February 2007 - dovecot

[Dovecot] .bz2 plugin?
by David McBride 14 Feb '07

14 Feb '07

Hello all, Is anyone working on a .bz2 plugin similar to the existing zlib plugin? Cheers, David -- David McBride <dwm(a)tastycake.net>

2 1

[Dovecot] dead bodies stacking up in Drafts folder
by Charles Bueche 14 Feb '07

14 Feb '07

Hi, Setup : Apple Mail 2.1.1 (752.3) on Intel MacBook Pro and Dovecot 1.0rc22 on Solaris 9/SPARC. I use IMAP/TLS. Problem : mails are stacking up in the Drafts folder. When I start writing a mail, it appears in the drafts folder, and usually disappear as desired when I hit "Send". It then appear in the "Sent" folder. Sometimes, a draft versions stays in "Drafts", I have 21 of them since 1.1.2007. In this period, I have written about 400 emails, so only about 5 % stick in "Drafts". I can of course periodically select and delete them, but I don't like such glitches. Never sure if emails are really sent. Advice welcome. I'm the Solaris packager and admin so I can test things if needed. Sorry if it's a known Apple Mail issue, I would be the one to beat for using closed-source stuff :-) Charles -- Charles Bueche <charles(a)bueche.ch> sand, snow, wave, wind and net -surfer A-Cat SUI 192

7 9

[Dovecot] [Fwd: Re: Is it 1.0 yet?]
by Gavin Henry 14 Feb '07

14 Feb '07

---------------------------- Original Message ---------------------------- Subject: Re: [Dovecot] Is it 1.0 yet? From: "Raymond Lillard" <ryl(a)plasmaequip.com> Date: Tue, February 13, 2007 11:16 pm To: "Gavin Henry" <ghenry(a)suretecsystems.com> -------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Gavin Henry wrote: > <quote who="Marc Perkel"> >> OK - my last main bug was fixed a few releases ago. I know that there's >> no end to getting things right but there comes a point when you need to >> call it done. No one trusts a 1.0 to be perfect but Dovecot is already >> better that most 2.0 versions of other software. >> >> I vote (as if my vote counted) to call it done, declare victory, and >> move on to 1.01, 1.02 etc. No one is going to trus it till it gets to >> 1.02 so I say lets bless it and move on. >> >> > > +1 > > +2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF0kbLW6j0KQLSyTQRAhbZAJ0SAJDaNES4wV+UajiKJ0ByObbP5gCfXfdv CU2v+W+diqDAnarYRncXj2s= =XTcI -----END PGP SIGNATURE-----

1 0

[Dovecot] Chdir Permission Denied
by Jamie Heinzel 13 Feb '07

13 Feb '07

Here are the error messages I get when anyone tries to login. Feb 13 11:22:17 mail dovecot: chdir(/home/don150) failed with uid 776: Permission denied Feb 13 11:22:17 mail imap-login: Login: don150 [::ffff:192.168.146.10] Feb 13 11:22:17 mail dovecot: child 12101 (imap) returned error 89 I am not running SELinux so I'm not sure what is happening here. All was working fine this morning, then at about 9:30 am nobody could log in. Any help would be great. Thanks!

2 2

Re: [Dovecot] [Fwd: Disable a User's email account]
by Steffen Kaiser 13 Feb '07

13 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, 13 Feb 2007, Michael Surette wrote: Hello, I'm not sure why you'd not mail this info the one, who had created the thread. Bye, - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBRdHa9y9SORjhbDpvAQLFoQf+PZUZZ6bHwhcKIh+8eTK3h4wEuF0lAqjE zuOjOC5D08bOgY86qt84vWqA+MYt9QTCXTPlTFxQYQESf5IgqgwKbPbl0PHxoc/1 GOddQ+Hd7I9lt42iWukqYtd6LGAV6CTIhZIFRm6uVnZYm1Or+3kiyFhiwMwkxSKF NfcsUYVenAhtfNSXOEALaBhvzdD/uUsZX/G/whq6y9A2xPOE25zdVxLPLP+F+mk3 enShwoGa1AMV6snOOEJIRkJ4QwuCacjuQjduyBKpn72rQukZBrHoJes8DOGdIKSx 3BrFz6ck+H+7hHt+vH6ukk2fRO7nkheltrMiCc22Uf97UIychHNrOA== =NWw9 -----END PGP SIGNATURE-----

