1

So I'm setting up a mailserver here - Courier & Postfix on Debian 7.8, authenticating against MySQL. Got it mostly set up - I can send mail, and the address is also receiving mail properly, with postfix putting it in the correct Maildir, everything is authenticating with sasl/pam correctly, etc.

However, I couldn't actually connect to IMAP through Thunderbird (it says that it can't validate the login details), and the logs weren't showing anything other than the actual connection attempt - there were no errors listed whatsoever (courier debug logging was enabled for this). The mailog showed only:

Jan 14 17:17:21 server imapd: Connection, ip=[::ffff:x.x.x.x]

So I went to testing it manually (telnet domain.tld 143) remotely, I get the following output:

* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS XMAGICTRASH] Courier-IMAP ready. Copyright 1998-2011 Double Precision, Inc.  See COPYING for distribution information.
1 LOGIN test@test.tld testpass
NO Error in IMAP command received by server.

The thing is though, when I test it locally on the server itself, it works fine!

me@server:/# telnet localhost 143
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS XMAGICTRASH] Courier-IMAP ready. Copyright 1998-2011 Double Precision, Inc.  See COPYING for distribution information.
1 LOGIN test@test.tld testpass
1 OK LOGIN Ok.

Searching for the NO Error in IMAP only pointed to cases where the command hadn't been prefixed by a number, which I've already done here - besides, it works properly on localhost. Also, searching for cases where it worked locally but not remotely only led to issues in connectivity, which isn't the case here either. I'm kinda stumped!

Draesk
  • 13
  • 2
  • 6
  • So, it appears to be an issue with imapd-ssl, as when I force Thunderbird to connect without STARTTLS or SSL, it actually connects! Unfortunately, given that there are no pertinent logs, I don't know *where* SSL is failing. – Draesk Jan 14 '17 at 16:38
  • Got it! It was Thunderbird's error console that gave it up! "SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message." Regenerated it with DH_BITS=2048 and we're good! – Draesk Jan 14 '17 at 16:58

0 Answers0