October 2006 - dovecot

[Dovecot] Conf parsing error
by Adnae Mac Uthidir 16 Oct '06

16 Oct '06

Dear Timo, I have found a conf-parse bug in rc10. If the last line in the configuration-file a }, the parser ignore this. Example: ----------------------------- brugh ~ # cat /etc/dovecot/dovecot.conf [...] plugin { trash = /etc/dovecot/trash.conf } brugh ~ # dovecot -c /etc/dovecot/dovecot.conf Error: Missing '}' ----------------------------- Add a empty line at the end of file and you can start without errors ;) -- Mit freundlichen Grüßen Adnae Mac Uthidir mailto:adnaeuthidir@gmail.com

2 1

[Dovecot] Segfault in in rc7 when index does not exists
by Marco Nenciarini 16 Oct '06

16 Oct '06

This is the trace (gdb) run Starting program: /root/tmp/dovecot-1.0.rc7/src/imap/imap x select inbox Program received signal SIGSEGV, Segmentation fault. mail_index_write_base_header (index=0x80e2a28, hdr=0xaff66028) at mail-index.c:1313 1313 memcpy(index->map->mmap_base, hdr, hdr_size); (gdb) bt #0 mail_index_write_base_header (index=0x80e2a28, hdr=0xaff66028) at mail-index.c:1313 #1 0x080902eb in mail_index_mark_corrupted (index=0x80e2a28) at mail-index.c:1839 #2 0x0809ca30 in mail_transaction_log_file_create (log=0x80e3928, path=0x80d2130 "/dovecot.index.log", dev=0, ino=0, file_size=0) at mail-transaction-log.c:575 #3 0x0809e138 in mail_transaction_log_file_open_or_create (log=0x80e3928, path=0x80d2130 "/dovecot.index.log") at mail-transaction-log.c:803 #4 0x0809e65c in mail_transaction_log_open_or_create (index=0x80e2a28) at mail-transaction-log.c:240 #5 0x08092f21 in mail_index_open (index=0x80e2a28, flags=MAIL_INDEX_OPEN_FLAG_CREATE, lock_method=MAIL_INDEX_LOCK_FCNTL) at mail-index.c:1489 #6 0x0808aa52 in index_storage_mailbox_init (ibox=0x80e3548, index=0x80e2a28, name=0x80c32e4 "INBOX", flags=0, move_to_memory=false) at index-storage.c:362 #7 0x08064d68 in maildir_open (storage=0x80dd420, name=0x80c32e4 "INBOX", flags=<value optimized out>) at maildir-storage.c:487 #8 0x08065628 in maildir_mailbox_open (_storage=0x80dd420, name=0x80c32e4 "INBOX", input=0x0, flags=0) at maildir-storage.c:560 #9 0x08059917 in _cmd_select_full (cmd=0x80dd62c, readonly=false) at cmd-select.c:32 #10 0x08059af7 in cmd_select (cmd=0x80dd62c) at cmd-select.c:92 #11 0x0805b3d4 in _client_input (context=0x80dd5e8) at client.c:377 #12 0x080b7f96 in io_loop_handler_run (ioloop=0x80db9c0) at ioloop-poll.c:199 #13 0x080b7348 in io_loop_run (ioloop=0x80db9c0) at ioloop.c:281 #14 0x0806316e in main (argc=Cannot access memory at address 0x0 ) at main.c:280 (gdb) p index->map $1 = (struct mail_index_map *) 0x0 (gdb) the envisonment is: DBOX_ROTATE_DAYS="1" DBOX_ROTATE_MIN_SIZE="16" DBOX_ROTATE_SIZE="2048" DOVECOT_VERSION="1.0.rc7" HOME="/srv/vmbox/spool/test/" IMAP_CLIENT_WORKAROUNDS="outlook-idle" IMAP_MAX_LINE_LENGTH="65536" IP="::ffff:127.0.0.1" LOCK_METHOD="fcntl" LOGGED_IN="1" LOG_TO_MASTER="1" MAIL="maildir:/" MAILBOX_IDLE_CHECK_INTERVAL="30" MAIL_CACHE_FIELDS="flags" MAIL_CACHE_MIN_MAIL_COUNT="0" MAIL_MAX_KEYWORD_LENGTH="50" MAIL_NEVER_CACHE_FIELDS="imap.envelope" MBOX_DIRTY_SYNCS="1" MBOX_DOTLOCK_CHANGE_TIMEOUT="120" MBOX_LAZY_WRITES="1" MBOX_LOCK_TIMEOUT="300" MBOX_MIN_INDEX_SIZE="0" MBOX_READ_LOCKS="fcntl" MBOX_WRITE_LOCKS="dotlock fcntl" POP3_CLIENT_WORKAROUNDS="" POP3_LOGOUT_FORMAT="top=%t/%p, retr=%r/%b, del=%d/%m, size=%s" POP3_UIDL_FORMAT="" RESTRICT_CHROOT="/srv/vmbox/spool/test" RESTRICT_GID_FIRST="1" RESTRICT_SETEXTRAGROUPS="mail" RESTRICT_SETGID="200" RESTRICT_SETUID="200" STDERR_CLOSE_SHUTDOWN="1" SYSLOG_FACILITY="16" USER="test(a)prato.linux.it" The directory /srv/vmbox/spool/test contains: # find /srv/vmbox/spool/test /srv/vmbox/spool/test /srv/vmbox/spool/test/cur /srv/vmbox/spool/test/new /srv/vmbox/spool/test/tmp I hope this is enougth Please keep me on CC because i'm not subscribed. Ciao P.S: the rc8 do exactly the same. -- --------------------------------------------------------------------- | Marco Nenciarini | Debian/GNU Linux Developer - Plug Member | | mnencia(a)prato.linux.it | http://www.prato.linux.it/~mnencia | --------------------------------------------------------------------- Key fingerprint = FED9 69C7 9E67 21F5 7D95 5270 6864 730D F095 E5E4

