November 2007 - dovecot

[Dovecot] backup dovecot
by Nikolay Shopik 04 Jan '08

04 Jan '08

What is correct way to backup dovecot store? Is am I right what is just enough to copy all maildir and my configuration. So in case failure I can just prepare new machine copy config, maildirs and I'm good to go with this.

7 11

[Dovecot] dovecot-auth consumes 100% CPU time on Solaris 10
by KOT MATPOCKuH 02 Jan '08

02 Jan '08

Is problem with CPU load solved? I have same problem - dovecot-auth eats one of my cores. I'm using dovecot 1.0.7 on Solaris 10 Sparc. I tried to use auth-bind and standard scheme with separate user for bind and have same result. Problem occupts only with LDAP authentication, on some other systems I use PostgreQSL and MySQL authentication and doesn't have this problem. Using PAM authentication is not possible, because dovecot run in chroot'ed environment and I planing to move it to separate system or zone without ldap client. -- MATPOCKuH

7 20

[Dovecot] Enhanced Kerberos support
by Richard A Nelson 31 Dec '07

31 Dec '07

The recent addition of auth_gssapi_hostname is a welcome addition, but a little more is needed for multi-homed (or multi-domained) sites. SSH recently added this enhancement to address this common need: GSSAPIStrictAcceptorCheck Determines whether to be strict about the identity of the GSSAPI acceptor a client authenticates against. If “yes” then the client must authenticate against the host service on the current hostname. If “no” then the client may authenticate against any service key stored in the machine’s default store. This facility is provided to assist with operation on multi homed machines. The default is “yes”. Note that this option applies only to protocol version 2 GSSAPI connections, and setting it to “no” may only work with recent Kerberos GSSAPI libraries. I've heard that other daemons support multi-names by instead of using gethostname(), obtain the hostname of the interface that the request came in on. Can either approach be looked at for dovecot ? Thanks, -- Richard A Nelson (Rick) cowboy(a)((linux.)?vnet|us).ibm.com Phone: 1-408-463-5584 Fax: 1-408-463-3873 COBOL Development IBM Silicon Valley Laboratory http://www.ibm.com/software/awdtools/cobol/

5 5

[Dovecot] auth-ldap not resetting connection state after failed bind
by Brendan Braybrook 29 Dec '07

29 Dec '07

timo, i think i found a small problem with the ldap implementation: when using auth_bind (this might be in all conditions, not just that one - i haven't tested further), if the server lost connection to the ldap server (ie, the ldap server died) dovecot-auth would never reconnect to the ldap server and all subsequent auth attempts would fail. after a little more digging, i discovered that if the ldap server went down and came back up before the next dovecot request then everything would be fine. however, if a request came in while the ldap server was down then dovecot-auth would "cache" that the server was unavailable and never recheck it. i believe i tracked it down to a couple lines in db_ldap_bind and fixed it - dovecot-auth is reconnecting to ldap in the condition where it was not previously: --- dovecot-1.0.3/src/auth/db-ldap.c 2007-10-15 18:26:55.983349000 +0000 +++ dovecot-1.0.3/src/auth/db-ldap.c.new 2007-10-15 18:28:03.124136000 +0000 @@ -446,7 +446,10 @@ msgid = ldap_bind(conn->ld, conn->set.dn, conn->set.dnpass, LDAP_AUTH_SIMPLE); if (msgid == -1) { - db_ldap_connect_finish(conn, ldap_get_errno(conn)); + if (db_ldap_connect_finish(conn, ldap_get_errno(conn)) < 0) { + /* lost connection, close it */ + ldap_conn_close(conn, TRUE); + } i_free(ldap_request); return -1; }

3 3

[Dovecot] about quota_warning behavior
by naoki 21 Dec '07

21 Dec '07

Hi, We've been using v1.0.5 +quota_warning patch, however quota_warning does't seem to be working properly. For example, in order to enable 80% over for quota warning, and we configured like following: ----------------------------------------------------------------------- plugin { quota_warning = storage=80%% /usr/local/path/to/plugin } ----------------------------------------------------------------------- But it does not work. However we set quota_warning value to 20%, it seems to be working. ----------------------------------------------------------------------- plugin { quota_warning =storage=20%% /usr/local/path/to/plugin } ----------------------------------------------------------------------- If this is the case, do we always have to set quota value to what we have after subtracting the required quota warning value from 100. for example, if we want quota warning value to be 70%, we actually have to write 30% in configuration?? Will there be another patch to fix this? Thanks -- Naoki Takazawa Marino Ltd., Yokohama, JAPAN

2 1

[Dovecot] Using global und per-user sieve scripts at the same time
by Matthias Kellermann 11 Dec '07

11 Dec '07

Hi list, I'm trying to get a global sieve mailfilter with per-user sieve scripts to work. At the "lda"-section in the dovecot.conf file I have: global_script_path = /usr/local/etc/sieve/spam /usr/local/etc/sieve/spam: require "fileinto"; if header :contains ["Subject"] ["***Spam***"] { fileinto "Spam"; stop; } which will work fine delivering Spam Mails in a Spam dir for every user. If a user creates his own .dovecot.sieve file the global script will not work anymore. How can I enable global and local per-user sieve scripts at once? Is this possible? Do you know any workaround so all users will have the same (Spam-)sieve filters beside there own (global templates or so)? Matthias

5 11

[Dovecot] MANAGESIEVE patch v7 for dovecot 1.0.3 and TLS
by Andreas Schneider 09 Dec '07

