fetchmail-users

[fetchmail-users] Exchange Server 2003 IMAP NTLM

[Ben R. <be...@mu...>]

Help?

I can open Outlook or use a browser to log into my account
So I know that my username and password are correct.
(I have tried to modify some of the info like password hashes and 
usernames/hostnames to maintain some security for my company)

Username:  user1
Domain:    win2k

This works fine.


When I try to login to the server it fails?

[root@linuxdesktop ~]# /usr/local/bin/fetchmail -v -v -v -c  -p IMAP -L 
Fetchlog --auth ntlm -u "user1@win2k" mailserver.win2k.domain.com
fetchmail: WARNING: Running as root is discouraged.
Enter password for user1@wi...@ma...:
fetchmail: 6.3.8 querying mailserver.win2k.domain.com (protocol IMAP) at 
Tue 10 Apr 2007 01:54:03 PM EDT: poll started
fetchmail: Trying to connect to 172.17.7.217/143...connected.
fetchmail: IMAP< * OK Microsoft Exchange Server 2003 IMAP4rev1 server 
version 6.5.7638.1 (mailserver.win2k.domain.com) ready.
fetchmail: IMAP> A0001 CAPABILITY
fetchmail: IMAP< * CAPABILITY IMAP4 IMAP4rev1 IDLE LOGIN-REFERRALS 
MAILBOX-REFERRALS NAMESPACE LITERAL+ UIDPLUS CHILDREN AUTH=NTLM
fetchmail: IMAP< A0001 OK CAPABILITY completed.
fetchmail: Protocol identified as IMAP4 rev 1
fetchmail: IMAP> A0002 AUTHENTICATE NTLM
fetchmail: IMAP< +
NTLM Request:
       Ident = NTLMSSP
       mType = 1
       Flags = 0000b207
        User = user1
      Domain = win2k
fetchmail: IMAP> BIGxLONGxHASHxOFxCHARS
fetchmail: IMAP< + BIGGERxLONGERxHASHxOFxCHARSxREALLYxLONG
NTLM Challenge:
       Ident = NTLMSSP
       mType = 2
      Domain = WIN2K
       Flags = 02818205
   Challenge = 63 47 0c 69 22 98 58 37
NTLM Response:
       Ident = NTLMSSP
       mType = 3
      LmResp = b6 b6 34 22 cd 1e 80 b1 23 d8 3f db aa be c3 45 9e e4 78 
6b f9 ac c4 aa
      NTResp = 95 5a 76 22 71 12 fb b4 8e 26 0a 8a 22 eb 57 ec 49 ce d0 
45 ac 48 32 51
      Domain = win2k
        User = user1
         Wks = user1
        sKey =
       Flags = 02818205
fetchmail: IMAP> ANOTHERxBIGxLONGxHASHxOFxCHARSxREALLYxLONGxTOO
fetchmail: IMAP< A0002 NO Logon failure: unknown user name or bad password.
fetchmail: IMAP> A0003 *
fetchmail: Authorization failure on user1@wi...@ma...
fetchmail: IMAP> A0004 LOGOUT
fetchmail: IMAP< A0003 BAD Protocol Error: "Unknown command found".
fetchmail: IMAP< * BYE Microsoft Exchange Server 2003 IMAP4rev1 server 
version 6.5.7638.1 signing off.
fetchmail: IMAP< A0004 OK LOGOUT completed.
fetchmail: 6.3.8 querying mailserver.win2k.domain.com (protocol IMAP) at 
Tue 10 Apr 2007 01:54:03 PM EDT: poll completed
fetchmail: normal termination, status 3

Re: [fetchmail-users] Exchange Server 2003 IMAP NTLM

[Rob M. <rob...@gm...>]

On 4/10/07, Ben Russo <be...@mu...> wrote:
> Help?
>
> I can open Outlook or use a browser to log into my account
> So I know that my username and password are correct.
> (I have tried to modify some of the info like password hashes and
> usernames/hostnames to maintain some security for my company)
>
> Username:  user1
> Domain:    win2k
>
> This works fine.
>
>
> When I try to login to the server it fails?
>
> [root@linuxdesktop ~]# /usr/local/bin/fetchmail -v -v -v -c  -p IMAP -L Fetchlog --auth ntlm -u "user1@win2k" mailserver.win2k.domain.com

Have you tried simple "user1" or "win2k\user1" (assuming that "win2k"
is the domain)?  It looks like you're not providing the username in an
expected format.

