June 2006 - dovecot - dovecot.org

[Dovecot] ssl-proxy: client certificates and crl check
by HenkJan Wolthuis 13 Jun '06

13 Jun '06

Hi, I've attached a new version of my patch against ssl_proxy-openssl.c which: - disconnects when no clientcertificate is presented - checks the clientcertificate against the crl for our root cert. (so you can't use a revoked client cert.) - returns the CommonName from the client cert. in ssl_proxy_get_peer_name (this way it's easier to use dovecot as imap-proxy with a passwd-like userdb + ssl_require_client_cert + ssl_username_from_cert, it "binds" the emailuser to the clientcertificate, so a user / clientcert. can access only the account from the userdb) In order to use it, the CAfile must be a file which contains the CAcertificate (pem format) followed by the CRL (also in pem format). (servercert and the clientcerts are signed with a self-signed rootcert) changes in this version: - found the proper way to extract the CommonName from a certificate! - code cleanup there are some issues with the patch: - it needs openssl > 0.9.7. the way I do CRL loading/checking is new in 0.9.7. There are some examples on the openssl-devel list, but not much documentation. - ssl_verify_client_cert now returns 0 in case of an invalid cert. was there a reason why it always returned 1? - ssl_proxy_get_peer_name is changed, code depending on this function returning "X509_NAME_oneline" can break.. (at the moment it is only used for the ssl_username_from_cert config option, i think) I'd like comments / ideas etc. -- groeten, HenkJan Wolthuis --- ssl-proxy-openssl.c.orig 2006-04-04 10:32:58.000000000 +0200 +++ ssl-proxy-openssl.c 2006-06-01 09:24:57.000000000 +0200 @@ -498,7 +498,7 @@ const char *ssl_proxy_get_peer_name(struct ssl_proxy *proxy) { X509 *x509; - char buf[1024]; + char buf[256]; const char *name; if (!ssl_proxy_has_valid_client_cert(proxy)) @@ -508,10 +508,16 @@ if (x509 == NULL) return NULL; /* we should have had it.. */ - X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf)); - name = t_strndup(buf, sizeof(buf)); + /* HJHJ */ + /* the X509_N_gtbN can return -1 without 0-terminating buf */ + /* if the call succeeds buf is 0-terminated (openssl 0.9.7e / 0.9.8b src) */ + buf[0] = '\0'; + if( X509_NAME_get_text_by_NID(X509_get_subject_name(x509),NID_commonName,buf,sizeof(buf)) < 0 ) + { buf[0] = '\0'; } + name = t_strndup(buf, sizeof(buf) ); X509_free(x509); - + /* HJHJ */ + return *name == '\0' ? NULL : name; } @@ -582,10 +588,22 @@ proxy = SSL_get_ex_data(ssl, extdata_index); proxy->cert_received = TRUE; + + /* HJHJ */ + char buf[1024]; + X509_NAME_oneline( X509_get_subject_name(ctx->current_cert),buf,sizeof(buf)); + if (!preverify_ok) + { proxy->cert_broken = TRUE; + i_warning("BAD CERT %s: %s",X509_verify_cert_error_string(ctx->error),buf); + } + else + { i_warning("CERT: %s",buf); } /* logging */ - return 1; + return preverify_ok; + /* HJHJ */ + } static int @@ -666,10 +684,20 @@ if (getenv("SSL_VERIFY_CLIENT_CERT") != NULL) { SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER | - SSL_VERIFY_CLIENT_ONCE, + SSL_VERIFY_FAIL_IF_NO_PEER_CERT, ssl_verify_client_cert); } + /* HJHJ */ +#if OPENSSL_VERSION_NUMBER >= 0x00907000L + X509_STORE *store; + if( (store=SSL_CTX_get_cert_store(ssl_ctx)) != NULL ) + { X509_STORE_set_flags( store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL); } + else + { i_warning("X509 get cert store failed..."); } +#endif + /* HJHJ */ + /* PRNG initialization might want to use /dev/urandom, make sure it does it before chrooting. We might not have enough entropy at the first try, so this function may fail. It's still been

2 5

[Dovecot] Using MySQL to store email?
by Marc Perkel 13 Jun '06

13 Jun '06

So Timo, Have you considered the idea of storing all the email in a MySQL database? Seems to me that MySQL could somplify all the backend stuff that everyone struggles with and with replication one could create very massive and reliable systems. What would it take to use MySQL that way?