2 5

[Dovecot] File isn't in mbox format: /home/foo/mail/Trash
by James Lupolt 16 Oct '06

16 Oct '06

Hello, I'm seeing the following error on a server: File isn't in mbox format: /home/foo/mail/Trash The Trash file is full of the following at the beginning: ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^ I've repaired the file several times, but this keeps happening. Would any of you mind offering me some insight into what could be causing this and how to fix it? Below is some information about the system: [root@server1 mail]# uname -a Linux server1.example.com 2.6.9-42.0.2.EL #1 Thu Aug 17 17:36:53 EDT 2006 i686 athlon i386 GNU/Linux [root@server1 mail]# cat /etc/redhat-release Red Hat Enterprise Linux ES release 4 (Nahant Update 4) [root@server1 mail]# rpm -qa|grep -i dovecot dovecot-0.99.11-4.EL4 [root@sever1 mail]# rpm -qa|grep -i sendmail sendmail-cf-8.13.1-3.RHEL4.5 sendmail-8.13.1-3.RHEL4.5 Here's everything that isn't a comment or blank line in dovecot.conf: [root@server1 mail]# grep -v ^# /etc/dovecot.conf|grep -v ^$ protocols = imap imaps pop3 pop3s imap_listen = [::] pop3_listen = [::] login_dir = /var/run/dovecot-login login = imap login = pop3 mbox_locks = flock auth = default auth_mechanisms = plain auth_userdb = passwd auth_passdb = pam auth_user = root Any advice would be appreciated. Best Regards, James Lupolt

2 1

[Dovecot] System-wide sieve script?
by Ty! Boyack 16 Oct '06

16 Oct '06

In the dovecot LDA documentation, it mentions having sieve scripts located in ~/.dovecot.sieve, which works great for per-user sieve code. I was trying to find out if there was a system-wide sieve script (maybe /etc/dovecot.sieve?) that would hopefully be run first, followed by any per-user sieve code. Anyone know if this is already possible, or if not, if there are any plans to implement this? I'm assuming one could make a kludgey fix by having every .dovecot.sieve include a system-wide file, but that would allow a user to remove that "include" if they choose. I'd like to have a centrally controlled, immutable set of rules that all mail goes through. If I missed something in the wiki or archives, I offer my apologies in advance. Thanks! -Ty!

