August 2006 - dovecot

Re: [Dovecot] Suggestion for dovecot default SSL configuration...
by Timo Sirainen 11 Aug '06

11 Aug '06

On Mon, 2006-07-24 at 13:48 -0700, Douglas Moore wrote: > First off, thanks for the effort on this software, it's a world > better than the uw-imap that I used to have to deal with... > > This isn't a bug report per se, but rather a response to something > that came up during some recent security scans. Given that SSLv2 > has it's share of issues, I'd like to suggest that you remove it from > the default ciphers supplied with the source distribution. A > simple :!SSLv2 added to the default cipher list would aid in the > overall security of the package. I'm not an expert in SSL, so I'd rather be sure that it's actually more helpful than harmful. Does something still use SSLv2? If I do the change, I guess the only thing it does is to break those clients that still try to use it? Is its security already bad enough that it's just better to break them?

1 0

[Dovecot] SSL CRL checking
by Timo Sirainen 11 Aug '06

11 Aug '06

Is there a reason that CRL is required to exist in the ssl_ca_file? Could it just use it only if it's there, but otherwise ignore it? Or is this a bad idea? Is it even possible at all to tell that to OpenSSL?

1 0

[Dovecot] Seeing dovecot crash under rc6, seems to go almost exactly every 2.5 hours...
by Dean Blackburn 11 Aug '06

11 Aug '06

We're getting the following crash report, but I'm not sure it contains anything immediately useful (especially since we're running on a minority platform in OS X)... Anyone see where we might be able to resolve this? The crash doesn't kill existing imap processes, but dovecot/imap-login needs to be restarted. ********** Host Name: mailserver Date/Time: 2006-08-10 14:24:16.131 -0700 OS Version: 10.4.6 (Build 8I127) Report Version: 4 Command: dovecot Path: /opt/local/sbin/dovecot Parent: dovecot [10099] Version: ??? (???) PID: 13818 Thread: 0 Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000020 Thread 0 Crashed: 0 dovecot 0x0000482c log_set_prefix + 36 (log.c:190) 1 dovecot 0x000070b0 create_mail_process + 1576 (mail-process.c:535) 2 dovecot 0x00005150 auth_master_callback + 96 (login-process.c:92) 3 dovecot 0x00002d9c auth_process_input + 460 (auth-process.c:121) 4 dovecot 0x00017d58 io_loop_handler_run + 388 (ioloop-select.c:140) 5 dovecot 0x0001006c io_loop_run + 48 (ioloop.c:273) 6 dovecot 0x00008c54 main + 1816 (main.c:577) 7 dovecot 0x000020a8 _start + 344 (crt.c:272) 8 dovecot 0x00001f4c start + 60 Thread 0 crashed with PPC Thread State 64: srr0: 0x000000000000482c srr1: 0x100000000200d030 vrsave: 0x0000000000000000 cr: 0x84002404 xer: 0x0000000020000000 lr: 0x0000000000004810 ctr: 0x00000000901313a0 r0: 0x00000000000070b0 r1: 0x00000000bffff320 r2: 0x0000000000024810 r3: 0x0000000000000000 r4: 0x000000000006f380 r5: 0x0000000000000001 r6: 0x0000000000000000 r7: 0x0000000000000002 r8: 0x000000006b690073 r9: 0x000000000006f104 r10: 0x00000000bffff310 r11: 0x0000000000020b3c r12: 0x000000000006f399 r13: 0x00000000ffffffff r14: 0x0000000000000000 r15: 0x0000000000000000 r16: 0x000000000006f113 r17: 0x000000000006f228 r18: 0x0000000000000000 r19: 0x000000000006f0fc r20: 0x0000000000000014 r21: 0x000000000001b0c0 r22: 0x000000000000041a r23: 0x000000000001b0c0 r24: 0x00000000018006e8 r25: 0x000000000001bfe0 r26: 0x000000000006f133 r27: 0x000000000006f2a8 r28: 0x000000000006f380 r29: 0x0000000000000000 r30: 0x0000000024002422 r31: 0x0000000000004810 Binary Images Description: 0x1000 - 0x1ffff dovecot /opt/local/sbin/dovecot 0x8fe00000 - 0x8fe51fff dyld 44.4 /usr/lib/dyld 0x90000000 - 0x901bbfff libSystem.B.dylib /usr/lib/libSystem.B.dylib 0x90213000 - 0x90218fff libmathCommon.A.dylib /usr/lib/system/libmathCommon.A.dylib 0x936d1000 - 0x936f2fff libmx.A.dylib /usr/lib/libmx.A.dylib

3 2

[Dovecot] dovecot process no longer dies
by Ceasar V. Navato, Jr. 11 Aug '06

11 Aug '06

Bill, After applying the patch from http://dovecot.org/list/dovecot-cvs/2006- August/006209.html, my dovecot rc6 is finally working. Thank you very much for the info. Regards, -- Ceasar V. Navato, Jr.

