Virtdomains: inter-domain admins do not work ---- was Re: Cannotget
loginrealms to work with 2.0.16
Ken Murchison
ken at oceana.com
Mon Oct 7 09:48:05 EDT 2002
Christian Schulte wrote:
>
> Ken Murchison wrote:
>
> >Quoting Christian Schulte <cs at schulte.it>:
> >
> >
> >
> >>>>Your other choice is to skip 2.1 and jump into 2.2
> >>>>available from CVS. Since you're already compiling
> >>>>your cyrus (as opposed to prepackaged binary) and
> >>>>you want virtual domains support (and willing to go
> >>>>to great lengths to get it), I'd suggest getting the 2.2 branch which
> >>>>has native virtual domainsupport
> >>>>built into it.
> >>>>
> >>>>There are a few ppl on the list who have been running
> >>>>the 2.2 branch for a couple weeks now and don't seem
> >>>>to be having any problems with it at all.
> >>>>
> >>>>
> >>Hello again,
> >>
> >>actually I got the cvs branch up and running. I am now running the 2_2
> >>cvs branch successfully on the same machine the 2.0.16 with SASL1 still
> >>runs on!
> >>
> >>
> >
> >FYI, this _might_ break POP3 access on the 2.2 side. It's possible that
> >accessing a mailbox via POP3 on 2.2 then 2.0.16 then 2.2 will not work. I
> >won't get into the technical details, but the mailbox format was tweaked in
> >2.1.something to fix a potential POP3 UIDL problem, and downgrading wasn't
> >considered (by me) and isn't handled gracefully.
> >
> >
> > Cyrus 2_2 got its own alias interface and the machine has two
> >
> >
> >>IPs now. I just had to tweak one option in the masterconf.c source to
> >>make the cyrus-2_2 master reading another cyrus.conf file than
> >>/etc/cyrus.conf. The 2.0.16 master reads /etc/cyrus.conf as usual and
> >> the 2.2 master now reads /etc/cyrus.conf.v2 . Every other configuration
> >>necessary for such setup could be specified in the cyrus.conf files. The
> >>old cyrus.conf file read by 2.0.16 for binding to the primary IP and
> >>starting the old binaries and the second cyrus.conf.v2 file for the 2.2
> >>master to bind to the secondary IP and to start the new binaries with
> >>theire own configuration files specified by the -C option. That all
> >>worked great and was much easier than I expected it to be! If I now
> >>would not have forgotten to specify another path to the sieve scripts
> >>for 2.2 than for 2.0.16, I would not have lost all my scripts. mkimap
> >>created a new /usr/sieve structure and delted the already existent one.
> >>But that was something I simply forgot about. For the new 2.2 I have the
> >>following imapd.conf file:
> >>
> >>configdirectory: /var/imap
> >>partition-default: /var/spool/imap
> >>admins: admin at somedomain.com
> >>servername: mailserver.somedomain.com
> >>localdomain: somedomain.com
> >>sasl_pwcheck_method: auxprop
> >>sasl_auxprop_plugin: sasldb
> >>sasl_allowanonymouslogin: no
> >>sasl_allowplaintext: yes
> >>tls_cert_file: /usr/local/var/imap/server.pem
> >>tls_key_file: /usr/local/var/imap/server.pem
> >>tls_ca_file: /usr/local/var/imap/CAcert.pem
> >>idlesocket: /usr/local/var/imap/socket/idle
> >>loginrealms: realm1.com realm2.net
> >>unixhierarchysep: yes
> >>virtdomains: yes
> >>altnamespace: no
> >>
> >>If creating a user with simply saslpasswd2 -c admin in the local realm I
> >>get the following situation:
> >>
> >>admin at somedomain.com: userPassword
> >>
> >>If logging in with "admin" I get the administration options but cannot
> >>create mailboxes in another domain than somedomain.com (Invalid mailbox
> >>name) and I cannot see any other mailboxes than in somedomain.com thus
> >>domain administration seems to work.
