August 2006 - dovecot

[Dovecot] auth failure with digest-md5
by LeVA 18 Aug '06

18 Aug '06

Hi! I'm using: Dovecot 1.0.beta8 OpenBSD 3.9 KMail 1.9.3 My password file contains only one user now. I've changed its password to a dumb one: 'asd' (so this is not a wrong password failure :) I've configured the PLAIN and DIGEST-MD5 mechanisms in dovecot.conf, and I'm only using pop3. Also I've turned on the verbose auth logging, and I'm attaching the logs inline. My password db contains the {DIGEST-MD5} prefixed password. The problem is very simple but very weird. I start the dovecot server and try to log in. It succeeds, I'm happy. But after one (the first) success, all further logins fails. Yes this a sometimes working/sometimes not problem, which is rare in this business... Here is the log of the first success: 00:48:41 Info: auth(default): client in: AUTH 1 DIGEST-MD5 service=POP3 secured lip=192.168.0.202 rip=192.168.0.3 resp= <newline> 00:48:41 Info: auth(default): client out: CONT 1 cmVhbG09IiIsbm9uY2U9ImJua2tUaHBDVURJblFENWRJZlgyb1E9PSIscW9wPSJhdXRoIixjaGFyc2V0PSJ1dGYtOCIsYWxnb3JpdGhtPSJtZDUtc2VzcyI= <newline> 00:48:41 Info: auth(default): client in: CONT 1 dXNlcm5hbWU9ImxldmEiLHJlYWxtPSIiLG5vbmNlPSJibmtrVGhwQ1VESW5RRDVkSWZYMm9RPT0iLGNub25jZT0iTy9MYndLMVo1dWc4ZURiT2wzaWlhN2ZsTUVTV3MvN1JSc05HL3JPbzhpND0iLG5jPTAwMDAwMDAxLHFvcD1hdXRoLGRpZ2VzdC11cmk9InBvcC8xOTIuMTY4LjAuMjAyIixyZXNwb25zZT0wYTQ3ZmUyNmVlMDg0MWE4ZDgzNTM3NzI5MzUxZmE3YQ== <newline> 00:48:41 Info: auth(default): client out: CONT 1 cnNwYXV0aD01MmQ1YTRlNTVhNWNiYzA0NDk2YTg5ODcyMDMwMGUxYw== <newline> 00:48:41 Info: auth(default): client in: CONT 1 <newline> 00:48:41 Info: auth(default): client out: OK 1 user=username <newline> 00:48:41 Info: auth(default): master in: REQUEST 9 15718 1 <newline> 00:48:41 Info: auth(default): master out: USER 9 username uid=6000 gid=6000 home=/var/mail/virtual/username/./ <newline> 00:48:41 Info: pop3-login: Login: user=<username>, method=DIGEST-MD5, rip=192.168.0.3, lip=192.168.0.202, TLS <newline> 00:48:41 Info: POP3(username): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0 And after that, every login fails: 00:49:28 Info: auth(default): client in: AUTH 1 DIGEST-MD5 service=POP3 secured lip=192.168.0.202 rip=192.168.0.3 resp=dXNlcm5hbWU9ImxldmEiLHJlYWxtPSIiLG5vbmNlPSJibmtrVGhwQ1VESW5RRDVkSWZYMm9RPT0iLGNub25jZT0iTy9MYndLMVo1dWc4ZURiT2wzaWlhN2ZsTUVTV3MvN1JSc05HL3JPbzhpND0iLG5jPTAwMDAwMDAyLHFvcD1hdXRoLGRpZ2VzdC11cmk9InBvcC8xOTIuMTY4LjAuMjAyIixyZXNwb25zZT0wMWRkMDNjYTcyMzBmMzM5YjRiY2NlM2VmMTcwMGU4Yw== <newline> 00:49:28 Info: pop3-login: Aborted login: method=DIGEST-MD5, rip=192.168.0.3, lip=192.168.0.202, TLS <newline> 00:49:28 Info: auth(default): passwd-file /etc/dovecot.passwd: Read 1 users I can notice that the second (the failure) log is shorter than the first (the success). Maybe something is missing from there. The PLAIN auth mechanism is working, even after a failed DIGEST-MD5 login. In fact the PLAIN login always works :) Thanks! Daniel -- LeVA

