July 2007 - dovecot - dovecot.org

[Dovecot] NFS cache flush tester
by Timo Sirainen 13 Jul '07

13 Jul '07

http://dovecot.org/tools/nfstest.c I wrote a test utility that tests different ways to flush NFS attribute cache and data cache. Please test in your NFS setup and show me the results, so I can make Dovecot v1.1 works well with NFS. Run the test several times (3 should be enough) to make sure the output stays the same, because the attribute cache flushes might incorrectly say "OK". And of course attribute cache must not be disabled for this test to work. If you have other ideas how to flush either cache please tell me and I'll update the test utility. I'd like to have a way to flush the cache without having the NFS client send anything to server. Unfortunately all of the below ways do that. Results for Linux v2.6.15 and v2.6.18: Info: Testing attribute cache.. Info: Attr cache flush fchown(-1, -1): failed Info: Attr cache flush fchown(uid, gid): OK Info: Attr cache flush fchmod(mode): OK Info: Attr cache flush chown(-1, -1): failed Info: Attr cache flush chown(uid, gid): OK Info: Attr cache flush chmod(mode): OK Info: Testing data cache.. Info: data cache: Appends weren't noticed (ret = 0) Info: - Attribute cache flush helped Info: data cache (no caching): failed Info: data cache (attr cache): failed Info: data cache (lockf()): OK Info: data cache (flock(shared)): OK Info: data cache (flock(exclusive)): OK

7 25

[Dovecot] Problem with Dovecot SASL in Postfix
by Chris McMacken 12 Jul '07

12 Jul '07

I'm trying to configure my postfix server to use Dovecot as an SASL server and running into some problems. My server supports a couple of domain, I have multiple user/password files for multiple domains to make the files a little easier to manage. Not sure if this question should belong in the dovecot mailing list or the postfix one, but here goes anyway. I have everything configured to use CRAM-MD5 authentication, including my mail client. Here the auth section of my dovecot conf. auth default { mechanisms = plain cram-md5 passdb passwd-file { # Path for passwd-file args = /usr/local/etc/dovecot/%d/passwd } userdb passwd-file { # Path for passwd-file args = /usr/local/etc/dovecot/%d/passwd } user = root # It's possible to export the authentication interface to other programs: socket listen { client { # The client socket is generally safe to export to everyone. Typical use # is to export it to your SMTP server so it can do SMTP AUTH lookups # using it. path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } heres a sample line from one of the passwd files: chrism:{CRAM-MD5}a67a65704086a046b3f875d1eaac8cb5c6fd13406507fead30d9bcb1bf… and to login through SASL I am trying to use the username chrism(a)example.com when I use the full email address like this to login like this I get this output into my postfix log: Jul 10 18:46:59 mail postfix/smtpd[57343]: connect from unknown[12.244.148.123] Jul 10 18:46:59 mail postfix/smtpd[57343]: NOQUEUE: reject: RCPT from unknown[12.244.148.123]: 554 5.7.1 <chrism(a)gmail.com>: Relay access denied; from=<chrism(a)example.com> to=<chrism(a)gmail.com> proto=ESMTP helo=<[192.168.1.14]> Jul 10 18:47:00 mail postfix/smtpd[57343]: disconnect from unknown[12.244.148.123] (not actually using example.com but I changed it here) heres my smtpd_recipient_restricitons from postconf smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination, permit_sasl_authenticated so when I use the full user name (chrism(a)example.com) it doesn't appear to even attempt logging into the sasl server. If I change it to simply chrism, heres the output: Jul 10 18:50:36 mail postfix/smtpd[57356]: connect from unknown[12.244.148.123] Jul 10 18:50:38 mail postfix/smtpd[57356]: warning: unknown[12.244.148.123]: SASL CRAM-MD5 authentication failed: PDI3NjU4MTE4NDExMTQzN0BtYWlsPg== Jul 10 18:50:39 mail postfix/smtpd[57356]: lost connection after AUTH from unknown[12.244.148.123] Jul 10 18:50:39 mail postfix/smtpd[57356]: disconnect from unknown[12.244.148.123] if I put my user name in as chrism and don't add the @example.com it tried to login but it can't login. anyone have any ideas?