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche

Re: [fetchmail-users] Exchange Server 2003 IMAP NTLM - can someone offer me a test account?

[Matthias A. <mat...@gm...>]

Ben Russo schrieb:
> Help?
> 
> I can open Outlook or use a browser to log into my account
> So I know that my username and password are correct.
> (I have tried to modify some of the info like password hashes and 
> usernames/hostnames to maintain some security for my company)
> 
> Username:  user1
> Domain:    win2k
> 
> This works fine.
> 
> 
> When I try to login to the server it fails?
> 
> [root@linuxdesktop ~]# /usr/local/bin/fetchmail -v -v -v -c  -p IMAP -L 
> Fetchlog --auth ntlm -u "user1@win2k" mailserver.win2k.domain.com
> fetchmail: WARNING: Running as root is discouraged.
> Enter password for user1@wi...@ma...:
> fetchmail: 6.3.8 querying mailserver.win2k.domain.com (protocol IMAP) at 
> Tue 10 Apr 2007 01:54:03 PM EDT: poll started
> fetchmail: Trying to connect to 172.17.7.217/143...connected.
> fetchmail: IMAP< * OK Microsoft Exchange Server 2003 IMAP4rev1 server 
> version 6.5.7638.1 (mailserver.win2k.domain.com) ready.
> fetchmail: IMAP> A0001 CAPABILITY
> fetchmail: IMAP< * CAPABILITY IMAP4 IMAP4rev1 IDLE LOGIN-REFERRALS 
> MAILBOX-REFERRALS NAMESPACE LITERAL+ UIDPLUS CHILDREN AUTH=NTLM
> fetchmail: IMAP< A0001 OK CAPABILITY completed.
> fetchmail: Protocol identified as IMAP4 rev 1
> fetchmail: IMAP> A0002 AUTHENTICATE NTLM
> fetchmail: IMAP< +
> NTLM Request:
>        Ident = NTLMSSP
>        mType = 1
>        Flags = 0000b207
>         User = user1
>       Domain = win2k
> fetchmail: IMAP> BIGxLONGxHASHxOFxCHARS
> fetchmail: IMAP< + BIGGERxLONGERxHASHxOFxCHARSxREALLYxLONG
> NTLM Challenge:
>        Ident = NTLMSSP
>        mType = 2
>       Domain = WIN2K
>        Flags = 02818205
>    Challenge = 63 47 0c 69 22 98 58 37
> NTLM Response:
>        Ident = NTLMSSP
>        mType = 3
>       LmResp = b6 b6 34 22 cd 1e 80 b1 23 d8 3f db aa be c3 45 9e e4 78 
> 6b f9 ac c4 aa
>       NTResp = 95 5a 76 22 71 12 fb b4 8e 26 0a 8a 22 eb 57 ec 49 ce d0 
> 45 ac 48 32 51
>       Domain = win2k
>         User = user1
>          Wks = user1
>         sKey =
>        Flags = 02818205
> fetchmail: IMAP> ANOTHERxBIGxLONGxHASHxOFxCHARSxREALLYxLONGxTOO
> fetchmail: IMAP< A0002 NO Logon failure: unknown user name or bad password.
> fetchmail: IMAP> A0003 *
> fetchmail: Authorization failure on user1@wi...@ma...
> fetchmail: IMAP> A0004 LOGOUT
> fetchmail: IMAP< A0003 BAD Protocol Error: "Unknown command found".
> fetchmail: IMAP< * BYE Microsoft Exchange Server 2003 IMAP4rev1 server 
> version 6.5.7638.1 signing off.
> fetchmail: IMAP< A0004 OK LOGOUT completed.
> fetchmail: 6.3.8 querying mailserver.win2k.domain.com (protocol IMAP) at 
> Tue 10 Apr 2007 01:54:03 PM EDT: poll completed
> fetchmail: normal termination, status 3