09 Dec '07

Hi, I allow only TLS/SSL connection to dovecot. The managesieve doesn't work with TLS but it works without it. gladiac@magrathea:~> gnutls-cli -p 2000 -s --insecure -V milliways.cynapses.org Resolving 'milliways.cynapses.org'... Connecting to '213.239.217.124:2000'... - Simple Client Mode: - Received[194]: "IMPLEMENTATION" "dovecot" "SASL" "PLAIN" "SIEVE" "fileinto reject envelope vacation imapflags notify subaddress relational comparator-i;ascii-numeric regex" "STARTTLS" OK "Dovecot ready." STARTTLS - Sent: 9 bytes - Received[33]: OK "Begin TLS negotiation now." Let me know if you need more information. Thanks, -- andreas -- http://www.cynapses.org/ - cybernetic synapses

3 4

[Dovecot] Questions about deliver log files
by frank.kintrup＠fkware.de 08 Dec '07

08 Dec '07

Hi, I upgraded from Courier to dovecot, and now I try to rebuild some of the features I used to have. One was a monthly per user log of maildrop's work. I used this code in maildroprc: DATE=`date +%m` logfile "$MAILDIR/maildrop-$DATE.log" This created a monthly log in the each user's Maildir. I find it easier to have a log per user than having to filter the log entries from a large log file for all users. I tried to recreate it with deliver by using the variables %h and %d/%n, but they are not interpreted when the log file is accessed ("Can't open log file /var/vmail/%d/%n/deliver.log: No such file or directory"). And there seems to be no way to include a date in the file name (but maybe I could use logrotate for that). Another problem: Currently deliver only logs the message id. A user would never ask for this (especially if he asks where certain mails were stored/discarded), he would ask for the sender's name/email or subject. Is the contents of the log file configurable? Frank

2 2

[Dovecot] SIGSEGV login process
by Maxim 05 Dec '07

05 Dec '07

Hi all. I recently upgraded from 1.0.0 to 1.0.7 version and found that process imap-login begins randomly crash: pid 29997 (imap-login), uid 143: exited on signal 11 (core dumped) pid 32189 (imap-login), uid 143: exited on signal 11 (core dumped) pid 32121 (imap-login), uid 143: exited on signal 11 (core dumped) pid 31309 (imap-login), uid 143: exited on signal 11 (core dumped) i guess that it happens during high load on CPU (but just guess) no anything upon upgrade changed - traffic, config are the same. can anyone help me? running FreeBSD 6.2, compiled from port with mysql, lda, kqueue, pop3 support. mail# dovecot -n # 1.0.7: /usr/local/etc/dovecot.conf protocols: imap pop3 pop3s imaps listen(default): *:143 listen(imap): *:143 listen(pop3): *:110 ssl_listen(default): *:993 ssl_listen(imap): *:993 ssl_listen(pop3): *:995 ssl_cert_file: /usr/local/etc/ssl_mail/dovecot.pem ssl_key_file: /usr/local/etc/ssl_mail/dovecot.pem ssl_cipher_list: ALL:!LOW disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login verbose_proctitle: yes first_valid_uid: 26 last_valid_uid: 26 mail_extra_groups: mail mail_location: maildir:~/Maildir mmap_disable: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): outlook-idle pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain cram-md5 digest-md5 apop login default_realm: proc.ru passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf mail# grep -v '^ *$#.*$\?$' /usr/local/etc/dovecot-sql.conf driver = mysql connect = host=/tmp/mysql.sock dbname=exim_users user=exim password=** default_pass_scheme = PLAIN password_query = SELECT concat(pw_name, '@', domain) as user, pw_clear_passwd as password FROM vusers WHERE pw_name = '%n' AND domain = '%d' user_query = SELECT pw_dir AS home, 26 AS uid, 26 AS gid, concat('maildir:storage=', quota*1024) AS quota FROM vusers WHERE pw_name = '%n' AND domain = '%d' backtrace from core file: mail# gdb ./work/dovecot-1.0.7/src/imap-login/imap-login /var/run/dovecot/login/tmp/imap-login.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"...(no debugging symbols found)... warning: exec file is newer than core file. Core was generated by `imap-login'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/libssl.so.4...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libssl.so.4 Reading symbols from /lib/libcrypto.so.4...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypto.so.4 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols found)...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x08051e2d in auth_client_request_continue () (gdb) bt #0 0x08051e2d in auth_client_request_continue () #1 0x0804b8db in client_auth_input () #2 0x080562ec in io_loop_handler_run () #3 0x0805599d in io_loop_run () #4 0x0804d963 in main () (gdb) or what anything info should i provide?

3 13

Re: [Dovecot] Variable krb5 cache location
by Timo Sirainen 04 Dec '07

04 Dec '07

On Sun, 2007-11-25 at 20:24 +0100, Roland Hopferwieser wrote: > First I want to thank you for this great software. > Second, I think it could be a good idea to give the user the chance to > change the location for the kerberos V cache, so there is no potentially > conflict with other processes. With external refreshment of the krb5 > cache, I use the cache also for authentication against the LDAP server > with the gssapi. > Please find attached a little diff file to dovecot 1.0.7. Looks ok, but I hate to add new settings to dovecot.conf nowadays since there are already too many. Also then there would be two Kerberos-related settings that simply set environment variables. I'm beginning to think that maybe something more generic is needed, such as: auth default { .. environment { krb5_ktname = .. krb5ccname = ... who_knows_what_else_in_future = .. } } I think LDAP library also can accept settings from environment. Anyone on mailing list have better ideas?

2 1