postfix+dovecot: smtp - pop3 authentication isssue
Hi Luvers, Here is scenario (not for me by the way, but someone else) Using laptop with Outlook/Win 7 for client. Mail server is Linux Ubuntu 10.10 (due for upgrade to 14.04 soon) - using Postfix+Dovecot. 1. Able to authenticate to server for smtp and pop using wifi at home and using 3G anywhere. 2. Unable to authenticate in workplace office (talking office building not Office software!!)- keeps asking for username and password when using mail.example.com.au in settings for outlook. (substitute for real domain name of course) 3. Able to authenticate as above if using ip number instead, which makes sense, since in office wifi and mail server on same subnet (192.168.1.X) Why would authentication not work using domain name instead of IP in workplace? This suddenly started about 1 week ago, and has been working fine for months before. Any idea? (I need a clear thinking mind here! Mine is clogged up with all sorts of possibilities... including NSA conspiracy!!) (Before I can tell the user his Outlook/Win 7 is screwed up, I want to eliminate other possibilities. The only thing he says has change is an antivirus software update) Cheers Daniel
On 15/05/14 10:57, Daniel Jitnah wrote:
Hi Luvers,
Here is scenario (not for me by the way, but someone else)
Using laptop with Outlook/Win 7 for client. Mail server is Linux Ubuntu 10.10 (due for upgrade to 14.04 soon) - using Postfix+Dovecot.
1. Able to authenticate to server for smtp and pop using wifi at home and using 3G anywhere.
2. Unable to authenticate in workplace office (talking office building not Office software!!)- keeps asking for username and password when using mail.example.com.au in settings for outlook. (substitute for real domain name of course)
3. Able to authenticate as above if using ip number instead, which makes sense, since in office wifi and mail server on same subnet (192.168.1.X)
Hi Daniel I suggest this is not an issue with the server but with the client. My suggestion would be to ping the mail server using the domain name and see if it resolves. It might also be a good idea to run ipconfig /flushdns Cheers Nic
On Thu, 15 May 2014 11:57:02 Nic Baxter wrote:
3. Able to authenticate as above if using ip number instead, which makes sense, since in office wifi and mail server on same subnet (192.168.1.X)
Hi Daniel I suggest this is not an issue with the server but with the client. My suggestion would be to ping the mail server using the domain name and see if it resolves. It might also be a good idea to run ipconfig /flushdns
It sounds like the DNS has the external IP address and the routers aren't setup to allow connections to the external address from inside the organisation. The best thing to do is to configure NAT on a router to redirect the external IP to the internal IP. It will be tempting to have separate internal and external views in the DNS, but don't do that, it causes lots of pain in the long term. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/
On 15/05/2014 1:00 PM, Russell Coker wrote:
On Thu, 15 May 2014 11:57:02 Nic Baxter wrote:
3. Able to authenticate as above if using ip number instead, which makes sense, since in office wifi and mail server on same subnet (192.168.1.X)
Hi Daniel I suggest this is not an issue with the server but with the client. My suggestion would be to ping the mail server using the domain name and see if it resolves. It might also be a good idea to run ipconfig /flushdns
It sounds like the DNS has the external IP address and the routers aren't setup to allow connections to the external address from inside the organisation.
Using the Windows machine, see what returns for the MX lookup, check the A record. Try pinging the A record. If you are using port 25, it might be hijacked or blocked. I use SSL connections and go with IMAP on ports 465 for SMTPS and 993 for IMAPS. So long as the office firewall and the ISP is not blocking ports, you should be fine. Given that this is a recent issue, perhaps a change in firewall or ISP is the difference.
The best thing to do is to configure NAT on a router to redirect the external IP to the internal IP. It will be tempting to have separate internal and external views in the DNS, but don't do that, it causes lots of pain in the long term.
If you want a public mail server and it doesn't /own/ it's public IP address, then, yes you will need Nat and port forwarding. I don't think having internal/external DNS views should be an issue.... Cheers A.