1 0

[Dovecot] Apple mail
by Аркадий Володин 13 Feb '07

13 Feb '07

I have strange situation with Appe mail and latest (rc22) Dovecot. I using "mbox" POP3 (not IMAP) type of message box on server (exim: driver=appendfile) I also using MySQL authentification and SSL. Server - Linux Slackware 11.0 Linux/Thunderbird, WinXP/Thunderbird, WinXP/Outlook clients are working fine with their message boxes. But Apple mail doesn't delete messages in user's mbox, so client gets a lot of duplicate messages. As I see in such a mbox, there isn't system message like: >From MAILER_DAEMON Tue Feb 13 14:41:08 2007 Date: Tue, 13 Feb 2007 14:41:08 +0000 From: Mail System Internal Data <MAILER-DAEMON@mail> Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA Message-ID: <1171377668@mail> X-IMAP: 1169824263 0000000019 Status: RO But every message in such a box marked as "Status: RO" Please, help me to solve this trouble.

1 0

[Dovecot] error message after migration UW --> DOVECOT
by Frank Bonnet 13 Feb '07

13 Feb '07

Hello I get a lot of messages looking as above since I migrate from UW dovecot: Feb 13 10:27:44 Error: IMAP(xxxxxxxx): mbox sync: UID inserted in the middle of mailbox /user/xxxxxxxx/Trash (7 > 5, seq=2, idx_msgs=2) What would be the impact for my users ? Thanks a lot Frank

2 1

[Dovecot] [Fwd: Disable a User's email account]
by edwardspl＠ita.org.mo 13 Feb '07

13 Feb '07

Dear All, The System is FC6... So, how to disbale a User's mail service ? eg : Sendmail ( SMTP ) + Dovecot ( pop3 /imap ). Edward. -- fedora-list mailing list fedora-list(a)redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

6 12

[Dovecot] PAM, NSS, and a new blocking=yes setting
by Timo Sirainen 13 Feb '07

13 Feb '07

I wondered for a while if I should do this before v1.0, but since there seem to be problems with some PAM/NSS users and this was way easier to implement than I realized, here it is: passdb pam and userdb passwd now support blocking=yes setting in their args. For PAM the default has been to fork the dovecot-auth process and talk via a pipe to the main dovecot-auth. I've never really liked this approach, but didn't bother fixing it before. However it is also what has caused the bugs with nss_ldap, and maybe with other NSS backends too. NSS lookups then have been done all in the same dovecot-auth process without any forking. This meant that if it got stuck (or delayed a bit in LDAP queries and such), the whole dovecot-auth got stuck and all authentication attempts got stuck. With blocking=yes the lookups are handled in dovecot-auth worker processes. Earlier these workers have been used only with MySQL. Initially there is only a single worker process, but whenever dovecot-auth notices that there are no free workers while a new auth request comes, a new worker is created. auth_worker_max_count specifies the maximum number of those processes. This blocking=yes will probably work great with NSS. With PAM I'm not so sure. Mostly because the worker never exits, it just does one PAM auth after another. I think usually PAM is used only once in a process, so there might be memory leaks and maybe other bugs.. Then again, maybe not. I'll add some auth_worker_max_requests setting which can be set to 1 if this is a problem. Also for blocking=no case I added code to send KILL signal to PAM child processes which haven't replied for 2 minutes. With blocking=yes this condition can't be checked currently. http://dovecot.org/list/dovecot-cvs/2007-February/007639.html http://dovecot.org/list/dovecot-cvs/2007-February/007642.html http://dovecot.org/list/dovecot-cvs/2007-February/007646.html

