April 2007 - dovecot - dovecot.org

[Dovecot] Suggestion: mod_auth_dovecot
by David Anderson 03 Apr '07

03 Apr '07

Hello, I have a suggestion which might be a small and very useful project for a C coder (I'm not one!). As Dovecot makes its authentication interface available to other programs, I think that an Apache module to use it would be very useful. Currently I share an passwd-db file between Dovecot and Apache. However with Apache that means I have to give Apache read access. That means that websites with PHP could read that password file if they liked. If Apache could talk to the Dovecot authentication process instead, that would be a lot better. I'm sure there are lots of situations in which this would be useful - Dovecot's authentication settings are so flexible that it would be very handy to be able to use them more widely. If anyone produces one, I pledge to produce an RPM package and submit it to Fedora as my contribution. I would do it myself if I knew C... David

4 6

[Dovecot] prefetch + static + deliver
by Tom Bombadil 02 Apr '07

02 Apr '07

Hi all... The prefetch entry in the wiki says: "If you're using Dovecot's local delivery agent, you'll still need a valid userdb which it can use to locate the users. You can do this by adding a normal sql/ldap userdb after userdb prefetch." (http://wiki.dovecot.org/UserDatabase/Prefetch) My question is: Does it need to be a SQL/LDAP userdb? How about static or passwd? Thanks in advance :)

3 3

[Dovecot] testing LDAP connections
by Hugo Monteiro 02 Apr '07

02 Apr '07

Hello all, I haven't looked into the source code, but i suspect that LDAP connections, once established, are not tested properly. My scenario is the followind: Dovecot server <--------> firewall <---------> LDAP backend What happens is that the firewall has a security feature which basically make de firewall box "forget" about connections that are idle for more than X period of time. That particular setting is 30 minutes right now. When that happens, neither the LDAP backend or the Dovecot server get any type of notification, and for all they care the connection is alive and well. This is a very common implementation in firewalls nowadays. So my question is, is there any way to make dovecot re-open a new connection if there is a timeout while trying to use a connection already opened? I believe that this could be of great benefit for those who don't have their servers on the same physical network. Thanks in advance, Hugo Monteiro. -- ci.fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Centro de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.ci.fct.unl.pt apoio(a)fct.unl.pt ci.fct.unl.pt:~# _

2 1

[Dovecot] Authenticaton in Active Directory(again)
by Claudio Roberto Prateat 02 Apr '07

02 Apr '07

Is possible authenticate in active directory 2003r2 with ldap (dovecot-ldap), but not using pam_ldap ? I have problem, faileds. I need example of the dovecot-ldap.conf for this authentication. Help, please. Best Regards !

2 1

[Dovecot] Using Dovecot LDA with Sendmail
by Scott Peron 02 Apr '07

02 Apr '07

Hi all, After looking at the LDA/Sendmail page in the dovecot wiki, I wanted to contribute another method to easily configure Sendmail to use deliver. Instead of adding a new mailer definition, as already suggested, one can simply use the following line in their sendmail.mc file instead: FEATURE(`local_procmail', `/usr/libexec/dovecot/deliver', `deliver -d $u', `SPhnu9')dnl And further on, still use: MAILER(procmail)dnl The location of deliver will of course vary for each OS and distro, etc, but this redefines the "procmail" mailer in the resulting sendmail.cf to use deliver instead, with the correct flags. For most setups, I believe this is the simplest configuration path. Scott -- Scott Peron, Webmaster, Infolytica Corp. webmaster(a)infolytica.com Tel: (514) 849-8752 x269 Fax: (514) 849-4239 http://www.infolytica.com Place du Parc, 300 Leo-Pariseau, Suite 2222, Montreal, QC, Canada, H2X 4B3

4 3

[Dovecot] SOLVED: Re: dovecot/LDAP: Multiple password replies
by Antonis Faragitakis 02 Apr '07

