1

Topic: Changing users password in roundcube leeds to Authentication failed

======== Required information ====
- iRedMail version: 0.9.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Web server (Apache or Nginx): Apache
- Linux/BSD distribution name and version: Debian Wheezy
- Related log if you're reporting an issue: dovecot.log & mail.log - debug turned on in roundcube and dovecot
====

Hello,

when a user changes his password in roundcube and logs in again, the authentication fails.

May 22 09:01:25 mail roundcube: [3] SELECT * FROM users WHERE mail_host = '127.0.0.1' AND username = 'demo@example.org';
May 22 09:01:27 mail roundcube: IMAP Error: Login failed for demo@example.org from 192.168.55.66. LOGIN: Authentication failed. in /usr/share/apache2/roundcubemail-1.0.4/program/lib/Roundcube/rcube_imap.php on line 184 (POST /mail/?_task=login?_task=login&_action=login)
May 22 09:01:27 mail roundcube: Failed login for demo@example.org from 192.168.55.66 in session 6l85l9hmc4d1q8mmmb30io7n41 (error: 0))

dovecot.log says

May 22 09:00:14 imap-login: Info: Login: user=<demo@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=30093, secured, session=<T4dNNqYWKQB/AAAB>
May 22 09:00:15 imap(demo@example.org): Info: Disconnected: Logged out in=281 out=1024
May 22 09:00:15 imap(demo@example.org): Info: Disconnected: Logged out in=309 out=2744
May 22 09:01:25 auth: Debug: ldap(demo@example.org,127.0.0.1,<KZ6AOqYWWQB/AAAB>): bind search: base=o=domains,dc=example,dc=org filter=(&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=imapsecured)(|(mail=demo@example.org)(&(enabledService=shadowaddress)(shadowAddress=demo@example.org))))
May 22 09:01:25 auth: Debug: ldap(demo@example.org,127.0.0.1,<KZ6AOqYWWQB/AAAB>): result: mail=demo@example.org
May 22 09:01:25 auth: Info: ldap(demo@example.org,127.0.0.1,<KZ6AOqYWWQB/AAAB>): invalid credentials (given password: d3m0-d3m0)
May 22 09:01:27 auth: Debug: client out: FAIL   1       user=demo@example.org
May 22 09:01:27 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<demo@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<KZ6AOqYWWQB/AAAB>

Logging into iredadmin as a user works, he can change the password, which works then for roundcube, too.
Is it related to change of password hashes maybe ? Any help is appreciated !

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Changing users password in roundcube leeds to Authentication failed

*) Did you upgrade Roundcube after initial iRedMail installation?
*) Did you change any setting in Roundcube's password plugin?

3 (edited by jobu 2015-05-22 15:52:23)

Re: Changing users password in roundcube leeds to Authentication failed

It was a fresh installation (one day before 0.9.1 release). i changed only the debug options, nothing in the password plugin. no manual roudecube upgrade, it is v1.0.4.

4

Re: Changing users password in roundcube leeds to Authentication failed

Could you please show us the full setting of Roundcube password plugin (plugins/password/config.inc.php)? Please remove comment lines and empty lines.

Also, please change user password to a temporary testing password (e.g. 123456), then show us the password hash stored in LDAP.

5

Re: Changing users password in roundcube leeds to Authentication failed

plugins/password/config.inc.php :

