Re: [gentoo-user] IMAP Server - authenticating off a Windows Domain?

[Hans-Werner Hilse]

Hi,

> That's the problem I'm getting at the moment - the user authenticates
> ok (using Samba's winbind & PAM) but the IMAP server exits because it
> can't "chdir" into the user's home directory (which doesn't exist). I'm
> told I can use `pam_mkhomedir` to solve this, but I'm beginning to
> wonder if I've gone up the wrong path with winbind.

Hm, why not just use a IMAP server that doesn't depend on existing Unix
accounts for its users? Cyrus comes to my mind...

-hwh

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] IMAP Server - authenticating off a Windows Domain?

[Stroller]

On Dec 13, 2005, at 8:36 am, Jose Gonzalez Gomez wrote:


Finally, we need to add users to both the Linux server and the
Windows domain.  Here lies an obvious deficiency with this
solution.  We have provided an enterprise-scalable authentication
mechanism but not an enterprise-scalable account-management
mechanism.

Is this really the case, please? I had just decided that PAM was the
way to go for me until I read this.


 I've never done this, but theoretically you could authenticate 
against a PDC using Kerberos and then use that Kerberos ticket to 
connect to any machine in your network using SSH (SSH has builtin 
support for SSO using Kerberos). I've successfully configured SSO in 
this way, but authentication was done against an OpenLDAP/Heimdal 
server. But weren't we talking about IMAP servers?


We are - using PAM the authentication mechanism can be applied to any 
service, but of course the IMAP server needs somewhere to store users' 
mailboxes.


That's the problem I'm getting at the moment - the user authenticates 
ok (using Samba's winbind & PAM) but the IMAP server exits because it 
can't "chdir" into the user's home directory (which doesn't exist). I'm 
told I can use `pam_mkhomedir` to solve this, but I'm beginning to 
wonder if I've gone up the wrong path with winbind.


Winbind _is_ authenticating beautifully for me, and wasn't too hard to 
setup, so I'm curious how other authentication mechanisms (Mr Busleiman 
suggested several) handle this.


Stroller.


--
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] IMAP Server - authenticating off a Windows Domain?

[Jose Gonzalez Gomez]

2005/12/10, Stroller <[EMAIL PROTECTED]>:
On Dec 5, 2005, at 2:34 pm, Arturo 'Buanzo' Busleiman wrote:>> Stroller wrote:>> to authenticate against the domain controller everytime the user logs>> on>> to their email?
>> You have many approaches, each of them with specific complications:>> ...> 3) PAM_LDAP and use courier with authpam: May probe useful. It> certainly did a couple of years ago for me.
 From  I'm readingthat:Finally, we need to add users to both the Linux server and the
Windows domain.  Here lies an obvious deficiency with thissolution.  We have provided an enterprise-scalable authenticationmechanism but not an enterprise-scalable account-managementmechanism.
Is this really the case, please? I had just decided that PAM was theway to go for me until I read this.
I've never done this, but theoretically you could authenticate against
a PDC using Kerberos and then use that Kerberos ticket to connect to
any machine in your network using SSH (SSH has builtin support for SSO
using Kerberos). I've successfully configured SSO in this way, but
authentication was done against an OpenLDAP/Heimdal server. But weren't
we talking about IMAP servers?

Best regards
Jose

Re: [gentoo-user] IMAP Server - authenticating off a Windows Domain?

[Stroller]

On Dec 5, 2005, at 2:34 pm, Arturo 'Buanzo' Busleiman wrote:


Stroller wrote:
to authenticate against the domain controller everytime the user logs 
on

to their email?


You have many approaches, each of them with specific complications:

...
3) PAM_LDAP and use courier with authpam: May probe useful. It 
certainly did a couple of years ago for me.


From  I'm reading 
that:


   Finally, we need to add users to both the Linux server and the
   Windows domain.  Here lies an obvious deficiency with this
   solution.  We have provided an enterprise-scalable authentication
   mechanism but not an enterprise-scalable account-management
   mechanism.

Is this really the case, please? I had just decided that PAM was the 
way to go for me until I read this.


