Perdition not recognizing STARTTLS
Steven Kelbley <[email protected]> Wed, 3 Sep 2014 16:56:20 -0400
| Newsgroups | gmane.mail.perdition.user |
|---|---|
| Message-ID | <CAEcz_ZWsW7wYVXaUV2cUE0aqqOz2C9WACfvPFrjsiR83Vxsn2A@mail.gmail.com> |
--===============0945995679==
Content-Type: multipart/alternative; boundary=20cf3005dd80d8efe805022f776a
--20cf3005dd80d8efe805022f776a
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Hi all, hoping you might be able to help me out. I have a Perdition proxy
server (v1.17.1-1) setup to forward users to one of two Cyrus (v2.3.16)
backend mailstores based on an LDAP query. Everything works fine except for
securing the connection between Perdition and Cyrus; somehow Perdition is
seemingly ignoring the STARTTLS entry in the mail server's CAPABILITY
string. STARTTLS works perfectly fine connecting from the Perdition server
to the Cyrus server using both "imtest" and "openssl s_client".
The certs are all signed by a separate test CA I set up the other day and
work fine otherwise. I've posted the log and relevant Perdition configs
below, and I=E2=80=99ve tested the backend servers individually to ensure S=
TARTTLS
is working fine on Cyrus=E2=80=99 end. Have I messed something up?
##/var/log/maillog##
Sep 3 10:23:34 perdition-host perdition[20007]: Connect:
client.example.com -> perdition.example.com
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "* OK IMAP4
Ready perdition.example.com 00021e71\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: CLIENT: "1
STARTTLS\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "1 OK Begin
TLS negotiation now\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SSL connection using
AES256-GCM-SHA384
Sep 3 10:23:34 perdition-host perdition[20007]: CLIENT: "2 login \"
[email protected]\" \"password\""
Sep 3 10:23:34 perdition-host perdition[20007]: CLIENT: "\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: username_add_domain:
username_add_domain 0 1 0x260e0b4
Sep 3 10:23:34 perdition-host perdition[20007]: username_add_domain:
username_add_domain 0 4 0x260e0b4
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "* OK
[CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN
SASL-IR COMPRESS=3DDEFLATE] server ready\r\n* OK [ALERT] Cyrus01\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "flim07
CAPABILITY\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: tls_outgoing_force is
set, but the real-server does not have the STARTTLS capability, connection
will not be encrypted
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "flim07
CAPABILITY\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "* CAPABILITY
IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR
COMPRESS=3DDEFLATE ACL RIGHTS=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDP=
LUS
NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ
THREAD=3DORDEREDSUBJECT THREAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE
SCAN IDLE LISTEXT LIST-SUBSCRIBED X-NETSCAPE URLAUTH\r\nflim07 OK
Completed\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "flim08 LOGIN
{37}\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "* CAPABILITY
IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR
COMPRESS=3DDEFLATE ACL RIGHTS=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDP=
LUS
NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ
THREAD=3DORDEREDSUBJECT THREAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE
SCAN IDLE LISTEXT LIST-SUBSCRIBED X-NETSCAPE URLAUTH\r\nflim07 OK
Completed\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "* CAPABILITY
IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR
COMPRESS=3DDEFLATE ACL RIGHTS=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDP=
LUS
NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ
THREAD=3DORDEREDSUBJECT THREAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE
SCAN IDLE LISTEXT LIST-SUBSCRIBED X-NETSCAPE URLAUTH\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: imap4_out_response:
invalid tag from server 1
Sep 3 10:23:34 perdition-host perdition[20007]:
imap4_out_authenticate: imap4_out_response login
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "
[email protected] {9}\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "+ go
ahead\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "password\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "+ go
ahead\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: imap4_out_response:
invalid tag from server 1
Sep 3 10:23:34 perdition-host perdition[20007]:
imap4_out_authenticate: imap4_out_response passwd
Sep 3 10:23:34 perdition-host perdition[20007]: main:
protocol->out_authenticate -1
Sep 3 10:23:34 perdition-host perdition[20007]: Fatal error
authenticating user. Exiting child.
##/etc/sysconfig/perdition##
RUN_PERDITION=3Dyes
POP3=3Dno
POP3S=3Dno
IMAP4=3Dno
IMAP4S=3Dyes
##/usr/etc/perdition/perdition_imap4s.conf##
(All left default except following options:)
connection_logging
debug
listen_port 143
map_library /usr/lib/libperditiondb_ldap.so.0
map_library_opt "ldap:<redacted>"
ok_line Connected to perdition IMAP proxy.
protocol IMAP4S
outgoing_port 143
pid_file /var/run/perdition/perdition.imap4s.pid
timeout 60
ssl_mode tls_all
ssl_ca_file /etc/pki/tls/certs/ca.crt
ssl_ca_accept_self_signed
ssl_cert_file /etc/pki/tls/private/host_perdition.crt
ssl_cert_accept_self_signed
ssl_key_file /etc/pki/tls/private/host_perdition.key
Thanks in advance for any help, I=E2=80=99ve spent a good amount of time =
stuck on
this issue.