2 2

[Dovecot] MD5-CRYPT passwords in a MySQL Database
by David Mills 13 Feb '07

13 Feb '07

First of all, hello to the list. I'm currently migrating from a /etc/passwd and /etc/shadow based configuration to a MySQL based one using dovecot 99.14 on debian sarge. The problem is that the /etc/shadow containes both DES encoded (Crypt) and md5 based passwords. I've set the default system to be Crypt, and have added {MD5-CRYPT} in front of the md5 passwords in place of the $1$ header found in /etc/shadow. But I can only log in on accounts that have DES based passwords. I've included my dovecot configuration, and below are 2 examples of encoded password, one crypt and one MD5: XalGYN3cy1crA {MD5-CRYPT}RL$Bvv.TF2XJkyVI6JOUO8tx/ If anyone has any ideas I'd really appreciate them since 80 odd accounts have this problem, so changing them one by one will be difficult. David -- David Mills Enki Technologies 01 76 00 71 20 *De nouvelles offres d'emploi...* *...pour bien démarrer 2007 !* Consulter la news <http://www.enki.fr/detail_actualite.htm?ACTU=13> - enki.fr <http://www.enki.fr> ## Dovecot 1.0 configuration file # Default values are shown after each value, it's not required to uncomment # any of the lines. Exception to this are paths, they're just examples # with real defaults being based on configure options. The paths listed here # are for configure --prefix=/usr --sysconfdir=/etc/dovecot # --localstatedir=/var --with-ssldir=/etc/ssl # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Protocols we want to be serving: # imap imaps pop3 pop3s protocols = imaps pop3 pop3s # IP or host address where to listen in for connections. It's not currently # possible to specify multiple addresses. "*" listens in all IPv4 interfaces. # "[::]" listens in all IPv6 interfaces, but may also listen in all IPv4 # interfaces depending on the operating system. You can specify ports with # "host:port". #imap_listen = * #pop3_listen = * # IP or host address where to listen in for SSL connections. Defaults # to above non-SSL equilevants if not specified. #imaps_listen = #pop3s_listen = # Disable SSL/TLS support. #ssl_disable = no # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before # dropping root privileges, so keep the key file unreadable by anyone but # root. #ssl_cert_file = /etc/ssl/certs/dovecot.pem #ssl_key_file = /etc/ssl/private/dovecot.pem # SSL parameter file. Master process generates this file for login processes. # It contains Diffie Hellman and RSA parameters. #ssl_parameters_file = /var/run/dovecot/ssl-parameters.dat # How often to regenerate the SSL parameters file. Generation is quite CPU # intensive operation. The value is in hours, 0 disables regeneration # entirely. #ssl_parameters_regenerate = 24 # Disable LOGIN command and all other plaintext authentications unless # SSL/TLS is used (LOGINDISABLED capability). Note that 127.*.*.* and # IPv6 ::1 addresses are considered secure, this setting has no effect if # you connect from those addresses. disable_plaintext_auth = no # Use this logfile instead of syslog(). /dev/stderr can be used if you want to # use stderr for logging (ONLY /dev/stderr - otherwise it is closed). #log_path = # For informational messages, use this logfile instead of the default #info_log_path = # Prefix for each line written to log file. % codes are in strftime(3) # format. #log_timestamp = "%b %d %H:%M:%S " ## ## Login processes ## # Directory where authentication process places authentication UNIX sockets # which login needs to be able to connect to. The sockets are created when # running as root, so you don't have to worry about permissions. Note that # everything in this directory is deleted when Dovecot is started. #login_dir = /var/run/dovecot/login # chroot login process to the login_dir. Only reason not to do this is if you # wish to run the whole Dovecot without roots. # http://wiki.dovecot.org/Rootless #login_chroot = yes ## ## IMAP login process ## login = imap # Executable location. #login_executable = /usr/lib/dovecot/imap-login # User to use for the login process. Create a completely new user for this, # and don't use it anywhere else. The user must also belong to a group where # only it has access, it's used to control access for authentication process. # Note that this user is NOT used to access mails. # http://wiki.dovecot.org/UserIds #login_user = dovecot # Set max. process size in megabytes. If you don't use # login_process_per_connection you might need to grow this. #login_process_size = 32 # Should each login be processed in it's own process (yes), or should one # login process be allowed to process multiple connections (no)? Yes is more # secure, espcially with SSL/TLS enabled. No is faster since there's no need # to create processes all the