OpenForum RSS: Dovecot + AD + SASL

Dovecot + AD + SASL (tux2002)

Wed, 30 Jun 2010 10:10:10 GMT

�� ݣ ��
http://www.ccs.neu.edu/home/battista/articles/winbind/nsswitch.html

Dovecot + AD + SASL (tux2002)

Wed, 30 Jun 2010 10:09:28 GMT

>�� - �� - �� - ��.
>

� �� winbind
��
http://www.ccs.neu.edu/home/battista/articles/winbind/winbind.html
http://www.ccs.neu.edu/home/battista/articles/winbind/domain.html
http://www.ccs.neu.edu/home/battista/articles/winbind/pam.html
� ��
cat /etc/pam.d/imap:
auth sufficient pam_winbind.so
auth required pam_unix.so nullok_secure use_first_pass
account sufficient pam_winbind.so
account required pam_unix.so
session required pam_unix.so
session required pam_winbind.so
session required pam_mkhomedir.so umask=0066 skel=/etc/skel

cat /etc/pam.d/pop3:
auth sufficient pam_winbind.so
auth required pam_unix.so nullok_secure use_first_pass
account sufficient pam_winbind.so
account required pam_unix.so
session required pam_unix.so
session required pam_winbind.so
session required pam_mkhomedir.so umask=0066 skel=/etc/skel

cat /etc/dovecot.conf:
.............
auth default {
mechanisms = plain login

pass

Dovecot + AD + SASL (KobaLTD.)

Wed, 30 Jun 2010 09:48:46 GMT

>��, �� , �� , ��
>SSL. � � �� dovecot
>�� pam_krb5 �� pam_winbind. Pam_winbind �� , pam_krb5 �� ,
>��, �� linux ��
>�� imap\hostname@DOMAIN, pop\hostname@DOMAIN (�� )

�� :( �� binding �� - �.�. dovecot �� , - �� SASL �� - �� - �� :(, �� bind � �� - ��

.....
Jun 29 15:34:55 mail dovecot: auth(default): ldap(test,192.168.0.60): no fields returned by the server
Jun 29 15:34:55 mail dovecot: auth(default): ldap(test,192.168.0.60): No password returned (and no nopassw

Dovecot + AD + SASL (tux2002)

Wed, 30 Jun 2010 09:39:33 GMT

��, �� , �� , �� SSL. � � �� dovecot �� pam_krb5 �� pam_winbind. Pam_winbind �� , pam_krb5 �� , ��, �� linux �� imap\hostname@DOMAIN, pop\hostname@DOMAIN (�� )

Dovecot + AD + SASL (tux2002)

Wed, 30 Jun 2010 09:34:12 GMT

http://www.ultimatewindowssecurity.com/wiki/WindowsSecuritySettings/Domain-Controller-LDAP-server-signing-requirements

Requiring LDAP data-signing can break many LDAP clients although Windows servers and workstations should support it without problem. If you use any non-Windows LDAP clients such as AD integrated Mac systems or Linux systems or other applications that communicate with AD via LDAP be very careful about requiring data signing. Research and test. Some clients support it. For LDAP clients that don’t support signing you may consider LDAP over SSL. See ??? for more details.