1

So I'm setting up a mailserver here - Courier & Postfix on Debian 7.8, authenticating against MySQL. Got it mostly set up - I can send mail, and the address is also receiving mail properly, with postfix putting it in the correct Maildir, everything is authenticating with sasl/pam correctly, etc.

However, I couldn't actually connect to IMAP through Thunderbird (it says that it can't validate the login details), and the logs weren't showing anything other than the actual connection attempt - there were no errors listed whatsoever (courier debug logging was enabled for this). The mailog showed only:

Jan 14 17:17:21 server imapd: Connection, ip=[::ffff:x.x.x.x]

So I went to testing it manually (telnet domain.tld 143) remotely, I get the following output:

* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS XMAGICTRASH] Courier-IMAP ready. Copyright 1998-2011 Double Precision, Inc.  See COPYING for distribution information.
1 LOGIN test@test.tld testpass
NO Error in IMAP command received by server.

The thing is though, when I test it locally on the server itself, it works fine!

me@server:/# telnet localhost 143
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS XMAGICTRASH] Courier-IMAP ready. Copyright 1998-2011 Double Precision, Inc.  See COPYING for distribution information.
1 LOGIN test@test.tld testpass
1 OK LOGIN Ok.

Searching for the NO Error in IMAP only pointed to cases where the command hadn't been prefixed by a number, which I've already done here - besides, it works properly on localhost. Also, searching for cases where it worked locally but not remotely only led to issues in connectivity, which isn't the case here either. I'm kinda stumped!

  • So, it appears to be an issue with imapd-ssl, as when I force Thunderbird to connect without STARTTLS or SSL, it actually connects! Unfortunately, given that there are no pertinent logs, I don't know where SSL is failing. – Draesk Jan 14 '17 at 16:38
  • Got it! It was Thunderbird's error console that gave it up! "SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message." Regenerated it with DH_BITS=2048 and we're good! – Draesk Jan 14 '17 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.