Kerberos/GSSAPI dovecot auth wierdeness?

[Carlos Mogas da Silva]

Hi list!

I'm migrating my server into a new REALM (INT.R3PEK.ORG) from an old one 
(R3PEK.ORG). This is a completely new install and configuration, so no 
leftovers exits.
The machine is correctly register into the REALM and users are able to 
login without a problem.

Now, when I try to login using a Kerberos ticket, for some reason that I 
can't understand, dovecot is looking for a ticket on the old REALM. 
Maybe because of the email domain (which stayed the same)? This is the 
error message I see on the clients:
"Failed to authenticate: Server krbtgt/[e-mail]"

The one it should be looking for is krbtgt/[e-mail], 
but I can't seem to figure out where the problem is.

I've posted the same email to the dovecot mailing list, but since I'm 
not sure this is a dovecot/configuration issue or something that I 
should have done on the FreeIPA side, I'm posting it here too just to 
have some feedback.

Thanks!

[Alexander Bokovoy]

On ke, 14 joulu 2022, Carlos Mogas da Silva via FreeIPA-users wrote:
> Hi list!
>
> I'm migrating my server into a new REALM (INT.R3PEK.ORG) from an old 
> one (R3PEK.ORG). This is a completely new install and configuration, 
> so no leftovers exits.
> The machine is correctly register into the REALM and users are able to 
> login without a problem.
>
> Now, when I try to login using a Kerberos ticket, for some reason that 
> I can't understand, dovecot is looking for a ticket on the old REALM. 
> Maybe because of the email domain (which stayed the same)? This is the 
> error message I see on the clients:
> "Failed to authenticate: Server krbtgt/[e-mail]"
>
> The one it should be looking for is 
> krbtgt/[e-mail], but I can't seem to figure out 
> where the problem is.
>
> I've posted the same email to the dovecot mailing list, but since I'm 
> not sure this is a dovecot/configuration issue or something that I 
> should have done on the FreeIPA side, I'm posting it here too just to 
> have some feedback.

Could you please share your Dovecot and krb5 configuration on that
Dovecot server?

It is hard to help without seeing anything.

[Carlos Mogas da Silva]

On 2022-12-14 14:19, Alexander Bokovoy via FreeIPA-users wrote:
> Could you please share your Dovecot and krb5 configuration on that
> Dovecot server?
>
> It is hard to help without seeing anything.

Sure mate. This was what I could think of that was relevant. If there's 
anything missing just ask.

# egrep -v "^#|^$" /etc/dovecot/conf.d/10-auth.conf
auth_realms = INT.R3PEK.ORG
auth_default_realm = INT.R3PEK.ORG
auth_username_format = %Ln
auth_gssapi_hostname = mail01.int.r3pek.org
auth_krb5_keytab =  /etc/dovecot/mail.keytab
auth_mechanisms = gssapi plain
!include auth-system.conf.ext

# egrep -v "^\s*#|^$" /etc/dovecot/conf.d/auth-system.conf.ext
passdb {
   driver = pam
}
userdb {
   driver = passwd
   override_fields = home=/email/%Lu
}

# klist -k /etc/dovecot/mail.keytab
Keytab name: FILE:mail.keytab
KVNO Principal
---- 
--------------------------------------------------------------------------
    1 smtp/[e-mail]
    1 smtp/[e-mail]
    1 smtp/[e-mail]
    1 smtp/[e-mail]
    1 imap/[e-mail]
    1 imap/[e-mail]
    1 imap/[e-mail]
    1 imap/[e-mail]

# klist -k /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- 
--------------------------------------------------------------------------
    1 host/[e-mail]
    1 host/[e-mail]
    1 host/[e-mail]
    1 host/[e-mail]

# cat /etc/sssd/sssd.conf
[domain/int.r3pek.org]

id_provider = ipa
ipa_server = _srv_, ipa01.int.r3pek.org
ipa_domain = int.r3pek.org
ipa_hostname = mail01.int.r3pek.org
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
dyndns_update = True
dyndns_iface = enp6s18
krb5_store_password_if_offline = True
[sssd]
services = nss, pam, ssh, sudo

domains = int.r3pek.org
[nss]
homedir_substring = /home

Thanks.

