Authenticating with dovecot

Question

I'm trying to access my emails using thunderbird but I'm getting an auth problem. I'm using valid certs and did adduser testuser with a simple password (1 letter, 8 didn't seem to change anything).

According to the logs it can't find the user. I haven't modified 10-auth.conf or anything in conf.d do I need to? Here is my dovecot.conf and log file

disable_plaintext_auth = no
mail_privileged_group = mail
mail_location = mbox:~/mail:INBOX=/var/mail/%u
userdb {
  driver = passwd
}

passdb {
  driver = shadow
  args = blocking=no
}

protocols = " imap"

service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
}
ssl=required
ssl_cert = </etc/letsencrypt/live/MY_DOMAIN.COM/fullchain.pem
ssl_key = </etc/letsencrypt/live/MY_DOMAIN.COM/privkey.pem

auth_verbose=yes
auth_debug=yes
auth_debug_passwords=yes
mail_debug=yes

Log file

dovecot: master: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: anvil: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: log: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: master: Dovecot v2.2.13 starting up for imap (core dumps disabled)
dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat
dovecot: auth: Debug: auth client connected (pid=5293)
dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=dtEqfrs9fwBo3ndE#011lip=1.2.3.4#011rip=123.123.123.123#011lport=143#011rport=6527
dovecot: auth: Debug: client passdb out: CONT#0111
dovecot: auth: Debug: client in: CONT#0111#011AHRlc3R1c2VyAHA= (previous base64 data may contain sensitive data)
dovecot: auth: Debug: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): lookup
dovecot: auth: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): unknown user
dovecot: auth: Debug: client passdb out: FAIL#0111#011user=testuser
dovecot: auth: Debug: client in: AUTH#0112#011PLAIN#011service=imap#011secured#011session=dtEqfrs9fwBo3ndE#011lip=1.2.3.4#011rip=123.123.123.123#011lport=143#011rport=6527#011resp=AHRlc3R1c2VyAHA= (previous base64 data may contain sensitive data)
dovecot: auth: Debug: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): lookup
dovecot: auth: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): unknown user
dovecot: auth: Debug: client passdb out: FAIL#0112#011user=testuser
dovecot: imap-login: Disconnected (auth failed, 2 attempts in 8 secs): user=<testuser>, method=PLAIN, rip=123.123.123.123, lip=1.2.3.4, TLS, session=<dtEqfrs9fwBo3ndE>
dovecot: auth: Debug: auth client connected (pid=5296)

derobert · Accepted Answer · 2016-09-30T16:55:28.320

2

In all likelihood, you want to be using the pam password database, not the shadow password database. But if you're going to use the shadow database, you need to either disable the auth-worker processes (by adding args = blocking=no to the passdb section) or have the auth-workers run as group shadow:

service auth-worker {
  group = shadow
}

Both of those solutions come from the wiki. Another good solution is not to use system passwords and instead use, e.g., the passwd-file database. Example with passwd-file:

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/passwords

}

then for your example user "testuser" with password of "p", /etc/dovecot/passwords would look like:

testuser:{SHA512-CRYPT}$6$R6MuJ818vCtvNw1y$ALycf9nfP8mL7EZysLTZJlnNGuygRHhr9xCDFi8tlIHND4i6fI8wwY6t0dAL6rOY0Jat2iZmQgqz4vEFT/0fa1

That huge hash value can be obtained via doveadm pw -s SHA512-CRYPT (it will be different each time, due to salting).

edited Sep 30 '16 at 16:55

answered Sep 30 '16 at 16:40

derobert

107,579
20
231
279

I'm not sure if I understood but here are the results http://pastebin.com/kSwWBPhF as a test i set my password to `p` (log says `x` for some reason). Am I to used a different type of passwd file? – Sep 30 '16 at 16:50
passwd-file has a different format than /etc/passwd; I'll add in an example. – derobert Sep 30 '16 at 16:52
@acidzombie24 example added. – derobert Sep 30 '16 at 16:55
Thanks. I had to add the user uid/gid so I put this after the password in the password file i made `user:{sha...}.../1234:1003:1003` and I had to change `mail_location = mbox:/var/mailout/%u:...` bc the default (I think it was `~/mail`) wouldn't work. Everything appears to be fine – Sep 30 '16 at 17:47

Authenticating with dovecot

1 Answers1