July 2006 - dovecot - dovecot.org

[Dovecot] pop3 authentication problems: Still got 'em...
by Bruce Lane 16 Jul '06

16 Jul '06

Fellow users, This is just a heads-up to let the list know that I'm still unable to get ANY sort of pop3 or pop3s authentication to work with Dovecot. Just as a sanity check, I set up an entirely separate system, running FreeBSD 6.1 production, postfix 2.3, and Dovecot 1.0rc2, as a testbed. I got the exact same problem that I had with the NetBSD 3.0 production server, specifically that Dovecot refuses to authenticate a user with either basic pop3 or pop3s. The way I see it, I may as well try to get basic pop3 working first. If it doesn't, pop3s will never work. This first quote is taken from the mail client (Pegasus) trying to establish a regular, unencrypted pop3 session. -=-=-=-=-=-=- [*] Connection established to 192.168.42.80 >> 0058 +OK AVG POP3 Proxy Server 7.1.368/7.1.394 [268.10.1/389] << 0013 USER kyrrin >> 0005 +OK << 0016 PASS XXXXXXXXX >> 0029 -ERR Authentication failed. -=-=-=-=-=-=-=- As you can see, the user ID of 'kyrrin' is getting passed as just that, and Dovecot at least seems to recognize it. I say this as a prefix to the next log clip, which will be the corresponding entry from /var/log/maillog, in which the user name is being presented (for whatever reason) in FQDN format. Note that pam was added just as an experiment. It failed too, despite the presence of a 'dovecot' file, containing the following, in /etc/pam.d -=-=-=-=-=-=-=- pioneer# cat /etc/pam.d/dovecot auth required pam_unix.so nullok account required pam_unix.so pioneer# -=-==-=-=-=-=- This would be the /var/log/maillog entry corresponding to the above-referenced Pegasus session. -=-=-=-=-=-=-=- Jul 16 11:24:38 pioneer dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=192.168.42.80rip=192.168.42.40 resp=AGt5cnJpbgBocDIxZHZlbTc= Jul 16 11:24:38 pioneer dovecot: auth(default): pam(kyrrin(a)bluefeathertech.com,192.168.42.40): pam_authenticate() failed: authentication error Jul 16 11:24:38 pioneer dovecot: auth(default): cache(kyrrin(a)bluefeathertech.com,192.168.42.40): User unknown Jul 16 11:24:40 pioneer dovecot: auth(default): client out: FAIL 1 user=kyrrin(a)bluefeathertech.com Jul 16 11:24:49 pioneer dovecot: pop3-login: Aborted login: user=<kyrrin(a)bluefeathertech.com>, method=PLAIN, rip=192.168.42.40, lip=192.168.42.80 -=-=-=-=-=-=-=- This next bit is the auth default section of my dovecot.conf file. Other sections, or the entire file, can be posted upon request. -=-=-=-=-=-=-=- auth default { # Space separated list of wanted authentication mechanisms: # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi mechanisms = plain login passdb pam { } passdb passwd { } userdb passwd { } socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } -=-=-=-=-=-=-=-=-=-=- I've posted a similar note to bsdforums, in the hope that someone there is (successfully) using Dovecot with pop3 and pop3s. Thanks in advance for any assistance. I'm really starting to get seriously upset about this, enough to give thought to qpopper over Dovecot. -=-=-=-=-=-=-=-=-=-=-=- Bruce Lane, Owner & Head Hardware Heavy, Blue Feather Technologies -- http://www.bluefeathertech.com kyrrin (at) bluefeathertech do/t c=o=m "If Salvador Dali had owned a computer, would it have been equipped with surreal ports?"

3 4

[Dovecot] auth with kerberos
by Renaud Allard 16 Jul '06

16 Jul '06

Hello, I am running dovecot 1.0RC2 and I'd like to know if there is a way to make dovecot provide PLAIN, LOGIN, CRAM-MD5, NTLM authentications from a kerberos database. GSSAPI works great, but I currently have to have two password databases, one for GSSAPI and one for all the others. What I'd like is to have only one password database (namely kerberos). I know that cyrus-sasl (which most of you don't like I think ;)) can provide such authentications, but I haven't found the way to configure dovecot to do the same. Any input welcome.