2 1

[Dovecot] 1.0.1: corrupt index on fresh mailbox, ideas?
by Troy Engel 12 Jul '07

12 Jul '07

A new employee started today, when logging into his new mailbox this morning during a walk-through I got a nasty server error response in Thunderbird - something I never see, DC runs smooth as butter for us. Checking the server log I see this: == snip == dovecot: Jul 09 09:38:54 Error: IMAP(xxxxxxx): Maildir /home/x/xxxxxxx/Maildir sync: UIDVALIDITY changed (1183406107 -> 1183999134) dovecot: Jul 09 09:39:06 Error: IMAP(xxxxxxx): Corrupted transaction log file /var/spool/dovecot/indexes/x/xxxxxxx/.INBOX/dovecot.index.log.2: invalid indexid (1183406107 != 1183999146) dovecot: Jul 09 09:39:06 Error: IMAP(xxxxxxx): Corrupted index cache file /var/spool/dovecot/indexes/x/xxxxxxx/.INBOX/dovecot.index.cache: indexid changed == snip == Some facts that make this a strange occurrence: 1) new IMAP mailbox, only one email was in it that I had sent last week (boilerplate Welcome email) 2) was working perfectly fine on Friday when I set things up (Thunderbird and SquirrelMail) and tested with the same client laptop and same Thunderbird 3) nothing bad happened with the servers over the weekend, all is tip-top - no restarts, reboots, nothing. 4) DC does use NFS mounted maildirs, but there is only one DC accessing any maildir - no other servers touch ~/Maildir/. mmap is disabled. What could be a reason for this index to have gotten corrupted? This is the first time I've had an index go corrupt out of all the users, so I'd like to try and track down the cause of this... thx, -te == dovecot -n == # 1.0.1: /etc/dovecot.conf log_path: /var/log/dovecot.log protocols: imap imaps listen: * ssl_cert_file: /opt/SSL/server.pem ssl_key_file: /opt/SSL/server.pem login_dir: /var/run/dovecot/login login_executable: /usr/libexec/dovecot/imap-login login_process_per_connection: no mail_location: maildir:~/Maildir:INDEX=/var/spool/dovecot/indexes/%1u/%u mmap_disable: yes namespace: type: private separator: . prefix: INBOX. inbox: yes auth default: cache_size: 4096 cache_ttl: 7200 passdb: driver: pam args: cache_key=%u dovecot userdb: driver: passwd args: blocking=yes == end == -- Troy Engel | Systems Engineer Fluid, Inc | http://www.fluid.com

5 12

[Dovecot] Fixing lda user_query error introduces new fault in mail delivery
by Frank Church 12 Jul '07