5 7

[Dovecot] LDAP Memory Leak
by Daniel 16 Oct '06

16 Oct '06

Hi Timo I use LDAP auth on a system with around 2000 email account. I use dual OpenLDAP servers. I haven't noticed a leak of memory. Is there any more information and I will have a look to see if I can see anything that might help. Is it only affecting certain machines or all? Regards Daniel Rowe Date: Mon, 16 Oct 2006 02:39:26 +0300 From: Timo Sirainen <tss(a)iki.fi> Subject: [Dovecot] 1.0.rc10 released To: dovecot-news(a)dovecot.org, dovecot(a)dovecot.org Message-ID: <1160955566.5448.126.camel@hurina> Content-Type: text/plain; charset="us-ascii" http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz.sig I've finally read all the mails in the mailing list and in my INBOX. If I haven't replied to some of your mail, please resend it. Remember that since 1.0.rc9 release dovecot.index.cache files will get rebuilt in 64bit systems, and it's probably better to delete them manually so you don't get errors in log files. There are only a couple of issues left in my v1.0-TODO list: - Master process appears to be leaking log fds with kqueue. Could someone again give me access to a system where this happens? - Login process problems. How well does it work now? Hopefully well enough that v1.0 could be released. - LDAP authentication is leaking memory? Can anyone confirm this? Even better, can someone figure out what exactly is leaking? :) Not a v1.0 blocker though. I think v1.0 will be released once no-one has reported any major problems for a Dovecot release in 2-4 weeks. I think login process handling is the only potentially major problem left. There are a few patches from people that I haven't forgotten, but I've decided not to put them into v1.0 anymore: - Filesystem quota group. I don't think it's that important feature, and it might break something. - HFS+ hardlink avoiding - Managesieve - vmailmgr support And finally the changes in this release: * When matching allowed_nets IPs, convert IPv6-mapped-IPv4 addresses to actual IPv4 addresses first. + IMAP: Try to avoid sending duplicate/useless message flag updates + Added support for non-plaintext authentication for vpopmail if it returns plaintext passwords. Based on patch by Remi Gacogne. + Added %D modified to return "sub.domain.org" as "sub,dc=domain,dc=org" (for LDAP queries). Patch by Andrey Panin. - rc9 broke cache files in 64bit systems - deliver works now with mail_chroot - auth cache didn't work properly with multiple passdbs - Fixes to handling CRLF linefeeds in mboxes.

2 1

[Dovecot] Dovecot and CRAM-MD5 authentication (brief) HOWTO
by James Turnbull 16 Oct '06

16 Oct '06

Hi all, I just finished configuring CRAM-MD5 for Dovecot and noted there were not a lot of resources out there that described the process. I've written up a rough and brief HOWTO at: http://www.kartar.net/weblog/cram-md5-authentication-with-dovecot/ Comments welcome and hope it helps someone. Regards James Turnbull -- James Turnbull <james(a)lovedthanlost.net> --- Author of Pro Nagios 2.0 (http://www.amazon.com/gp/product/1590596099/) Hardening Linux (http://www.amazon.com/gp/product/1590594444/) --- PGP Key (http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0C42DF40)