time. #login_process_per_connection = yes # Number of login processes to create. If login_process_per_user is # yes, this is the number of extra processes waiting for users to log in. #login_processes_count = 3 # Maximum number of extra login processes to create. The extra process count # usually stays at login_processes_count, but when multiple users start logging # in at the same time more extra processes are created. To prevent fork-bombing # we check only once in a second if new processes should be created - if all # of them are used at the time, we double their amount until limit set by this # setting is reached. This setting is used only if login_process_per_use is yes. #login_max_processes_count = 128 # Maximum number of connections allowed in login state. When this limit is # reached, the oldest connections are dropped. If login_process_per_user # is no, this is a per-process value, so the absolute maximum number of users # logging in actually login_processes_count * max_logging_users. #login_max_logging_users = 256 ## ## POP3 login process ## # Settings default to same as above, so you don't have to set anything # unless you want to override them. login = pop3 # Exception to above rule being the executable location. #login_executable = /usr/lib/dovecot/pop3-login ## ## Mail processes ## # Maximum number of running mail processes. When this limit is reached, # new users aren't allowed to log in. #max_mail_processes = 1024 # Show more verbose process titles (in ps). Currently shows user name and # IP address. Useful for seeing who are actually using the IMAP processes # (eg. shared mailboxes or if same uid is used for multiple accounts). #verbose_proctitle = no # Show protocol level SSL errors. #verbose_ssl = no # Valid UID range for users, defaults to 500 and above. This is mostly # to make sure that users can't log in as daemons or other system users. # Note that denying root logins is hardcoded to dovecot binary and can't # be done even if first_valid_uid is set to 0. first_valid_uid = 106 #last_valid_uid = 0 # Valid GID range for users, defaults to non-root/wheel. Users having # non-valid GID as primary group ID aren't allowed to log in. If user # belongs to supplementary groups with non-valid GIDs, those groups are # not set. #first_valid_gid = 1 #last_valid_gid = 0 # Grant access to these extra groups for mail processes. Typical use would be # to give "mail" group write access to /var/mail to be able to create dotlocks. mail_extra_groups = mail # ':' separated list of directories under which chrooting is allowed for mail # processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too). # This setting doesn't affect login_chroot or auth_chroot variables. # WARNING: Never add directories here which local users can modify, that # may lead to root exploit. Usually this should be done only if you don't # allow shell access for users. See # /usr/share/doc/dovecot-common/configuration.txt for more information. #valid_chroot_dirs = # Default chroot directory for mail processes. This can be overridden by # giving /./ in user's home directory (eg. /home/./user chroots into /home). #mail_chroot = # Default MAIL environment to use when it's not set. By leaving this empty # dovecot tries to do some automatic detection as described in # /usr/share/doc/dovecot-common/mail-storages.txt. There's a few special # variables you can use: # # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain # %h - home directory # # You can also limit a width of string by giving the number of max. characters # after the '%' character. For example %1u gives the first character of # username. Some examples: # # default_mail_env = maildir:/var/mail/%1u/%u/Maildir # default_mail_env = mbox:~/mail/:INBOX=/var/mail/%u # default_mail_env = mbox:/var/mail/%d/%n/:INDEX=/var/indexes/%d/%n # default_mail_env = mbox:~/mail/:INBOX=/var/mail/%u # Space-separated list of fields to cache for all mails. Currently these # fields are allowed followed by a list of commands they speed up: # # Envelope - FETCH ENVELOPE and SEARCH FROM, TO, CC, BCC, SUBJECT, # SENTBEFORE, SENTON, SENTSINCE, HEADER MESSAGE-ID, # HEADER IN-REPLY-TO # Body - FETCH BODY # Bodystructure - FETCH BODY, BODYSTRUCTURE # MessagePart - FETCH BODY[1.2.3] (ie. body parts), RFC822.SIZE, # SEARCH SMALLER, LARGER, also speeds up BODY/BODYSTRUCTURE # generation. This is always set with mbox mailboxes, and # also default with Maildir. # # Different IMAP clients work in different ways, that's why Dovecot by default # only caches MessagePart which speeds up most operations. Whenever client # does something where caching could be used, the field is automatically marked # to be cached later. For example after FETCH BODY the BODY will be cached # for all new