3 3

[Dovecot] Also in 1.0RC7, Beginner Help with a fatal error in a first Basic Install
by Paul 18 Aug '06

18 Aug '06

Thinking that the issue with libssl is an artifact of the unstable branch, I've just tried, a reproduced the problem with, v10.rc7. Thank you. Paul

1 0

[Dovecot] 1.0 RC7 released
by Netserve 18 Aug '06

18 Aug '06

>> | Can everyone now agree that there are no more hangs? :) > 100,000 logins since we upgraded, no problems at all Linux svr22 2.6.xx- FC4 #1 Fri Aug 26 20:35:25 EDT 2005 x86_64 x86_64 86_64 GNU/Linux Good work! Regards John Lyons ADSL £9.99 www.discountadsl.co.uk Netserve Consultants Ltd Unit 8 The Bungalow Offices St Asaph Business Park St Asaph LL17 0LQ T: 0845 6444194 F: 01745 582374 w: www.netserve.co.uk e: support(a)nsnoc.com

1 0

[Dovecot] LDAP Auth problems with auth_bind=yes
by Rob Coward 18 Aug '06

18 Aug '06

Hi, I first posted this problem a day or two ago and have not seen any responses yet. To clarify my problem, I am authenticating virtual users against Active Directory on Win2k3, where their login id is their email address. I am using an almost identical setup to Suranga's below, however my initial bind user doesn't have access to the userPassword attribute, so I am using: auth_bind = yes This is working fine when users enter their correct email address & password, or if the email address is not found, however if a valid email address is given but the password is incorrect, it seems to kill something in the ldap_auth code as all further connections get a temporary authentication error at the client, and the following in /var/log/maillog: Aug 18 13:04:31 gm-ho-lin-06 dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=::ffff:127.0.0.1 rip=::ffff:127.0.0.1 resp=ADA5OTlAc3RvcmVzLmdhbWUuY28udWsAOTk5MA== Aug 18 13:04:31 gm-ho-lin-06 dovecot: auth(default): ldap(0999@stores.game.co.uk,::ffff:127.0.0.1): bind search: base=OU=Stores,OU=UK,DC=group,DC=game,DC=net filter=(&(objectClass=user)(mail=0999(a)stores.game.co.uk)) Aug 18 13:04:31 gm-ho-lin-06 dovecot: auth(default): ldap(0999@stores.game.co.uk,::ffff:127.0.0.1): ldap_search() failed: Operations error Aug 18 13:04:31 gm-ho-lin-06 dovecot: auth(default): client out: FAIL 1 user=0999(a)stores.game.co.uk temp Aug 18 13:04:31 gm-ho-lin-06 dovecot: imap-login: Aborted login: user=<0999(a)stores.game.co.uk>, method=PLAIN, rip=::ffff:127.0.0.1, lip=::ffff:127.0.0.1, secured Is the auth_ldap code not resetting the ldap connection bind details to the dn/dnpass values for each login ? You help would be greatly appreciated as I hope to make this a production server within the next week. Regards, Rob Coward Unix Developer GAME STORES GROUP LTD Tel: 01256 784476 Email: Rob.Coward(a)game.net -----Original Message----- From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of suranga de silva Sent: 18 August 2006 19:14 To: dovecot(a)dovecot.org Subject: Re: [Dovecot] dovecot Digest, Vol 40, Issue 65 Dear Tim Schafer, Take a look at my sample dovecot-ldap.conf hosts = localhost dn = cn=root,dc=ceylonlinux,dc=com dnpass = secret ldap_version = 3 base = dc=ceylonlinux,dc=com deref = never scope = subtree user_attrs = mail,homeDirectory=mailMessageStore,uidNumber=1003,gidNumber=1003 user_filter = (&(objectClass=user)(mail=%u)) pass_attrs = mail=user,userPassword=password pass_filter = (&(objectClass=user)(mail=%u)) default_pass_scheme = CRYPT user_global_uid = 1003 user_global_gid = 1003 Here I am using my own schema called "user", but in your case change it to inetOrgPerson or the schema name you are using. I think the most common problem in this process is the ldap filter. Above in my configuration user_filter and pass_filter are used as ldap filters for querying user name and password. There I am using mail attribute. gid and uid are belong to the user vmail. May be this explanation will help you to figure out your problem You can refer my article in the following link for further reference http://www.ceylonlinux.com/pdf/openldap_backsql_postfix_maildir_cl.pdf Cheers!!! Suranga De Silva. CTO CEYLON LINUX This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at: mailto:postmaster@game.net The recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage. This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses. http://www.game.co.uk http://www.gamegroup.plc.uk