$config['password_driver'] = "ldap";
$config['password_confirm_current'] = false;
$config['password_minimum_length'] = 8;
$config['password_require_nonalpha'] = true;
$config['password_log'] = true;
$config['password_login_exceptions'] = true;
$config['password_hosts'] = null;
$config['password_force_save'] = false;
$config['password_db_dsn'] = '';
$config['password_query'] = 'SELECT update_passwd(%c, %u)';
$config['password_crypt_hash'] = 'md5';
$config['password_idn_ascii'] = false;
$config['password_dovecotpw'] = "/usr/bin/doveadm pw";
$config['password_dovecotpw_method'] = "SSHA512";
$config['password_dovecotpw_with_method'] = true;
$config['password_hash_algorithm'] = 'sha1';
$config['password_hash_base64'] = false;
$config['password_blowfish_cost'] = 12;
$config['password_pop_host'] = 'localhost';
$config['password_pop_port'] = 106;
$config['password_saslpasswd_args'] = '';
$config['password_ldap_host'] = "127.0.0.1";
$config['password_ldap_port'] = "389";
$config['password_ldap_starttls'] = false;
$config['password_ldap_version'] = "3";
$config['password_ldap_basedn'] = "o=domains,dc=example,dc=org";
$config['password_ldap_method'] = "admin";
$config['password_ldap_adminDN'] = "cn=vmailadmin,dc=example,dc=org";
$config['password_ldap_adminPW'] = "HIDDENPASSWORD";
$config['password_ldap_userDN_mask'] = "mail=%login,ou=Users,domainName=%domain,o=domains,dc=example,dc=org";
$config['password_ldap_searchDN'] = 'cn=roundcube,ou=services,dc=example,dc=com';
$config['password_ldap_searchPW'] = 'secret';
$config['password_ldap_search_base'] = 'ou=people,dc=example,dc=com';
$config['password_ldap_search_filter'] = '(uid=%login)';
$config['password_ldap_encodage'] = "ssha512";
$config['password_ldap_pwattr'] = "userPassword";
$config['password_ldap_force_replace'] = true;
$config['password_ldap_lchattr'] = "shadowLastChange";
$config['password_ldap_samba_pwattr'] = '';
$config['password_ldap_samba_lchattr'] = '';
$config['password_directadmin_host'] = 'tcp://localhost';
$config['password_directadmin_port'] = 2222;
$config['password_vpopmaild_host'] = 'localhost';
$config['password_vpopmaild_port'] = 89;
$config['password_cpanel_host'] = 'host.domain.com';
$config['password_cpanel_username'] = 'username';
$config['password_cpanel_password'] = 'password';
$config['password_cpanel_port'] = 2087;
$config['password_ximss_host'] = 'mail.example.com';
$config['password_ximss_port'] = 11024;
$config['password_chpasswd_cmd'] = 'sudo /usr/sbin/chpasswd 2> /dev/null';
$config['xmail_host'] = 'localhost';
$config['xmail_user'] = 'YourXmailControlUser';
$config['xmail_pass'] = 'YourXmailControlPass';
$config['xmail_port'] = 6017;
$config['hmailserver_remote_dcom'] = false;
$config['hmailserver_server'] = array(
    'Server' => 'localhost', // hostname or ip address
    'Username' => 'administrator', // windows username
    'Password' => 'password' // windows user password
);
$config['password_virtualmin_format'] = 0;
$config['password_pw_usermod_cmd'] = 'sudo /usr/sbin/pw usermod -h 0 -n';
$config['password_dbmail_args'] = '-p sha512';
$config['password_expect_bin'] = '/usr/bin/expect';
$config['password_expect_script'] = '';
$config['password_expect_params'] = '';
$config['password_smb_host'] = 'localhost';
$config['password_smb_cmd'] = '/usr/bin/smbpasswd';

password_ldap_searchDN and password_ldap_search_base does not macht the given ldap_base. is that the problem ?

the users password after a change:

SSHA-512 hashed Password - {SSHA512}H4nz67...

other passwords from the backup i restored on the new installation are {CRYPT}

6

Re: Changing users password in roundcube leeds to Authentication failed

jobu wrote:

password_ldap_searchDN and password_ldap_search_base does not macht the given ldap_base. is that the problem ?

*) with `password_ldap_method = admin`, we don't need password_ldap_searchDN and password_ldap_search_base at all, because we declare the full dn in `password_ldap_userDN_mask`.

*) {SSHA512} should be fine.

*) Please turn on debug mode in Dovecot by following below tutorial, then try to login again, any error log in Dovecot log file?
http://www.iredmail.org/docs/debug.dovecot.html

Note: Please show us full log related to your failed login attempt.

7

Re: Changing users password in roundcube leeds to Authentication failed

*) Please turn on debug mode in Dovecot by following below tutorial, then try to login again, any error log in Dovecot log file?
http://www.iredmail.org/docs/debug.dovecot.html

i could not turn on auth_verbose_passwords = yes, the possible values are no, plain and sha1 and i am not sure about it, but i seems to be no big difference.

Note: Please show us full log related to your failed login attempt.