messages. Normally you should leave this alone, unless you know # what most of your IMAP clients are. Caching more fields than needed makes # the index files larger and generate useless I/O. # # With maildir there's one extra optimization - if nothing is cached, indexing # the maildir becomes much faster since it's not opening any of the mail files. # This could be useful if your IMAP clients access only new mails. #mail_cache_fields = MessagePart # Space-separated list of fields that Dovecot should never set to be cached. # Useful if you want to save disk space at the cost of more I/O when the fields # needed. #mail_never_cache_fields = # Workarounds for various client bugs: # oe6-fetch-no-newmail: # Never send EXISTS/RECENT when replying to FETCH command. Outlook Express # seems to think they are FETCH replies and gives user "Message no longer # in server" error. Note that OE6 still breaks even with this workaround # if synchronization is set to "Headers Only". # outlook-idle: # Outlook and Outlook Express never abort IDLE command, so if no mail # arrives in half a hour, Dovecot closes the connection. This is still # fine, except Outlook doesn't connect back so you don't see if new mail # arrives. # outlook-pop3-no-nuls: # Outlook and Outlook Express hang if mails contain NUL characters. # This setting replaces them with 0x80 character. #client_workarounds = # Dovecot can notify client of new mail in selected mailbox soon after it's # received. This setting specifies the minimum interval in seconds between # new mail notifications to client - internally they may be checked more or # less often. Setting this to 0 disables the checking. # NOTE: Evolution client breaks with this option when it's trying to APPEND. #mailbox_check_interval = 0 # Like mailbox_check_interval, but used for IDLE command. #mailbox_idle_check_interval = 30 # Allow full filesystem access to clients. There's no access checks other than # what the operating system does for the active UID/GID. It works with both # maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/ # or ~user/. #mail_full_filesystem_access = no # Maximum allowed length for custom flag name. It's only forced when trying # to create new flags. #mail_max_flag_length = 50 # Save mails with CR+LF instead of plain LF. This makes sending those mails # take less CPU, especially with sendfile() syscall with Linux and FreeBSD. # But it also creates a bit more disk I/O which may just make it slower. #mail_save_crlf = no # Use mmap() instead of read() to read mail files. read() seems to be a bit # faster with my Linux/x86 and it's better with NFS, so that's the default. #mail_read_mmaped = no # By default LIST command returns all entries in maildir beginning with dot. # Enabling this option makes Dovecot return only entries which are directories. # This is done by stat()ing each entry, so it causes more disk I/O. # (For systems setting struct dirent->d_type, this check is free and it's # done always regardless of this setting) #maildir_stat_dirs = no # Copy mail to another folders using hard links. This is much faster than # actually copying the file. This is problematic only if something modifies # the mail in one folder but doesn't want it modified in the others. I don't # know any MUA which would modify mail files directly. IMAP protocol also # requires that the mails don't change, so it would be problematic in any case. # If you care about performance, enable it. #maildir_copy_with_hardlinks = no # Check if mails' content has been changed by external programs. This slows # down things as extra stat() needs to be called for each file. If changes are # noticed, the message is treated as a new message, since IMAP protocol # specifies that existing messages are immutable. #maildir_check_content_changes = no # Which locking methods to use for locking mbox. There's three available: # dotlock: Create <mailbox>.lock file. This is the oldest and most NFS-safe # solution. If you want to use /var/mail/ like directory, the users # will need write access to that directory. # fcntl : Use this if possible. Works with NFS too if lockd is used. # flock : May not exist in all systems. Doesn't work with NFS. # # You can use both fcntl and flock too; if you do the order they're declared # with is important to avoid deadlocks if other MTAs/MUAs are using both fcntl # and flock. Some operating systems don't allow using both of them # simultaneously, eg. BSDs. If dotlock is used, it's always created first. #mbox_locks = dotlock fcntl # Should we create dotlock file even when we want only a read-lock? Setting # this to yes hurts the performance when the mailbox is accessed simultaneously # by multiple processes, but it's needed for reliable reading if no other # locking methods are