December 2007 - dovecot

[Dovecot] dovecot: auth(default): LDAP: ldap_result() failed: Can't contact LDAP server
by Rolf E. Sonneveld 28 Dec '07

28 Dec '07

Hi, I'm new to the list; excuse me if this has been asked recently/before. running: # dovecot --version 1.0.8 Output of dovecot -n: base_dir: /var/run/dovecot protocols: none ssl_disable: yes login_dir: /var/run/dovecot/login login_executable: /usr/local/dovecot/libexec/dovecot/imap-login auth default: verbose: yes debug: yes debug_passwords: yes passdb: driver: ldap args: /usr/local/dovecot/etc/dovecot-ldap.conf userdb: driver: ldap args: /usr/local/dovecot/etc/dovecot-ldap.conf socket: type: listen client: path: /usr/local/postfix/spool/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot-auth-master mode: 438 Using dovecot only for the purpose of providing SMTP AUTH service for Postfix, using Active Directory (AD) as authentication source. As you can see from the config, connectivity between Dovecot and AD is implemented using LDAP. Contents of /usr/local/dovecot/etc/dovecot-ldap.conf (some site-specific info masqueraded): auth_bind = yes pass_filter = (sAMAccountName=%u) hosts = AD1.domain.com:3268 AD2.domain.com:3268 dn = CN=Service Account Postfix,OU=Services,DC=domain,DC=com dnpass = secret ldap_version = 3 base = DC=domain,DC=com scope = subtree Now, this works fine and authentication via SMTP AUTH + Dovecot works perfect. Yet, every 15 minutes I get the following warning in the syslog logfile: Dec 24 07:20:00 hostname dovecot: auth(default): LDAP: ldap_result() failed: Can't contact LDAP server Dec 24 07:35:01 hostname dovecot: auth(default): LDAP: ldap_result() failed: Can't contact LDAP server Dec 24 07:50:01 hostname dovecot: auth(default): LDAP: ldap_result() failed: Can't contact LDAP server Dec 24 08:05:02 hostname dovecot: auth(default): LDAP: ldap_result() failed: Can't contact LDAP server Dec 24 08:20:02 hostname dovecot: auth(default): LDAP: ldap_result() failed: Can't contact LDAP server Dec 24 08:35:03 hostname dovecot: auth(default): LDAP: ldap_result() failed: Can't contact LDAP server I've looked through the archives and it seems that this problem is caused by the fact that Dovecot (using the OpenLDAP client libraries?) keeps the LDAP connection open; after (in our case) 15 minutes Active Directory closes the connection and Dovecot signals this in the syslog (and presumably automatically will create a new connection to AD). I'm pretty sure that the OpenLDAP client libraries provide options to use a client-side timeout for LDAP connections. My questions are: * is there a reason that Dovecot wants to keep the LDAP connection open? * Will the new V1.1 version have a config parameter to set the LDAP client timeout or a default timeout value to close the connection? * If there's no 'fix' foreseen for V1.1, I'd like to file a request to add such a parameter. How can I file such a request? The warning is annoying; the sysadmin will create a filter, to filter the warning out from the syslog, but I'm afraid that if there's a real problem with authentication, that will be filtered too and the real problem is not noticed, before users start to complain. /rolf