26 62

[Dovecot] Multiple quota roots
by Timo Sirainen 13 Jun '06

13 Jun '06

IMAP RFC defines a way to have multiple quota roots. For example with filesystem quota the first quota root would be "available disk space in filesystem" and second quota root would be the user's normal quota. I guess this could similarly be useful for example to have a per-domain quota (eg. 10GB) and each user have their own separate quota (eg. 1GB), so that 20 the users together still couldn't use more than the 10GB. Anyway the most important reason why I need to implement them now is to allow a configuration where you could have eg. 1GB quota normally, but also extra 100MB allowed for Trash mailbox. So even when you're over quota your IMAP client can still do its copy-to-Trash operations. I guess with Maildir++ quota backend this should need to be implemented in a backwards compatible way so that the main maildirsize file contains the 1GB quota limit but still tracks the entire usage so it can grow to 1,1GB there. Now, anyone have suggestions how all of this should be configured in config file to make it as useful for different purposes as possible? :)

1 1

[Dovecot] strange behaviour: connecting to mysql, but no queries after upgrade on ubuntu...
by Nikolaus Schlemm 13 Jun '06

13 Jun '06

hi all, I'm having trouble using dovecot with mysql after upgrading to 1.0.beta3 on ubuntu. according to the mysql log, dovecot connects but doesn't issue any queries.. any hints what might be wrong or where I should look? -- Cheers, Nikl

1 0

[Dovecot] what is the correct password file format?
by M. Fioretti 13 Jun '06

13 Jun '06

Hello, I'm trying to set up dovecot installed from RPM (version dovecot-0.99.11-2.EL4.1, the one included in Centos 4.3). I get this error: dovecot-auth: passwd-file(user@domail): unknown user even if user@domain exists: auth_userdb = passwd-file /etc/imap.virtual_users auth_passdb = passwd-file /etc/imap.virtual_users -bash-3.00# cat /etc/imap.v_users user@domain:{DIGEST-MD5}thepassword:uid_value:gid_value::/absolute/path/to/virtual/mailboxes why do I get this error? and what is the correct config format for this version of dovecot? TIA, Marco -- Marco Fioretti mfioretti, at the server mclink.it Fedora Core 3 for low memory http://www.rule-project.org/ Furious activity is no substitute for understanding. -- H.H. Williams

1 0

Re: [Dovecot] Dovecot fails to start after enabling "deliver" executable settings to config file
by infowolfe 12 Jun '06

12 Jun '06

On 6/12/06, My BSD <MyBSD(a)comcast.net> wrote: > The directory should have been "/opt/local/var/run/dovecot/". > > However, when "user" and "group" are set to "9999" dovecot will not > start with the following error log entries: > > ------------------------------------------- > dovecot: Jun 12 12:52:36 Error: auth(default): User doesn't exist: 9999 > dovecot: Jun 12 12:52:36 Error: Auth process died too early - shutting > down dovecot: Jun 12 12:52:36 Error: child 29585 (auth) returned error > 89 > ------------------------------------------- cat /etc/passwd | grep 9999 if you don't see any output, then cat /etc/passwd | more and pick a different uid/gid to launch dovecot as ;-)

