Perdition not recognizing STARTTLS?
Steven Kelbley <[email protected]> Wed, 3 Sep 2014 16:37:43 -0400
| Newsgroups | gmane.mail.perdition.user |
|---|---|
| Message-ID | <CAEcz_ZXN7HtR2nz43+etbBj0KcSCorhUE=rEFcovdNsLH+CfPw@mail.gmail.com> |
--===============0452770925==
Content-Type: multipart/alternative; boundary=001a11c1d31c3982ac05022f35f8
--001a11c1d31c3982ac05022f35f8
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Hi all, hoping you might be able to help me out.
I have a Perdition proxy server (v1.17.1-1) setup to forward users to one
of two Cyrus (v2.3.16) backend mailstores based on an LDAP query.
Everything works fine except for securing the connection between Perdition
and Cyrus; somehow Perdition is seemingly ignoring the STARTTLS entry in
the mail server's CAPABILITY string. STARTTLS works perfectly fine
connecting from the Perdition server to the Cyrus server using both
"imtest" and "openssl s_client".
The certs are all signed by a separate test CA I set up the other day and
work fine otherwise. I've posted the log and relevant Perdition configs
below, and I=E2=80=99ve tested the backend servers individually to ensure S=
TARTTLS
is working fine on Cyrus=E2=80=99 end. Have I messed something up?
##/var/log/maillog##
Sep 3 10:23:34 perdition-host perdition[20007]: Connect:
client.example.com -> perdition.example.com
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "* OK IMAP4
Ready perdition.example.com 00021e71\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: CLIENT: "1
STARTTLS\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "1 OK Begin
TLS negotiation now\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SSL connection using
AES256-GCM-SHA384
Sep 3 10:23:34 perdition-host perdition[20007]: CLIENT: "2 login \"
[email protected]\" \"password\""
Sep 3 10:23:34 perdition-host perdition[20007]: CLIENT: "\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: username_add_domain:
username_add_domain 0 1 0x260e0b4
Sep 3 10:23:34 perdition-host perdition[20007]: username_add_domain:
username_add_domain 0 4 0x260e0b4
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "* OK
[CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN
SASL-IR COMPRESS=3DDEFLATE] server ready\r\n* OK [ALERT] Cyrus01\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "flim07
CAPABILITY\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: tls_outgoing_force is
set, but the real-server does not have the STARTTLS capability, connection
will not be encrypted
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "flim07
CAPABILITY\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "* CAPABILITY
IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR
COMPRESS=3DDEFLATE ACL RIGHTS=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDP=
LUS
NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ
THREAD=3DORDEREDSUBJECT THREAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE
SCAN IDLE LISTEXT LIST-SUBSCRIBED X-NETSCAPE URLAUTH\r\nflim07 OK
Completed\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "flim08 LOGIN
{37}\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "* CAPABILITY
IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR
COMPRESS=3DDEFLATE ACL RIGHTS=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDP=
LUS
NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ
THREAD=3DORDEREDSUBJECT THREAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE
SCAN IDLE LISTEXT LIST-SUBSCRIBED X-NETSCAPE URLAUTH\r\nflim07 OK
Completed\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "* CAPABILITY
IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR
COMPRESS=3DDEFLATE ACL RIGHTS=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDP=
LUS
NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ
THREAD=3DORDEREDSUBJECT THREAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE
SCAN IDLE LISTEXT LIST-SUBSCRIBED X-NETSCAPE URLAUTH\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: imap4_out_response:
invalid tag from server 1
Sep 3 10:23:34 perdition-host perdition[20007]:
imap4_out_authenticate: imap4_out_response login
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "
[email protected] {9}\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "+ go
ahead\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: SELF: "password\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: REAL: "+ go
ahead\r\n"
Sep 3 10:23:34 perdition-host perdition[20007]: imap4_out_response:
invalid tag from server 1
Sep 3 10:23:34 perdition-host perdition[20007]:
imap4_out_authenticate: imap4_out_response passwd
Sep 3 10:23:34 perdition-host perdition[20007]: main:
protocol->out_authenticate -1
Sep 3 10:23:34 perdition-host perdition[20007]: Fatal error
authenticating user. Exiting child.
##/etc/sysconfig/perdition##
RUN_PERDITION=3Dyes
POP3=3Dno
POP3S=3Dno
IMAP4=3Dno
IMAP4S=3Dyes
##/usr/etc/perdition/perdition_imap4s.conf##
(All left default except following options:)
connection_logging
debug
listen_port 143
map_library /usr/lib/libperditiondb_ldap.so.0
map_library_opt "ldap:<ldap_url_here>"
ok_line Connected to perdition IMAP proxy.
protocol IMAP4S
outgoing_port 143
pid_file /var/run/perdition/perdition.imap4s.pid
timeout 60
ssl_mode tls_all
ssl_ca_file /etc/pki/tls/certs/ca.crt
ssl_ca_accept_self_signed
ssl_cert_file /etc/pki/tls/private/host_perdition.crt
ssl_cert_accept_self_signed
ssl_key_file /etc/pki/tls/private/host_perdition.key
Thanks in advance for any help, I=E2=80=99ve spent a good amount of time =
stuck on
this issue.
