Persistent authentication requests on mobile devices

romaccount

Hello, I’m running my mailcow with docker since about 4 or 5 years.. A few weeks ago i decided to put everything behind a NGINX reverse proxy to have multiple different services also in one place.. All in all everything works fine, but on iOS/MacOS mail and also Samsung mail app we now often get a authentication popup wanting to reenter credentials.. In Outlook there are no errors.. The domain and ip address stayed the same (just resized the server on hetzner).
I followed the steps provided in the docs, my mailcow.conf has those lines:

MAILCOW_HOSTNAME=mail.mydomain.io
HTTP_PORT=8080
HTTP_BIND=127.0.0.1
HTTPS_PORT=8443
HTTPS_BIND=127.0.0.1

The docker compose part for the reverse proxy looks like this

nginx:
    image: nginx:latest
    container_name: nginx_proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /opt/web/nginx/conf.d:/etc/nginx/conf.d
      - /opt/web/certbot/conf:/etc/letsencrypt
      - /opt/web/certbot/www:/var/www/certbot
      - /opt/mailcow-dockerized/data/assets/ssl/mail.mydomain.io:/etc/nginx/certs/mailcow:ro
    depends_on:
      - wordpress
      - phpmyadmin
    networks:
      - web-network
      - mailcow-network
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"

My NGINX conf for the reverse proxy for mailcow looks like this:

# Mailcow proxy
upstream mailcow {
    server nginx-mailcow:8080;
    keepalive 32;
}

upstream mailcow-ssl {
    server nginx-mailcow:8443;
    keepalive 32;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      "";
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name mail.mydomain.io autodiscover.mydomain.io autoconfig.mydomain.io;

    # ACME challenge for Let's Encrypt
    location /.well-known/acme-challenge/ {
        proxy_pass http://mailcow;
        proxy_set_header Host $host;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name mail.mydomain.io autodiscover.mydomain.io autoconfig.mydomain.io;

    ssl_certificate /etc/nginx/certs/mailcow/cert.pem;
    ssl_certificate_key /etc/nginx/certs/mailcow/key.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    client_max_body_size 0;

    location /Microsoft-Server-ActiveSync {
        proxy_pass https://mailcow-ssl/Microsoft-Server-ActiveSync;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_connect_timeout 75s;
        proxy_send_timeout 3650s;
        proxy_read_timeout 3650s;
        proxy_buffers 64 512k;
        client_body_buffer_size 512k;
    }

    location / {
        proxy_pass https://mailcow-ssl;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_buffering off;
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
        # SOGo proxy buffers (needed since 2022-04 update)
        proxy_buffer_size 128k;
        proxy_buffers 64 512k;
        proxy_busy_buffers_size 512k;
    }
}

All occurences of mail.mydomain.io are of course normally the correct domain.
SoGo works normally, sending and receiving mails also. Calenders also work, even in the mobile apps. Just that re-appearing authentication popup.

ETNyx

I would try to check your certificate what shows echo | openssl s_client -connect mail.mydomain.io:993 -servername mail.mydomain.io ?

DocFraggle

IMAP doesn’t use port 443, so all of your config you pasted above doesn’t really matter. Your clients will connect via port 993

ETNyx

Seams MC is ACME of use,… I expect you change broke renewal of your certs, that is on 443|80 ports,.. That’s why I want you to check your certificate using openssl

DocFraggle

ETNyx I just checked his SSL cert (FQDN was present in his original post), seems ok so far

romaccount

Hi, thats the result of the openssl command:

CONNECTED(00000005)
depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=R13
verify return:1
depth=0 CN=mail.mydomain.io
verify return:1
---
Certificate chain
 0 s:CN=mail.mydomain.io
   i:C=US, O=Let's Encrypt, CN=R13
   a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Jan 14 12:40:10 2026 GMT; NotAfter: Apr 14 12:40:09 2026 GMT
 1 s:C=US, O=Let's Encrypt, CN=R13
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGjDCCBXSgAwIBAgISBsmlPefcXXkiGqqbTWNWl9oCMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTMwHhcNMjYwMTE0MTI0MDEwWhcNMjYwNDE0MTI0MDA5WjAYMRYwFAYDVQQD
Ew1tYWlsLm5vb290LmlvMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
6ak5oQo/f0SADVakjvuQ9t74uOGCtA9p/hCF+1NBjLBuY7rDJjHdeqlybmDTV+Fx
r7c0WjEIznPBmfDv8tXZwFFh7e/S/zCzqVlHhrbYE29QUR3GHcXaTJv6YtotQE68
J7zGf8HuEg9xm5G+T7ODJ7vKHSGW2BmVb75d0WJ02sI8SdlgGHRMSQbFx5/O7zmM
IKfJw4TYV4P9KLaQZYXV3ONo7EYO0h/94UuGA26+Yug1EI071O6nP8JcVrN1ZpZJ
ZvXkYjZr2Vcz3KXaVGXtz5NPnTXZpbgRIEqzvihJtyvWDoh86wWXvmTdB/HagkaD
1wPdwQ4b5DOXdYjKf4YuuSXJ7P5oFKVZv6wyWBCunkUExs2ki6ZbGbOB2gciZjLh
vTSMG/XOkvoocg9A+VZyipF/0JA7W70gARmfcVO4y0rAFew6OxBsuG+2IUlyjpbT
apCjGcA3HROJrXqN9idyhXI0UsAXggEgNeN8Y/pEZcQTL2cWPqQUTQamBeanYMdz
i3UN5oOzl1K2XyM2lCOarCgvxJg/1uhnTgIImIQNYPHhIJOJTcPWxyF/qtTO7S3z
Vizc+oGs6xPkRsKcEoeEmbZChtEon9Qdkqqbitl9QYe3gq+nGr3hbRkEqSruJUaH
H2d644jjZdSL3WOdrA2tOti/U7CQy71G+8+thboTagcCAwEAAaOCArMwggKvMA4G
A1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYD
VR0TAQH/BAIwADAdBgNVHQ4EFgQUNGVAV0dyTsz3vZsZaEixd1HwBuwwHwYDVR0j
BBgwFoAU56ufDywzoFPTXk94yLKEDjvWkjMwMwYIKwYBBQUHAQEEJzAlMCMGCCsG
AQUFBzAChhdodHRwOi8vcjEzLmkubGVuY3Iub3JnLzCBpgYDVR0RBIGeMIGbghhh
dXRvY29uZmlnLmxlcm5zdGl0dXQuYXSCE2F1dG9jb25maWcubm9vb3QuaW+CEmF1
dG9jb25maWcucHVuei5pb4IaYXV0b2Rpc2NvdmVyLmxlcm5zdGl0dXQuYXSCFWF1
dG9kaXNjb3Zlci5ub29vdC5pb4IUYXV0b2Rpc2NvdmVyLnB1bnouaW+CDW1haWwu
bm9vb3QuaW8wEwYDVR0gBAwwCjAIBgZngQwBAgEwLQYDVR0fBCYwJDAioCCgHoYc
aHR0cDovL3IxMy5jLmxlbmNyLm9yZy8zLmNybDCCAQwGCisGAQQB1nkCBAIEgf0E
gfoA+AB1ABaDLavwqSUPD/A6pUX/yL/II9CHS/YEKSf45x8zE/X6AAABm7y62AAA
AAQDAEYwRAIgQr1GDHwkJTLFYOeTSKDjNon9NBK5MxvUjP5LdZL0PNkCIFcQV1J9
VQqF+JmYj+2Lt4489n9djlxHpTfsFdNsSOhnAH8Apcl4kl1XRheChw3YiWYLXFVk
i30AQPLsB2hR0YhpGfcAAAGbvLraPgAIAAAFAC72gJwEAwBIMEYCIQCAiNRPc5dO
uYfLQKpvej7btN2Y3lVYTDIk7k0E0KcT9gIhAORly7JF0DkjBej73Vloc4R5Fp9j
CWwagxvvJFcBtEtCMA0GCSqGSIb3DQEBCwUAA4IBAQAEoalH69XeSLL6hzvtZzt6
9AhVGMDT0CHemyCNYTNmjRjEd+1fhVgLyRRmYmW+tGQgj2i/L2ujoxEBufGLOOES
+7OQCg/OE7onTZUcqkYM0pIjBJHbGlwru35uK1u/urLi5Ba2ivE4fm++2JXroR0o
EscDz2+JsuNyEBuR2mGJuGXjp9QBu5KKX8itm1KpIISFfyx1vJwe/G64f2akJzha
VhrPoq0c8tzW6Cks5lr2Vx3+sCa3JGGBbni5PKMmqw/EwYmaDtY2GF/eNzDWrY7+
Scpci6G6RzzBQZEzvZDpbpE5Om4ZpZIopr9IXnE0tlLQtiCFrGy+rn4VzI3P+EnG
-----END CERTIFICATE-----
subject=CN=mail.mydomain.io
issuer=C=US, O=Let's Encrypt, CN=R13
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: rsa_pss_rsae_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 3790 bytes and written 1624 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Server public key is 4096 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
DONE```