1 0

[Dovecot] ./configure and /or Makefile problem
by B.O.F.H. 12 Jun '06

12 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 This is on OpenBSD 3.x. I'll fully admit not being a savvy programmer and therefore unable to suggest a decent resolution. It seems that _something_ in either the main "configure" script or one of the Makefile.in templates is causing the Makefiles in src/auth and src/util to add two variables named "AUTH_CFLAGS" and "AUTH_LIBS", which on first look makes sense. Looking a bit deeper, they both contain variables in the format "@VARNAME@" which I'm presuming _should_ have been replaced with actual paths and/or "-l" statements during the configure process. Those being: AUTH_CFLAGS = -I@includedir@ @INCLUDE_des@ AUTH_LIBS = -L@libdir@ -lgssapi -lkrb5 -lasn1 @LIB_des_appl@ - - -lroken @LIB_crypt@ @LIB_dbopen@ @LIBS@ -L/usr/local/lib -lpq - - -L/usr/local/lib/mysql -lmysqlclient -lz -lm Two issues become apparent: 1 - Somehow, the unexpanded "@" variables are making it to the command line 2 - "-lroken" is a Linux specific library and is not found in most *BSD's. Generally configure scripts replace it with "-lcrypto" on host OS detection. This can be displayed by looking at the errors for both auth and util: Making all in auth gmake[3]: Entering directory `/src/mail/dovecot-1.0.beta8/src/auth' if gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I../../src/lib - - -I../../src/lib-sql -I../../src/lib-settings -I../../src/lib-ntlm - - -DAUTH_MODULE_DIR=\""/usr/local/lib/dovecot/auth"\" - - -DPKG_LIBEXECDIR=\""/usr/local/libexec/dovecot"\" -I@includedir@ @INCLUDE_des@ -I/usr/local/include -I/usr/include/kerberosV - - -std=gnu99 -O2 -march=athlon -pipe -Wall -W -Wmissing-prototypes - - -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 - - -Wbad-function-cast -MT mycrypt.o -MD -MP -MF ".deps/mycrypt.Tpo" - - -c -o mycrypt.o mycrypt.c; \ then mv -f ".deps/mycrypt.Tpo" ".deps/mycrypt.Po"; else rm -f ".deps/mycrypt.Tpo"; exit 1; fi gcc: cannot specify -o with -c or -S and multiple compilations gmake[3]: *** [mycrypt.o] Error 1 gmake[3]: Leaving directory `/src/mail/dovecot-1.0.beta8/src/auth' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/src/mail/dovecot-1.0.beta8/src' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/src/mail/dovecot-1.0.beta8' gmake: *** [all] Error 2 Making all in util gmake[3]: Entering directory `/src/mail/dovecot-1.0.beta8/src/util' if gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I../../src/lib - - - -I../../src/auth -I/usr/local/include -I/usr/include/kerberosV - - - -std=gnu99 -O2 -march=athlon -pipe -Wall -W -Wmissing-prototypes - - - -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 - - - -Wbad-function-cast -MT rawlog.o -MD -MP -MF ".deps/rawlog.Tpo" - - -c - -o rawlog.o rawlog.c; \ then mv -f ".deps/rawlog.Tpo" ".deps/rawlog.Po"; else rm -f ".deps/rawlog.Tpo"; exit 1; fi /bin/sh ../../libtool --mode=link --tag=CC gcc -std=gnu99 -O2 - - - -march=athlon -pipe -Wall -W -Wmissing-prototypes - - - -Wmissing-declarations -Wpointer-arith -Wchar-subscripts - - -Wformat=2 - -Wbad-function-cast -L/usr/local/lib -o rawlog rawlog.o ../lib/liblib.a mkdir .libs gcc -std=gnu99 -O2 -march=athlon -pipe -Wall -W -Wmissing-prototypes - - - -Wmissing-declarations -Wpointer-arith -Wchar-subscripts - - -Wformat=2 - -Wbad-function-cast -o rawlog rawlog.o -L/usr/local/lib ../lib/liblib.a if gcc -DHAVE_CONFIG_H -I. -I. -I../.. - - -I../../src/lib - -I../../src/auth -I/usr/local/include - - -I/usr/include/kerberosV - -std=gnu99 -O2 -march=athlon -pipe -Wall - - -W -Wmissing-prototypes - -Wmissing-declarations -Wpointer-arith - - -Wchar-subscripts -Wformat=2 - -Wbad-function-cast -MT gdbhelper.o - - -MD -MP -MF ".deps/gdbhelper.Tpo" -c -o gdbhelper.o gdbhelper.c; \ then mv -f ".deps/gdbhelper.Tpo" ".deps/gdbhelper.Po"; else rm -f ".deps/gdbhelper.Tpo"; exit 1; fi /bin/sh ../../libtool --mode=link - - --tag=CC gcc -std=gnu99 -O2 - -march=athlon -pipe -Wall -W - - -Wmissing-prototypes - - - -Wmissing-declarations -Wpointer-arith -Wchar-subscripts - - -Wformat=2 - -Wbad-function-cast -L/usr/local/lib -o gdbhelper gdbhelper.o ../lib/liblib.a gcc -std=gnu99 -O2 -march=athlon -pipe -Wall -W -Wmissing-prototypes - - - -Wmissing-declarations -Wpointer-arith -Wchar-subscripts - - -Wformat=2 - -Wbad-function-cast -o gdbhelper gdbhelper.o - - -L/usr/local/lib ../lib/liblib.a if gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I../../src/lib - - - -I../../src/auth -I/usr/local/include -I/usr/include/kerberosV - - - -std=gnu99 -O2 -march=athlon -pipe -Wall -W -Wmissing-prototypes - - - -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 - - - -Wbad-function-cast -MT dovecotpw.o -MD -MP -MF ".deps/dovecotpw.Tpo" -c -o dovecotpw.o dovecotpw.c; \ then mv -f ".deps/dovecotpw.Tpo" ".deps/dovecotpw.Po"; else rm -f ".deps/dovecotpw.Tpo"; exit 1; fi /bin/sh ../../libtool --mode=link - - --tag=CC gcc -std=gnu99 -O2 - -march=athlon -pipe -Wall -W - - -Wmissing-prototypes - -Wmissing-declarations -Wpointer-arith - - -Wchar-subscripts -Wformat=2 - -Wbad-function-cast - - -L/usr/local/lib -o dovecotpw dovecotpw.o ../auth/libpassword.a ../lib-ntlm/libntlm.a ../lib/liblib.a - -L@libdir@ -lgssapi -lkrb5 - - -lasn1 @LIB_des_appl@ -lroken @LIB_crypt@ @LIB_dbopen@ @LIBS@ - - -L/usr/local/lib -lpq -L/usr/local/lib/mysql - - - -lmysqlclient -lz -lm -export-dynamic ../../libtool[6473]: cd: /src/mail/dovecot-1.0.beta8/src/util/@libdir@ - No such file or directory libtool: link: cannot determine absolute directory name of `@libdir@' gmake[3]: *** [dovecotpw] Error 1 gmake[3]: Leaving directory `/src/mail/dovecot-1.0.beta8/src/util' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/src/mail/dovecot-1.0.beta8/src' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/src/mail/dovecot-1.0.beta8' gmake: *** [all] Error 2 To get Dovecot to build, I manually went into both Makefiles, made "AUTH_CFLAGS" empty and deleted all "@" references and "-lroken" in "AUTH_LIBS" replacing them with "-lcrypto" Once I did that, it built successfully and has not thrown any errors. - -- Ed V. Don't hit the keys so hard, it hurts. 12 June 2006 08:22:32 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (MingW32) iQIVAwUBRI15U6fRmhqF/IZAAQpxDBAA5eHEmclQjjQesfrz9cq5zkFeted+G5md vDCQ65Q8QDD5yXdg0BKlc571JbFJjI2Rc7jGEGsokrgP895jOEHDMEaDbJ4CCX8h r5IqFSmS9Hi/Uuyte1Aww7lLBnq0+yT9NcxzmYP0OYwGRM+EpYU5Z4/mwjgSmFcR 0qn/2WlmK+Q1kBD3S0IrtbOOUjLEFX+x+C5iomd0Ua05FuwtKSFFBBChNU9jOl3S 4ir9UVYJpd8pOikfghnPrSegoigjU4SsxcbvjFi3lfZUpJPY5oZZDNzRqh5/oJHc PSwIl8as98RqQqtJsMzEwzT787pAD5zT5q+KAk+0jRPN5Qhc58lnDSQD2KBr9WPg MeZmRivQAkK5LUePkSCGg+BqsiA6UJka5RF76nGfpi3boL7Uc6Q9OFYFHWny8g1T dxrQvXW5//n6QyxTPliK9Nu3g7tspp07E6oBMSAhu6q7KF3l+ReARVPEpdjcgOqM yz+rzk6a8NMTkXfsysvwm11EU6pvjgrJRpnVlLvYfbbIu0BDIVrr9J4iAXWvb6Ll 447S+DDf67rDxp0VscmCxQ1CrI8WK2mL/SGdnuJEcQvP2B1BurI01AcVNcUDfeNi anHOX+b8OUkwbvjOecFMNEMg/GHN1Ckgd05vgG4o4u2IyBsA/a1cypNFHnwLFTxM IRjupfBLxlE= =y6WG -----END PGP SIGNATURE-----