Ben,

sorry to hear of authentication troubles - apparently there's something
wrong in fetchmail. To my excuse, I have contradictory information as to
what goes into the Wks=... field and no authoritative reference on the
NTLM authentication dialogue.

Anyone: Can someone provide me a test account for IMAP access to an
Exchange 2003 server or point me to /authoritative/ documentation as to
the NTLM authentication in IMAP?
I only need IMAP access and a valid mailbox with perhaps a test message.
If you can offer that, please contact me off-list.
I can tunnel with OpenVPN, SSH or Cisco VPN if needed and perhaps also
IPSec.

My only NTLM-enabled servers I can test on are Cyrus IMAPd which are
apparently more forgiving than Exchange 2003.

Ben, if you could capture your Outlook's authentication procedure (DO
NOT USE SAVED PASSWORDS AND DO ENTER SOME BOGUS DATA INSTEAD SUCH AS
foobar- DO NOT USE YOUR REAL PASSWORD) with Wireshark (or Windump or
tcpdump - try windump -w output.dump -s 2000) zip the output file and
mail to me offlist.

Thanks.

Best regards,
Matthias Andree

Re: [fetchmail-users] Exchange Server 2003 IMAP NTLM - can someone offer me a test account?

[Ben R. <Be...@mu...>]

Matthias Andree wrote:
> Ben Russo schrieb:
>   
>> Help?
>>
>> I can open Outlook or use a browser to log into my account
>> So I know that my username and password are correct.
>> (I have tried to modify some of the info like password hashes and 
>> usernames/hostnames to maintain some security for my company)
>>
>> Username:  user1
>> Domain:    win2k
>>
>> This works fine.
>>
>>
>> When I try to login to the server it fails?
>>
>> [root@linuxdesktop ~]# /usr/local/bin/fetchmail -v -v -v -c  -p IMAP -L 
>> Fetchlog --auth ntlm -u "user1@win2k" mailserver.win2k.domain.com
>>
>>     
>   
Thanks for your reply!  What a great user community.
And thanks to Mr. MacGregor too.

With a little help from the Exchange Server admin I got squared away.
He had to turn on logging on the server, and then checked the log.
We found error 0x80040920 every time I tried to authenticate.
    http://support.microsoft.com/kb/296387

He opened up my account in the Windows Directory server (or Exchange server)
and changed the mailbox alias so that it matched my Windows Login name
"user1"
The mailbox alias was  "User.1"  (where User is my first name and "1" 
was my last name"
He also adjusted the primary and secondary SMTP alias, but I don't know 
if that was necessary.
It was primary SMTP Us...@do...
and secondary smtp  us...@do...
He swapped the two.

Immediately after that it works fine.
So I am all set.

BTW, it can also fetch other folders in *my* mailbox.
with

      -r "INBOX,Spam/Spam - Quarantine"

on the command line.

My .fetchmailrc looks like this:

set postmaster "linuxuser"
set bouncemail
set no spambounce
set properties ""
set logfile /home/linuxuser/.fetchmaillog
set no syslog
poll mailserver.win2k.domain.com with proto IMAP, auth ntlm user 
"user1@win2k" with pass 'MyPassWord' is linuxuser here options fetchall

My crontab looks like:

*       *       *       *       *        /usr/local/bin/fetchmail -L 
/home/linuxuser/.fetchmaillog -t 10 -B 10 -r "INBOX,Spam/Spam - 
Quarantine" > /dev/null


Seems to work GREAT!

Thanks again.