1 0

[Dovecot] How to change passwords on LDAP Server?
by Luis Motta Campos 18 Aug '06

18 Aug '06

Dear List People Someone here could please send me some advice on changin' LDAP passwords? It seems that everything is working nice, except by dovecot: I can send emails using my new LDAP password trought postfix smtp authentication, I can login to my Intranet website and to the Mod-LDAP protected pages on my company. I just can't POP my mail messages, because Dovecot says "dovecot-auth: ldap(user(a)company.net): password mismatch". I guess this is because I'm incorrectly coding the password. Please help me to figure out the right way to crypt the password so Dovecot can read this from the LDAP. *Extra* *Information:* I made a simpler and smaller test version of the program that I use to change passwords, its attached to the email. The essentials are there. *Versions:* My dovecot is a Debian/Sarge (Stable) 3.1 package. I'm also using Perl, Net::LDAP, Apache with Mod_Perl and OpenLDAP. Everything on linux, of course. Package Version ---- ---- dovecot-common 0.99.14-1sarge0 dovecot-imapd 0.99.14-1sarge0 dovecot-pop3d 0.99.14-1sarge0 perl 5.8.4-8sarge4 libnet-ldap-perl 0.3202-3 apache-perl 1.3.33-6sarge2 slapd 2.2.23-8 kernel-image-2.4.2 2.4.27-10sarge1 Any help, suggestion or comment are welcome. Thank you all in advance. -- Luis Motta Campos Segula Technologies Portugal http://www.segula.pt/ #!/usr/bin/perl use strict; use warnings; use Net::LDAP; use Carp qw( croak ); # Connects to server my $ldap = new Net::LDAP( 'localhost' ) or croak $@; my $message = $ldap->bind( 'uid=user,ou=People,dc=company,dc=com', password => 'secret' ); croak $message->error if $message->is_error; # Locate user $message = $ldap->search( base => 'ou=People, dc=company, dc=com', filter => 'uid=user', scope => 'one' ); croak $message->error if $message->is_error; my $entry = $message->entry(0); croak 'Nobody found!?!' unless $entry; # Replace password. $entry->replace( userPassword => '{CRYPT}'. crypt( 'secret', join( '', ('.', '/', 0..9, 'A'..'Z', 'a'..'z')[rand 64, rand 64] ) ) ); $message = $entry->update( $ldap ); croak $message->error if $message->is_error; # Report results. print q{User password changed to: "}.$entry->get_value( 'userPassword' ).qq{".\n};

1 0

[Dovecot] OT: best way to move maildirs to another host ?
by Brice Figureau 18 Aug '06