02 Apr '07

On 02/04/07, Timo Sirainen <tss(a)iki.fi> wrote: > On Mon, 2007-04-02 at 12:17 +0300, Antonis Faragitakis wrote: > > > Apr 2 11:47:50 srv-ath dovecot: auth(default): > > ldap(a.faragitakis,127.0.0.1): > > Multiple password replies > > I changed this error message now to: "pass_filter matched multiple > objects, aborting". > > So with the given pass_filter and username it found multiple objects > from the LDAP. Maybe there are some duplicate objects? > Yes, my mistake duplicate objects on the subtree. Found this out after 3 days :(((( Thank You Antonis

1 0

[Dovecot] dovecot/LDAP: Multiple password replies
by Antonis Faragitakis 02 Apr '07

02 Apr '07

Hello list, I'm trying to connect to pop3 using dovecot which authenticates through ldap, but i get the following Multiple password replies when i try to connect to server Apr 2 11:47:50 srv-ath dovecot: auth(default): ldap(a.faragitakis,127.0.0.1): base=ou=email,ou=services,dc=company,dc=com scope=subtree filter=(&(objectClass=qmailUser)(objectClass=uidObject)(uid=a.faragitakis)(accountStatus=active)) fields=uid,userPassword Apr 2 11:47:50 srv-ath dovecot: auth(default): ldap(a.faragitakis,127.0.0.1): uid(user)=a.faragitakis userPassword(password)=******* Apr 2 11:47:50 srv-ath dovecot: auth(default): ldap(a.faragitakis,127.0.0.1): Multiple password replies Apr 2 11:47:51 srv-ath dovecot: auth(default): client out: FAIL 2 user=a.faragitakis temp my dovecot-ldap.conf is as follows: hosts = localhost #uris = dn = cn=Manager,dc=company,dc=com dnpass = ******** #auth_bind = no #auth_bind_userdn = ldap_version = 3 base = ou=email,ou=services,dc=company,dc=com deref = never scope = subtree user_attrs = uid,mailMessageStore,,,, user_filter = (&(objectClass=qmailUser)(objectClass=uidObject)(uid=%u)(accountStatus=active)) pass_attrs = uid,userPassword pass_filter = (&(objectClass=qmailUser)(objectClass=uidObject)(uid=%u)(accountStatus=active)) default_pass_scheme = PLAIN user_global_uid = 2000 user_global_gid = 2000 my ldap objects/attributes is as follows: | objectClass: inetOrgPerson, qmailUser, uidObject | attributes: cn,mail,sn,uid,accountStatus,mailMessageStore,userPassword | example: |->cn=Antonis Faragitakis | |-> mail=a.faragitakis(a)company.com | |-> sn=Faragitakis | |-> uid=a.faragitakis | |-> accountStatus=active | |-> mailMessageStore=/home/vmail/a.faragitakis/ | |-> userPassword=secret thanks in advanced Antonis

2 1

[Dovecot] Unexpected behaviour when deleteing a big mailbox
by Steffen Kaiser 02 Apr '07

