February 2003 - dovecot

[dovecot] inetd/xinetd/tcpserver support
by Timo Sirainen 26 Mar '03

26 Mar '03

I was just thinking how they could be easily supported. This would work, right? : imap stream tcp nowait root /usr/sbin/tcpd /usr/local/libexec/dovecot/imap-login imaps stream tcp nowait root /usr/sbin/tcpd /usr/local/libexec/dovecot/imap-login --ssl imap-login would try to connect to master process using some named socket. If it couldn't, it would create the master process itself. Master process would work as usual (executes auth and imap processes), except it wouldn't be executing login processes. This wouldn't require much code changing, and it would still be using all the same privilege separations as the standalone version so it would be just a secure. Only thing I'm wondering is if any of the TCP wrappers care about the created child processes? The master process would have to stay alive after the connection that created it dies. I guess I'll implement this soon and try if it works.

7 20

[dovecot] IMAP Folder paths
by Juergen Kahnert 07 Mar '03

07 Mar '03

Hello, we like to use dovecot, but our old imapd used to store the paths of the folder in the file ~/.mailboxlist. This file contains something like this: mail/read mail/dovecot .netscape/imap/mailbox .Mail/foo Each line with a path to one mbox folder. And please pay attention that there is no path to the inbox, because this is stored on the server... Is there a way to use this files with dovecot? It would be a real pain to change this for a few thousand user... Do you see a chance of using such a file? Or is it already possible and I'd overlooked it? Or is it easy / hard to implement? kind regards, Jürgen Kahnert

5 6

[dovecot] Re: zlib support
by Ian R. Justman 27 Feb '03

27 Feb '03

Timo Sirainen wrote: > Yes, it's been in todo for some time now. mbox support would likely be > read-only, read-write would require recreating the whole .gz file on > updates. Actually, I wouldn't mind seeing something like this so I can compress up my old mail and perhaps store them on CD, for example. I tend to archive mailing list traffic by month (which I store in mbox format), so past months tend to not change much, if at all. :) While not an absolute necessity, it'd be nice to have. --Ian.

1 0

[dovecot] zlib support
by seth vidal 27 Feb '03

27 Feb '03

Hi, Silly idea, Ever considered zlib support so the imap server could read through gzipped mbox files or gzipped maildir entries? -sv

2 1

[dovecot] pop3: last, and auth plain
by Mark E. Mallett 27 Feb '03

27 Feb '03

Hi- A couple of comments regarding the POP3 server (I realize the POP3 server is probably low priority though..) One problem is that the "LAST" command is not supported. Some mail clients end up downloading all messages every time because of this (or so I'm told). The biggest source of these remarks is people using the yahoo webmail front end. I wonder if this could be added? Also, under BSD/OS, the "auth plain" mechanism doesn't work. Perusing the mailing list archives, I see that the symptoms appear just like those that were reported earlier for another BSD system. I'm curious as to whether there has been any progress on that front? Yours, -mm-