2 3

Re: [Dovecot] namespace problem / 1.1beta11
by ja nein 28 Dec '07

28 Dec '07

Hi Timo, I think I've hit a separator bug: This is namespace query of dovecot and source server: ---snip--- * OK Dovecot ready. 1 login ... 1 OK Logged in. 2 NAMESPACE * NAMESPACE (("INBOX/" ".")) NIL NIL 2 OK Namespace completed. 3 logout * BYE Logging out 3 OK Logout completed. Connection closed by foreign host. Escape character is '^]'. * OK [CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=NTLM AUTH=SRP AUTH=OTP AUTH=PASSDSS-3DES-1 SASL-IR] Cyrus IMAP4 v2.3.8 server ready 1 login ... 1 OK [CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID LOGINDISABLED ACL RIGHTS=kxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT SORT=MODSEQ THREAD=ORDEREDSUBJECT THREAD=REFERENCES ANNOTATEMORE CATENATE CONDSTORE IDLE LISTEXT LIST-SUBSCRIBED X-NETSCAPE URLAUTH] User logged in 2 NAMESPACE * NAMESPACE (("INBOX/" "/")) (("user/" "/")) (("" "/")) 2 OK Completed 3 logout * BYE LOGOUT received ---snip--- So Dovecot is stating Namespace separator is ".". But my dovecot -n namespace section shows: namespace: type: private separator: / prefix: INBOX/ inbox: yes list: yes subscriptions: yes According to this I've set separator to "/". And this is the problem. I think problem arised somewhere between beta9 and beta11, as it worked before... The separator in imapsync was for both "/" (--sep1 /, --sep2 /), I just played with all possibilities... Well, never mind if v1.2 or v2.0, as long as LMTP makes it in ;) Anyway, we can provide some good stress testing in such an environment... Regards and for all Merry Christmas and a happy new year! Sebastian ----- Ursprüngliche Mail ---- Von: Timo Sirainen <tss(a)iki.fi> An: ja nein <reg9009(a)yahoo.de> CC: dovecot(a)dovecot.org Gesendet: Freitag, den 21. Dezember 2007, 18:19:31 Uhr Betreff: Re: [Dovecot] namespace problem / 1.1beta11 On Wed, 2007-12-12 at 07:16 +0000, ja nein wrote: > From Folder [INBOX/Trash] .. > /home/imapsync/imapsync --host1 ip.of.host.1 --user1 user1 --password1 password --host2 127.0.0.1 --user2 user2 --password2 password --authmech2 LOGIN --regextrans2 s/\./_/g --delete2 --sep1 . --sep2 . --justfolders Shouldn't those be -sep1 / -sep2 /. Or at least the one that's on Dovecot's side. > Btw., as we work in a load balanced environment, LMTP delivery would be a great feature for upcoming releases, as it would enable people to use multiple frontends of SMTP servers without the need of connecting them to a somewhat shared file system. Forwarding all mail to a SMTP server on the machine running dovecot and doing delivery there isn't the favoured option (at least for us). Yes, LMTP would be nice, but it pretty much requires v2.0 framework. I'm still not sure if the next version will be v1.2 or v2.0.. Jetzt Mails schnell in einem Vorschaufenster überfliegen. Dies und viel mehr bietet das neue Yahoo! Mail - www.yahoo.de/mail

3 2

[Dovecot] assertion on deliver (1.1.beta10)
by Nuno Lopes 28 Dec '07

28 Dec '07

Hi, I'm testing version 1.1.beta10 and getting these assertions on deliver: file index-transaction.c: line 54 (index_transaction_finish_rollback): assertion failed: (t->mail_ref_count == 0) This was after an upgrade from a 1.0 release candidate. If you need I can try and reproduce this in a more controled environment to pinpoint the problem. Thanks, -- Nuno Lopes

2 4

[Dovecot] Dovecot + Cygwin the 2nd
by Ronny 28 Dec '07

28 Dec '07

Hi, i still try to get dovecot to run under cygwin. After a post on the cygwin list i am able tu run dovecot. Under Cygwin you have to run dovecot by inetd. Starting the binary "dovecot.exe" does not work. Well the server is running but answers with a fatal error. Account: 'localhost', Server: 'localhost', Protokoll: POP3, Serveranswer: 'Fatal: EOF while reading environment from master', Port: 110, Secure (SSL): No, error on server: 0x800CCC90, Fehlernummer: 0x800CCC90 This error is from Outlook, Thunderbird just says there is an error without any error message. So maybe you can help me to bring my story to a hapy end ;-) Cheers Ronny

3 11

[Dovecot] cache files corruption
by Dmitry Pryadko 28 Dec '07

28 Dec '07

Here what one of my users sometimes gets in logs when using IMAP: dovecot: IMAP(skribtsov(a)pawlin.mass.hc.ru): Disconnected in IDLE dovecot: IMAP(skribtsov(a)pawlin.mass.hc.ru): Maildir /usr/local/mail/pawlin.mass.hc.ru/skribtsov/Maildir sync: UID inserted in the middle of mailbox (59 > 16, file = 1198267793.H747026P68033.mail5.hc.ru:2,RS) dovecot: IMAP(skribtsov(a)pawlin.mass.hc.ru): Disconnected: Mailbox is in inconsistent state, please relogin. dovecot: IMAP(skribtsov(a)pawlin.mass.hc.ru): Maildir /usr/local/mail/pawlin.mass.hc.ru/skribtsov/Maildir sync: UID inserted in the middle of mailbox (59 > 16, file = 1198267793.H747026P68033.mail5.hc.ru:2,RS) dovecot: IMAP(skribtsov(a)pawlin.mass.hc.ru): Disconnected: Mailbox is in inconsistent state, please relogin. dovecot: IMAP(skribtsov(a)pawlin.mass.hc.ru): Corrupted transaction log file /usr/local/mail/pawlin.mass.hc.ru/skribtsov/Maildir/dovecot.index.log.2: invalid indexid (1198254020 != 1198498301) dovecot: IMAP(skribtsov(a)pawlin.mass.hc.ru): Corrupted index cache file /usr/local/mail/pawlin.mass.hc.ru/skribtsov/Maildir/dovecot.index.cache: indexid changed After that, some messages could "disappear" from messages list. And then maybe "appear" again. When I delete dovecot.* files, all goes ok. I use NFS storage. BTW, it seems like this problem exists only when working with M$ Outlook :) # 1.0.5: /usr/local/etc/dovecot.conf syslog_facility: local7 protocols: imap pop3 imaps pop3s ssl_cert_file: /etc/ssl/mail5.hc.ru.pem ssl_key_file: /etc/ssl/mail5.hc.ru.pem disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_greeting: Mail server ready. login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(pop3): no login_max_processes_count: 256 max_mail_processes: 2048 verbose_proctitle: yes first_valid_uid: 90 last_valid_uid: 65000 first_valid_gid: 90 last_valid_gid: 90 mail_extra_groups: mail mail_location: maildir:~/Maildir mmap_disable: yes lock_method: dotlock mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): outlook-idle pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login cram-md5 verbose: yes debug: yes debug_passwords: yes worker_max_count: 150 passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: prefetch userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf socket: type: listen master: path: /var/run/dovecot/auth-master mode: 384 user: vexim plugin: quota: maildir -- Dmitry Pryadko http://www.hc.ru