2 2

Re: [Dovecot] TLS Issues - Plain Text login?
by Timothy White 15 Jul '06

15 Jul '06

Thanks Marcus and Thomas. I should have checked it in another client ;-) Tim -- Linux Counter user #273956 Don't email joeblogs(a)scouts.org.au

1 0

Re: [Dovecot] Deliever in RC2 incorretly outputs "saved mail to INBOX"
by Alex Pimperton 14 Jul '06

14 Jul '06

Hi All, I've recently upgraded to RC2 (debian package) and now I get the following message in syslog all the time: Jul 14 15:51:04 server01 deliver(alex): saved mail to INBOX This seems to happen for every mail, despite some being filtered into different folders. It goes like this: Mail arrives from Ubuntu mailing list: Jul 14 15:53:49 server01 postfix/qmgr[19023]: D51A95C023: from=<ubuntu-users-bounces(a)lists.ubuntu.com>, size=4319, nrcpt=1 (queue active) I get this message: Jul 14 15:53:51 server01 deliver(alex): saved mail to INBOX Postfix sends to deliver: Jul 14 15:53:51 server01 postfix/local[29843]: D51A95C023: to=<alex(a)placet.co.uk>, relay=local, delay=29, status=sent (delivered to command: /usr/lib/dovecot/deliver) ...and a few seconds later it shows up in my Ubuntu-Users folder, exactly where my sieve rule sends it. Is this a bug? Alex -- This message has been scanned for viruses and dangerous content by the MailScanner at Placet.co.uk, and is believed to be clean.

1 0

[Dovecot] Backing up mail
by Davide Bolcioni 14 Jul '06

14 Jul '06

Greetings, in backing up mail stored according to default_mail_env = mbox:~/mail/:INBOX=/var/mail/%u is it safe *not* to backup the .imap subdirectory ? I am currently using dovecot-0.99.13-3.FC3. When restoring, I guess the safe option would be to zap the contents of .imap so that it gets rebuilt, correct ? Thank you for your consideration, Davide Bolcioni -- Paranoia is a survival asset.

1 0

[Dovecot] TLS Issues - Plain Text login?
by Timothy White 14 Jul '06

14 Jul '06

I'm trying to setup IMAP, so that it works via secure connections. I have it working fine over SSL, now I wish to get TLS to work. I have set imap and imaps to both listen on *, and have disable_plaintext_auth = yes, which according to the docs, Disable LOGIN command and all other plaintext authentications unless SSL/TLS is used (LOGINDISABLED capability). So the problem is now, that TLS doesn't work. Trying it with thunderbird, I get a message about login being disabled, and to check my settings and such. The port is correct (imap, not imaps), and I have it to always use TLS. I see the following in my logs Jul 14 16:35:46 mafeking dovecot: imap-login: Aborted login: rip=58.7.136.163, lip=203.30.47.34, TLS Any ideas? To me it appears to be using TLS, so why doesn't thunderbird work? Is it the LOGINDISABLED capa keyword? Is it dovecot telling Thunderbird the wrong capa when using TLS? It all works fine with SSL, and the port (in thunderbird) set to the imaps port. The logs show lines like below when using SSL. Jul 14 16:36:32 mafeking dovecot: imap-login: Login: user=<joeblogs>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Any ideas? Or should I just force SSL? Thanks Tim (using RC2) -- Linux Counter user #273956 Don't email joeblogs(a)scouts.org.au

3 2

[Dovecot] How to create rules?
by Romeo Theriault 14 Jul '06

14 Jul '06

Hi, I have dovecot installed and working fine. I would like (server side) a rule runs on all messages and if it finds certain words in the message it will run a script which will send a new email. How can I create these rules? Do I need another piece of software? Thank you, Romeo

7 12

Re: [Dovecot] Squirrelmail Change Dovecot Password Plugin
by Cecil S. Nutakor 14 Jul '06

14 Jul '06

Having a plugin that allows squirrelmail to change Dovecot's password would depend entirely on how you have your Dovecot passwords stored. Peter your right, My Dovecot passwords are stored in /etc/dovecot/passwd and Dovecot users stored in /etc/dovecot/users Thanks > On 7/13/2006 07:42, Cecil S. Nutakor seems to have typed: >> After a moment i noticed that i could make the users change their own >> passwords using squirrelmail, but unfortunatly for me after googling >> around the Internet and also visiting squirrelmail plugin page i could >> not >> find a change Dovecot password plugin for squirrelmail. > > If your Dovecot passwords are stored as system passwords, then you would > have to allow PHP (squirrelmail) to change system passwords. Currently, > I have SQL store my Dovecot passwords (which are actually used for > a lot of different authentication purposes), so it was trivial to write > a page that allows users to change the password in the SQL database and > would be easy to add this to squirrelmail if you wanted, but given how > many ways that Dovecot can use for authentication, a generic plugin that > works for all of them would be extraordinarily difficult (and a security > risk for some of the password storage methods - you don't want PHP to > be able to edit your /etc/passwd if you are using *BSD/*nix) > Office Of The SYSTEMS ARCHITECT DISCOVERYTEL GH