romaccount

Could it be because there are different domains using the same mailserver? like mail@domain1.com and mail@domain2.com both use mail.mydomain.io as mailserver..
I never saw the message before putting mailcow behind the reverse proxy…

DocFraggle

romaccount No, this is absolutely no problem.
You said you are running multiple services on your server now, did you check the load of the server? Maybe this happens when the server’s load is very high?

Also, check the logs at the specific timestamp

romaccount

Didn’t check yet, but the server now has 16GB ram and 8 vCPU (Hetzner CX43 Intel/AMD), before the resize it only had 2GB and everything worked fine.
Currently i’m just running a wordpress, mariadb and a phpmyadmin container in addition. Also a dozzle for the docker logs.
Most entries are like these:

Jan 25 21:47:08 225814c56852 dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=172.22.1.13, lip=172.22.1.250
  Jan 25 21:47:08 225814c56852 dovecot: managesieve-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.22.1.13, lip=172.22.1.250
  Jan 25 21:47:21 225814c56852 dovecot: auth-worker(785553): HTTP request failed with closed for user bernhard@punz.io
  Jan 25 21:47:21 225814c56852 dovecot: auth-worker(785553): HTTP request failed with closed for user bernhard@punz.io
  Jan 25 21:47:21 225814c56852 dovecot: auth-worker(785553): conn unix:auth-worker (pid=135,uid=401): auth-worker<4>: lua(bernhard@punz.io,2001:871:265:b67a:3dd8:a981:f0d:1bd1): Password mismatch (SHA1 of given password: a26e6d)

When taking a look at dozzle directly after the popup happens, nothing conspicuous is shown unfortunately

Just in, happened again
That are the logs:
Feb 14 17:22:23 f87909ea7315 dovecot: auth-worker(284372): HTTP request failed with closed for user team@lernstitut.at Feb 14 17:22:23 f87909ea7315 dovecot: auth-worker(284372): conn unix:auth-worker (pid=140,uid=401): auth-worker<5>: lua(team@lernstitut.at,213.164.1.110,<vXNqIMtKR7HVpAFu>): Password mismatch (SHA1 of given password: 1782e1) Feb 14 17:22:25 f87909ea7315 dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<team@lernstitut.at>, method=PLAIN, rip=213.164.1.110, lip=172.22.1.250, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Feb 14 17:22:29 f87909ea7315 dovecot: auth-worker(284372): HTTP request failed with closed for user team@lernstitut.at Feb 14 17:22:29 f87909ea7315 dovecot: auth-worker(284372): HTTP request failed with closed for user team@lernstitut.at Feb 14 17:22:29 f87909ea7315 dovecot: auth-worker(284372): conn unix:auth-worker (pid=140,uid=401): auth-worker<7>: lua(team@lernstitut.at,213.164.1.110,<mbGOIMtKR97VpAFu>): Password mismatch (SHA1 of given password: 1782e1) Feb 14 17:22:31 f87909ea7315 dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<team@lernstitut.at>, method=PLAIN, rip=213.164.1.110, lip=172.22.1.250, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