available. #mbox_read_dotlock = no # Maximum time in seconds to wait for lock (all of them) before aborting. #mbox_lock_timeout = 300 # If dotlock exists but the mailbox isn't modified in any way, override the # lock file after this many seconds. #mbox_dotlock_change_timeout = 30 # umask to use for mail files and directories #umask = 0077 # Drop all privileges before exec()ing the mail process. This is mostly # meant for debugging, otherwise you don't get core dumps. Note that setting # this to yes means that log file is opened as the logged in user, which # might not work. It could also be a small security risk if you use single UID # for multiple users, as the users could ptrace() each others processes then. #mail_drop_priv_before_exec = no ## ## IMAP process ## # Executable location #imap_executable = /usr/lib/dovecot/imap # Set max. process size in megabytes. Most of the memory goes to mmap()ing # files, so it shouldn't harm much even if this limit is set pretty high. #imap_process_size = 256 # Support for dynamically loadable modules. #imap_use_modules = no #imap_modules = /usr/lib/dovecot/imap ## ## POP3 process ## # Executable location #pop3_executable = /usr/lib/dovecot/pop3 # Set max. process size in megabytes. Most of the memory goes to mmap()ing # files, so it shouldn't harm much even if this limit is set pretty high. #pop3_process_size = 256 # Support for dynamically loadable modules. #pop3_use_modules = no #pop3_modules = /usr/lib/dovecot/pop3 ## ## Authentication processes ## # An Authentication process is a child process used by Dovecot that # handles the authentication steps. The steps cover an authentication # mechanism (auth_mechanisms, how the client authenticates in the IMAP or # POP3 protocol), which password database should be queried (auth_passdb), # and which user database should be queried (auth_userdb, to obtain # UID, GID, and location of the user's mailbox/home directory). # # You can have multiple processes, though a typical configuration will # have only one. Each time "auth = xx" is seen, a new process # definition is started. The point of multiple processes is to be able # to set stricter permissions. (See auth_user below.) # # Just remember that only one Authentication process is asked for the # password, so you can't have different passwords accessible through # different process definitions (unless they have different # auth_mechanisms, and you're ok with having different password for # each mechanisms). # Authentication process name. auth = default # Specifies how the client authenticates in the IMAP protocol. # Space separated list of permitted authentication mechanisms: # anonymous plain digest-md5 cram-md5 # # anonymous - No authentication required. # plain - The password is sent as plain text. All IMAP/POP3 clients # support this, and the password can be encrypted by Dovecot to match # any of the encryption schemes used in password databases. # digest-md5 and cram-md5 - both encrypt the password so it is more # secure in transit, but are not well supported by clients, and # require that the password database use a matching encryption # scheme (or be in plaintext). # # See auth.txt for more details. # # If you are using SSL there is less benefit to digest-md5 and # cram-md5 as the communication is already encrypted. auth_mechanisms = plain # Space separated list of realms for SASL authentication mechanisms that need # them. You can leave it empty if you don't want to support multiple realms. # Many clients simply use the first one listed here, so keep the default realm # first. #auth_realms = # Default realm/domain to use if none was specified. This is used for both # SASL realms and appending @domain to username in plaintext logins. #auth_default_realm = # User database specifies where mails are located and what user/group IDs # own them. For single-UID configuration use "static". # http://wiki.dovecot.org/Authentication # http://wiki.dovecot.org/VirtualUsers # passwd: /etc/passwd or similiar, using getpwnam() # passwd-file <path>: passwd-like file with specified location # static uid=<uid> gid=<gid> home=<dir template>: static settings # vpopmail: vpopmail library # ldap <config path>: LDAP, see /etc/dovecot/dovecot-ldap.conf # mysql <config path>: a MySQL database, see /etc/dovecot/dovecot-mysql.conf # pgsql <config path>: a PostgreSQL database, see # /etc/dovecot/dovecot-pgsql.conf auth_userdb = passwd #auth_userdb = static uid=139 gid=139 home=/home/users/%u/ # Password database specifies only the passwords for users. # http://wiki.dovecot.org/Authentication # passwd: /etc/passwd or similiar, using getpwnam() # shadow: /etc/shadow or similiar, using getspnam() # pam [<service> | *]: PAM authentication # passwd-file <path>: passwd-like file with