1.4.x imapd SSL courier-imap-ssl klappt nicht.. SSL ist aktiviert.

d43M0n23 · Apr 19th 2017

Hallo,

ich habe folgendes problem. Seit dem upgrade auf version 1.4.x kann ich mich nicht mehr per TLS anmelden. Ok soweit, steht ja auch auf github mit dem PLAIN PW.
Nun habe ich auch unser SSL zertifikat eingebunden.

SMTP klappt einwandfrei mit SSL... aber anmelden klappt leider überhaupt nicht mehr. Hat jemand dazu eine idee. Leider gibt auch die log selbst im Debug mode keine dienliche Info.
Das wesentliche Problem ist das wenn ich PLAIN anmelde auf imapd per Man in the middel alle passwörter auslesbar sind.

mit freundlichen Grüßen
d43M0n23

**Nuxwin** · Apr 19th 2017

@d43M0n23

You mean that you cannot connect to IMAP server using TLS (STARTTLS) and plain password?

First, make sure that your SSL certificate is valid and that in your client parameters, the name used for the IMAP server is the one from your SSL certificate.

Also please, do the following

Shell-Script

# tail -fn0 /var/log/mail.log

Then, try to connect using STARTSSL and plain password to your IMAP account and post us the output of the above command.

d43M0n23 · Apr 20th 2017

Hi nuxwin

My SSL Cert is vaild, server name imap is the same name from certificat.

this is mail.log part with using Thunderbird

Code

Apr 20 10:05:22 isp imapd: Connection, ip=[::ffff:84.113.xxx.xx]Apr 20 10:05:22 isp postfix/smtpd[18916]: connect from 84-113-xxx-xx.cable.dynamic.surfer.at[84.113.xxx.xx]Apr 20 10:05:22 isp imapd: LOGOUT, ip=[::ffff:84.113.xxx.xx], rcvd=24, sent=464Apr 20 10:05:22 isp postfix/smtpd[18916]: improper command pipelining after EHLO from 84-113-xxx-xx.cable.dynamic.surfer.at[84.113.xxx.xx]: QUIT\r\nApr 20 10:05:22 isp postfix/smtpd[18916]: disconnect from 84-113-xxx-xx.cable.dynamic.surfer.at[84.113.xxx.xx]

this is mail.log part with outlook.

Code

Apr 20 11:46:32 isp imapd: Connection, ip=[::ffff:84.113.xxx.xx]Apr 20 11:46:34 isp imapd: Disconnected, ip=[::ffff:84.113.xxx.xx], time=2Apr 20 11:46:37 isp imapd: Connection, ip=[::ffff:84.113.xxx.xx]Apr 20 11:47:38 isp authdaemond: authmysql: sysusername=<null>, sysuserid=1001, sysgroupid=8, homedir=/var/mail/virtual, address=alex@XXXXX.com, fullname=alex@XXXXX.com, maildir=xcoorp.com/alex/, quota=0S, options=<null>Apr 20 11:47:38 isp authdaemond: Authenticated: sysusername=<null>, sysuserid=1001, sysgroupid=8, homedir=/var/mail/virtual, address=alex@XXXXX.com, fullname=alex@XXXXX.com, maildir=xcoorp.com/alex/, quota=0S, options=<null>Apr 20 11:47:38 isp postfix/smtpd[27976]: 56AB819C04C: client=84-113-xxx-xx.cable.dynamic.surfer.at[84.113.xxx.xx], sasl_method=LOGIN, sasl_username=alex@XXXXX.comApr 20 11:47:38 isp postfix/cleanup[27973]: 56AB819C04C: message-id=<>Apr 20 11:47:38 isp postfix/qmgr[19793]: 56AB819C04C: from=<alex@XXXXX.com>, size=777, nrcpt=1 (queue active)Apr 20 11:47:38 isp authdaemond: received userid lookup request: alex@XXXXX.comApr 20 11:47:38 isp authdaemond: authmysql: trying this moduleApr 20 11:47:38 isp authdaemond: SQL query: SELECT mail_addr, mail_pass, "", '1001', '8', '/var/mail/virtual', concat(SUBSTRING(mail_addr, LOCATE('@', mail_addr)+1), '/', mail_acc, '/'), concat(quota,'S'), mail_addr, "" FROM mail_users WHERE mail_addr = 'alex@XXXXX.com' AND (status = 'ok' AND po_active = 'yes')Apr 20 11:47:38 isp authdaemond: Authenticated: sysusername=<null>, sysuserid=1001, sysgroupid=8, homedir=/var/mail/virtual, address=alex@XXXXX.com, fullname=alex@XXXXX.com, maildir=xcoorp.com/alex/, quota=0S, options=<null>Apr 20 11:47:38 isp postfix/pipe[27979]: 56AB819C04C: to=<alex@XXXXX.com>, relay=maildrop, delay=0.6, delays=0.6/0/0/0.01, dsn=2.0.0, status=sent (delivered via maildrop service)Apr 20 11:47:38 isp postfix/qmgr[19793]: 56AB819C04C: removedApr 20 11:47:38 isp postfix/smtpd[27976]: disconnect from 84-113-xxx-xx.cable.dynamic.surfer.at[84.113.xxx.xx]Apr 20 11:47:39 isp spamd[898]: prefork: child states: II

here the courier-imap-ssl status:

Code

root@isp:~# /etc/init.d/courier-imap-ssl status -l
* courier-imap-ssl.service - LSB: Courier IMAP-SSL server
Loaded: loaded (/etc/init.d/courier-imap-ssl)
Active: active (running) since Wed 2017-04-19 13:10:20 CEST; 21h ago
Process: 9135 ExecStop=/etc/init.d/courier-imap-ssl stop (code=exited, status=0/SUCCESS)
Process: 9143 ExecStart=/etc/init.d/courier-imap-ssl start (code=exited, status=0/SUCCESS)
CGroup: /system.slice/courier-imap-ssl.service
|-9155 /usr/sbin/courierlogger -pid=/var/run/courier/imapd-ssl.pid -start -name=imapd-ssl /usr/sbin/couriertcpd -address=127.0.0.1 -maxprocs=600 -maxperip=90 -nodnslookup -noidentl...
`-9156 /usr/sbin/couriertcpd -address=127.0.0.1 -maxprocs=600 -maxperip=90 -nodnslookup -noidentlookup 993 /usr/bin/couriertls -server -tcpd /usr/lib/courier/courier/imaplogin /usr...
Apr 19 13:10:20 isp courier-imap-ssl[9143]: Starting Courier IMAP-SSL server: imapd-ssl.
Apr 19 13:10:20 isp systemd[1]: Started LSB: Courier IMAP-SSL server.

Display More

without tls in outlook or starttls in thunderbird it works perfekt but i can with man in the middle attack easy read all Password @ connection ... ;/

my settings TB:

my settings outlook2013:

normaly i make SSL config manual @ postfix and courier..this time im using your autoinstaller to aktivate SSL...
the Panel works fine with it.

any idea.

best regards d43M0n23

**Nuxwin** · Apr 20th 2017

Quote from d43M0n23

Apr 20 10:05:22 isp postfix/smtpd[18916]: improper command pipelining after EHLO from 84-113-xxx-xx.cable.dynamic.surfer.at[84.113.xxx.xx]: QUIT\r\n

It seem that you have an error regarding a pipe command. Please show us your postfix /etc/postfix/master.cf file. Beside this, I don't see any error regarding TLS.

d43M0n23 · Apr 20th 2017

okay,

this is my master.cf file

Code

# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - y - - smtpd
submission inet n - y - - smtpd
# -o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#
smtps inet n - y - - smtpd
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - y - - qmqpd
pickup fifo n - y 60 1 pickup
cleanup unix n - y - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 bounce
trace unix - - y - 0 bounce
verify unix - - y - 1 verify
flush unix n - y 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - y - - smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - y - - smtp
-o smtp_fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - y - - showq
error unix - - y - - error
retry unix - - y - - error
discard unix - - y - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - y - - lmtp
anvil unix - - y - 1 anvil
scache unix - - y - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# i-MSCP autoresponder
imscp-arpl unix - n n - - pipe
flags=O user=vmail:imscp argv=/var/www/imscp/engine/messenger/imscp-arpl-msgr $recipient
maildrop unix - n n - - pipe
flags=DRhu user=vmail:mail argv=maildrop -w 90 -d ${user}@${nexthop} ${extension} ${recipient} ${user} ${nexthop} ${sender}

Display More

**Nuxwin** · Apr 20th 2017

@d43M0n23

I don't see any problem in your master.cf file. Well, I'll process some test on my server. I stay you informed.

d43M0n23 · Apr 20th 2017

okay, thank you Nuxwin

**Nuxwin** · Apr 21st 2017

I cannot confirm the problem with STARTTLS (port 143), nor with SSL (port 993). All is working as expected.

Relevant logs from my tests:

Connection to courier-imap-ssl server on port 993 (SSL/TLS)

Shell-Script

root@www:~# tail -fn0 /var/log/mail.logApr 21 03:19:05 www imapd-ssl: Connection, ip=[::ffff:192.168.1.1]Apr 21 03:19:05 www imapd-ssl: LOGIN, user=nuxwin@bbox.nuxwin.com, ip=[::ffff:192.168.1.1], port=[54447], protocol=IMAPApr 21 03:19:11 www imapd-ssl: DISCONNECTED, user=nuxwin@bbox.nuxwin.com, ip=[::ffff:192.168.1.1], headers=0, body=0, rcvd=256, sent=1053, time=6, starttls=1

Connection to courier-imap server on port 143 (STARTTLS)

Shell-Script

root@www:~# tail -fn0 /var/log/mail.log
Apr 21 03:21:00 www imapd: Connection, ip=[::ffff:192.168.1.1]
Apr 21 03:21:00 www imapd: LOGIN, user=nuxwin@bbox.nuxwin.com, ip=[::ffff:192.168.1.1], port=[47190], protocol=IMAP
Apr 21 03:21:04 www imapd: DISCONNECTED, user=nuxwin@bbox.nuxwin.com, ip=[::ffff:192.168.1.1], headers=0, body=0, rcvd=75, sent=464, time=4, starttls=1

Environment

1.4.x imapd SSL courier-imap-ssl klappt nicht.. SSL ist aktiviert.

Share

Daily visitors