Stroller

--
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] IMAP Server - authenticating off a Windows Domain?

[Arturo 'Buanzo' Busleiman]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Stroller wrote:
> to authenticate against the domain controller everytime the user logs on
> to their email?

You have many approaches, each of them with specific complications:

1) Samba+Winbind+PAM = You really want samba on a mail server?
2) Kerberos = I can't talk much about this one :) - Not enough experience.
3) PAM_LDAP and use courier with authpam: May probe useful. It certainly did a 
couple of years ago
for me.
4) courier's authldap module - like (3), but with one layer less. never tried 
it.

- --
Arturo "Buanzo" Busleiman - www.buanzo.com.ar
Consultor en Seguridad Informatica / Dominio Digital TV - Da FOSS man!
KTP Consultores - info AT ktpconsultores.com.ar

Romper un sistema de seguridad los acerca tanto a ser hackers como el
encender autos puenteando los convierte en ingenieros automotrices.
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDlFAGAlpOsGhXcE0RAshTAJ0U8yd8dMASwHwp0FnlKv2rDMLwaQCdFEaq
QV+cUttgowE9q1C99bCH7EA=
=LMpT
-END PGP SIGNATURE-
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] IMAP Server - authenticating off a Windows Domain?

[Sean Johnson]

On 12/5/05, Stroller <[EMAIL PROTECTED]> wrote:
> Hi there,
>
> Does anyone have any experience of this, please? I have a number of
> users with roaming profiles on a Windows Domain Controller (SBS 2003).
> I don't want to use Exchange as a mailserver but instead an IMAP sever
> such as Courier (which I'm familiar with).
>
> Each user will have to change their password on the domain every couple
> of weeks and because I want to provide webmail access to their IMAP
> accounts it's desirable that their IMAP username & password be the same
> as their Windows one. I don't mind adding users by hand on the
> Linux-based IMAP server but I would prefer that passwords be changed
> automatically - I guess the best way to do this is for the IMAP server
> to authenticate against the domain controller everytime the user logs
> on to their email?
>
> Has anyone any experience of this, please?
>

You might be able to use samba & winbind for this, and modify the imap
pam config to use system-auth-winbind. I haven't actually tried this,
but it might be something worth playing with.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] IMAP Server - authenticating off a Windows Domain?

[Jose Gonzalez Gomez]

2005/12/5, Stroller <[EMAIL PROTECTED]>:
Hi there,Does anyone have any experience of this, please? I have a number ofusers with roaming profiles on a Windows Domain Controller (SBS 2003).I don't want to use Exchange as a mailserver but instead an IMAP sever
such as Courier (which I'm familiar with).Each user will have to change their password on the domain every coupleof weeks and because I want to provide webmail access to their IMAPaccounts it's desirable that their IMAP username & password be the same
as their Windows one. I don't mind adding users by hand on theLinux-based IMAP server but I would prefer that passwords be changedautomatically - I guess the best way to do this is for the IMAP serverto authenticate against the domain controller everytime the user logs
on to their email?Has anyone any experience of this, please?
You should either go the Kerneros way for single sign on (I think SBS
2003 uses it), or use an IMAP server that is capable of handling user
authentication against LDAP (if using Active Directory).

HTH, best regards
Jose

[gentoo-user] IMAP Server - authenticating off a Windows Domain?

[Stroller]

Hi there,

Does anyone have any experience of this, please? I have a number of 
users with roaming profiles on a Windows Domain Controller (SBS 2003). 
I don't want to use Exchange as a mailserver but instead an IMAP sever 
such as Courier (which I'm familiar with).


Each user will have to change their password on the domain every couple 
of weeks and because I want to provide webmail access to their IMAP 
accounts it's desirable that their IMAP username & password be the same 
as their Windows one. I don't mind adding users by hand on the 
Linux-based IMAP server but I would prefer that passwords be changed 
automatically - I guess the best way to do this is for the IMAP server 
to authenticate against the domain controller everytime the user logs 
on to their email?


Has anyone any experience of this, please?

TIA for any advice,

Stroller.

--
gentoo-user@gentoo.org mailing list