12 Jul '07

I was getting these errors below and after fixing it delivery errors were introduced dovecot/error_log ============== dovecot: Jul 11 06:19:28 Error: auth-worker(default): sql(user(a)domain.com): User query failed: Table 'postfix.users' doesn't exist deliver(user(a)domain.com): Jul 11 06:19:28 Error: BUG: Unexpected input from auth master: FAIL 1 dovecot: Jul 11 06:21:41 Error: auth-worker(default): sql(admin(a)achimota.com,127.0.0.1): User query failed: Table 'postfix.users' doesn't exist ============== It turns out that using prefetch with dovecot lda required a user_query in dovecot/sql.conf I fixed it by adding this query to dovecot/sql.conf user_query = SELECT concat('/var/vmail/', maildir) as home, 601 as uid, 12 as gid FROM mailbox WHERE username = '%u' AND active = '1' This resulted in a new mailbox /var/vmail/domain.com/user(a)domain.com being created when although /var/vmail/domain.com/user already exists and is what the query returns It seems that prior to that when the query was failing the mail was properly delivered somehow by dovecot, but fixing it created a new problem. It appears that the mail_location = maildir:/var/vmail/%d/%u in dovecot.conf could be related as %u is user(a)domain.com Is there a fix for this? Does the deliver line in postfix/master.cf need to be adjusted in some way I will probably have to disable the user_query and restart for the time being dovecot version - 1.0rc26 Here is dovecot.conf =============== ssl_cert_file = /etc/pki/dovecot/certs/abc.domain.net.crt ssl_key_file = /etc/pki/dovecot/private/abc.domain.net.key ssl_ca_file = /etc/pki/dovecot/certs/ca-bundle.crt mail_location = maildir:/var/vmail/%d/%u mail_extra_groups = mail first_valid_uid = 601 last_valid_uid = 601 maildir_copy_with_hardlinks = yes protocol imap { mail_plugins = quota imap_quota imap_client_workarounds = outlook-idle delay-newmail } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { postmaster_address = postmaster(a)domain.net mail_plugins = quota log_path = /var/log/dovecot/deliver.log info_log_path = /var/log/dovecot/deliver.log } auth default { mechanisms = plain passdb sql { args = /etc/dovecot/sql.conf } userdb prefetch { } userdb sql { args = /etc/dovecot/sql.conf } user = nobody socket listen { master { path = /var/run/dovecot/auth-master mode = 0660 user = vmail group = mail } client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = mail } } } dict { } plugin { quota = maildir:storage=10240:messages=1000 acl = vfile:/etc/dovecot/acls trash = /etc/dovecot/trash.conf } dovecot/sql.conf ============== default_pass_scheme = PLAIN-MD5 driver = mysql connect = host=localhost dbname=postfix user=dovecot password=password password_query = SELECT username as user, password, concat('/var/vmail/', maildir) as userdb_home, concat('maildir:/var/vmail/', maildir) as userdb_mail, 601 as userdb_uid, 12 as userdb_gid, concat('dirsize:storage=', cast(quota as char)) AS userdb_quota FROM mailbox WHERE username = '%u' AND active = '1' user_query = SELECT concat('/var/vmail/', maildir) as home, 601 as uid, 12 as gid FROM mailbox WHERE username = '%u' AND active = '1' dovecot line in postfix/master.cf ======================= # Dovecot LDA dovecot unix - n n - - pipe flags=DRhu user=vmail:mail argv=/usr/local/libexec/dovecot/deliver -d ${recipient} - Frank

2 1

[Dovecot] Can Wiki entry on dovecot LDA/deliver be clarified?
by Frank Church 11 Jul '07

11 Jul '07

Hi guys, I am having some problems relating to this "Fixing lda user_query error introduces new fault in mail delivery" and I'd like to know if the above wiki comment holds even if a user_query is configured to return the correct mail folder. According to this LDA delivers only to the mail_location setting. Does that mean that it will stick to the value in dovecot.conf or will the value returned in the query override it? This appears to be the problem I am experiencing with the previous thread. >From wiki entry at wiki.dovecot.org/LDA ============================ Problems with deliver Currently deliver doesn't support namespaces. The mails can be delivered only to mailboxes specified by the mail_location setting. If you are using prefetch userdb, keep in mind that deliver does not make a password query and thus will not work if -d parameter is used. The UserDatabase/Prefetch page explains how to fix this. ================================== Any ideas? - Frank

1 1

[Dovecot] target doesn't allow inferior mailboxes
by Adam Williams 11 Jul '07

11 Jul '07

Using Seamonkey as my email client, and IMAP to check mail. If I create a new IMAP folder, and then delete it, I get the error: The current command did not succeed. The mail server responded: Target mailbox doesn't allow inferior mailboxes. Tried a google search, didn't really come up with anything. I have rw permissions on /home/awilliam/Mail/* and delete the files fine using rm -rf /home/awilliam/Mail/whatever and editing the folder out of .subscriptions. Any ideas? [root@roark ~]# dovecot --version 1.0.1 [root@roark ~]# dovecot -n # 1.0.1: /etc/dovecot.conf login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/Mail/:INBOX=/var/spool/mail/%u mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd

3 3

[Dovecot] About a simultaneous session of Dovecot(IMAP)
by Takateru Ueda 11 Jul '07

11 Jul '07

The construction of the mail server with Postfix+Dovecot(IMAP) is examined. ・The number of mailboxes is about 1000. ・The reception protocol uses IMAP and the Maildir form. ・OS is Redhat Enterprise Linux ES4. ・MUA uses Outlook Express. ・Postfix and Dovecot use latest Ver. In the above-mentioned environment, it is understanding person. how much the number of maximum sessions (number of people) that can be used at the same time becomes from MUA (When grounds of the calculation are understood, it is the best. )