1 0

[Dovecot] LDAP Memory Leak
by Daniel 16 Oct '06

16 Oct '06

Hi Timo I use LDAP auth on a system with around 2000 email account. I use dual OpenLDAP servers. I haven't noticed a leak of memory. Is there any more information and I will have a look to see if I can see anything that might help. Is it only affecting certain machines or all? Regards Daniel Rowe Date: Mon, 16 Oct 2006 02:39:26 +0300 From: Timo Sirainen <tss(a)iki.fi> Subject: [Dovecot] 1.0.rc10 released To: dovecot-news(a)dovecot.org, dovecot(a)dovecot.org Message-ID: <1160955566.5448.126.camel@hurina> Content-Type: text/plain; charset="us-ascii" http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz.sig I've finally read all the mails in the mailing list and in my INBOX. If I haven't replied to some of your mail, please resend it. Remember that since 1.0.rc9 release dovecot.index.cache files will get rebuilt in 64bit systems, and it's probably better to delete them manually so you don't get errors in log files. There are only a couple of issues left in my v1.0-TODO list: - Master process appears to be leaking log fds with kqueue. Could someone again give me access to a system where this happens? - Login process problems. How well does it work now? Hopefully well enough that v1.0 could be released. - LDAP authentication is leaking memory? Can anyone confirm this? Even better, can someone figure out what exactly is leaking? :) Not a v1.0 blocker though. I think v1.0 will be released once no-one has reported any major problems for a Dovecot release in 2-4 weeks. I think login process handling is the only potentially major problem left. There are a few patches from people that I haven't forgotten, but I've decided not to put them into v1.0 anymore: - Filesystem quota group. I don't think it's that important feature, and it might break something. - HFS+ hardlink avoiding - Managesieve - vmailmgr support And finally the changes in this release: * When matching allowed_nets IPs, convert IPv6-mapped-IPv4 addresses to actual IPv4 addresses first. + IMAP: Try to avoid sending duplicate/useless message flag updates + Added support for non-plaintext authentication for vpopmail if it returns plaintext passwords. Based on patch by Remi Gacogne. + Added %D modified to return "sub.domain.org" as "sub,dc=domain,dc=org" (for LDAP queries). Patch by Andrey Panin. - rc9 broke cache files in 64bit systems - deliver works now with mail_chroot - auth cache didn't work properly with multiple passdbs - Fixes to handling CRLF linefeeds in mboxes.

1 0

[Dovecot] Apple Mail quota display
by Timothy Martin 15 Oct '06

15 Oct '06

I know this isn't necessarily a dovecot issue, but I was wondering if anyone has the quota displaying correctly in Apple Mail? I have it set up and working and displaying properly in thunderbird, roundcube (webmail), and squirrelmail. But for some reason Apple's Mail doesn't show the values or its nice thermometer bar. Are there additional configuration options for quota not documented on the wiki? .tim

2 3

[Dovecot] Duplicate mails
by Vegar Nilsen 15 Oct '06

15 Oct '06

Hi, one of our customers reported a problem after we moved her maildir to another disk. (Jail in FreeBSD 6, moved to another disk with rsync.) For some reason she's seeing duplicates of almost every message from November, 2005 until June, 2006 (the move happened in September, 2006.) It seems like these mails have been respooled somehow and been inserted into the maildir with the same date and time as the original: root#loc [</var/gopostal/maildirs/wow/lina/cur>] diff 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac root#loc [</var/gopostal/maildirs/wow/lina/cur>] ls -l 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf -rw------- 1 mailnull mail 7755 Nov 24 2005 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf root#loc [</var/gopostal/maildirs/wow/lina/cur>] ls -l 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac -rw------- 1 mailnull mail 7755 Nov 24 2005 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac As the diff command shows these mails are identical, except that one was created about 10 months after the other. 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac was written by Exim in November (we've configured Exim to add the size (",S=7755") to the file name), but I have no idea where the other file comes from. Could this be Dovecot that has recreated these mails for some reason? (Since the file names are different I doubt that this happened during the rsync, instead it must come from some program that conforms to the maildir standard of naming files. The mailserver had a different name back in November, mail9 was the old name, locusts is the new one.) Originally this file 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf was named 1158863410.P19488Q34M511758.locusts.copyleft.no:2,bf which, if I understand it correctly, means it's unread. (The customer has deleted it since reporting this problem.) root#loc [</var/gopostal/maildirs/wow/lina/cur>] uname -r ; dovecot --version ; exim -bV 6.1-RELEASE 1.0.beta3 Exim version 4.60 #0 (FreeBSD 6.0) built 22-Feb-2006 13:01:52 If anybody has an idea as to what caused this I would really appreciate any pointers or info. Thanks in advance, Vegar Nilsen -- Copyleft Software AS < http://www.copyleft.no/ >

2 1

[Dovecot] Authenticating dovecot against Active Directory using bsdauth and login_ldap
by Martin Croker 15 Oct '06