1 0

[Dovecot] LDA Command time limit exceeded
by Dominique Feyer 11 Aug '06

11 Aug '06

I have many errors of this type in my logs: 2 * postfix/pipe[21511]: BC8DD3356A: to=<*****@******>, relay=dovecot, delay=1001, status=bounced (Command time limit exceeded: "/usr/local/dovecot-1.0-rc2/libexec/dovecot/deliver") My command time limit is 1000s in postfix (more than 15 minutes) After many check, I found that a lots of this error is not really an error. The mail is delivered in the mailbox, but postfix send an error message. Like if Dovecot LDA process dont exit correctly after sending a mail. Do you know this bug ? As workaround i set the command time limit to 1400s but this is too long for our customer. They need in time service. We use an NFS server as storage for all our mail. Output of nfstat: Server nfs v3: null getattr setattr lookup access readlink 1 0% 744955962 21% 34845109 1% 397981329 11% 818838045 24% 0 0% read write create mkdir symlink mknod 649838729 19% 502171416 14% 29188492 0% 301741 0% 0 0% 0 0% remove rmdir rename link readdir readdirplus 54138192 1% 19903 0% 30702957 0% 27796623 0% 1294453 0% 84457031 2% fsstat fsinfo pathconf commit 48529 0% 31463 0% 0 0% 11339977 0% Output of iostat: Linux 2.4.27-3-686-smp (data.clm.net4all.ch) 21. 07. 06 cpu-moy: %user %nice %sys %iowait %idle 0,16 0,00 1,65 0,00 98,19 Device: tps Blk_lus/s Blk_�crits/s Blk_lus Blk_�crits scsi/host0/bus0/target0/lun0/disc 165,50 310,46 617,07 1800983948 3579692632 scsi/host0/bus0/target0/lun0/part1 165,48 309,32 617,06 1794404866 3579616544 scsi/host0/bus0/target0/lun0/part5 0,02 1,13 0,01 6579064 76088 Thanks for your answers, -- Net4all S.A. Dominique Feyer Administrateur Système Ch. de la Colline 5bis CH-1007 Lausanne dfeyer(a)net4all.ch

2 1

[Dovecot] xfs quota support
by polish 11 Aug '06

11 Aug '06

Hello, quota support is out of action on xfs filesystem on my centos 4.x . Problem is that i haven't these file #include <linux/dqblk_xfs.h> on my system. Solution is simple. After instalation xfsprogs-devel you get necessary files, but you must use another header file in dovecot/src/plugins/quota/quota-fs.c. Instead <linux/dqblk_xfs.h> you should use <xfs/xqm.h>. If you advise me, how can i detect if <xfs/xqm.h> exist instead <linux/dqblk_xfs.h>, i can send patch back. I'm not familiar with autotools. existing code in dovecot/src/plugins/quota/quota-fs.c : #ifdef HAVE_LINUX_DQBLK_XFS_H # include <linux/dqblk_xfs.h> #endif new code : #ifdef HAVE_XFS_XQM_H #include<xfs/xqm.h> #endif Best regards Polish -- ********************************************************** * starnem a porad nic, rozum jako kdyby se nam vyhybal * **********************************************************

2 1

[Dovecot] Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable
by Matt Roman 10 Aug '06

10 Aug '06

So I just upgraded from Dovecot 0.99 to the latest 1.0 RC2 because I was having all sorts of Authentication problems and crashes in 0.99. The upgrade did not solve the problem apparently. Dovecot still crashes periodically and always needs to be manually rebooted. The log file errors at the time of the crash: dovecot: Jul 12 14:30:59 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:04 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:09 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:14 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:19 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:24 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:29 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:30 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:33 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:35 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:39 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:40 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:44 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:45 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:49 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:50 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:54 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:55 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:59 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:59 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:59 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:00 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:04 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:04 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:04 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:05 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:09 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:09 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:09 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable I use PAM on the dovecot server connecting to a separate OpenLDAP server with the maildirs on NFS. Currently only the dovecot server talks to the maildirs. Postfix is also on this server, using the same PAM Authentication for SASL and works fine - It does not appear to be a problem with the Authentication server. Thanks in advance!!! -Matt

2 2

Re: [Dovecot] Dovecot deliver logging problem and procmail
by Gerhard Wiesinger 10 Aug '06

