I would like to consider a case where both Linux and Windows computers
are in use, but mail servers are completely Linux-oriented (f.e.,
dovecot + postfix on Fedora hosts).
In such a heterogeneous environment, to provide unique
authorisation/authentication mechanism, either "OpenLDAP + Samba NT" or
"AD + msSFU" solutions are used. It provides uniform accounts and
passwords, independent of whether users use Linux or Windows on their
desktops.
There is one circumstance which can spoil this fine solution a bit. When
a windows user creates its mail account (in OE or similar), he/she is
compelled to specify login and password "manually". When sometimes the
uniform password will be changed (either by Ctrl-Alt-Del from the
desktop, or by a system admin), this "manual" specification in the local
mail settings will not be changed automatically. The user then is
compelled to change its password there too; or sysadmin should use
different, seldom-changed account/password set just for mail subsystem...
All modern windows mail programs provide an "SPA" option (secure
password authentication). Using it, the mail program just uses the
current desktop's login/password. This way the situation described above
can be effectively avoided. But "SPA" uses NTLM (and spnego?)
authentication mechanism, which is not supported properly now neither by
dovecot or by postfix (it seems that another MTA and imap servers do not
support it properly as well).
Yes, I know that both postfix and dovecot actually "supports" NTLM now.
But dovecot uses NTLM against a local database only, it cannot
authenticate users against the windows domain. Postfix (and other MTA)
could use cyrus-sasl library, which has a "ntlm" plugin (capable to do
domain auth), but the actual blocker here is the dovecot issues.
Since the postfix and friends can do SMTP auth against a dovecot-auth
daemon, the solution seems to be focused in dovecot package only. By
adding of proper NTLM support to dovecot-auth, we can use "SPA" on
windows desktops and can forget about manual filling of login/password form.
Samba team strongly recommends to use "ntlm_auth" helper binary and
"winbind" daemon (both from the "samba-common" package), which provides
a stable way to do "NTLM" and "GSS-SPNEGO" auth types against a windows
domain. This way Squid and recently Apache do NTLM now. Hence I think
about adding of "ntlm_auth + winbind" support for Dovecot.
Before I shall begin it, I would like to ask:
- Is this issue a corner case or not?
- Are there some another solution for the support of "SPA against
domain" by Linux MTA/pop/imap servers in Fedora?
- Perhaps someone has already made something of it? At least partially?
- Is the solution proposed the best way to solve the issue (for
corporate systems etc.)?
Regards,
Dmitry Butskoy
http://www.fedoraproject.org/wiki/DmitryButskoy
--
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-devel-list
