Problems POP3S after upgrade to 8.8.6 ... proxy?

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
Post Reply
Labsy
Outstanding Member
Outstanding Member
Posts: 411
Joined: Sat Sep 13, 2014 12:52 am

Problems POP3S after upgrade to 8.8.6 ... proxy?

Post by Labsy »

Hi,

After migration from Ubuntu 12.04 to Ubuntu 14.04 and upgrading afterwards ZCS 8.0.9 to 8.8.6, I have weird issues with POP3 clients.
Also SSL was upgraded from commercial SHA-2 with SHA-1 root to full SHA-2 with SHA-2 root.

Now, among 2000+ users, I can see some dozens of POP3S connections on port 995, and inside Zimbra Admin I see dozens of POP3S success authentications.
BUT some others, maybe a dozen of them, simply cannot authenticate against POP3S on port 995. They are using Windows 7 with Outlook 2013 or 2016.
SMTP authentication is also required, and they can send using SMTP over 465 or 587 ports, no problem.
Only POP3S is problematic on *SOME* computers.

In nginx log I see:

Code: Select all

[info] 16250#0: *99998 upstream sent invalid response: "-ERR LOGIN failed" while reading response from upstream, client: <client IP>:28801, server: 0.0.0.0:995, login: "<user@domain> ", upstream: 10.10.11.50:7110 (<client IP>:28801->10.10.11.50:995) <=> (10.10.11.50:34574->10.10.11.50:7110)
Any idea?
User avatar
tonster
Zimbra Employee
Zimbra Employee
Posts: 313
Joined: Fri Feb 21, 2014 10:14 am
Location: Ypsilanti, MI
ZCS/ZD Version: Release 8.7.0_GA_1659.RHEL6_64_2016

Re: Problems POP3S after upgrade to 8.8.6 ... proxy?

Post by tonster »

Nginx logs don't seem wrong from what you shared. What's in the mailbox.log?

Sent from my SM-G950U using Tapatalk
Labsy
Outstanding Member
Outstanding Member
Posts: 411
Joined: Sat Sep 13, 2014 12:52 am

Re: Problems POP3S after upgrade to 8.8.6 ... proxy?

Post by Labsy »

Comparing /opt/zimbra/log/nginx.log with .../mailbox.log for the same entry:

Code: Select all

10:05:46 [info] 16249#0: *101233 upstream sent invalid response: "-ERR LOGIN failed" while reading response from upstream, client: <clientIP>:54821, server: 0.0.0.0:995, login: "<cleint@domain.com>", upstream: 10.10.11.50:7110 (<cleintIP>:54821->10.10.11.50:995) <=> (10.10.11.50:37040->10.10.11.50:7110)

10:05:46,055 INFO  [Pop3Server-293] [ip=10.10.11.50;oip=<clientIP>;] account - authentication failed for <client@domain.com>%20 (no such account)
But SMTP authenticates with same client credentials. Also login from Webmail works.

**EDIT**
Seems like the bug from here: viewtopic.php?t=60367
Similar symptoms.
Last edited by Labsy on Tue Feb 20, 2018 10:28 pm, edited 1 time in total.
User avatar
tonster
Zimbra Employee
Zimbra Employee
Posts: 313
Joined: Fri Feb 21, 2014 10:14 am
Location: Ypsilanti, MI
ZCS/ZD Version: Release 8.7.0_GA_1659.RHEL6_64_2016

Re: Problems POP3S after upgrade to 8.8.6 ... proxy?

Post by tonster »

Sounds like they typed something wrong for the pop3 credentials. %20 is the @ symbol. It could be the client they're using is doing during dumb but it seems like clients should know how to handle that properly.

Sent from my SM-G950U using Tapatalk
Labsy
Outstanding Member
Outstanding Member
Posts: 411
Joined: Sat Sep 13, 2014 12:52 am

Re: Problems POP3S after upgrade to 8.8.6 ... proxy?

Post by Labsy »

tonster wrote:Sounds like they typed something wrong for the pop3 credentials. %20 is the @ symbol. It could be the client they're using is doing during dumb but it seems like clients should know how to handle that properly.
Wow, you brought my attention possibly to the culpit of the problem.
%20 is not @ symbol, but SPACE. They copy-pasted either username or password with space at the end of line - I am 95% sure that's the problem.

But still the question remains, how then SMTP WITH AUTHENTICATION works, when in Outlook username and password is only typed once for both, SMTP and POP3 authentication.
Will check tomorrow and report back.
User avatar
tonster
Zimbra Employee
Zimbra Employee
Posts: 313
Joined: Fri Feb 21, 2014 10:14 am
Location: Ypsilanti, MI
ZCS/ZD Version: Release 8.7.0_GA_1659.RHEL6_64_2016

Re: Problems POP3S after upgrade to 8.8.6 ... proxy?

Post by tonster »

Labsy wrote:
tonster wrote:Sounds like they typed something wrong for the pop3 credentials. %20 is the @ symbol. It could be the client they're using is doing during dumb but it seems like clients should know how to handle that properly.
Wow, you brought my attention possibly to the culpit of the problem.
%20 is not @ symbol, but SPACE. They copy-pasted either username or password with space at the end of line - I am 95% sure that's the problem.

But still the question remains, how then SMTP WITH AUTHENTICATION works, when in Outlook username and password is only typed once for both, SMTP and POP3 authentication.
Will check tomorrow and report back.
Ah yes, you're right, space indeed is what I meant! Quite possibly they typed it in one field, then copy/pasted in another (and maybe they used space as the first character instead of the last?). That would explain the discrepancy. I think you're on the right track though!
Post Reply