Russell Coker <russell@coker.com.au> writes:
On Thu, 15 May 2014 11:57:02 Nic Baxter wrote:
3. Able to authenticate as above if using ip number instead, which makes sense, since in office wifi and mail server on same subnet (192.168.1.X)
Hi Daniel I suggest this is not an issue with the server but with the client. My suggestion would be to ping the mail server using the domain name and see if it resolves. It might also be a good idea to run ipconfig /flushdns
It sounds like the DNS has the external IP address and the routers aren't setup to allow connections to the external address from inside the organisation.
The best thing to do is to configure NAT on a router to redirect the external IP to the internal IP. It will be tempting to have separate internal and external views in the DNS, but don't do that, it causes lots of pain in the long term.
Or split-horizon DNS. (It's not nice, but IMO NAT is worse.)
Trent W. Buck <trentbuck@gmail.com> wrote:
Russell Coker <russell@coker.com.au> writes:
It sounds like the DNS has the external IP address and the routers aren't setup to allow connections to the external address from inside the organisation.
The best thing to do is to configure NAT on a router to redirect the external IP to the internal IP. It will be tempting to have separate internal and external views in the DNS, but don't do that, it causes lots of pain in the long term.
Or split-horizon DNS.
(It's not nice, but IMO NAT is worse.)
Judging by the addresses given earlier in the thread, unfortunately NAT is already involved in the scenario.
This is a tale of many things and of many errors. (original post is below) I am cc'ing this to luv-talk, as it is not a Linux issue. Please respond on luv-talk if you wish to. It appears that at some stage in the last few months, the original domain registrar and dns hosting of this user was taken over by another [bigger] registrar (if you know anything about this having happened lately, you may know who is involved). In this process though it seems that the dns record of the email server was changed, unknown to the user (at least the user has no record of this). While the MX still pointed to the users own server (physically located in their office), the outgoing smtp server was redirected to the hosting provider's own smtp server, rather than the original clients email server as an A record. (mail.example.com.au) For some reason also, the hosting provider blocked external IP of the user's office a few days ago, causing smtp to stop. (apparently because they detected unusual activity coming from that IP) So while the client was able to access smtp services outside the office, they could not do so from inside inside, but when using the ip of the internal server they could access smtp (but a different server). My question is, does any one know if its a known practice for a dns hosting provider to change a record to a smtp server to point to their own, and that without informing the user? (it is still possible that the user was informed but did not make a record of this). Contacting the dns hosting provider, they only said everything is fine on their side, and could give no more info. BTW: this changed was discovered when I noted that in email coming from outside the header showed that it was processed by an Exim smtp server, where as the users one is actually a Postfix one. Cheers Daniel. On 15/05/14 10:57, Daniel Jitnah wrote:
Hi Luvers,
Here is scenario (not for me by the way, but someone else)
Using laptop with Outlook/Win 7 for client. Mail server is Linux Ubuntu 10.10 (due for upgrade to 14.04 soon) - using Postfix+Dovecot.
1. Able to authenticate to server for smtp and pop using wifi at home and using 3G anywhere.
2. Unable to authenticate in workplace office (talking office building not Office software!!)- keeps asking for username and password when using mail.example.com.au in settings for outlook. (substitute for real domain name of course)
3. Able to authenticate as above if using ip number instead, which makes sense, since in office wifi and mail server on same subnet (192.168.1.X)
Why would authentication not work using domain name instead of IP in workplace? This suddenly started about 1 week ago, and has been working fine for months before. Any idea? (I need a clear thinking mind here! Mine is clogged up with all sorts of possibilities... including NSA conspiracy!!)
(Before I can tell the user his Outlook/Win 7 is screwed up, I want to eliminate other possibilities. The only thing he says has change is an antivirus software update)
Cheers Daniel _______________________________________________ luv-main mailing list luv-main@luv.asn.au http://lists.luv.asn.au/listinfo/luv-main
participants (6)
-
Andrew McGlashan -
Daniel Jitnah -
Jason White -
Nic Baxter -
Russell Coker -
trentbuck＠gmail.com