[Alexander Bokovoy]

On ke, 14 joulu 2022, Carlos Mogas da Silva wrote:
> On 2022-12-14 14:19, Alexander Bokovoy via FreeIPA-users wrote:
> > Could you please share your Dovecot and krb5 configuration on that
> > Dovecot server?
> >
> > It is hard to help without seeing anything.
>
> Sure mate. This was what I could think of that was relevant. If 
> there's anything missing just ask.

Thanks. I also asked for krb5 configuration: /etc/krb5.conf and files
included from it, I think they are in /etc/krb5.conf.d and
/var/lib/sss/pubconf/krb5.include.d

You can see a full list of the directories with

grep includedir /etc/krb5.conf

The rest of the configuration looks fine but krb5 configs will help to
understand how hostname to realm mapping would be performed and what
else is affecting the configuration.
> # egrep -v "^#|^$" /etc/dovecot/conf.d/10-auth.conf
> auth_realms = INT.R3PEK.ORG
> auth_default_realm = INT.R3PEK.ORG
> auth_username_format = %Ln
> auth_gssapi_hostname = mail01.int.r3pek.org
> auth_krb5_keytab =  /etc/dovecot/mail.keytab
> auth_mechanisms = gssapi plain
> !include auth-system.conf.ext
>
> # egrep -v "^\s*#|^$" /etc/dovecot/conf.d/auth-system.conf.ext
> passdb {
>  driver = pam
> }
> userdb {
>  driver = passwd
>  override_fields = home=/email/%Lu
> }
>
> # klist -k /etc/dovecot/mail.keytab
> Keytab name: FILE:mail.keytab
> KVNO Principal
>
> 1 smtp/[e-mail]
>   1 smtp/[e-mail]
>   1 smtp/[e-mail]
>   1 smtp/[e-mail]
>   1 imap/[e-mail]
>   1 imap/[e-mail]
>   1 imap/[e-mail]
>   1 imap/[e-mail]
>
> # klist -k /etc/krb5.keytab
> Keytab name: FILE:/etc/krb5.keytab
> KVNO Principal
>
> 1 host/[e-mail]
>   1 host/[e-mail]
>   1 host/[e-mail]
>   1 host/[e-mail]
>
> # cat /etc/sssd/sssd.conf
> [domain/int.r3pek.org]
>
> id_provider = ipa
> ipa_server = _srv_, ipa01.int.r3pek.org
> ipa_domain = int.r3pek.org
> ipa_hostname = mail01.int.r3pek.org
> auth_provider = ipa
> chpass_provider = ipa
> access_provider = ipa
> cache_credentials = True
> ldap_tls_cacert = /etc/ipa/ca.crt
> dyndns_update = True
> dyndns_iface = enp6s18
> krb5_store_password_if_offline = True
> [sssd]
> services = nss, pam, ssh, sudo
>
> domains = int.r3pek.org
> [nss]
> homedir_substring = /home
>
> Thanks.

[Carlos Mogas da Silva]

On 2022-12-14 14:34, Alexander Bokovoy via FreeIPA-users wrote:
> Thanks. I also asked for krb5 configuration: /etc/krb5.conf and files
> included from it, I think they are in /etc/krb5.conf.d and
> /var/lib/sss/pubconf/krb5.include.d
>
> You can see a full list of the directories with
>
> grep includedir /etc/krb5.conf

# egrep -v "^\s*#|^$" /etc/krb5.conf.d/*
/etc/krb5.conf.d/crypto-policies:[libdefaults]
/etc/krb5.conf.d/crypto-policies:permitted_enctypes = 
aes256-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 
aes128-cts-hmac-sha256-128 aes128-cts-hmac-sha1-96
/etc/krb5.conf.d/enable_sssd_conf_dir:includedir 
/var/lib/sss/pubconf/krb5.include.d/
/etc/krb5.conf.d/freeipa:[libdefaults]
/etc/krb5.conf.d/freeipa:    spake_preauth_groups = edwards25519
/etc/krb5.conf.d/kcm_default_ccache:[libdefaults]
/etc/krb5.conf.d/kcm_default_ccache:    default_ccache_name = KCM:
/etc/krb5.conf.d/sssd_enable_idp:[plugins]
/etc/krb5.conf.d/sssd_enable_idp: clpreauth = {
/etc/krb5.conf.d/sssd_enable_idp:  module = 
idp:/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so
/etc/krb5.conf.d/sssd_enable_idp: }
/etc/krb5.conf.d/sssd_enable_idp: kdcpreauth = {
/etc/krb5.conf.d/sssd_enable_idp:  module = 
idp:/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so
/etc/krb5.conf.d/sssd_enable_idp: }