The passwords are correct obviously

DocFraggle

romaccount dovecot: auth-worker(284372): HTTP request failed with closed for user team@lernstitut.at

Hmm, it looks like dovecot is using http for authentication in it’s backend? Wasn’t aware of this. So maybe, in the end, your reverse proxy config IS messing things up somehow….

mcmfe

romaccount we also ran into Password mismatch (SHA1 of given password: XXXXX)errors when migrating to a new server. The problem was that mailcow stored some data in docker volumes that have their persistent data at /var/lib/docker and not in the data/ folder next to the docker-compose.yml as we had assumed initially.

Once we copied the volume data from the old server to the new server mailcow was working like a charm again.

romaccount

And this
Feb 14 18:13:37 f87909ea7315 dovecot: imap-login: Login: user=<patricia@lernstitut.at>, method=PLAIN, rip=213.164.1.110, lip=172.22.1.250, mpid=286926, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Feb 14 18:13:37 f87909ea7315 dovecot: imap(patricia@lernstitut.at)<286926><MHas18tKR1rVpAFu>: Disconnected: Connection closed (SELECT finished 0.084 secs ago) in=124 out=1179 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Feb 14 18:13:40 f87909ea7315 dovecot: lmtp(286181): Connect from 172.22.1.13 Feb 14 18:13:40 f87909ea7315 dovecot: lmtp(286181): Disconnect from 172.22.1.13: Logged out (state=MAIL FROM) Feb 14 18:13:40 f87909ea7315 dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=172.22.1.13, lip=172.22.1.250, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Feb 14 18:13:40 f87909ea7315 dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=172.22.1.13, lip=172.22.1.250 Feb 14 18:13:40 f87909ea7315 dovecot: managesieve-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.22.1.13, lip=172.22.1.250

romaccount

Mh, i asked Claude about this (bear with me) and added
keepalive_timeout 300s; keepalive_requests 100;
to the upstreams
and proxy_buffering on; to the location block. Also re-entered the credentials, maybe this will help.

DocFraggle

Did you also check your config against the Nginx config in the official docs?

https://docs.mailcow.email/post_installation/reverse-proxy/r_p-nginx/

ETNyx

@romaccount

as DocFraggle mentioned, check your nginx config. I would strongly recommend forcing inner communication using http.

Your certificates are bound to your public domain name. When your proxy tries to connect to https://mailcow-ssl, the handshake likely fails because the certificate doesn’t match the internal Docker hostname/IP.

romaccount

ETNyx Thank you, tried that now. Changed the proxy to http://mailcow and also changed the autodiscover part because I saw that it wasn’t autodiscover.* but autodiscover.mydomain.io (probably thats also a problem).
I will have an eye on it and come back if the problem comes again

romaccount

Today I installed Edison mail as test and its interesting because a few minutes ago i got the error again in apple mail but NOT in edison mail, there everything worked as intended. After force closing the apple mail app and restarting it the mail arrived and the error disappeared.

romaccount

Update: a week ago i switched the setup to multi IP
mailcow now listens on the old IP address 168.x.x.x (HTTP_BIND=116.x.x.x, HTTPS_BIND=116.x.x.x, HTTP_PORT=80, HTTPS_PORT=443). Removed mailcow from my the reverse proxy.
Everything else listens on my new IP 116.x.x.x, changed my compose.yml to map ports of nginx to 116.x.x.x:80:80 and 116.x.x.x:443:443.
Thought that this would solve the issue because mailcow isnt anymore behind the reverse proxy but unfortunately not.
Now i thought maybe something in the mailcow installation has been corrupted or so, is there a way to fully reinstall mailcow but preserve the data? (Probably yes because i would be able to migrate to a new server). But i dont want to switch to a new server since i would like to keep the IP and reputation of the server.