> >>If logging in with "admin at somedomain.com" I do not get any
> >>administration options and only see the admin inbox which I created for
> >>testing. I cannot get the difference here!
> >>The DNS reverselookup to the IP resolves correctly to
> >>mailserver.somedomain.com and /etc/nodename also says somedomain.com.
> >>domain-administration seems to work if logging in without an
> >>@localrealm, but inter-domain administration completely does not work
> >>for me.
> >>
> >>Changing the admins: line to
> >>
> >>admins: admin
> >>
> >>
> >>If now logging in with "admin" I get administration options but cannot
> >>see any user mailbox and again can only see the admin inbox. If I try to
> >>create a mailbox like user/test I get permission denied. If I create a
> >>mailbox like user/test at otherdomain.com I get Invalid mailbox name.
> >>If logging in with "admin at somedomain.com" I do not get any
> >>administration options and again only see the admin inbox. So
> >>inter-domain administrators do not work!
> >>What am I doing wrong ? Any hints would be helpful!
> >>
> >>
> >
> >Read the administrators section of doc/install-virtdomains.html closely. Set
> >
> >defaultdomain: admin at somedomin.com
> >
> >
> >
> Ok! I read that thausend times but I cannot get any more hints in that.
>
> cyrus.conf:
>
> # standard standalone server implementation
>
> START {
> # do not delete this entry!
> recover cmd="/usr/local/cyrus2-cvs/bin/ctl_cyrusdb -C
> /etc/imapd.conf.v2 -r"
>
> # this is only necessary if using idled for IMAP IDLE
> idled cmd="/usr/local/cyrus2-cvs/bin/idled -C /etc/imapd.conf.v2"
> }
>
> # UNIX sockets start with a slash and are put into /var/imap/socket
> SERVICES {
> # add or remove based on preferences
> imap cmd="/usr/local/cyrus2-cvs/bin/imapd -C
> /etc/imapd.conf.v2" listen="[212.123.33.68]:imap" prefork=0
> imaps cmd="/usr/local/cyrus2-cvs/bin/imapd -C
> /etc/imapd.conf.v2 -s" listen="[212.123.33.68]:imaps" prefork=0
> pop3 cmd="/usr/local/cyrus2-cvs/bin/pop3d -C
> /etc/imapd.conf.v2" listen="[212.123.33.68]:pop3" prefork=0
> pop3s cmd="/usr/local/cyrus2-cvs/bin/pop3d -C
> /etc/imapd.conf.v2 -s" listen="[212.123.33.68]:pop3s" prefork=0
> sieve cmd="/usr/local/cyrus2-cvs/bin/timsieved -C
> /etc/imapd.conf.v2" listen="[212.123.33.68]:sieve" prefork=0
>
> # at least one LMTP is required for delivery
> # lmtp cmd="lmtpd" listen="lmtp" prefork=0
> lmtpunix cmd="lmtpd" listen="/var/imap/socket/lmtp" prefork=0
>
> # this is only necessary if using notifications
> # notify cmd="notifyd" listen="/var/imap/socket/notify"
> proto="udp" prefork=1
> }
>
> EVENTS {
> # this is required
> checkpoint cmd="/usr/local/cyrus2-cvs/bin/ctl_cyrusdb -C
> /etc/imapd.conf.v2 -c" period=30
>
> # this is only necessary if using duplicate delivery suppression
> delprune cmd="/usr/local/cyrus2-cvs/bin/ctl_deliver -C
> /etc/imapd.conf.v2 -E 3" period=1440
>
> # this is only necessary if caching TLS sessions
> tlsprune cmd="/usr/local/cyrus2-cvs/bin/tls_prune -C
> /etc/imapd.conf.v2" period=1440
> }
>
> imapd.conf.v2:
>
> configdirectory: /var/imap