2 4

[dovecot] 0.99.8 released
by Timo Sirainen 25 Feb '03

25 Feb '03

Hope I didn't forget anything :) v0.99.8 2003-02-25 Timo Sirainen <tss(a)iki.fi> * NOTE: Configuration file has changed a bit: auth_userinfo was replaced by userdb and passdb. *_port were merged into *_listen. Disabling listening in imaps port is now done by changing protocols setting. * Maildir: .customflags location has changed for INBOX. If you have set any custom flags, move Maildir/.INBOX/.customflags into Maildir/.customflags or they will be lost. * mbox: Autodetect /var/mail/%u and /var/spool/mail/%u as INBOXes if they're found and mail_default_env isn't set. * passwd-file: File format changed a bit. If you used realm or mail fields, you'll have to fix the file. See doc/auth.txt for description of the format. + Fully featured POP3 server included. Disabled by default. + Support for LITERAL+, MULTIAPPEND, UNSELECT, IDLE, CHILDREN and LISTEXT extensions. + LDAP authentication support. + Internal API cleanups made Dovecot faster and take less memory + auth_verbose logs now all authentication failures + Support for Solaris 9 sendfilev() + New setting: mail_full_filesystem_access allows clients to access the whole filesystem by simply giving the path before the mailbox name (eg. SELECT ~user/mail/box, LIST "" /tmp/%). While this allows users to share mailboxes, it's not recommended since Dovecot's index files can't be safely shared. + New setting: client_workarounds. + Dynamically loadable authentication modules. Binary package builders should consider using it for at least LDAP. + mbox: Content-Length is saved now to each saved message, so it's now safe to have lines beginning with "From ". + mbox: mail_read_mmaped = no works with it now + Indexes can be kept in memory by adding :INDEX=MEMORY to MAIL environment. There's not much point to do this now though, since the UIDs won't be saved. - COPY now behaves as RFC2060 says: "If the COPY command is unsuccessful for any reason, server implementations MUST restore the destination mailbox to its state before the COPY attempt." - LIST and LSUB rewrite, should fix several bugs in them - maildir_copy_with_hardlinks = yes was broken. - mboxes in subfolders weren't selectable. - STORE didn't accept multiple flags without () around them - PLAIN SASL-authentication was a bit broken. - IMAP dates were parsed a few hours wrong - STATUS command removed \Recent flags from messages - Several bugfixes to SEARCH command, especially related to multiple search conditions - If auth/login process died unexpectedly at startup, the exit status or killing signal wasn't logged. - mbox parsing might have crashed sometimes - mbox: when saving mails, internal headers were allowed in input, sometimes causing problems (eg. duplicate headers) when appending and copying messages - mbox: X-Keywords headers were duplicated - Some small fixes to how messages are saved to Maildir - Next command after STARTTLS was ignored which left the connection stuck sometimes - Dovecot was pretty much broken with FreeBSD

1 0

[dovecot] Re: Configuration file format changes
by Timo Sirainen 25 Feb '03

25 Feb '03

On Tue, 2003-02-25 at 02:56, Brad Figg wrote: > Just my $.02 (and that's probably overcharging). Anytime I need > a config file I use XML and an open source parser. I hate XML config files. Not going to happen. Ever. :) I think they're difficult to read with standard text editor. Even more difficult to modify. And creating read-only parser for just about any config file format doesn't take hardly any time. External XML libraries would also annoy people.

2 1

[dovecot] Configuration file format changes
by Timo Sirainen 25 Feb '03

25 Feb '03

After tomorrow's 0.99.8 release I think it's time for a new config file format. It could be made backwards compatibile with the old format, but there would be new tree-like categories. I was thinking something like this: # global settings protocols = imap # "foo.server.org" is just descriptive name # settings inside server { .. } will override global ones. # groups (namespace, login settings, auth settings) aren't replaced # unless same name is used. server foo.server.org { imap_listen = 1.2.3.4 ssl_cert_file = /etc/ssl/certs/foo.cer # default namespace (no name) namespace { type = private mail = mbox:~/mail } # Have to quote so '#' won't be thought out as comment. # I think quoting should work everywhere actually.. namespace "#maildir" { type = private inbox = yes # this namespace contains INBOX mail = Maildir:~/Maildir } # override global auth default auth default { auth_mechanisms = plain digest-md5 auth_realms = foo.server.org auth_userdb = ldap /etc/dovecot-ldap.conf auth_passdb = ldap /etc/dovecot-ldap.conf } } server bar.server.org { imap_listen = 1.2.3.5 ssl_cert_file = /etc/ssl/certs/bar.cer namespace { type = private #mail = #autodetect } # shared mailboxes between users # eg. user/timo.sirainen/some-shared-folder namespace user { type = user mail = /home/%u/mail/shared } } server baz.server.org { imap_listen = 1.2.3.6 ssl_disable = yes # Only Courier-like INBOX namespace namespace INBOX { type = private } } # common namespace between all instances namespace shared { type = shared mail = mbox:/var/lists:INDEX=~/mail/.shared/ } auth default { auth_mechanisms = plain auth_userdb = passwd auth_passdb = pam }

