March 2006 - dovecot - dovecot.org

[Dovecot] Default SELinux policy on Fedora FC4 prevents dovecot service from starting
by slohcine＠verizon.net 09 Mar '06

09 Mar '06

Hello, I recently setup a Fedora FC4 server to host e-mail and webapps. During the install, I turned on SELinux in active mode. All apps seems to work OK but Dovecot daemon won't start. In the audit log, I see this entry when I try to start the dovecot daemon. type=AVC msg=audit(1141464818.541:40305): avc: denied { read } for pid=1989 comm="dovecot" name=dovecot.pem dev=md2 ino=3646976 scontext=system_u:system_r:dovecot_t tcontext=system_u:object_r:cert_t tclass=file type=PATH msg=audit(1141499436.214:3266533): item=0 name="/etc/pki/dovecot/dovecot.pem" inode=3646976 dev=09:02 mode=0100600 ouid=0 ogid=0 rdev=00:00 I put SELinux into permissive mode and Dovecot works OK. Looks like dovecot does not assume the correct security context when it initializes and reads the cert file. My question for the list is what changes should I make to the SELinux policy to safely permit dovecot to read the file? I'm no expert at SELinux but hoping for some direction, or another way to solve this problem. Ideally, I'd like to keep SELinux in enforcing mode. Many thanks, Eric

2 1

[Dovecot] MySQL problem when using Dovecot as proxy
by Christian Jensen 09 Mar '06

09 Mar '06

Hi, I have just installed Dovecot as a POP3 proxy with great success. Its works flawlessly when i keep to the standard but since I am proxying a Microsoft Exchange 2003 (because the build-in POP3 in MS sux bigtime) I would very much like to use account names like: DOMAIN\username and this doesn't work when I include that in the MySQL table. In the logfile it clearly writes DOMAIN\username so its some kind of translation between dovecot and MYSQL. Any suggestions. I another solution would be to allow all users instead of having to create them in the MySQL table. Is this possible ? /Christian P.S Before Dovecot some Outlook users could only download max. 250kB through POP3 - now with Dovecot there is NO LIMIT! :)

1 0

[Dovecot] :INDEX and :CONTROL in 0.99.14
by Karl Latiss 09 Mar '06

09 Mar '06

Before anyone say "upgrade" for various reasons I can't right now (and at any rate everything else works well with this version). My problem is that I can't get :INDEX and :CONTROL working at all: default_mail_env = maildir:~/:INDEX=/home/dovecot/index/%d/% n:CONTROL=/home/dovecot/control/%d/%n ls -l /home/dovecot/ total 8 drwxrwxrwx 3 dovecot dovecot 4096 Mar 8 07:52 control drwxrwxrwx 3 dovecot dovecot 4096 Mar 8 07:55 index (I've made everything 777 for testing) The error I get is: Mar 8 09:54:26 host imap(user(a)domain.com): mkdir (/home/dovecot/index/domain.com/user/.INBOX) failed: Permission denied If I su to the user(a)domain.com user I can manually create the directory OK. I'm using LDAP for authentication if that makes any difference. Any clues? Pointers? Need more information? -- Karl Latiss <karl.latiss(a)atvert.com.au> Atvert Systems

3 7

[Dovecot] Can I install in the following fashion?
by Stewart Dean 08 Mar '06

08 Mar '06

<permit me my perhaps foolish preference...an explanation> I run mail service for a small college. I've long joked that if someone stole the mail server, the phone would ring before the alarm (which has a 1 minute delay) did, that the user base expected 25x8x367 coverage. Making updates/upgrades to the mail server feels like a tightrope walk with no net. I always appreciated UofWIMAP because there is one binary. Doing and upgrade or backing it out is simplicity itself. I could compile the single binary on my compile machine, test the same binary on my testbed, and then drop it in my production machine and it would work with a minimum of surprises. So portable, so predictable, no security risk of a compiler on a production machine. Of course, /most/ of open source software has all these bits and pieces scattered everywhere. Oh, it may install initially just dandy, but come the day when It's Time For The Upgrade.... 1) can I do it quick and clean and 2) can I recover to what I had before quickly and correctly if the upgrade flops?????? Alas, Dovecot is sprinkled in many, many pieces...but at least, I think (right?) that they are all in the prefix-dir. Gulp. So. I am hoping I can do this: Build/Test Install 1) build/install in /usr/local/dovecot_bld/ Build### in the expectation that everything will be stuck down there. I don't want to put it into /usr/local/ because it will be in there with everything else....no way to get just the dovecot stuff.. 2) tar up the contents of my prefix directory and extract it over on my testbed under /usr/local/dovecot. Notice that the path to dovecot's "stuff" has changed from /usr/local/dovecot_bld/ Build### to /usr/local/dovecot I'm hoping that this won't be a problem. I will point the line in inetd at it and Everything Will Work. 3) Assuming I don't change anything and everything tests out (flawlessly!), I............. Introduction to Production (assuming that all the mailboxes, homedirs and the like have been sorted out) 1) make a tarball of the current working dovecot executables dir (/usr/local/dovecot) 2) extract the tarball there as before on the testbed machine and everything is fine. 2) if the update flops, I can bring back the tarball of the previous Dovecot incarnation My Questions: A) Will this work or are there dependencies I'm not aware of? B) Is there Some Better Way or..... I have this ongoing <ahem> discussion with the Open Source wonks that delight in many, many modules, libraries, etc. I /know/ the reasons a developer would want to do things that way, but, for those of use fielding the application, it's /so/ much easier and success/failure recovery is /so/ much more likely if....there are only one or two or three chunks that we can drop in or quickly back out. I realize that the developer is coding in large part for the utter joy of creating a wondrous, living, breathing edifice of code, that works, that works cleanly, that works as none has before. Yes. But I would think (IMHO) that the developer would receive a greater portion of the ego rush (also a big part of the developer stimulus) of overwhelming application acceptance (and thunderous applause), if he or she made it easy to support and upgrade! You see a sysadmin is so often an utter coward (I confess), who doesn't like unpleasant surprises, whose managment Really Doesn't Like Unpleasant Surprises. When I do my job really well, nobody knows I've done anything. OK...let me have it. -- ==== Stewart Dean, Unix System Admin, Henderson Computer Resources Center of Bard College, Annandale-on-Hudson, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

