<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>On 2015-11-26 06:42, Philip Trickett (List) wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --> <!-- head ignored --><!-- meta ignored -->
<div class="moz-cite-prefix">On 25/11/15 17:18, Brady, Mike wrote:</div>
<blockquote id="mid_db58bf03d2048a562998b6fc913cdacd_devnull_net_nz" class=" cite">Phil
<p>I am going need some more details on what you have done.</p>
<p>I am assuming:</p>
<ol>
<li><span style="font-size: 10pt;">Install OS and Kolab</span></li>
<li>Run setup-kolab</li>
<li><span style="font-size: 10pt;">Migrate LDAP Data</span></li>
<li><span style="font-size: 10pt;">Migrate IMAP Data</span></li>
</ol>
<p>If this is what you did, when you migrated the LDAP data did you either exclude everything in ou=Special Users,dc=your,dc=domain or change the passwords in all the configuration files?</p>
<p>Mike</p>
</blockquote>
Hi Mike,<br /> <br /> I pretty much followed those steps, but I cheated slightly ;)<br /> <br /> I did steps 1 & 2, for setup-kolab, I used the configuration passwords from the original server on the new server, to save having to change passwords, then I migrated all the LDAP data from the old server.<br /> <br /> I then migrated the IMAP data, by rsyncing /var/lib/imap and /var/spool/imap from the old server (during this time, cyrus-imapd was shutdown, as well as the directory server etc.) <br /> <br /> Once I had done this, I logged in to roundcube on a couple of the accounts, and checked a few messages etc. which showed up fine with no errors.<br /> <br /> Then I proceeded to follow the guide to secure the installation, and after this, logging in give a mailbox not found.<br /> <br /> However, on looking at logs and firebug, I can only see the successful login to cyrus from roundcube, and no errors are returned, so I am a bit stumped by this.<br /> <br /> There is a bit of a log excerpt below of the login process:<br /> <br /> tail -f /var/log/maillog /var/log/httpd/ssl_access_log /var/log/httpd/ssl_error_log<br /> ==> /var/log/maillog <==<br /> Nov 25 17:29:55 mail imap[3785]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.009205 sys: 0.005508<br /> Nov 25 17:29:55 mail imap[3786]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:29:55 mail imap[3786]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-3786-1448472595-1-1905125910673132224><br /> Nov 25 17:29:55 mail imap[3786]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.009059 sys: 0.006039<br /> Nov 25 17:29:57 mail imap[3783]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:29:57 mail imap[3783]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-3783-1448472597-1-4950283356597843003><br /> Nov 25 17:29:57 mail imap[3785]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:29:57 mail imap[3785]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-3785-1448472597-1-9158458248579971895><br /> Nov 25 17:29:57 mail imap[3783]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.008515 sys: 0.006386<br /> Nov 25 17:29:57 mail imap[3785]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.000567 sys: 0.003450<br /> <br /> ==> /var/log/httpd/ssl_access_log <==<br /> 192.168.156.30 - - [25/Nov/2015:12:52:14 +0000] "GET /roundcubemail/35fe554a98f8ebb6/?_task=mail&_refresh=1&_mbox=INBOX&_remote=1&_unlock=loading1448455935036&_action=list&_=1448455934624 HTTP/1.1" 200 933<br /> 192.168.156.30 - - [25/Nov/2015:12:52:15 +0000] "GET /roundcubemail/assets/program/resources/blank.tif HTTP/1.1" 200 270<br /> 192.168.156.23 - <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> [25/Nov/2015:12:53:15 +0000] "GET /chwala//api/?method=authenticate&version=2 HTTP/1.1" 200 128<br /> 192.168.156.30 - - [25/Nov/2015:12:53:14 +0000] "POST /roundcubemail/35fe554a98f8ebb6/?_task=mail&_action=refresh HTTP/1.1" 200 186<br /> 192.168.156.30 - - [25/Nov/2015:17:29:43 +0000] "GET /roundcubemail/ HTTP/1.1" 200 7124<br /> 192.168.156.30 - - [25/Nov/2015:17:29:54 +0000] "POST /roundcubemail/?_task=login HTTP/1.1" 302 -<br /> 192.168.156.30 - - [25/Nov/2015:17:29:55 +0000] "GET /roundcubemail/63350724609ca0f3/?_task=mail HTTP/1.1" 200 55032<br /> 192.168.156.30 - - [25/Nov/2015:17:29:57 +0000] "GET /roundcubemail/assets/program/resources/blank.tif HTTP/1.1" 200 270<br /> 192.168.156.30 - - [25/Nov/2015:17:29:57 +0000] "GET /roundcubemail/63350724609ca0f3/?_task=mail&_refresh=1&_mbox=INBOX&_remote=1&_unlock=loading1448472597825&_action=list&_=1448472597435 HTTP/1.1" 200 933<br /> 192.168.156.30 - - [25/Nov/2015:17:29:57 +0000] "GET /roundcubemail/63350724609ca0f3/?