Dovecot pigeonhole sieve proxy with ldap

Question

for an upcoming IMAP migration, I need to proxy my users. I plan to use Nginx for proxying IMAP and POPS traffic and directing them according to a LDAP attribute (mailHost) But Nginx can't proxy SIEVE.

Dovecot PigeonHole seems to be able to proxy SIEVE protocol. I try to configure it to avoid LDAP authentication because there's already an authentication on IMAP stores. That doesn't work for now. Here's my conf following this doc:

Pasword DB extra fields

Dovecot proxies

/etc/dovecot/dovecot.conf:

protocols sieve
!include conf.d/*.conf

/etc/dovecot/conf.d/90-sieve.conf

plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve

/etc/dovecot/conf.d/10-auth.conf

auth_mechanisms = plain login
!include auth-ldap.conf.ext

/etc/dovecot/conf.d/auth-ldap.conf

passdb {
  driver = ldap
  args = /etc/dovecot/dovecot-ldap.conf.ext
}
userdb {
  driver = ldap
  args = /etc/dovecot/dovecot-ldap.conf.ext
}

/etc/dovecot/dovecot-ldap.conf.ext

hosts = xxx.xxx.xxx.xxx
ldap_version = 3
base = ou=myOU, dc=domain, dc=example
pass_attrs = \
  =user=%{ldap:user}, \
  =password=, \
  =proxy=y, \
  =host=%{ldap:mailHost}

And here's the error in the log when I try to modify a sieve script using Horde Webmail:

dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, session=

I surely missed a setting somewhere. For now, I haven't found yet.

Any help will be greatly appreciated Thanks

Is ma Live Is ma Live · Accepted Answer · 2019-10-18T10:05:22

OK, I've found the problem

To proxy password to IMAP backends: /etc/dovecot/dovecot-ldap.conf.ext:

hosts = xxx.xxx.xxx.xxx
ldap_version = 3
base = ou=myOU, dc=domain, dc=example
pass_attrs = \
  =user=%{ldap:user}, \
  =password=, \
  =proxy=y, \
  =nopassword=y, \
  =host=%{ldap:mailHost}
  =port=2000

The doc says:

If you don’t want proxy itself to do authentication, you can configure it to succeed with any given password. You can do this by returning an empty password and nopassword field.

And port 2000 is needed because the IMAP backend still in production is running an old version of timsieved (cyrus sieve implementation)

Then, the backends are waiting for PLAIN authentication. That's disabled by default in Dovecot, so activate it with: /etc/dovecot/conf.d/10-auth.conf:

disable_plaintext_auth = no
auth_mechanisms = plain login
!include auth-ldap.conf.ext

This degrades the security, so I will limit access to port 2000 to the dovecot pigeon-hole proxy.

Dovecot pigeonhole sieve proxy with ldap

1 Answers