2 5

[Dovecot] per user quota
by Massimo Maioli 28 Dec '07

28 Dec '07

Hi, i've tryed to setup per user quota with postfix/dovecot, but without luck. My configuration is: postfix 2.3.8 with virtualdomain on mysql (http://workaround.org tutorial) dovecot 1.0.9 IMAP/PO3 OK on dovecot config, i've made the changes for the quota plugin, i've setup the gereral quota at 20MB, with this configuration: quota = maildir:storage=20480:messages=1000 it works very well, from telnet connection and squirrelmail, i see the right % of quota used. My problem is the per user quota, if i want give some user, more or minus space, i'm not able to do this. I've added a quota field to the mysql that read dovecot, but i don't know ho to read this in dovecot-mysql.conf. Someone can help me? Thanks

2 1

[Dovecot] Audit log?
by Bjørn T Johansen 26 Dec '07

26 Dec '07

Where can I found the log that dovecot writes if a user fails to log in? I am authenticating agains an sql db, but I can't find where dovecot logs this, if it does? Regards, BTJ -- ----------------------------------------------------------------------------------------------- Bjørn T Johansen btj(a)havleik.no ----------------------------------------------------------------------------------------------- Someone wrote: "I understand that if you play a Windows CD backwards you hear strange Satanic messages" To which someone replied: "It's even worse than that; play it forwards and it installs Windows" -----------------------------------------------------------------------------------------------

5 9

[Dovecot] v1.1.beta12 released
by Timo Sirainen 25 Dec '07

25 Dec '07

http://dovecot.org/releases/1.1/beta/dovecot-1.1.beta12.tar.gz http://dovecot.org/releases/1.1/beta/dovecot-1.1.beta12.tar.gz.sig Still not a release candidate, maybe the next one.. This release fixes a lot of bugs and adds some new sanity checks. Fixes quite a lot of mbox problems. v1.1.beta11 (no other versions) had a potential security hole where memory was free()d multiple times. \Recent flags should work perfectly now with mbox. Still somewhat broken with maildir.

2 1

[Dovecot] Dovecot Log control=
by Evaggelos Balaskas 24 Dec '07

24 Dec '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, i use dovecot-1.0.9 + sieve plugin 1.0.2 pop3 - imap, virtual users from file with MD5-CRYPT some with maildir some with mbox, spamassasin + sieve filter per user, etc - etc and everything are simple perfect. The only real question i have is this: in the logs when the dovect LDA deliver a mail to a maildir account is something control= What exactly is this ? deliver(ebalaskas): Dec 14 23:32:35 Info: maildir: root=/var/mail/folders/ebalaskas, index=/var/mail/index/ebalaskas, control=, inbox= -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHYvb0WIK+Pe9twhoRAnyVAKCKHsvi7DJ01uYnAQvbeLNh85HBoQCgxtSp Sm9WetpSQMJsiyp0wAkReOQ= =k0f0 -----END PGP SIGNATURE-----

2 2

[Dovecot] Brute Force Blocking?
by Ben Cadieux 24 Dec '07

24 Dec '07

Hi Everyone, Before I begin, I'd just like to mention: I love dovecot. Thank you :) Anyway, today I had 8000 login attempts to my dovecot server in an hour before blocking the IP with my firewall. After googling, I didn't see very much discussion on the topic. There was some mention of blocksshd which was supposed to support dovecot in the next release (but doesn't appear to) and also fail2ban. While a script that parses logfiles will work, I'm not sure that this is the best way to go about handling repeated authentication failure. Would it not be best built into dovecot? Are there any plans for this? Best Regards, Ben Cadieux

8 8