May 26 08:37:04 auth: Debug: ldap(demo@example.org,127.0.0.1,<bh/HWvYWvgB/AAAB>): bind search: base=o=domains,dc=example,dc=org filter=(&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=imapsecured)(|(mail=demo@example.org)(&(enabledService=shadowaddress)(shadowAddress=demo@example.org))))
May 26 08:37:04 auth: Debug: ldap(demo@example.org,127.0.0.1,<bh/HWvYWvgB/AAAB>): result: mail=demo@example.org
May 26 08:37:04 auth: Info: ldap(demo@example.org,127.0.0.1,<bh/HWvYWvgB/AAAB>): invalid credentials (given password: demo-d3m0)
May 26 08:37:06 auth: Debug: client out: FAIL   1       user=demo@example.org
May 26 08:37:06 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<demo@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<bh/HWvYWvgB/AAAB>

as mentioned before, logging into iredadmin for self-service works for the user with the password.

8

Re: Changing users password in roundcube leeds to Authentication failed

I expect more detailed debug message in /var/log/dovecot.log, do you have below settings in dovecot.conf?

mail_debug = yes                                                                  
auth_verbose = yes                                                                
auth_debug = yes

9

Re: Changing users password in roundcube leeds to Authentication failed

Yes, all set - the logs excerpt shoed events only for the login process, here is todays full log for the user:

May 26 08:34:02 auth: Debug: ldap(demo@example.org,127.0.0.1,<MnnzT/YWzgB/AAAB>): bind search: base=o=domains,dc=example,dc=org filter=(&(objectClass=mailUser)(accountStatus=active)(enabledS
ervice=mail)(enabledService=imapsecured)(|(mail=demo@example.org)(&(enabledService=shadowaddress)(shadowAddress=demo@example.org))))
May 26 08:34:02 auth: Debug: ldap(demo@example.org,127.0.0.1,<MnnzT/YWzgB/AAAB>): result: mail=demo@example.org
May 26 08:34:02 auth: Info: ldap(demo@example.org,127.0.0.1,<MnnzT/YWzgB/AAAB>): invalid credentials (given password: demo-d3m0)
May 26 08:34:04 auth: Debug: client out: FAIL   1       user=demo@example.org
May 26 08:34:04 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<demo@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<MnnzT/YWzgB/AAAB>
May 26 08:34:11 auth: Debug: ldap(demo@example.org,127.0.0.1,<MNg3UPYW0AB/AAAB>): bind search: base=o=domains,dc=example,dc=org filter=(&(objectClass=mailUser)(accountStatus=active)(enabledS
ervice=mail)(enabledService=imapsecured)(|(mail=demo@example.org)(&(enabledService=shadowaddress)(shadowAddress=demo@example.org))))
May 26 08:34:11 auth: Debug: ldap(demo@example.org,127.0.0.1,<MNg3UPYW0AB/AAAB>): result: mail=demo@example.org
May 26 08:34:11 auth: Info: ldap(demo@example.org,127.0.0.1,<MNg3UPYW0AB/AAAB>): invalid credentials (given password: demodemo)
May 26 08:34:13 auth: Debug: client out: FAIL   1       user=demo@example.org
May 26 08:34:13 imap-login: Info: Disconnected (auth failed, 1 attempts in 6 secs): user=<demo@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<MNg3UPYW0AB/AAAB>
May 26 08:35:04 auth: Debug: ldap(demo@example.org,127.0.0.1,<oW2nU/YWHwB/AAAB>): bind search: base=o=domains,dc=example,dc=org filter=(&(objectClass=mailUser)(accountStatus=active)(enabledS
ervice=mail)(enabledService=imapsecured)(|(mail=demo@example.org)(&(enabledService=shadowaddress)(shadowAddress=demo@example.org))))
May 26 08:35:04 auth: Debug: ldap(demo@example.org,127.0.0.1,<oW2nU/YWHwB/AAAB>): result: mail=demo@example.org
May 26 08:35:04 auth: Debug: client out: OK     1       user=demo@example.org
May 26 08:35:04 auth: Debug: ldap(demo@example.org,127.0.0.1,<oW2nU/YWHwB/AAAB>): user search: base=o=domains,dc=example,dc=org scope=subtree filter=(&(objectClass=mailUser)(accountStatus=ac
tive)(enabledService=mail)(enabledService=imapsecured)(|(mail=demo@example.org)(&(enabledService=shadowaddress)(shadowAddress=demo@example.org)))) fields=mail,homeDirectory,mailQuota
May 26 08:35:04 auth: Debug: ldap(demo@example.org,127.0.0.1,<oW2nU/YWHwB/AAAB>): result: mail=demo@example.org homeDirectory=/var/vmail/vmail1/example.org/d/e/m/demo-2011.04.12.11.57.
16/ mailQuota=1572864000
May 26 08:35:04 auth: Debug: master out: USER   145883137       demo@example.org       home=/var/vmail/vmail1/example.org/d/e/m/demo-2011.04.12.11.57.16/     mail=maildir:~/Maildir/ quota_rule=
*:bytes=1572864000
May 26 08:35:04 imap-login: Info: Login: user=<demo@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=22766, secured, session=<oW2nU/YWHwB/AAAB>
May 26 08:35:04 imap(demo@example.org): Debug: Effective uid=2000, gid=2000, home=/var/vmail/vmail1/example.org/d/e/m/demo-2011.04.12.11.57.16/
May 26 08:35:04 imap(demo@example.org): Debug: Quota root: name=user backend=dict args=:proxy::quotadict
May 26 08:35:04 imap(demo@example.org): Debug: Quota rule: root=user mailbox=* bytes=1572864000 messages=0
May 26 08:35:04 imap(demo@example.org): Debug: Quota warning: bytes=1336934400 (85%) messages=0 reverse=no command=quota-warning 85 demo@example.org
May 26 08:35:04 imap(demo@example.org): Debug: Quota warning: bytes=1415577600 (90%) messages=0 reverse=no command=quota-warning 90 demo@example.org
May 26 08:35:04 imap(demo@example.org): Debug: Quota warning: bytes=1494220800 (95%) messages=0 reverse=no command=quota-warning 95 demo@example.org
May 26 08:35:04 imap(demo@example.org): Debug: dict quota: user=demo@example.org, uri=proxy::quotadict, noenforcing=0
May 26 08:35:04 imap(demo@example.org): Debug: Namespace : type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir/
May 26 08:35:04 imap(demo@example.org): Debug: maildir++: root=/var/vmail/vmail1/example.org/d/e/m/demo-2011.04.12.11.57.16//Maildir, index=, control=, inbox=/var/vmail/vmail1/gugw.tu-darmstadt
.de/d/e/m/demo-2011.04.12.11.57.16//Maildir, alt=
May 26 08:35:04 imap(demo@example.org): Debug: acl: initializing backend with data: vfile
May 26 08:35:04 imap(demo@example.org): Debug: acl: acl username = demo@example.org
May 26 08:35:04 imap(demo@example.org): Debug: acl: owner = 1
May 26 08:35:04 imap(demo@example.org): Debug: acl vfile: Global ACL directory: (none)
May 26 08:35:04 imap(demo@example.org): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=yes location=maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/
Shared/%u
May 26 08:35:04 imap(demo@example.org): Debug: shared: root=/var/run/dovecot, index=, control=, inbox=, alt=
May 26 08:35:04 imap(demo@example.org): Debug: acl: initializing backend with data: vfile
May 26 08:35:04 imap(demo@example.org): Debug: acl: acl username = demo@example.org
May 26 08:35:04 imap(demo@example.org): Debug: acl: owner = 0
May 26 08:35:04 imap(demo@example.org): Debug: acl vfile: Global ACL directory: (none)
May 26 08:35:04 imap(demo@example.org): Debug: acl vfile: file /var/vmail/vmail1/example.org/d/e/m/demo-2011.04.12.11.57.16//Maildir/.Drafts/dovecot-acl not found
May 26 08:35:04 imap(demo@example.org): Debug: acl vfile: file /var/vmail/vmail1/example.org/d/e/m/demo-2011.04.12.11.57.16//Maildir/.Sent/dovecot-acl not found
May 26 08:35:04 imap(demo@example.org): Debug: acl vfile: file /var/vmail/vmail1/example.org/d/e/m/demo-2011.04.12.11.57.16//Maildir/.Junk/dovecot-acl not found
May 26 08:35:04 imap(demo@example.org): Debug: acl vfile: file /var/vmail/vmail1/example.org/d/e/m/demo-2011.04.12.11.57.16//Maildir/.Trash/dovecot-acl not found
May 26 08:35:04 imap(demo@example.org): Info: Disconnected: Logged out in=195 out=893
May 26 08:37:04 auth: Debug: ldap(demo@example.org,127.0.0.1,<bh/HWvYWvgB/AAAB>): bind search: base=o=domains,dc=example,dc=org filter=(&(objectClass=mailUser)(accountStatus=active)(enabledS
ervice=mail)(enabledService=imapsecured)(|(mail=demo@example.org)(&(enabledService=shadowaddress)(shadowAddress=demo@example.org))))
May 26 08:37:04 auth: Info: ldap(demo@example.org,127.0.0.1,<bh/HWvYWvgB/AAAB>): invalid credentials (given password: demo-d3m0)
May 26 08:37:06 auth: Debug: client out: FAIL   1       user=demo@example.org
May 26 08:37:06 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<demo@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<bh/HWvYWvgB/AAAB>
May 26 08:43:34 auth: Debug: ldap(demo@example.org,127.0.0.1,<09IBcvYWNAB/AAAB>): bind search: base=o=domains,dc=example,dc=org filter=(&(objectClass=mailUser)(accountStatus=active)(enabledS
ervice=mail)(enabledService=imapsecured)(|(mail=demo@example.org)(&(enabledService=shadowaddress)(shadowAddress=demo@example.org))))
May 26 08:43:34 auth: Debug: ldap(demo@example.org,127.0.0.1,<09IBcvYWNAB/AAAB>): result: mail=demo@example.org
May 26 08:43:34 auth: Info: ldap(demo@example.org,127.0.0.1,<09IBcvYWNAB/AAAB>): invalid credentials (given password: demo-d3m0)
May 26 08:43:36 auth: Debug: client out: FAIL   1       user=demo@example.org
May 26 08:43:36 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<demo@example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<09IBcvYWNAB/AAAB>