10 Aug '06

Hello Timo! Any ideas why it may take so long time to open big mbox files with indexes and delivered through dovecot deliver? So it looks like that something is wrong with the indexes or the algorithm. For details have a look below. BTW: procmail filtering through deliver works well now for me in production environment. I'll make some code cleanups and configuration options. Maybe I can release the patch today. Ciao, Gerhard On Mon, 3 Jul 2006, Timo Sirainen wrote: > On Jul 3, 2006, at 11:07 PM, Gerhard Wiesinger wrote: > >> As far as I saw dovecot's deliver process updates some header fields and the >> index files: >> Status: >> X-Keywords: (with a lot of spaces, why?) >> Content-Length: 6 > > The extra spaces are there so that if Dovecot needs to update some headers it > can take the needed space from there so it doesn't have to move the whole > mbox. > Yes, I saw it after I wrote the mail ... >> After access with dovecot the following header fields change: >> Status: O >> X-IMAPbase: 115195111 0000000009 >> X-UID: 2 >> >> So basically this isn't an advantage over the procmail or any other >> delivering process top mbox. The problem is that after the first access the >> X-UID and X-IMAPbase header must be added, so on large mbox files this might >> take a long time. > > Well, first of all Dovecot should take the space it needs from the X-Keywords > spaces, so it doesn't need to write all that much data. > > Second, the X-UID etc. headers are added by deliver if the mbox file is fully > synced against the indexes. So after you had opened it once with IMAP, after > that deliver should write the X-UID headers also as long as you don't use > something else than Dovecot to modify the mbox. Ok, that worked well. I tried to deliver some large mails (~50MB) which worked well. After sending around 500MB (10 Mails) I opened the mailbox with pine over imap. It still took a lot of time (>20s) to open the mbox. Indexes should be up2date, so why does it take so long time? After opening a second time everything is fine. Any ideas? Ciao, Gerhard

2 2

Re: [Dovecot] imap-login (proxy) Connection queue full
by Bill Boebel 10 Aug '06

10 Aug '06

On Thu, August 10, 2006 5:22 pm, Timo Sirainen <tss(a)iki.fi> said: > On Thu, 2006-08-10 at 16:28 -0400, Bill Boebel wrote: >> When running Dovecot (rc6 CVS dovecot-20060808) as a proxy, why would it log the >> following when it has not yet maxed out the allowed number of imap-login >> processes? >> >> Aug 10 16:23:34 director5 dovecot: imap-login: Disconnected: Connection queue >> full: >> >> I am seeing this logged several times per minute. From netstat, the server has >> 650 proxied IMAP connections and 450 proxied IMAPS connections, there are >> currently 10 imap-login processes running, and using the following config: > > I did some changes to CVS which hopefully should fix this? Cool, thanks. I will try this tonight. Bill

1 0

[Dovecot] 1.0.rc2 released
by Timo Sirainen 10 Aug '06

10 Aug '06

Final 1.0 release is looking to get closer. There's nothing left in my TODO list for it, so please report any old and new bugs you see. This release also makes upgrades from 0.99 more transparent with automatic renaming of .subscriptions and .customflags files with maildir. http://dovecot.org/releases/dovecot-1.0.rc2.tar.gz http://dovecot.org/releases/dovecot-1.0.rc2.tar.gz.sig * disable_plaintext_auth=yes: Removed hardcoded 127.* and ::1 IP checks. Now we just assume that the connection is secure if the local IP matches the remote IP address. * SSL code rewrite which hopefully makes it work better than before. Seems to work correctly, but if you suddently have trouble with SSL connections this is likely the reason. + verbose_ssl=yes: Log also SSL alerts and BIO errors - If namespace's location field wasn't set, the default location was supposed to be used but it wasn't. - When copying ssl-parameters.dat file from /var/lib to /var/run its permissions went wrong if it couldn't be copied with hard linking. - Fixed filesystem quota plugin to work with BSDs. - Maildir: Saving mails didn't work if quota plugin was enabled (again) - Maildir: Messages' received time wasn't saved properly when saving/copying multiple messages at a time. Also if using quota plugin the S= size was only set for the first saved file, and even that was wrong. - passdb passwd-file: Don't require valid uid/gid fields if file isn't also being used as a userdb. - PostgreSQL: Handle failures better so that there won't be "invalid fd" errors in logs. - Don't try to expunge messages if the mailbox is read-only. It'll just cause our index files to go out of sync with the real mailbox and cause errors. - ANONYMOUS authentication mechanism couldn't work because anonymous_username setting wasn't passed from master process.

9 15