Re: [fetchmail-users] Exchange Server 2003 IMAP NTLM - can someone offer me a test account?

[Matthias A. <mat...@gm...>]

Ben Russo schrieb:
> Help?
> 
> I can open Outlook or use a browser to log into my account
> So I know that my username and password are correct.
> (I have tried to modify some of the info like password hashes and 
> usernames/hostnames to maintain some security for my company)
> 
> Username:  user1
> Domain:    win2k
> 
> This works fine.
> 
> 
> When I try to login to the server it fails?
> 
> [root@linuxdesktop ~]# /usr/local/bin/fetchmail -v -v -v -c  -p IMAP -L 
> Fetchlog --auth ntlm -u "user1@win2k" mailserver.win2k.domain.com
> fetchmail: WARNING: Running as root is discouraged.
> Enter password for user1@wi...@ma...:
> fetchmail: 6.3.8 querying mailserver.win2k.domain.com (protocol IMAP) at 
> Tue 10 Apr 2007 01:54:03 PM EDT: poll started
> fetchmail: Trying to connect to 172.17.7.217/143...connected.
> fetchmail: IMAP< * OK Microsoft Exchange Server 2003 IMAP4rev1 server 
> version 6.5.7638.1 (mailserver.win2k.domain.com) ready.
> fetchmail: IMAP> A0001 CAPABILITY
> fetchmail: IMAP< * CAPABILITY IMAP4 IMAP4rev1 IDLE LOGIN-REFERRALS 
> MAILBOX-REFERRALS NAMESPACE LITERAL+ UIDPLUS CHILDREN AUTH=NTLM
> fetchmail: IMAP< A0001 OK CAPABILITY completed.
> fetchmail: Protocol identified as IMAP4 rev 1
> fetchmail: IMAP> A0002 AUTHENTICATE NTLM
> fetchmail: IMAP< +
> NTLM Request:
>        Ident = NTLMSSP
>        mType = 1
>        Flags = 0000b207
>         User = user1
>       Domain = win2k
> fetchmail: IMAP> BIGxLONGxHASHxOFxCHARS
> fetchmail: IMAP< + BIGGERxLONGERxHASHxOFxCHARSxREALLYxLONG
> NTLM Challenge:
>        Ident = NTLMSSP
>        mType = 2
>       Domain = WIN2K
>        Flags = 02818205
>    Challenge = 63 47 0c 69 22 98 58 37
> NTLM Response:
>        Ident = NTLMSSP
>        mType = 3
>       LmResp = b6 b6 34 22 cd 1e 80 b1 23 d8 3f db aa be c3 45 9e e4 78 
> 6b f9 ac c4 aa
>       NTResp = 95 5a 76 22 71 12 fb b4 8e 26 0a 8a 22 eb 57 ec 49 ce d0 
> 45 ac 48 32 51
>       Domain = win2k
>         User = user1
>          Wks = user1
>         sKey =
>        Flags = 02818205
> fetchmail: IMAP> ANOTHERxBIGxLONGxHASHxOFxCHARSxREALLYxLONGxTOO
> fetchmail: IMAP< A0002 NO Logon failure: unknown user name or bad password.
> fetchmail: IMAP> A0003 *
> fetchmail: Authorization failure on user1@wi...@ma...
> fetchmail: IMAP> A0004 LOGOUT
> fetchmail: IMAP< A0003 BAD Protocol Error: "Unknown command found".
> fetchmail: IMAP< * BYE Microsoft Exchange Server 2003 IMAP4rev1 server 
> version 6.5.7638.1 signing off.
> fetchmail: IMAP< A0004 OK LOGOUT completed.
> fetchmail: 6.3.8 querying mailserver.win2k.domain.com (protocol IMAP) at 
> Tue 10 Apr 2007 01:54:03 PM EDT: poll completed
> fetchmail: normal termination, status 3

Ben,

sorry to hear of authentication troubles - apparently there's something
wrong in fetchmail. To my excuse, I have contradictory information as to
what goes into the Wks=... field and no authoritative reference on the
NTLM authentication dialogue.

Anyone: Can someone provide me a test account for IMAP access to an
Exchange 2003 server or point me to /authoritative/ documentation as to
the NTLM authentication in IMAP?
I only need IMAP access and a valid mailbox with perhaps a test message.
If you can offer that, please contact me off-list.
I can tunnel with OpenVPN, SSH or Cisco VPN if needed and perhaps also
IPSec.

My only NTLM-enabled servers I can test on are Cyrus IMAPd which are
apparently more forgiving than Exchange 2003.

Ben, if you could capture your Outlook's authentication procedure (DO
NOT USE SAVED PASSWORDS AND DO ENTER SOME BOGUS DATA INSTEAD SUCH AS
foobar- DO NOT USE YOUR REAL PASSWORD) with Wireshark (or Windump or
tcpdump - try windump -w output.dump -s 2000) zip the output file and
mail to me offlist.

Thanks.

Best regards,
Matthias Andree