Steven Kelbley
--001a11c1d31c3982ac05022f35f8
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<p dir=3D"ltr"><br>
Hi all, hoping you might be able to help me out.</p>
<p dir=3D"ltr">I have a Perdition proxy server (v1.17.1-1) setup to forward=
users to one of two Cyrus (v2.3.16) backend mailstores based on an LDAP qu=
ery. Everything works fine except for securing the connection between Perdi=
tion and Cyrus; somehow Perdition is seemingly ignoring the STARTTLS entry =
in the mail server's CAPABILITY string. STARTTLS works perfectly fine c=
onnecting from the Perdition server to the Cyrus server using both "im=
test" and "openssl s_client".</p>
<p dir=3D"ltr">The certs are all signed by a separate test CA I set up the =
other day and work fine otherwise. I've posted the log and relevant Per=
dition configs below, and I=E2=80=99ve tested the backend servers individua=
lly to ensure STARTTLS is working fine on Cyrus=E2=80=99 end. Have I messed=
something up?</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">##/var/log/maillog##</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: Connect: <a href=3D"http://client.example.com">client.example.=
com</a> -> <a href=3D"http://perdition.example.com">perdition.example.co=
m</a></p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "* OK IMAP4 Ready <a href=3D"http://per=
dition.example.com">perdition.example.com</a> 00021e71\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: CLIENT: "1 STARTTLS\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "1 OK Begin TLS negotiation now\r\n&quo=
t;</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SSL connection using AES256-GCM-SHA384</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: CLIENT: "2 login \"<a href=3D"mailto:user-test@email=
.example.com">[email protected]</a>\" \"password\"=
"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: CLIENT: "\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: username_add_domain: username_add_domain 0 1 0x260e0b4</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: username_add_domain: username_add_domain 0 4 0x260e0b4</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "* OK [CAPABILITY IMAP4 IMAP4rev1 LITER=
AL+ ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR COMPRESS=3DDEFLATE] serve=
r ready\r\n* OK [ALERT] Cyrus01\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "flim07 CAPABILITY\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: tls_outgoing_force is set, but the real-server does not have t=
he STARTTLS capability, connection will not be encrypted</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "flim07 CAPABILITY\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "* CAPABILITY IMAP4 IMAP4rev1 LITERAL+ =
ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR COMPRESS=3DDEFLATE ACL RIGHTS=
=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT=
CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ THREAD=3DORDEREDSUBJECT THR=
EAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE SCAN IDLE LISTEXT LIST-SUB=
SCRIBED X-NETSCAPE URLAUTH\r\nflim07 OK Completed\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "flim08 LOGIN {37}\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "* CAPABILITY IMAP4 IMAP4rev1 LITERAL+ =
ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR COMPRESS=3DDEFLATE ACL RIGHTS=
=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT=
CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ THREAD=3DORDEREDSUBJECT THR=
EAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE SCAN IDLE LISTEXT LIST-SUB=
SCRIBED X-NETSCAPE URLAUTH\r\nflim07 OK Completed\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "* CAPABILITY IMAP4 IMAP4rev1 LITERAL+ =
ID STARTTLS AUTH=3DPLAIN AUTH=3DLOGIN SASL-IR COMPRESS=3DDEFLATE ACL RIGHTS=
=3Dkxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT=
CHILDREN MULTIAPPEND BINARY SORT SORT=3DMODSEQ THREAD=3DORDEREDSUBJECT THR=
EAD=3DREFERENCES ANNOTATEMORE CATENATE CONDSTORE SCAN IDLE LISTEXT LIST-SUB=
SCRIBED X-NETSCAPE URLAUTH\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: imap4_out_response: invalid tag from server 1</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: imap4_out_authenticate: imap4_out_response login</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "<a href=3D"mailto:[email protected]=
ple.com">[email protected]</a> {9}\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "+ go ahead\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: SELF:=C2=A0=C2=A0 "password\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: REAL:=C2=A0=C2=A0 "+ go ahead\r\n"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: imap4_out_response: invalid tag from server 1</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: imap4_out_authenticate: imap4_out_response passwd</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: main: protocol->out_authenticate -1</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 Sep=C2=A0 3 10:23:34 perdition-host perdi=
tion[20007]: Fatal error authenticating user. Exiting child.</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">##/etc/sysconfig/perdition##</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 RUN_PERDITION=3Dyes</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 POP3=3Dno</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 POP3S=3Dno</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 IMAP4=3Dno</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 IMAP4S=3Dyes</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">##/usr/etc/perdition/perdition_imap4s.conf##</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 (All left default except following option=
s:)</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 connection_logging</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 debug</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 listen_port 143</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 map_library /usr/lib/libperditiondb_ldap.=
so.0</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 map_library_opt "ldap:<ldap_url_h=
ere>"</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ok_line Connected to perdition IMAP proxy=
.</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 protocol IMAP4S</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 outgoing_port 143</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 pid_file /var/run/perdition/perdition.ima=
p4s.pid</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 timeout 60</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_mode tls_all</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_ca_file /etc/pki/tls/certs/ca.crt</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_ca_accept_self_signed</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_cert_file /etc/pki/tls/private/host_p=
erdition.crt</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_cert_accept_self_signed</p>
<p dir=3D"ltr">=C2=A0=C2=A0=C2=A0 ssl_key_file /etc/pki/tls/private/host_pe=
rdition.key</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">Thanks in advance for any help, I=E2=80=99ve spent a good am=
ount of time stuck on this issue.</p>
<p dir=3D"ltr"> </p>
<p dir=3D"ltr">Steven Kelbley</p>
--001a11c1d31c3982ac05022f35f8--
--===============0452770925==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
______________________________________________
Perdition-users mailing list
[email protected]
http://lists.vergenet.net/listinfo/perdition-users
--===============0452770925==--