# egrep -v "^\s*#|^$" /var/lib/sss/pubconf/krb5.include.d/*
/var/lib/sss/pubconf/krb5.include.d/domain_realm_int_r3pek_org:[domain_realm]
/var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults:[libdefaults]
/var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults: canonicalize = 
true
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin:[plugins]
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin: localauth = {
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin:  module = 
sssd:/usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin: }

While also testing some stuff out, if I force the IP address of the 
mail01.r3pek.org server to be the internal one, the auth works. Am I 
missing something or is the normal?

[Alexander Bokovoy]

On ke, 14 joulu 2022, Carlos Mogas da Silva wrote:
> On 2022-12-14 14:34, Alexander Bokovoy via FreeIPA-users wrote:
> > Thanks. I also asked for krb5 configuration: /etc/krb5.conf and files
> > included from it, I think they are in /etc/krb5.conf.d and
> > /var/lib/sss/pubconf/krb5.include.d
> >
> > You can see a full list of the directories with
> >
> > grep includedir /etc/krb5.conf
>
> # egrep -v "^\s*#|^$" /etc/krb5.conf.d/*
> /etc/krb5.conf.d/crypto-policies:[libdefaults]
> /etc/krb5.conf.d/crypto-policies:permitted_enctypes = 
> aes256-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 
> aes128-cts-hmac-sha256-128 aes128-cts-hmac-sha1-96
> /etc/krb5.conf.d/enable_sssd_conf_dir:includedir 
> /var/lib/sss/pubconf/krb5.include.d/
> /etc/krb5.conf.d/freeipa:[libdefaults]
> /etc/krb5.conf.d/freeipa:    spake_preauth_groups = edwards25519
> /etc/krb5.conf.d/kcm_default_ccache:[libdefaults]
> /etc/krb5.conf.d/kcm_default_ccache:    default_ccache_name = KCM:
> /etc/krb5.conf.d/sssd_enable_idp:[plugins]
> /etc/krb5.conf.d/sssd_enable_idp: clpreauth = {
> /etc/krb5.conf.d/sssd_enable_idp:  module = 
> idp:/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so
> /etc/krb5.conf.d/sssd_enable_idp: }
> /etc/krb5.conf.d/sssd_enable_idp: kdcpreauth = {
> /etc/krb5.conf.d/sssd_enable_idp:  module = 
> idp:/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so
> /etc/krb5.conf.d/sssd_enable_idp: }
>
> # egrep -v "^\s*#|^$" /var/lib/sss/pubconf/krb5.include.d/*
> /var/lib/sss/pubconf/krb5.include.d/domain_realm_int_r3pek_org:[domain_realm]
> /var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults:[libdefaults]
> /var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults: canonicalize = 
> true
> /var/lib/sss/pubconf/krb5.include.d/localauth_plugin:[plugins]
> /var/lib/sss/pubconf/krb5.include.d/localauth_plugin: localauth = {
> /var/lib/sss/pubconf/krb5.include.d/localauth_plugin:  module = 
> sssd:/usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so
> /var/lib/sss/pubconf/krb5.include.d/localauth_plugin: }
>
> While also testing some stuff out, if I force the IP address of the 
> mail01.r3pek.org server to be the internal one, the auth works. Am I 
> missing something or is the normal?

You have canonicalization set to true, this is default configuration in
IPA, so krb5 will do 'mail01.int.r3pek.org' -> IP address -> hostname
transformation. This means whatever hostname is obtained afterwards is
used then. If it is mail01.r3pek.org, then Kerberos realm of r3pek.org
domain would be used. Is it R3PEK.ORG or INT.R3PEK.ORG? It can be
changed via _kerberos TXT record.