15 Oct '06

All, I'm working in a multi-platform environment where user accounts are already held in Active Directory. I'm been trying to setup dovecot to perform user authentication against Active Directory using ldap. My Environment is: Platform OpenBSD 3.9 Dovecot Version 1.0.rc7 Active Directory Windows 2003 The approach I've taken (being the only one I was able to make work) is to use login_ldap to perform bind authentication against Active Directory/LDAP and authenticate dovecot using bsdauth. As far as I can tell the dovecot ldap authentication module requires access to the encrypted password field to which Active Directory does not permit access. Simulated LDAP login fails and when debug is enabled writes the following to /var/log/maillog ==== /var/log/maillog ================ Oct 15 20:12:27 server dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=***********************== Oct 15 20:12:27 server dovecot: auth(default): bsdauth(mcrokerx,127.0.0.1): invalid password field Oct 15 20:12:28 server dovecot: auth(default): client out: FAIL 1 user=mcrokerx Oct 15 20:12:38 server dovecot: imap-login: Aborted login: user=<mcrokerx>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured ======================================= It appears that the cause of these log messages are the following lines of code in src/auth/passdb-bsdauth.c ==== src/auth/passdb-bsdauth.c ======== 29 if (!IS_VALID_PASSWD(pw->pw_passwd)) { 30 auth_request_log_info(request, "bsdauth", 31 "invalid password field"); 32 callback(PASSDB_RESULT_USER_DISABLED, request); 33 return; 34 } ======================================= These lines seem to require that the pw structure contains the encrypted password in pw->pw_passwd. Where login_ldap is used against Active Directory the encrypted password is not available to bsdauth and instead pw->pw_passwd contains '*'. If auth_userokay is called independently it is however able to authenticate the user correctly, as such I wonder if the IS_VALID_PASSWD check is actually necessary. It could be that my entire approach is wrong in which case I'm happy to be put right; however it seems that lines 29-34 need modification to correctly support this behaviour of bsdauth. This is beyond my limited ability in c but temporarily removing these lines of code from passdb-bsdauth.c has enabled me to authenticate dovecot against login_ldap (and thereby against Active Directory). My config files are: ==== /etc/dovecot.conf ================ base_dir = /var/dovecot/ ssl_cert_file = /etc/ssl/certs/server.crt ssl_key_file = /etc/ssl/private/server.key disable_plaintext_auth = no login_dir = /var/dovecot/login login_user = _dovecot mmap_no_write = yes protocol imap { imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { pop3_uidl_format = %08Xu%08Xv pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth default { mechanisms = plain passdb bsdauth { } userdb passwd-file { args = /etc/passwd } user = root } plugin { } ======================================= ==== /etc/login.conf (exert) ========== staff:\ :auth=-ldap:\ :x-ldap-server=10.0.0.23:\ :x-ldap-port=389:\ :x-ldap-noreferrals:\ :x-ldap-uscope=subtree:\ :x-ldap-basedn=dc=my,dc=domain,dc=co,dc=uk:\ :x-ldap-binddn=cn=UnixUser,cn=Users,dc=my,dc=domain,dc=co,dc=uk:\ :x-ldap-bindpw=mypassword:\ :x-ldap-filter=(&(objectClass=user)(mail=%u)):\ :datasize-cur=512M:\ :datasize-max=infinity:\ :maxproc-max=256:\ :maxproc-cur=128:\ :requirehome@:\ :tc=default: ======================================= Note: for login_ldap to work it is necessary that the user information (minus password) is replicated on the localhost. I've done this using a relatively inelegant script which for completeness is below. I guess adding some error checking would be a good idea. ==== ldapsync.ksh ===================== #!/bin/ksh ldapsearch -h 10.0.0.23 \ -D cn=UnixUser,cn=Users,dc=my,dc=domain,dc=co,dc=uk \ -b cn=Users,dc=my,dc=domain,dc=co,dc=uk \ -w mypassword \ -v \ -x "(objectClass=user)" | while read key value ; do if [ "$key" == name: ]; then ldap_name="$value" fi # User Mail field as Unix name - remove @my.domain.co.uk if necessary if [ "$key" == mail: ]; then ldap_mail=$( echo "$value" | sed 's/@.*//g' ) if ( id 2>/dev/null >/dev/null $ldap_mail ); then usermod -c "$ldap_name" -s osbin/nologin -g staff -L staff $ldap_mail else useradd -d /home/$ldap_mail -c "$ldap_name" -s /sbin/nologin -m -g staff -L staff $ldap_mail fi ldap_name="" ldap_mail="" fi done ======================================= Martin

2 1