find out why it bugs. I'm going to give my brain a rest for a bit before I resume tilting at the NTML windmill! I'll check back with the list to see if you've come up with anything. > Aki Again, thanks for all your help. --Mark -----Original Message----- > Subject: Re: Configure Dovecot for GSSAPI [formerly: Looking for GSSAPI config] > To: dovecot at dovecot.org > From: Aki...

...to imply that they HAVE TO use mail.hprs.local. > >> I had a look at the NTLM mechanism, it *should* support SSP and NTLMv2. >> I have to set up some kind of test environment to find out why it bugs. > I'm going to give my brain a rest for a bit before I resume tilting at the NTML windmill! I'll > check back with the list to see if you've come up with anything. > >> Aki > Again, thanks for all your help. > > --Mark > > -----Original Message----- >> Subject: Re: Configure Dovecot for GSSAPI [formerly: Looking for GSSAPI config] >&gt...

...NTLMv2: server and client nonce, MITM can't force downgrade" ... whatever that means. Anyway, probably it's my lack of understanding terminology. I don't even know what a "nonce" is. But, I learn well from examples! Can somone please give me a sample 10-auth.conf for NTML and any other supporting settings or configs I need? My current/working dovecot settings, which have been running perfectly for well over a year now, are: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanism...

...e sendmail > and procmail as MTA to deliver mail to the appropriate Maildir folders (as defined in > /etc/passwd for home directories) and I use /etc/shadow as Dovecot's passdb for non-domain mail > clients such as iPhone and Outlook (the latter simply because I haven't figured out NTML > authentication for Outlook yet). Then, when you run 'getent passwd userA' which user do you get back ? and have you tried creating a new local Unix user lately if that user exists in AD already ? User 'rowland' is in AD: root at devstation:/home/rowland/dovecot# getent pas...

...used to connect with Dovecot to read mail on the Users' WIN7 workstations. I believe I have confirmed that MS Outlook will either ... 1) send the userid and password configured in the Outlook settings to Dovecot for authorizing. This mechanism has been working fine for months. or ... 2) Use NTML authorization if "Require login using Secure Password Authentication (SPA)" is checked: https://en.wikipedia.org/wiki/Secure_Password_Authentication Those, I believe, are the only two choices with Outlook (other than Exchange). Therefore, in order not to configure a Domain-distinct pass...

...hans Also now the Samba disk on the samba-srv can be accessed on the Y-drive. But Wireshark show now that NTLM is used to encrypt the network packages. NTLM doesn't work with tickets that need to be renewed. The problem that the Samba shared is some seconds not available doesn't occur when NTML is used to encrypt the network packages. The problem that the share is some seconds not available also doesn't occur when the share is not on Samba but on an other Windows system, also when Kerberos is used. In the attachment contains the C-program source that can be used to reproduce the pro...

...amba disk on the samba-srv can be accessed on the > Y-drive. But Wireshark show now that NTLM is used to encrypt the > network packages. NTLM doesn't work with tickets that need to be > renewed. The problem that the Samba shared is some seconds not > available doesn't occur when NTML is used to encrypt the network > packages. > > The problem that the share is some seconds not available also doesn't > occur when the share is not on Samba but on an other Windows system, > also when Kerberos is used. > > In the attachment contains the C-program source th...

...gt; MITM can't force downgrade" ... whatever that means. > > > > Anyway, probably it's my lack of understanding terminology. I don't even know what a "nonce" > > is. But, I learn well from examples! Can somone please give me a sample 10-auth.conf for NTML > > and any other supporting settings or configs I need? > > > > My current/working dovecot settings, which have been running perfectly for well over a year > > now, are: > > > > $ dovecot -n > > # 2.2.15: /usr/local/etc/dovecot/dovecot.conf > > # OS:...

...and procmail as MTA to deliver mail to the appropriate Maildir folders (as defined in >>> /etc/passwd for home directories) and I use /etc/shadow as Dovecot's passdb for non-domain mail >>> clients such as iPhone and Outlook (the latter simply because I haven't figured out NTML >>> authentication for Outlook yet). >> Then, when you run 'getent passwd userA' which user do you get back ? >> and have you tried creating a new local Unix user lately if that user >> exists in AD already ? >> >> User 'rowland' is in AD: >...

...used to connect with Dovecot to read mail on the Users' WIN7 workstations. I believe I have confirmed that MS Outlook will either ... 1) send the userid and password configured in the Outlook settings to Dovecot for authorizing. This mechanism has been working fine for months. or ... 2) Use NTML authorization if "Require login using Secure Password Authentication (SPA)" is checked: https://en.wikipedia.org/wiki/Secure_Password_Authentication Those, I believe, are the only two choices with Outlook (other than Exchange). Therefore, in order not to configure a Domain-distinct pass...

...ave users authenticate against MySQL (virtual users) or pam (local users). Or do i just ignore it all and stick with PLAIN since the connection is already encrypted? What is LOGIN? My MUA supports "Password" (which is PLAIN evidently), kerberos 5, MD5 Challenge-response (CRAM-MD5), and NTML (??) -- If you have any young friends who aspire to become writers, the second-greatest favor you can do them is to present them with copies of The Elements of Style. The first-greatest, of course, is to shoot them now, while they're happy. -Dorothy Parker

...gt; MITM can't force downgrade" ... whatever that means. > > > > Anyway, probably it's my lack of understanding terminology. I don't even know what a "nonce" > > is. But, I learn well from examples! Can somone please give me a sample 10-auth.conf for NTML > > and any other supporting settings or configs I need? > > > > My current/working dovecot settings, which have been running perfectly for well over a year > > now, are: > > > > $ dovecot -n > > # 2.2.15: /usr/local/etc/dovecot/dovecot.conf > > # OS:...

...> and procmail as MTA to deliver mail to the appropriate Maildir folders (as defined in > > /etc/passwd for home directories) and I use /etc/shadow as Dovecot's passdb for non-domain mail > > clients such as iPhone and Outlook (the latter simply because I haven't figured out NTML > > authentication for Outlook yet). > > Then, when you run 'getent passwd userA' which user do you get back ? > and have you tried creating a new local Unix user lately if that user > exists in AD already ? > > User 'rowland' is in AD: > > root at de...

...À : samba at lists.samba.org >>>>> Objet : Re: [Samba] Incompatibility Windows 7 >>>>> >>>>> Hello everybody >>>>> >>>>> Ok Marco, I'm reassured to look you have the same problem. >>>>> My friend speak of NTML for my problem, it can help me? >>>>> What is NTML? >>>>> >>>>> Thank you >>>>> >>>>> >>>>>> -----Message d'origine----- >>>>>> De : Marco Gaiarin via samba [mailto:samba at lists.samb...

In the release notes for v1.2.2, Timo said: > Found and fixes several v1.2-specific bugs. Hopefully it's now stable > for most people's usage. > > * GSSAPI: More changes to authentication. Hopefully good now. > What were the GSSAPI changes? I am having problems with _some_ of my users using GSSAPI auth. I am using version 1.2.1. The client (thunderbird) reports that the