> partition-default: /var/spool/imap
> servername: imap.rent-a-mailserver.de
> defaultdomain: rent-a-mailserver.de
> admins: schulte
> sasl_pwcheck_method: auxprop
> sasl_auxprop_plugin: sasldb
> sasl_allowanonymouslogin: no
> sasl_allowplaintext: yes
> #sasl_mysql_use: smtp
> #sasl_mysql_passwd: smtp
> #sasl_mysql_hostnames: inforeg.epag.net
> #sasl_mysql_database: jboss
> #sasl_mysql_statement: select password from SASLUser where login='%u'
> and domain='%r'
> #sasl_mysql_verbose: yes
> tls_cert_file: /usr/local/var/imap/server.pem
> tls_key_file: /usr/local/var/imap/server.pem
> tls_ca_file: /usr/local/var/imap/CAcert.pem
> idlesocket: /usr/local/var/imap/socket/idle
> unixhierarchysep: yes
> virtdomains: yes
> altnamespace: no
>
> root-10:30:43:/ >dig -x 212.123.33.68
>
> ; <<>> DiG 9.2.0 <<>> -x 212.123.33.68
> ;; global options: printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15539
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
>
> ;; QUESTION SECTION:
> ;68.33.123.212.in-addr.arpa. IN PTR
>
> ;; ANSWER SECTION:
> 68.33.123.212.in-addr.arpa. 172800 IN PTR imap.rent-a-mailserver.de.
>
> ;; AUTHORITY SECTION:
> 33.123.212.in-addr.arpa. 172800 IN NS dns1.epag.net.
> 33.123.212.in-addr.arpa. 172800 IN NS dns2.epag.net.
>
> ;; ADDITIONAL SECTION:
> dns2.epag.net. 84561 IN A 212.123.32.78
>
> ;; Query time: 6 msec
> ;; SERVER: 212.123.33.69#53(212.123.33.69)
> ;; WHEN: Mon Oct 7 10:30:48 2002
> ;; MSG SIZE rcvd: 145
>
> root-10:30:48:/ >/usr/local/cyrus2-cvs/perl5/5.00503/bin/cyradm --auth
> login --user schulte 212.123.33.68
> IMAP Password:
>
> Login failed: user not found at
> /usr/perl5/site_perl/5.005/i86pc-solaris/Cyrus/IMAP/Admin.pm line 114
> cyradm: cannot authenticate to server with login as schulte
>
> root-10:32:14:/ >/usr/local/cyrus2-cvs/perl5/5.00503/bin/cyradm --auth
> login --user schulte at rent-a-mailserver.de 212.123.33.68
> IMAP Password:
>
> Login failed: user not found at
> /usr/perl5/site_perl/5.005/i86pc-solaris/Cyrus/IMAP/Admin.pm line 114
> cyradm: cannot authenticate to server with login as
> schulte at rent-a-mailserver.de
>
> Oct 7 10:32:44 mail imap[10762]: [ID 921384 local6.debug] accepted
> connection
> Oct 7 10:32:47 mail imap[10762]: [ID 914338 local6.notice] badlogin:
> imap.rent-a-mailserver.de[212.123.33.68] plaintext schulte SASL(-13):
> user not found: checkpass failed
>
> root-10:34:46:/ >sasldblistusers2
> schulte at rent-a-mailserver.de: userPassword
>
> Creating a user with saslpasswd2 without specifying a domain would
> create a user with realm mail and not rent-a-mailserver.de !
This is most likely your problem. Make sure that your hostname is fully
qualified, so that saslpasswd2 creates secrets with
mail.rent-a-mailserver.de as the realm, or just leave it alone and let
it use 'mail' as the realm. In either case, Cyrus/SASL should do the
"right thing".
> If I now remove the defaultdomain: line from imapd.conf.v2 the behaviour
> changes to:
This is a waste of time. You can NOT have a global (inter-domain admin)
without specifying defaultdomain. It specifically says this in the
documentation.