specified location # vpopmail: vpopmail authentication # ldap <config path>: LDAP, see /etc/dovecot/dovecot-ldap.conf # mysql <config path>: a MySQL database, see /etc/dovecot/dovecot-mysql.conf # pgsql <config path>: a PostgreSQL database, see # /etc/dovecot/dovecot-pgsql.conf #auth_passdb = shadow auth_passdb = mysql /etc/dovecot/dovecot-mysql.conf #auth_executable = /usr/lib/dovecot/dovecot-auth # Set max. process size in megabytes. #auth_process_size = 256 # User to use for the process. This user needs access to only user and # password databases, nothing else. Only shadow and pam authentication # requires roots, so use something else if possible. Note that passwd # authentication with BSDs internally accesses shadow files, which also # requires roots. Note that this user is NOT used to access mails. # That user is specified by auth_userdb above. auth_user = root # Directory where to chroot the process. Most authentication backends don't # work if this is set, and there's no point chrooting if auth_user is root. #auth_chroot = # Number of authentication processes to create #auth_count = 1 # List of allowed characters in username. If the user-given username contains # a character not listed in here, the login automatically fails. This is just # an extra check to make sure user can't exploit any potential quote escaping # vulnerabilities with SQL/LDAP databases. If you want to allow all characters, # set this value to empty. #auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ # Username to use for users logging in with ANONYMOUS SASL mechanism #auth_anonymous_username = anonymous # More verbose logging. Useful for figuring out why authentication isn't # working. #auth_verbose = no # Even more verbose logging for debugging purposes. Shows for example SQL # queries. #auth_debug = no # digest-md5 authentication process. It requires special MD5 passwords which # /etc/shadow and PAM doesn't support, so we never need roots to handle it. # Note that the passwd-file is opened before chrooting and dropping root # privileges, so it may be 0600-root owned file. #auth = digest_md5 #auth_mechanisms = digest-md5 #auth_realms = #auth_userdb = passwd-file /etc/passwd.imap #auth_passdb = passwd-file /etc/passwd.imap #auth_user = imapauth #auth_chroot = # if you plan to use only passwd-file, you don't need the two auth processes, # simply set "auth_methods = plain digest-md5" # For the mysql passdb module, you'll need a database with a table that # contains fields for at least the userid and password. If you want to # use the user@domain syntax, you might want to have a separate domain # field as well. # # If your users all have the same uig/gid, and have predictable home # directories, you can use the static userdb module to generate the home # dir based on the userid and domain. In this case, you won't need fields # for home, uid, or gid in the database. # # If you prefer to use the mysql userdb module, you'll want to add fields # for home, uid, and gid. Here is an example table: # # CREATE TABLE users ( # userid VARCHAR(128) NOT NULL, # password VARCHAR(64) NOT NULL, # home VARCHAR(256) NOT NULL, # uid INTEGER NOT NULL, # gid INTEGER NOT NULL, # active CHAR(1) DEFAULT 'Y' NOT NULL # ); db_host = localhost db_port = 3306 db_unix_socket = /var/run/mysqld/mysqld.sock db = mail db_user = dovecot db_passwd = 3eDcVb db_client_flags = 0 # Default password scheme. # # Currently supported schemes include PLAIN, PLAIN-MD5, DIGEST-MD5, and CRYPT. # default_pass_scheme = CRYPT # Query to retrieve the password. # # The query should return one row, one column. If more than one row or column # is returned, authentication will automatically fail. # # Available substitutions: # %u = entire userid # %n = user part of user@domain # %d = domain part of user@domain # # Example: # password_query = SELECT password FROM users WHERE userid = '%n' AND domain = '%d' # password_query = SELECT password FROM users WHERE userid = '%u' AND active = 'Y' # password_query = SELECT password FROM enki_users WHERE username = '%u' # Query to retrieve the user information. # # The query must return only one row. The columns to return are: # home - Home directory # mail - MAIL environment # system_user - System user name (for initgroups()) # uid - System UID # gid - System GID # # Either home or mail is required. uid and gid are required. If more than one # row is returned or there's missing fields, login will automatically fail. # # Examples # user_query = SELECT home, uid, gid FROM users WHERE userid = '%n' AND domain = '%d' # user_query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%u' # user_query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%u' # #user_query = SELECT home, uid, gid FROM users WHERE userid = '%u'

2 1