18 Aug '06

Hi, I'm sorry because this mail is a little bit off-topic, but Timo's email titled "1.0RC7 Released" made me think about a possible issue for me. I have to move an old dovecot installation (1.0b2) from an i386 server to a new x86_64 server running latest available dovecot. My concern is about moving all my users' mail stored as maildir onto this new server. What would be the best way to do that ? >From Timo's comment on 32bits->64bits migration, I guess I'll have to move only the maildirs (and get rid of dovecot cache files), right ? Next, from what I remember about maildir, the message names usually contain the inode so that the file name is unique. If I strictly move the files, I can be sure that the moved files won't have the same inodes number as what is in the name. Should I care ? Or should I use something different than scp/rsync to perform the migration ? Thanks for your answers, Regards, -- Brice Figureau <brice+dovecot(a)daysofwonder.com>

3 3

[Dovecot] Dovecot 1.0RC7 on FreeBSD 6.1/i386
by Martin Jackson 18 Aug '06

18 Aug '06

Everything looks good here, with kqueue support. Thanks for all the hard work, Timo! Marty

1 0

Re: [Dovecot] 1.0 RC7 released
by Bill Boebel 18 Aug '06

18 Aug '06

On Thu, August 17, 2006 6:28 pm, Timo Sirainen <tss(a)iki.fi> said: > I think my v1.0 TODO list is: > > - avoid duplicate flag change notifications, or in case the message is > also expunged don't bother notifying its flag changes at all > (shouldn't be hard) > - HFS+ avoid-hardlinks patch? > - 32bit -> 64bit upgrade still doesn't work without assert-crashing: > mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: > (fixed_size == (unsigned int)-1 || fixed_size == data_size) > - Courier-compatible INBOX. namespace gives "invalid namespace" errors What about this one? The "Connection queue full" issue doesn't appear to be entirely fixed. In fact the fix was disconnecting so frequently that I reverted to the non-fixed version: http://www.dovecot.org/list/dovecot/2006-August/015401.html Bill

1 0

[Dovecot] dovecot mbox to dovecot maildir migration
by Michael Blancas 18 Aug '06

18 Aug '06

Hi, I'm migrating accounts from one server with dovecot mbox and pam nss-ldap authentication to a new server with dovecot maildir and mysql auth (no posix accounts). My problem is the pop3 uidl format on the two servers are different, even though I'm using pop3_uidl_format = %08Xu%08Xv in both configs, I'm always re-downloading left messages on my test runs. Is there a way I could reuse the X-UID and X-IMAPbase headers on the converted mails. Issuing the UIDL command via pop3 always give a different result for the mbox and maildir spools. The X-UID and X-IMAPbase headers are present in the converted mails. The first number of X-IMAPbase maps to the mail UIDVALIDITY and the second is the same as X-UID, the mail uid. Thanks.

2 2

[Dovecot] Supporting local and virtual LDAP users, with seperate mail_env
by Tim Schafer 18 Aug '06

18 Aug '06

Is it possible to have local users with mail in maildir:%h/.maildir and virutal users with mail in maildir:/home/exim/%u/.maildir I seem to have authentication working for both local users and LDAP users. But I'm getting this error trying to access a virtual users mail. Aug 17 08:12:08 hostname dovecot: IMAP(Firstname Lastname): maildir: data=/HOME_DIRECTORY_USED_BUT_NOT_GIVEN_BY_USERDB/.maildir Aug 17 08:12:08 hostname dovecot: IMAP(Firstname Lastname): maildir: root=/HOME_DIRECTORY_USED_BUT_NOT_GIVEN_BY_USERDB/.maildir, index=/HOME_DIRECTORY_USED_BUT_NOT_GIVEN_B Y_USERDB/.maildir, control=, inbox= Aug 17 08:12:08 hostname dovecot: IMAP(Firstname Lastname): mkdir(/HOME_DIRECTORY_USED_BUT_NOT_GIVEN_BY_USERDB/.maildir/cur) failed: Permission denied -- Regards, Tim Schafer Information Technology Logistics Easier with Technology Freight Solution Providers direct 916-376-6190 10453 Old Placerville Road fax 916-376-6156 Sacramento, CA 95827 tim_schafer(a)shipfsp.com

4 7