2 2

Re: [Dovecot] Dovecot fails to start after enabling "deliver" executable settings to config file
by Timo Sirainen 12 Jun '06

12 Jun '06

On Mon, 2006-06-12 at 10:29 -0400, My BSD wrote: > dovecot: Jun 12 10:08:53 Error: auth(default): bind > (/opt/var/run/dovecot/auth-client) failed: No such file or directory Does /opt/var/run/dovecot/ directory exist? And you haven't tried to chroot auth process?

1 0

[Dovecot] deliver setgid issues
by Brad 12 Jun '06

12 Jun '06

Okay .. have dovecot set up with following settings : userdb static { args = uid=97 gid=97 home=/export/dovecot/mail/%d/%u mail=mbox:/export/dovecot/mbox/%d/%u/ } passdb passwd-file { # Path for passwd-file args = /etc/dovecot-passdb } Passdb works I think in the sense that I can log into dovecot using a regular mail client. The real issue is when I try to deliver any type of mail using dovecot-lda (deliver). deliver is setuid and setgid dovecot .. I event se the static mail dirs above to be owned by dovecot (I know .. a no no .. but wanted to trace down issue) I also have first_valid_uid = 96 and first_valid_uid = 96 Now .. when I try to do this .. echo "A Test Message" | /usr/local/libexec/dovecot/deliver -d existinguser I get this .. master in: USER 1 echo service=deliver dovecot: Mar 11 23:45:24 Info: auth(default): master out: USER 1 echo uid=97 gid=97 home=/export/dovecot/mail//echo mail=mbox:/export/dovecot/mbox//echo/ dovecot: Mar 11 23:45:24 Error: auth(default): deliver: Fatal: setgroups(97) failed: Operation not permitted 97 is the gid for the dovecot user .. which owns just about everything deliver could ever touch. What am I missing ?

5 6

[Dovecot] Verbose logs to show ACL hits?
by Gavin Henry 12 Jun '06

12 Jun '06

Hi all, Using Beta here, but can't see anything in dovecot.conf for this? Any tips? Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

2 3