02 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, my last tests left me with a mailbox with > 80'000 messages in Maildir. Dovecot served them fine. No problem. I usually use IMAP's "Mark messages a deleted" function and expunge later. Because the "Move to Trash" is default in many MUAs, I decided to try it on this mailbox. I do think that it is hard to detect and prevent such problem, but could it be implemented that when the client connection times out, the COPY process is terminated and rolled back? I mean, as long as the messages are copied/linked to */tmp nothing is done, yet, hence, a simple cleanup of */tmp would result in a rollback. Due to the timeout, the EXPUNGE wasn't issued so far and the source mailbox is unchanged. Or, is it possible to prevent two COPYs of an overlapping message range into the same destination folder simultaneously? Or, can I prevent to COPY such a huge range of messages at once? I know 80'000 messages are much, but I have users with an INBOX of at least 40'000, eventually moving all files into an archive mailbox. I'm also surprised to find that I didn't get two full copies of the source mailbox. ============== Start situation: 4.8G .box1 (I didn't recorded the individual subdirs, unfortunately.) # find .box1 -type f | wc -l 84273 Newly created .Trash. === I started Thunderbird, let sync the mailbox, selected them all, and pressed "Delete". Some time later: Connection timed out. I, wondered, and hit "Delete" a second time. Again, connection timed out. === I was surprised, however, to see that the Dovecot log with still active telling me that mails are copied to Trash. I ended up with two processes copying all messages to .Trash/tmp on the server. The process I traced a bit later linked any file after the other. What I wondered right from the beginning was, that du -hs .??* displayed about 3.5GB in .Trash, but still 4.8GB in .box1. So, why are there 3.5GB additional files in .Trash, when I configured Dovecot to use hardlinks? The end situation is that .box1 contains all messages still, but any Unseen messages are moved to .box1/cur, and .Trash contains: 7.4G .Trash/cur 791M .Trash/new 76K .Trash/tmp # find .Trash/ -type f | wc -l 121713 The size nearly doubled. # du -hs .box1 ; du -sh .Trash/ 4.8G .box1 8.2G .Trash/ ==== Last lines in Dovecot log: dovecot: Mar 21 11:46:15 Info: IMAP(dvtest) [11535]: copy -> Trash: uid=83964, msgid=<xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx(a)xx-xxxx-xxxxx-xxxx.xx>, box=box1 dovecot: Mar 21 11:46:15 Info: IMAP(dvtest) [11535]: copy -> Trash: uid=83965, msgid=<xxxxxxxx.xxxxxxx(a)xx-xxxx-xxxxx-xxxx.xx>, box=box1 dovecot: Mar 21 11:46:29 Info: IMAP(dvtest) [11535]: Disconnected: Mailbox is in inconsistent state, please relogin. Last lines of strace: fstat64(13, {st_mode=S_IFREG|0600, st_size=1341104, ...}) = 0 stat64("/var/cache/dovecot/31045/index/.box1/dovecot.index", {st_mode=S_IFREG|0600, st_size=1341104, ...}) = 0 alarm(120) = 0 fcntl64(13, F_SETLKW64, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}, 0xbfe562d4) = 0 alarm(0) = 120 fstat64(13, {st_mode=S_IFREG|0600, st_size=1341104, ...