1 1

[dovecot] Maildir plus mbox?
by wolfgang 25 Feb '03

25 Feb '03

is it possible with dovecot to have the inbox in Maildir format and additional imap folders in mbox format? regards, wolfgang

2 2

[dovecot] Re: Trouble setting up dovecot
by Tim Snider 24 Feb '03

24 Feb '03

Thanks Timo, turns out I'm more of a rookie at sysconfiguring than I thought, so perhaps this helps identify stuff that a rookie wouldn't already know...<G> On Thu, 2003-02-20 at 19:46, Timo Sirainen wrote: > > > I've not configured up LDAP on my server yet, so it's just plain PAM for > > now. I'm able to login fine with all my other apps, so I doubt it's a > > problem with PAM, but not impossible. I haven't done anything with PAM > > on this machine yet as it's live. I've been testing things out on > > another machine(NON-SMP/RH8), which I'll try tomorrow if I get a > > chance.) > > You have to have it configured in /etc/pam.d/imap. For example: > > auth required pam_unix.so nullok > account required pam_unix.so Thanks this makes more sense than the options you provide in doc/auth.txt, so you may wish to change that. On both RH7.3 and a RH8.0 box here, I don't have pwdfile, it's apparently been replaced by other functionality. > > > each imap-login is waiting at a read(7, > > That's the problem then. It really shouldn't be blocking there. Could > you get the backtrace to see where it's hanging? ie. run as root: > > gdb /usr/local/libexec/dovecot/imap-login <pid of the imap-login> > > and "bt" in it. It's hung up in SSL_CTX_use_PrivateKey() in ssl-proxy-openssl.c, which as you correctly surmised below, is due to a password protected key. I've located and used mkcert.sh. As a note the only docs for doc/mkcert.sh are halfway through the NEWS file and rapidly receeding as you add new releases, (congrats on the fast progress by the way!), however you might consider adding a short note about it to the doc/auth.txt or doc/configuration.txt file for those new to dovecot. > > > I do call fflush() after each write to log. Killing with SIGTERM will do > > > clean exit which may log more things, maybe it's just that? Also killing > > > child processes makes master process log their exits. > > > > I usually note the messages log (watched by a tail -f) show up after I > > kill the dovecot master process.(Kill -9) > > Depends on what the messages are I guess. But if you're kill -9ing the > master process, it's quite likely that the child processes will complain > about losing it. After playing a bit, I think that those messages were due to the kill -9, SIGTERM is nicer. I still end up with little in the way of verbose debugging messages, by my standards. Usually all I see is login and logout messages. Otherwise, I get the occasional lockfile message, which is something that I need to sort out with Exim, and completely on my end. > > dovecot: Feb 20 18:11:51 Info: Dovecot starting up > > imap-login: Dec 31 16:00:00 Fatal: Can't load private key file > > /usr/local/ssl/private/cedarintkey.pem: error:0906406D:PEM > > routines:DEF_CALLBACK:problems getting password > > Err, isn't this the reason why your SSL doesn't work? :) Or was that > just an example? If your private key is crypted with some password, > Dovecot can't use it at least currently.. Correct! Doh! I have been able to use imaps, since I built a non-passworded private key. I was using passworded keys that I'd built for Apache, and would eventually like to have one set of keys that I can reference for each virtual domain. Were you planning on something like the Apache startssl option? I can live with the constraint of one 'connection' key for now. Have you considered allowing each virtual domain to have it's own keys? Kind of difficult as the secure pipe to the server is already in place by the time the login name is seen... Kinda makes it tough for a true virtual presence without explicit assigned IP's. Hmmm, any plans for at least a different keys/identity per IP? If I understand the configuration file for now, it seems to be designed for one cert per machine. Thanks for the help, I've just got to sort out the lockfile differences between Exim and Dovecot and I should then be functional. After that I'll start using LDAP. TJ

2 1