Steven Kelbley
--20cf3005dd80d8efe805022f776a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<p dir=3D"ltr"><br>
Hi all, hoping you might be able to help me out. I have a Perdition proxy s=
erver (v1.17.1-1) setup to forward users to one of two Cyrus (v2.3.16) back=
end mailstores based on an LDAP query. Everything works fine except for sec=
uring the connection between Perdition and Cyrus; somehow Perdition is seem=
ingly ignoring the STARTTLS entry in the mail server's CAPABILITY strin=
g. STARTTLS works perfectly fine connecting from the Perdition server to th=
e Cyrus server using both "imtest" and "openssl s_client&quo=
t;.</p>
<p dir=3D"ltr">The certs are all signed by a separate test CA I set up the =
other day and work fine otherwise. I've posted the log and relevant Per=
dition configs below, and I=E2=80=99ve tested the backend servers individua=
lly to ensure STARTTLS is working fine on Cyrus=E2=80=99 end. Have I messed=
something up?</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">##/var/log/maillog##</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: Connect: <a href=3D"http://client.example.com">client.example.=
com</a> -> <a href=3D"http://perdition.example.com">perdition.example.co=
m</a></p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "* OK IMAP4 Ready <a href=3D"http://per=
dition.example.com">perdition.example.com</a> 00021e71\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: CLIENT: "1 STARTTLS\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "1 OK Begin TLS negotiation now\r\n&quo=
t;</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SSL connection using AES256-GCM-SHA384</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: CLIENT: "2 login \"<a href=3D"mailto:user-test@email=
.example.com">[email protected]</a>\" \"password\"=
"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: CLIENT: "\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: username_add_domain: username_add_domain 0 1 0x260e0b4</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: username_add_domain: username_add_domain 0 4 0x260e0b4</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "* OK [CAPABILITY IMAP4 IMAP4rev1 LITER=
AL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR COMPRESS=3DDEFLATE] serve=
r ready\r\n* OK [ALERT] Cyrus01\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "flim07 CAPABILITY\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: tls_outgoing_force is set, but the real-server does not have t=
he STARTTLS capability, connection will not be encrypted</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "flim07 CAPABILITY\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "* CAPABILITY IMAP4 IMAP4rev1 LITERAL+ =
ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR COMPRESS=3DDEFLATE ACL RIGHTS=
=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT=
CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ THREAD=3DORDEREDSUBJECT THR=
EAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE SCAN IDLE LISTEXT LIST-SUB=
SCRIBED X-NETSCAPE URLAUTH\r\nflim07 OK Completed\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "flim08 LOGIN {37}\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "* CAPABILITY IMAP4 IMAP4rev1 LITERAL+ =
ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR COMPRESS=3DDEFLATE ACL RIGHTS=
=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT=
CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ THREAD=3DORDEREDSUBJECT THR=
EAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE SCAN IDLE LISTEXT LIST-SUB=
SCRIBED X-NETSCAPE URLAUTH\r\nflim07 OK Completed\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "* CAPABILITY IMAP4 IMAP4rev1 LITERAL+ =
ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR COMPRESS=3DDEFLATE ACL RIGHTS=
=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT=
CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ THREAD=3DORDEREDSUBJECT THR=
EAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE SCAN IDLE LISTEXT LIST-SUB=
SCRIBED X-NETSCAPE URLAUTH\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: imap4_out_response: invalid tag from server 1</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: imap4_out_authenticate: imap4_out_response login</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "<a href=3D"mailto:[email protected]=
ple.com">[email protected]</a> {9}\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "+ go ahead\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "password\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "+ go ahead\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: imap4_out_response: invalid tag from server 1</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: imap4_out_authenticate: imap4_out_response passwd</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: main: protocol->out_authenticate -1</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: Fatal error authenticating user. Exiting child.</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">##/etc/sysconfig/perdition##</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 RUN_PERDITION=3Dyes</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 POP3=3Dno</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 POP3S=3Dno</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 IMAP4=3Dno</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 IMAP4S=3Dyes</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">##/usr/etc/perdition/perdition_imap4s.conf##</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 (All left default except following option=
s:)</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 connection_logging</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 debug</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 listen_port 143</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 map_library /usr/lib/libperditiondb_ldap.=
so.0</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 map_library_opt "ldap:<redacted&g=
t;"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ok_line Connected to perdition IMAP proxy=
.</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 protocol IMAP4S</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 outgoing_port 143</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 pid_file /var/run/perdition/perdition.ima=
p4s.pid</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 timeout 60</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_mode tls_all</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_ca_file /etc/pki/tls/certs/ca.crt</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_ca_accept_self_signed</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_cert_file /etc/pki/tls/private/host_p=
erdition.crt</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_cert_accept_self_signed</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_key_file /etc/pki/tls/private/host_pe=
rdition.key</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">Thanks in advance for any help, I=E2=80=99ve spent a good am=
ount of time stuck on this issue.</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">Steven Kelbley</p>
--20cf3005dd80d8efe805022f776a--
--===============0945995679==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
______________________________________________
Perdition-users mailing list
[email protected]
http://lists.vergenet.net/listinfo/perdition-users
--===============0945995679==--