}) = 0 mmap2(NULL, 1341104, PROT_READ|PROT_WRITE, MAP_SHARED, 13, 0) = 0xb3ffc000 munmap(0xb4285000, 1341104) = 0 write(1, "* 7998 FETCH (FLAGS ($Label2 $La"..., 2067) = 2067 write(1, "* 8091 FETCH (FLAGS (\\Answered \\"..., 2056) = -1 EPIPE (Broken pipe) - --- SIGPIPE (Broken pipe) @ 0 (0) --- munmap(0xb7cbc000, 1341104) = 0 fcntl64(13, F_SETLK64, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}, 0xbfe56394) = 0 write(2, "\1IDisconnected: Mailbox is in in"..., 66) = 66 # /usr/local/dovecot.rc27/sbin/dovecot -n # /usr/local/dovecot.rc27/etc/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot/dovecot.log protocols: imap imaps pop3 pop3s ssl_ca_file: /etc/ssl/certs/ca.crt ssl_cert_file(default): /etc/ssl/certs/imap.pem ssl_cert_file(imap): /etc/ssl/certs/imap.pem ssl_cert_file(pop3): /etc/ssl/certs/pop3.pem ssl_key_file(default): /etc/ssl/private/imap.key ssl_key_file(imap): /etc/ssl/private/imap.key ssl_key_file(pop3): /etc/ssl/private/pop3.key disable_plaintext_auth: no verbose_ssl: yes login_dir: /var/run/dovecot//login login_executable(default): /usr/local/dovecot.rc27/libexec/dovecot/imap-login login_executable(imap): /usr/local/dovecot.rc27/libexec/dovecot/imap-login login_executable(pop3): /usr/local/dovecot.rc27/libexec/dovecot/pop3-login login_log_format_elements: %p: user=<%u> method=%m rip=%r lip=%l %c verbose_proctitle: yes first_valid_uid: 1000 mail_location: maildir:%h/MailDir:CONTROL=/var/cache/dovecot/%i/control:INDEX=/var/cache/dovecot/%i/index mail_debug: yes dotlock_use_excl: yes maildir_copy_with_hardlinks: yes maildir_copy_preserve_filename: yes mail_drop_priv_before_exec: yes mail_executable(default): /usr/local/dovecot.rc27/libexec/dovecot/imap mail_executable(imap): /usr/local/dovecot.rc27/libexec/dovecot/imap mail_executable(pop3): /usr/local/dovecot.rc27/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_log zlib mail_plugins(imap): quota imap_quota mail_log zlib mail_plugins(pop3): quota mail_log mail_plugin_dir(default): /usr/local/dovecot.rc27/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/dovecot.rc27/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/dovecot.rc27/lib/dovecot/pop3 mail_log_prefix: %Us(%u) [%p]: mail_log_max_lines_per_sec: 30 pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %u pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): oe-ns-eoh namespace: type: private separator: . inbox: yes hidden: yes auth default: mechanisms: plain login cache_size: 10 username_chars: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890 verbose: yes debug: yes passdb: driver: ldap args: /usr/local/dovecot.rc26/etc/dovecot-ldap.conf passdb: driver: shadow userdb: driver: prefetch userdb: driver: ldap args: /usr/local/dovecot.rc26/etc/dovecot-ldap.conf userdb: driver: passwd-file args: /etc/passwd socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: path: /var/run/dovecot/auth-master mode: 432 group: mail plugin: quota: fs Bye, - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBRgFBGy9SORjhbDpvAQLBcQf+OAqiufFlyPqJTyM3Ylkmiae2afXPe2wl bNWg6AyDrdvFw+rtdc5vnYukQUSk2a8zQBggt3Rfb1zZQb0pszrzLdR+fOwnW2uE kDyHRhyy88aVpM848oQKYnlWdNHFrdwbyp2myU4JxJhu0bXsAhyMgf9txshwe5cd 23O1x+gkWUp+1wuz84uTep3Kcs1wVXWANEN5RT4YMI3MOqMrcyB+P0lj0luy0HTH HE9T6mLqzGt0Cw6yfm+1W8bU3Wnt3C5je15gT++OPd5YmDvpQs+fOjavDIITsuOf jBck4N+KjwOM+FzP8Ea1WNWCvObJKdeiISkoFWFO9bafw5Yue9hFNA== =yyP5 -----END PGP SIGNATURE-----