[Carlos Mogas da Silva]

On 2022-12-14 14:48, Alexander Bokovoy via FreeIPA-users wrote:
> On ke, 14 joulu 2022, Carlos Mogas da Silva wrote:
> > # egrep -v "^\s*#|^$" /var/lib/sss/pubconf/krb5.include.d/*
> > /var/lib/sss/pubconf/krb5.include.d/domain_realm_int_r3pek_org:[domain_realm]
> > /var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults:[libdefaults]
> > /var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults: canonicalize = 
> > true
> > /var/lib/sss/pubconf/krb5.include.d/localauth_plugin:[plugins]
> > /var/lib/sss/pubconf/krb5.include.d/localauth_plugin: localauth = {
> > /var/lib/sss/pubconf/krb5.include.d/localauth_plugin:  module = 
> > sssd:/usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so
> > /var/lib/sss/pubconf/krb5.include.d/localauth_plugin: }
> >
> > While also testing some stuff out, if I force the IP address of the 
> > mail01.r3pek.org server to be the internal one, the auth works. Am I 
> > missing something or is the normal?
>
> You have canonicalization set to true, this is default configuration in
> IPA, so krb5 will do 'mail01.int.r3pek.org' -> IP address -> hostname
> transformation. This means whatever hostname is obtained afterwards is
> used then. If it is mail01.r3pek.org, then Kerberos realm of r3pek.org
> domain would be used. Is it R3PEK.ORG or INT.R3PEK.ORG? It can be
> changed via _kerberos TXT record.

Well, the external domain is mail01.r3pek.org, which has the public IPs. 
The REALM and the internal domains are INT.R3PEK.ORG. Email domains are 
@r3pek.org

[Alexander Bokovoy]

On ke, 14 joulu 2022, Carlos Mogas da Silva via FreeIPA-users wrote:
> On 2022-12-14 14:48, Alexander Bokovoy via FreeIPA-users wrote:
> > On ke, 14 joulu 2022, Carlos Mogas da Silva wrote:
> > > # egrep -v "^\s*#|^$" /var/lib/sss/pubconf/krb5.include.d/*
> > > /var/lib/sss/pubconf/krb5.include.d/domain_realm_int_r3pek_org:[domain_realm]
> > > /var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults:[libdefaults]
> > > /var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults: canonicalize 
> > > = true
> > > /var/lib/sss/pubconf/krb5.include.d/localauth_plugin:[plugins]
> > > /var/lib/sss/pubconf/krb5.include.d/localauth_plugin: localauth = {
> > > /var/lib/sss/pubconf/krb5.include.d/localauth_plugin:  module = 
> > > sssd:/usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so
> > > /var/lib/sss/pubconf/krb5.include.d/localauth_plugin: }
> > >
> > > While also testing some stuff out, if I force the IP address of 
> > > the mail01.r3pek.org server to be the internal one, the auth 
> > > works. Am I missing something or is the normal?
> >
> > You have canonicalization set to true, this is default configuration in
> > IPA, so krb5 will do 'mail01.int.r3pek.org' -> IP address -> hostname
> > transformation. This means whatever hostname is obtained afterwards is
> > used then. If it is mail01.r3pek.org, then Kerberos realm of r3pek.org
> > domain would be used. Is it R3PEK.ORG or INT.R3PEK.ORG? It can be
> > changed via _kerberos TXT record.
>
> Well, the external domain is mail01.r3pek.org, which has the public 
> IPs. The REALM and the internal domains are INT.R3PEK.ORG. Email 
> domains are @r3pek.org

The external domain is r3pek.org, you mean. Just add

_kerberos.r3pek.org TXT "INT.R3PEK.ORG"

TXT record to your public domain. You also would need to add
{smtp,imap}/mail01.r3pek.org as a principal alias to
{smtp,imap}/mail01.int.r3pek.org to make it using the same Kerberos
principal entry.

[Carlos Mogas da Silva]

On Wed, 2022-12-14 at 17:02 +0200, Alexander Bokovoy via FreeIPA-users wrote:
> The external domain is r3pek.org, you mean. Just add
>
> _kerberos.r3pek.org TXT "INT.R3PEK.ORG"
>
> TXT record to your public domain. You also would need to add
> {smtp,imap}/mail01.r3pek.org as a principal alias to
> {smtp,imap}/mail01.int.r3pek.org to make it using the same Kerberos
> principal entry.

Confirmed working! Thanks for the help.