10

Re: Changing users password in roundcube leeds to Authentication failed

No idea yet.

jobu wrote:

the users password after a change:
SSHA-512 hashed Password - {SSHA512}H4nz67...

Just want to confirm: does the hashed password contains string "SSHA-512 hashed Password - "? Or just '{SSHA512}xxxxxxx'?

11

Re: Changing users password in roundcube leeds to Authentication failed

I did query using apache directory studio, so i can't tell exactly.
There is an attribute described as userPassword and a corresponding value, showing SSHA-512 hashed Password. The value itself is something like {SSHA512}H4nz67... can you provide me the correct ladpsearch query ?

ldapsearch -x -D 'cn=vmailadmin,dc=example,dc=org' -W -b 'ou=Users,domainName=example.org,o=domains,dc=example,dc=org' "(&(sn=demo))"

shows only

userPassword:: e1NTSEE1MTJ9S3ppaVlITTJFZWxQVXB1MVdGOHl2WGVzM1BsNERnby8zZXF3cHp
 1VWR1ZTdqRVEzenRTb2dkdnJRVGM5d2NGdmxQc09vQ0c2ampwMkh4NHlXbFhLOVFzQmIvVT0=

12

Re: Changing users password in roundcube leeds to Authentication failed

jobu wrote:

The value itself is something like {SSHA512}H4nz67...

This is correct.
Can you verify the new password with Apache Directory Studio?

13

Re: Changing users password in roundcube leeds to Authentication failed

Hmmm, not sure ... Apache Directory Studio shows a wrong timestamp for the change log of the password.

#!RESULT OK
#!CONNECTION ldap://*ip*:389
#!DATE 2015-05-15T09:38:16.563
dn: mail=postmaster@example.org,o=domainAdmins,dc=example,dc=org
changetype: modify
add: userPassword
userPassword:: e0NSWVBUfSQxJE1TOXN0VlRQJGJWN0NUWFhwQk5DMzQ0QjlJamN0UTE=

Do you know another way to check ? I am definitely not an expert in ldap or Apache Directory Studio ;o)
Check like here does not match for this hash.

14

Re: Changing users password in roundcube leeds to Authentication failed

The test you linked is for System Users - not Users stored within LDAP

15

Re: Changing users password in roundcube leeds to Authentication failed

With Apache Directory Studio, if you double-click user's password, it will show you a dialog, it allows you to verify password.

16

Re: Changing users password in roundcube leeds to Authentication failed

Thanks for that, it's quite easy when you know what to do ...
The password is correct. sad

17

Re: Changing users password in roundcube leeds to Authentication failed

What i didn't try until now - using the account via IMAP in thunderbird ... i doesn't work, same dovecot.log errors., reproducable with other accounts. I'm using iRedMail since roundabout 0.7.0, the users exists since than. Disabling roundcubes password module is an option, but does not feel right.
Thanks for the fast response anyway !

18

Re: Changing users password in roundcube leeds to Authentication failed

I have no idea. Is it possible for you to upgrade Roundcube to the latest 1.1.1 and try again?

19

Re: Changing users password in roundcube leeds to Authentication failed

After the upgrade to v1.1.1 it works again !

Thank you for your support - again.

Best regards.