5

I'm trying to access my emails using thunderbird but I'm getting an auth problem. I'm using valid certs and did adduser testuser with a simple password (1 letter, 8 didn't seem to change anything).

According to the logs it can't find the user. I haven't modified 10-auth.conf or anything in conf.d do I need to? Here is my dovecot.conf and log file

disable_plaintext_auth = no
mail_privileged_group = mail
mail_location = mbox:~/mail:INBOX=/var/mail/%u
userdb {
  driver = passwd
}

passdb {
  driver = shadow
  args = blocking=no
}

protocols = " imap"

service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
}
ssl=required
ssl_cert = </etc/letsencrypt/live/MY_DOMAIN.COM/fullchain.pem
ssl_key = </etc/letsencrypt/live/MY_DOMAIN.COM/privkey.pem

auth_verbose=yes
auth_debug=yes
auth_debug_passwords=yes
mail_debug=yes

Log file

dovecot: master: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: anvil: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: log: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: master: Dovecot v2.2.13 starting up for imap (core dumps disabled)
dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat
dovecot: auth: Debug: auth client connected (pid=5293)
dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=dtEqfrs9fwBo3ndE#011lip=1.2.3.4#011rip=123.123.123.123#011lport=143#011rport=6527
dovecot: auth: Debug: client passdb out: CONT#0111
dovecot: auth: Debug: client in: CONT#0111#011AHRlc3R1c2VyAHA= (previous base64 data may contain sensitive data)
dovecot: auth: Debug: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): lookup
dovecot: auth: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): unknown user
dovecot: auth: Debug: client passdb out: FAIL#0111#011user=testuser
dovecot: auth: Debug: client in: AUTH#0112#011PLAIN#011service=imap#011secured#011session=dtEqfrs9fwBo3ndE#011lip=1.2.3.4#011rip=123.123.123.123#011lport=143#011rport=6527#011resp=AHRlc3R1c2VyAHA= (previous base64 data may contain sensitive data)
dovecot: auth: Debug: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): lookup
dovecot: auth: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): unknown user
dovecot: auth: Debug: client passdb out: FAIL#0112#011user=testuser
dovecot: imap-login: Disconnected (auth failed, 2 attempts in 8 secs): user=<testuser>, method=PLAIN, rip=123.123.123.123, lip=1.2.3.4, TLS, session=<dtEqfrs9fwBo3ndE>
dovecot: auth: Debug: auth client connected (pid=5296)

1 Answer 1

2

In all likelihood, you want to be using the pam password database, not the shadow password database. But if you're going to use the shadow database, you need to either disable the auth-worker processes (by adding args = blocking=no to the passdb section) or have the auth-workers run as group shadow:

service auth-worker {
  group = shadow
}

Both of those solutions come from the wiki. Another good solution is not to use system passwords and instead use, e.g., the passwd-file database. Example with passwd-file:

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/passwords

}

then for your example user "testuser" with password of "p", /etc/dovecot/passwords would look like:

testuser:{SHA512-CRYPT}$6$R6MuJ818vCtvNw1y$ALycf9nfP8mL7EZysLTZJlnNGuygRHhr9xCDFi8tlIHND4i6fI8wwY6t0dAL6rOY0Jat2iZmQgqz4vEFT/0fa1

That huge hash value can be obtained via doveadm pw -s SHA512-CRYPT (it will be different each time, due to salting).

4
  • I'm not sure if I understood but here are the results pastebin.com/kSwWBPhF as a test i set my password to p (log says x for some reason). Am I to used a different type of passwd file?
    – user4069
    Commented Sep 30, 2016 at 16:50
  • passwd-file has a different format than /etc/passwd; I'll add in an example.
    – derobert
    Commented Sep 30, 2016 at 16:52
  • @acidzombie24 example added.
    – derobert
    Commented Sep 30, 2016 at 16:55
  • Thanks. I had to add the user uid/gid so I put this after the password in the password file i made user:{sha...}.../1234:1003:1003 and I had to change mail_location = mbox:/var/mailout/%u:... bc the default (I think it was ~/mail) wouldn't work. Everything appears to be fine
    – user4069
    Commented Sep 30, 2016 at 17:47

You must log in to answer this question.