_task=mail&_remote=1&_unlock=0&_action=getunread&_=1448472597436 HTTP/1.1" 200 75<br /> <br /> ==> /var/log/maillog <==<br /> Nov 25 17:30:57 mail imap[3782]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:30:57 mail imap[3782]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-3782-1448472657-1-14027085326122907929><br /> Nov 25 17:30:57 mail imap[3783]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:30:57 mail imap[3783]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-3783-1448472657-1-7942227074731681134><br /> Nov 25 17:30:57 mail imap[3783]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.002896 sys: 0.001913<br /> <br /> ==> /var/log/httpd/ssl_access_log <==<br /> 192.168.156.23 - <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> [25/Nov/2015:17:30:57 +0000] "GET /chwala//api/?method=authenticate&version=2 HTTP/1.1" 200 128<br /> <br /> ==> /var/log/maillog <==<br /> Nov 25 17:30:58 mail imap[3782]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.009165 sys: 0.006415<br /> <br /> ==> /var/log/httpd/ssl_access_log <==<br /> 192.168.156.30 - - [25/Nov/2015:17:30:57 +0000] "POST /roundcubemail/63350724609ca0f3/?_task=mail&_action=refresh HTTP/1.1" 200 186<br /> 192.168.156.30 - - [25/Nov/2015:17:31:01 +0000] "GET /roundcubemail/63350724609ca0f3/?_task=logout&_token=8cfe772e7b2535db746bbaafb49449ba HTTP/1.1" 200 5936<br /> <br /> ==> /var/log/maillog <==<br /> Nov 25 17:31:13 mail imap[4897]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:31:13 mail imap[4897]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-4897-1448472673-1-655763290223196110><br /> Nov 25 17:31:13 mail imap[4897]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.009506 sys: 0.003168<br /> <br /> ==> /var/log/httpd/ssl_access_log <==<br /> 192.168.156.30 - - [25/Nov/2015:17:31:13 +0000] "POST /roundcubemail/63350724609ca0f3/?_task=login HTTP/1.1" 302 -<br /> <br /> ==> /var/log/maillog <==<br /> Nov 25 17:31:13 mail imap[3783]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:31:13 mail imap[3783]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-3783-1448472673-1-6058572438371252881><br /> Nov 25 17:31:13 mail imap[3783]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.003986 sys: 0.001599<br /> <br /> ==> /var/log/httpd/ssl_access_log <==<br /> 192.168.156.30 - - [25/Nov/2015:17:31:13 +0000] "GET /roundcubemail/1b8c245e42d4ac37/?_task=mail HTTP/1.1" 200 55032<br /> 192.168.156.30 - - [25/Nov/2015:17:31:15 +0000] "GET /roundcubemail/assets/program/resources/blank.tif HTTP/1.1" 200 270<br /> <br /> ==> /var/log/maillog <==<br /> Nov 25 17:31:15 mail imap[4897]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:31:15 mail imap[3785]: starttls: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits new) no authentication<br /> Nov 25 17:31:15 mail imap[4897]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-4897-1448472675-1-12513764351967823944><br /> Nov 25 17:31:15 mail imap[3785]: login: localhost.localdomain [127.0.0.1] <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> PLAIN+TLS User logged in SESSIONID=<mail2-3785-1448472675-1-17553890062648386401><br /> Nov 25 17:31:15 mail imap[3785]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.003053 sys: 0.002034<br /> <br /> ==> /var/log/httpd/ssl_access_log <==<br /> 192.168.156.30 - - [25/Nov/2015:17:31:15 +0000] "GET /roundcubemail/1b8c245e42d4ac37/?_task=mail&_remote=1&_unlock=0&_action=getunread&_=1448472675540 HTTP/1.1" 200 75<br /> <br /> ==> /var/log/maillog <==<br /> Nov 25 17:31:15 mail imap[4897]: USAGE <a class="moz-txt-link-abbreviated" href="mailto:philip.trickett@example.org">philip.trickett@example.org</a> user: 0.003734 sys: 0.002348<br /> <br /> ==> /var/log/httpd/ssl_access_log <==<br /> 192.168.156.30 - - [25/Nov/2015:17:31:15 +0000] "GET /roundcubemail/1b8c245e42d4ac37/?_task=mail&_refresh=1&_mbox=INBOX&_remote=1&_unlock=loading1448472675929&_action=list&_=1448472675539 HTTP/1.1" 200 933<br /> <br /> <br /> </blockquote>
<p>Phil</p>
<p>I am running out of ideas as well.</p>
<p>Have a look in the LDAP logs to see if everything is as expected. </p>
<p>Otherwise start backing out the security changes one at a time.</p>
<p>I have to admit that I haven't followed the security howto exactly. I am ok with stuff that stays inside the box not being encrypted so a I have separate TLS/nonTLS IMAP configurations for IMAP and haven't enabled TLS on LDAP. Makes things faster as well doing this.</p>
<p>Mike</p>
<p> </p>
<div> </div>
</body></html>