> root-10:37:03:/ >/usr/local/cyrus2-cvs/perl5/5.00503/bin/cyradm --auth
> login --user schulte 212.123.33.68
> IMAP Password:
>
> 212.123.33.68> lm
> INBOX (\HasNoChildren)
> 212.123.33.68> cm user/test
> createmailbox: Permission denied
> 212.123.33.68> cm test
> createmailbox: Permission denied
> 212.123.33.68> cm user/test at otherdomain.com
> createmailbox: Invalid mailbox name
> 212.123.33.68> lm *
> INBOX (\HasNoChildren)
> 212.123.33.68>
>
> I can login in now with the same user!
>
> root-10:38:09:/ >/usr/local/cyrus2-cvs/perl5/5.00503/bin/cyradm --auth
> login --user schulte at rent-a-mailserver.de 212.123.33.68
> IMAP Password:
>
> 212.123.33.68> lm
> INBOX (\HasNoChildren)
> 212.123.33.68> cm user/test
> createmailbox: Permission denied
> 212.123.33.68> cm test
> createmailbox: Permission denied
> 212.123.33.68> cm user/test at otherdomain.com
> createmailbox: Invalid mailbox name
> 212.123.33.68> lm *
> INBOX (\HasNoChildren)
> 212.123.33.68>
>
> Changing the admins: line now to be:
> admins: schulte at rent-a-mailserver.de
> root-10:39:47:/ >/usr/local/cyrus2-cvs/perl5/5.00503/bin/cyradm --auth
> login --user schulte at rent-a-mailserver.de 212.123.33.68
> IMAP Password:
>
> 212.123.33.68> lm
> INBOX (\HasNoChildren) user/c.schulte/Trash
> (\HasNoChildren)
> user/c.schulte (\HasChildren)
> 212.123.33.68> cm user/test
> 212.123.33.68> cm user/test at otherdomain.com
> createmailbox: Invalid mailbox name
> 212.123.33.68>
>
> I can create mailboxes in the specified domain! I can administer the domain!
>
> Adding the defaultdomain: line again but now with:
>
> defaultdomain: schulte at rent-a-mailserver.de
>
> root-10:40:56:/ >/usr/local/cyrus2-cvs/perl5/5.00503/bin/cyradm --auth
> login --user schulte at rent-a-mailserver.de 212.123.33.68
> IMAP Password:
>
> 212.123.33.68> lm
> INBOX (\HasNoChildren) user/c.schulte/Trash
> (\HasNoChildren)
> user/c.schulte (\HasChildren) user/test
> (\HasNoChildren)
> 212.123.33.68> cm user/test2
> Works!
> 212.123.33.68> cm user/test2 at otherdomain.com
> createmailbox: Invalid mailbox name
> 212.123.33.68> quit
>
> Behavior has not changed !
>
> Changing the admins line back to:
>
> admins: schulte
>
> root-10:42:43:/ >/usr/local/cyrus2-cvs/perl5/5.00503/bin/cyradm --auth
> login --user schulte at rent-a-mailserver.de 212.123.33.68
> IMAP Password:
>
> 212.123.33.68> lm
> INBOX (\HasNoChildren)
> 212.123.33.68> cm user/test3
> createmailbox: Permission denied
> 212.123.33.68> cm user/test4 at otherdomain.com
> createmailbox: Invalid mailbox name
> 212.123.33.68> quit
>
> root-10:43:19:/ >/usr/local/cyrus2-cvs/perl5/5.00503/bin/cyradm --auth
> login --user schulte 212.123.33.68
> IMAP Password:
>
> 212.123.33.68> lm
> INBOX (\HasNoChildren)
> 212.123.33.68> cm user/test3
> createmailbox: Permission denied
> 212.123.33.68> cm user/test3 at otherdomain.com
> createmailbox: Invalid mailbox name
> 212.123.33.68> quit
>
> I cannot get that to work nor can I understand what is going wrong here
> ! Thanks for your help!
>
> ---Christian---
--
Kenneth Murchison Oceana Matrix Ltd.
Software Engineer 21 Princeton Place
716-662-8973 x26 Orchard Park, NY 14127
--PGP Public Key-- http://www.oceana.com/~ken/ksm.pgp
More information about the Info-cyrus
mailing list