☰

使用 dovecot 進行身份驗證

tag-icon • tag-icon dovecot
使用 dovecot 進行身份驗證

我正在嘗試使用雷鳥存取我的電子郵件，但遇到身份驗證問題。我使用有效的證書並使用adduser testuser簡單的密碼（1 個字母，8 個似乎沒有改變任何內容）。

根據日誌，它找不到用戶。我還沒有修改 10-auth.conf 或 conf.d 中的任何內容，我需要修改嗎？這是我的 dovecot.conf 和日誌文件

disable_plaintext_auth = no
mail_privileged_group = mail
mail_location = mbox:~/mail:INBOX=/var/mail/%u
userdb {
  driver = passwd
}

passdb {
  driver = shadow
  args = blocking=no
}

protocols = " imap"

service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
}
ssl=required
ssl_cert = </etc/letsencrypt/live/MY_DOMAIN.COM/fullchain.pem
ssl_key = </etc/letsencrypt/live/MY_DOMAIN.COM/privkey.pem

auth_verbose=yes
auth_debug=yes
auth_debug_passwords=yes
mail_debug=yes

記錄檔

dovecot: master: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: anvil: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: log: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
dovecot: master: Dovecot v2.2.13 starting up for imap (core dumps disabled)
dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat
dovecot: auth: Debug: auth client connected (pid=5293)
dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=dtEqfrs9fwBo3ndE#011lip=1.2.3.4#011rip=123.123.123.123#011lport=143#011rport=6527
dovecot: auth: Debug: client passdb out: CONT#0111
dovecot: auth: Debug: client in: CONT#0111#011AHRlc3R1c2VyAHA= (previous base64 data may contain sensitive data)
dovecot: auth: Debug: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): lookup
dovecot: auth: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): unknown user
dovecot: auth: Debug: client passdb out: FAIL#0111#011user=testuser
dovecot: auth: Debug: client in: AUTH#0112#011PLAIN#011service=imap#011secured#011session=dtEqfrs9fwBo3ndE#011lip=1.2.3.4#011rip=123.123.123.123#011lport=143#011rport=6527#011resp=AHRlc3R1c2VyAHA= (previous base64 data may contain sensitive data)
dovecot: auth: Debug: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): lookup
dovecot: auth: shadow(testuser,123.123.123.123,<dtEqfrs9fwBo3ndE>): unknown user
dovecot: auth: Debug: client passdb out: FAIL#0112#011user=testuser
dovecot: imap-login: Disconnected (auth failed, 2 attempts in 8 secs): user=<testuser>, method=PLAIN, rip=123.123.123.123, lip=1.2.3.4, TLS, session=<dtEqfrs9fwBo3ndE>
dovecot: auth: Debug: auth client connected (pid=5296)

答案1

您很可能希望使用pam 密碼資料庫，不是影子密碼資料庫。但是，如果您要使用影子資料庫，則需要停用 auth-worker 進程（透過新增args = blocking=no至該passdb部分）或讓 auth-worker 作為群組執行shadow：

service auth-worker {
  group = shadow
}

這兩個解決方案都來自 wiki。另一個好的解決方案是不使用系統密碼，而是使用例如密碼檔案資料庫。密碼檔案範例：

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/passwords

}

那麼對於您的範例使用者“testuser”，密碼為“p”，/etc/dovecot/passwords將如下所示：

testuser:{SHA512-CRYPT}$6$R6MuJ818vCtvNw1y$ALycf9nfP8mL7EZysLTZJlnNGuygRHhr9xCDFi8tlIHND4i6fI8wwY6t0dAL6rOY0Jat2iZmQgqz4vEFT/0fa1

可以通過以下方式獲得巨大的哈希值doveadm pw -s SHA512-CRYPT（由於加鹽，每次都會不同）。

相關內容