Imapsync with external LDAP?

[fausp (fpausp)]

Windows Server Version: 2022
NethServer Version: 8
Module: imapsync and mail

I cannot setup Imapsync if NS8 is joined to external LDAP…

Shouldn’t this be possible?

[fausp (fpausp)]

Windows Server Version: 2022
NethServer Version: 8
Module: imapsync and mail

OK, I think I got it. I had to setup Mail first…

But there is another Problem:

[stephdl (Stéphane de Labrusse)]

Imapsync is designed to use the ns8 mail server you have to link imasync to it

[fausp (fpausp)]

Hi,

I think the setup is correct?

[stephdl (Stéphane de Labrusse)]

Remove and reinstall imasync but before try to check the cli below

[stephdl (Stéphane de Labrusse)]

I did a quick test with a remote LDAP and no pb so far

[stephdl (Stéphane de Labrusse)]

[root@R4-pve ~]# tree /home/imapsync1/.config/state/
/home/imapsync2/.config/state/
├── CACHEDIR.TAG
├── agent.env
├── apitoken.cache
├── cron
├── environment
└── imapsync
    ├── stephane_9bevc3.env
    ├── stephane_9bevc3.pwd
    └── vmail.pwd

[stephdl (Stéphane de Labrusse)]

[root@R4-pve ~]# cat /home/imapsync1/.config/state/imapsync/vmail.pwd 
yrG@S..xiB%K@O/+G,g5/RplJMvZPnVa

[stephdl (Stéphane de Labrusse)]

hum can you see the mailbox of the mail server, can you list user in the web page…I bet no

go to mail module > mailboxes

[stephdl (Stéphane de Labrusse)]

[stephdl (Stéphane de Labrusse)]

please did you configure the ldap with the toggle verify the tls certificate to true ???

[fausp (fpausp)]

No TLS…

[stephdl (Stéphane de Labrusse)]

you can browse users in the ldap page and in the maiboxes of the mail page ?

[fausp (fpausp)]

ldap page does work but mailboxes doesnt

[fausp (fpausp)]

I did a 2nd test with active TLS:

This looks good now, I will do further tests tomorrow…

[stephdl (Stéphane de Labrusse)]

so to resume, you joined a remote domain without TLS, you got no error so far from the UI, but obviously you cannot list the users of the domain, does it sound close of your issue ?

[fausp (fpausp)]

@stephdl

so to resume, you joined a remote domain without TLS, you got no error so far from the UI, but obviously you cannot list the users of the domain, does it sound close of your issue ?

The 1. Test without TLS and TLS verification did not work as expected.
The 2. Test, as you can see in the screenshot, works so far. I can list users etc., but I have to do forther tests to be sure mails are fetched from the provider and sorted to the users and sent out correctly…

[stephdl (Stéphane de Labrusse)]

question, do you think that an AD allowing to authenticate without TLS remotely is safe enough !!!

maybe dovecot forces the TLS on its own

cc @davidep

[fausp (fpausp)]

@stephdl

question, do you think that an AD allowing to authenticate without TLS remotely is safe enough !!!

No

@stephdl

maybe dovecot forces the TLS on its own

It looks like…

[stephdl (Stéphane de Labrusse)]

tested on a remote ldap account without TLS, I cannot reproduce the issue

create an AD on NS7
set to do not ask for encryption

LDAP Result Code 8 "Strong Auth Required": BindSimple: Transport encryption required

The commands by @giacomo need a little fix: mkdir -p /etc/e-smith/templates-custom/var/lib/machines/nsdc/etc/samba/smb.conf.include/ - echo "ldap server require strong auth = no" > 20notls + echo "ldap server require strong auth = no" > /etc/e-smith/templates-custom/var/lib/machines/nsdc/etc/samba/smb.conf.include/20notls expand-template /var/lib/machines/nsdc/etc/samba/smb.conf.include systemctl restart nsdc Instead of creating a template-custom, you could try to edit the [global] sect…

bind to this AD on NS8 without TLS on port 389
install mail, webtop, imapsync

I can use the domain page and the mailboxes page, and the imapsync page, I can login with ldap users to webtop

If I remove the custom template I did on NS7 and I restart the nsdc, then I cannot browse remotely the users on all pages