1 0

[Dovecot] dovecot 1.00 RC2 bugs
by Alexander Zagrebin 14 Jul '06

14 Jul '06

imho, dovecot 1.00 RC2 has two bugs at the maildir quota implementation 1. Incorrect calculation of used storage and count of messages When calculating, dovecot counts "." and ".." directory entries. So, if there are no subdirs and messages in maildir, maildirsize still shows 4 messages and some used storage. My workaround is --- src/plugins/quota/quota-maildir.c.orig Sun Jun 11 21:36:24 2006 +++ src/plugins/quota/quota-maildir.c Thu Jul 13 11:33:58 2006 ======================================================== @@ -82,6 +82,8 @@ len = str_len(path); while ((dp = readdir(dirp)) != NULL) { + if (!strcmp(dp->d_name, ".")) continue; + if (!strcmp(dp->d_name, "..")) continue; p = strstr(dp->d_name, ",S="); num = (uoff_t)-1; if (p != NULL) { ======================================================== This patch skips special directory entries. 2. Under some condition maildirsize contains invalid data Consider a such situation 1. User begins pop3 session 2. dovecot calls this sequence of procedures maildir_quota_transaction_begin -> maildirquota_refresh -> maildirsize_read While reading maildirsize's data, may be situation when mailbox size must be recalculated (maildirsize greater 5120, quotas was changed...). In this case dovecot closes maildirsize's file descriptor (root->fd) and assigns it "-1". After that code calls maildirsize_recalculate -> maildirsize_write So maildirsize is rewritten and contains valid data. BUT file descriptor (root->fd) still contains "-1" 3. User retrieves and deletes some messages, then quits. So maildirsize must be updated. 4. Code calls maildir_quota_transaction_commit, but root->fd equals "-1", so maildirsize_update doesn't calls and maildirsize contains incorrect (obsolete) data My workaround is ======================================================== --- src/plugins/quota/quota-maildir.c.orig Sun Jun 11 21:36:24 2006 +++ src/plugins/quota/quota-maildir.c Thu Jul 13 11:33:58 2006 @@ -246,11 +248,12 @@ return -1; } - if (file_dotlock_replace(&dotlock, 0) < 0) { + if (file_dotlock_replace(&dotlock, DOTLOCK_REPLACE_FLAG_DONT_CLOSE_FD) < 0) { mail_storage_set_critical(storage, "file_dotlock_replace(%s) failed: %m", path); return -1; } + root->fd = fd; return 0; } ======================================================== This patch preserves fd after writing recalculated maildirsize file, and when maildir_quota_transaction_commit is called, root->fd contains valid file descriptor. -- Alexander Zagrebin

1 0

[Dovecot] pop3s Authentication Issues, Continued
by Bruce Lane 14 Jul '06

14 Jul '06

Fellow Dovecot'ers. I tried something tonight that I should have done a while back: Turned on verbose logging in the authentication section. I'm still unable to get the mail client I'm experimenting with (Pegasus) to complete a pop3s connection, in that I still get an indication of a failed password. However, at least I'm a little closer to understanding the failure itself. Please note what came up in /var/log/maillog. Jul 13 22:41:25 featherweb dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 secured lip=192.168.42.130 rip=192.168.42.40 resp=AGt5cnJpbgBocDIxZHZlbTc= Jul 13 22:41:25 featherweb dovecot: auth(default): cache(kyrrin(a)bluefeathertech.com,192.168.42.40): User unknown Jul 13 22:41:26 featherweb dovecot: auth(default): client out: FAIL 1 user=kyrrin(a)bluefeathertech.com More specifically: Take a good hard look at the end of the second line. Why in the Multiverse would the thing consider me an unknown user? Unless it's not really checking /etc/passwd at all...? Excerpt from dovecot.conf follows. -=-=-=-=-=-=-=-=- auth default { # Space separated list of wanted authentication mechanisms: # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi mechanisms = plain login passdb passwd { } userdb passwd { } socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } As a point of interest, SENDING mail via a secure connection (SMTP AUTH via STARTTLS) is working quite well. I'm beginning to think that the OpenSSL installation isn't authenticating properly...? Insights welcome. Thanks much. -=-=-=-=-=-=-=-=-=-=-=- Bruce Lane, Owner & Head Hardware Heavy, Blue Feather Technologies -- http://www.bluefeathertech.com kyrrin (at) bluefeathertech do/t c=o=m "If Salvador Dali had owned a computer, would it have been equipped with surreal ports?"

2 1