6 7

[Dovecot] Busy studying
by Timo Sirainen 08 Mar '06

08 Mar '06

In case you're wondering why I haven't answered your mail. I try to do as much reading to exams as possible, and as little as possible anything else.. They're over in 2,5 weeks, so I'll start reading the old emails again then. :) BTW. If someone wants to help a bit, outlook-idle workaround seems to be broken. The timeout function never gets called in cmd-idle.c. I'm guessing it broke after I added the other timeout function for printing "OK Still here" message every 2 minutes, so the bug is probably in timeout handling in ioloop.c.

1 0

[Dovecot] Simple Question
by Charlie Davis 08 Mar '06

08 Mar '06

Brand spanking new to Dovecot. Trying to move over to it, got a few simple questions. 1) Is there any documentation on the .customflags file? Not sure what this is for... 2) I'd like to make a directory for every user NOT be writable. Meaning the email server (Exim) can put the mail down in the directory but a user can no move an email into it through Imap. I couldn't find a search for the mailing list either, so sorry if this has been asked 92380498 times. -Charlie

1 1

[Dovecot] Special treatment of ~/mail directory
by Václav Haisman 08 Mar '06

08 Mar '06

Hi, would it be possible not to treat ~/mail specially and not to add mailboxes in the directory automatically? It would make migrating from IMAP-UW easier. Vaclav Haisman

4 3

[Dovecot] Undeleteable folders
by Casey Allen Shobe 08 Mar '06

08 Mar '06

We have 3 folders in every user's account which need to be there. Sometimes the users are stupid and delete or rename them. Is there any way to make them unmodifiable, but still allow them to see them, and move mail into/out of them? Cheers, -- Casey Allen Shobe | cshobe(a)seattleserver.com | 206-381-2800 SeattleServer.com, Inc. | http://www.seattleserver.com

1 0

[Dovecot] Dovecot with mbox and maildir
by Dario Ale 08 Mar '06

08 Mar '06

Hello, I have a question, i need migrate from old mail server to new mail server, the mailboxes format in the new mail server is maildir, in the old is mbox, the problem is that only the INBOXs are approximately 64Gb (are 7000 users), in the new I installed Dovecot, in the old is UW-Imap. The question is, Is there any form for have mbox and maildir simultaneously with Dovecot? I am using Postfix, my MDA is procmail, this write mailbox in the correct format, then i can copy all INBOXs and HOMEs to the new mail server, and change the mailbox format "slowly", supposedly procmail detecting the mailbox format and Dovecot could detect too. Thanks, very much. pd: sorry, my english not is good. -- Dario Ale (dario.a en telpin.com.ar) Area Internet Telpin - Jason 1026 - Pinamar (7167) www.telpin.com.ar

1 0

[Dovecot] self-signed certificates
by Benjamin 08 Mar '06

08 Mar '06

Hallo, i'm having troubles installing self-signed certificates for dovecot. After installing, dovecot generates a key and cert. But he is using the wrong common name (where does dovecot get this name from?). I tried deleting them and installing a handcrafted cert with this: openssl genrsa -out mail.key 2048 openssl req -new -key mail.key -out mail.csr openssl x509 -req -days 4312 -in mail.csr -out mail.cert -signkey mail.key after that i tried to update the dovecont.conf to point to the new files. But dovecot refuses to read them, i allways get an error, that dovecot can't read the certificate file. With dpkg-reconfigure dovecot-common, dovecot generates new ones, and they are working fine, but have the wrong common name. Thanks in advance Regards Benjamin

3 2