6 17

[Dovecot] imaptest10 and stalled messages
by Mike Brudenell 01 Apr '07

01 Apr '07

Greetings - I've now got as far as playing with the imaptest10 test utility to see if I can stress-test our development server. imaptest10 is built against dovecot-1.0rc28 It may just be that I'm excessively heavy handed, but when I let imaptest10 rip with the command... ./imaptest10 user=test%03d host=testserver.imap.york.ac.uk clients=50 mbox=./dovecot.mbox msgs=1000 secs=30 logout=10 ...after 15 seconds or so I started getting output along the lines of: Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 10% 30% 5% 2 0 1 1 1 0 0 0 0 0 0 50/ 50 2 0 0 1 1 0 0 0 0 0 0 50/ 50 0 0 2 2 0 1 1 1 1 1 0 50/ 50 2 0 2 2 0 1 1 1 1 1 2 50/ 50 0 0 1 1 0 0 0 0 0 0 0 50/ 50 - 16. stalled for 16 secs in LOGIN - 17. stalled for 16 secs in LOGIN - 18. stalled for 16 secs in LOGIN 2 1 1 2 1 0 0 0 0 0 0 50/ 50 - 17. stalled for 17 secs in LOGIN - 18. stalled for 17 secs in LOGIN - 22. stalled for 16 secs in LOGIN - 23. stalled for 16 secs in LOGIN - 24. stalled for 16 secs in LOGIN 1 0 1 1 0 0 0 0 0 0 0 50/ 50 - 17. stalled for 18 secs in LOGIN - 18. stalled for 18 secs in LOGIN - 22. stalled for 17 secs in LOGIN - 23. stalled for 17 secs in LOGIN - 24. stalled for 17 secs in LOGIN - 28. stalled for 16 secs in LOGIN - 29. stalled for 16 secs in LOGIN - 30. stalled for 16 secs in LOGIN - 31. stalled for 16 secs in LOGIN - 32. stalled for 16 secs in LOGIN The "stalled" log lines continue until the test completes. I'm assuming it's just that I'm pushing our hardware beyond its reasonable limits: it is only an oldish development box... Sun v120 with 1 650MHz SPARC processor and 1Gbyte RAM Dovecot is using shadow password file authentication. The mail folders are in Maildirs, NFS-mounted from a NetApp filer, and each account's INBOX has around 1000 messages in it. Control and Index files are on local disk. By the end of the 30 second test run load average has climbed to around 11 I don't know how "active" the imaptest10 utility is when it's running, but do you think I should be concerned by the "stalled" messages? That is, do you think I have something configured amiss? Or is it likely just to be I'm expecting too much of our hardware? (The real system will have beefier Suns with Opteron-based CPUs, more memory, etc) With thanks, Mike B-) PS. I forgot to say: despite all this activity there's not a single error logged by Dovecot in the (admittedly short at this stage) test runs. -- The Computing Service, University of York, Heslington, York Yo10 5DD, UK Tel:+44-1904-433811 FAX:+44-1904-433740 * Unsolicited commercial e-mail is NOT welcome at this e-mail address. *

2 7

[Dovecot] locking question
by Stewart Dean 01 Apr '07

01 Apr '07

There are three applications that have their mitts on files on my mail server, which is running AIXV5.3 and UWIMAP and mbox format. The mail folders and INBOXES are native to that machine, but also are NFS exported to a login server and a mailing list server. All three machines are running the lockd daemon. Everybody wants to lock differently 1) procmail (delivering for sendmail), which seems to want to use dotlocking, fcntl and lockf locking; for whatever reasons, the compile time tests seem to disallow flock. 2) UWIMAP which according to wiki.dovecot.org/Migration/UW uses: mbox_read_locks = flock mbox_write_locks = dotlock flock 3) I want to run dovecot in the same environment as I switch over, for which the locking strategy is supposed to be (according to http://wiki.dovecot.org/MboxLocking) mbox_read_locks = fcntl mbox_write_locks = dotlock fcntl Since that same page in the wiki says. "*It's important that all software that's reading or writing to mboxes use the same locking settings.",* I had recompiled procmail so it only usedotlocking and fcntl (thus removing lockf in addition to the disallowed flock)...but now I bumped into the Migration/UW page and there looks to be a conflict. I want to be able to run dovecot (for testing) and UWIMAP (for all users/production) at the same time (but never at the same time with the same mailbox), but UWIMAP is doc'ed to use flock and Dovecot doesn't It's conceivable that the different locking strategies of UWIMAP and Dovecot don't matter because they would never be going after the same mail files (right?) but there is procmail, which has to interact with both. It appears to not use flock OK, even though the docs say it should since UWIMAP expects it, and I've disabled lockf as well. But will there be a conflict with procmail and dovecot's use of fcntl, which UWIMAP doesn't use? Help. * * ** -- ==== Stewart Dean, Unix System Admin, Henderson Computer Resources Center of Bard College, Annandale-on-Hudson, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

2 1