2 2

[Dovecot] Connecting to dovecot/imap without a password
by Don Russell 11 Jul '07

11 Jul '07

I have written a script that connects (localhost) to the dovecot/imap server and performs various maintenance on my mail, by folder..... deleting old stuff, keeping the n most recent, that sort of crap, er good stuff. :-) My script is written in php (I use the various imap_* functions), and it connects to the imap server running on the same machine... is there a way to connect to the server without having to specify my user name and password? I was thinking there may be some form of "implied" logon if a request from user "don" requests to log on to user "don", then there's no need for a password check, when the connection is via localhost. That way I don't have to deal with userid/password related issues. :-) Thanks

2 2

[Dovecot] postfix pipe to deliver, null_sender.
by Erland Nylend 11 Jul '07

11 Jul '07

Hello, I just noticed a problem on our servers .. If I send myself a bounce, like this: | [en@mailserver ~]$ telnet localhost 25 | Trying 127.0.0.1... | Connected to localhost.localdomain (127.0.0.1). | Escape character is '^]'. | 220 mailserver ESMTP Postfix | helo foo | 250 mailserver | mail from: <> | 250 2.1.0 Ok | rcpt to: my(a)mail.address.tld | 250 2.1.5 Ok | data | 354 End data with <CR><LF>.<CR><LF> | testing | . | 250 2.0.0 Ok: queued as 673072767C | quit | 221 2.0.0 Bye | Connection closed by foreign host. Then the resulting mail message I get, has this header: | Return-Path: <MAILER-DAEMON> | Delivered-To: my(a)mail.address.tld | Received: from foo (localhost.localdomain [127.0.0.1]) | by mailserver (Postfix) with SMTP id 673072767C | for <my(a)mail.address.tld>; Wed, 11 Jul 2007 13:36:07 +0200 (CEST) | Message-Id: <20070711113611.673072767C@mailserver> | Date: Wed, 11 Jul 2007 13:36:07 +0200 (CEST) | From: MAILER-DAEMON | To: undisclosed-recipients:; It seems that postfix changes the return-path, and I dont see why it would do something like that. The bounce is not a bounce anymore, and if a user fetches the mail with e.g. fetchmail, and it cannot be delivered, then the bounce will be bounced, to MAILER-DAEMON .. My master.cf entry looks like this: dovecot unix - n n - - pipe flags=DRhu user=atmail:atmail argv=/usr/local/dovecot/libexec/dovecot/deliver -d ${recipient} If I add null_sender= , then that resolves it: dovecot unix - n n - - pipe flags=DRhu user=atmail:atmail null_sender= argv=/usr/local/dovecot/libexec/dovecot/deliver -d ${recipient} What do other postfix/dovecot-users do? Will this change break anything? I cannot see why empty null_sender isn't default .. so I'm wondering if there is something I've missed. Should we update the examples on http://wiki.dovecot.org/LDA/Postfix to include empty null_sender? -- Erland Nylend

1 0

[Dovecot] [Patch] Samba's proposed "ntlm_auth + winbind" support for dovecot-auth
by Dmitry Butskoy 11 Jul '07

11 Jul '07

The Samba team recommends to use their "ntlm_auth" command line helper for "NTLM" and "GSS-SPNEGO" authentication. This helper interacts with the Samba's winbind daemon, and this way can authenticate users against NT or Active Directory windows domain. Currently Dovecot can do "NTLM" authentication too, but just "locally" (against a local or sql database etc.). I've made a patch (attached), which adds "ntlm_auth" (or "winbind") support for Dovecot. The idea is to add two new authentication mechanisms: "mech_winbind_ntlm" and "mech_winbind_spnego". Both are coded in one additional file, "mech-winbind.c". An option "auth_ntlm_use_winbind" specifies whether to use the current implementation of ntlm, or do it by the "ntlm_auth" helper. "GSS-SPNEGO" always performed by the helper. Normally, "ntlm_auth" is invoked once, for all further requests. Such a way, "ntlm_auth helper from the Samba package, interacting with the Samba's winbind daemon", is used now by Squid, Apache and AFAIK some other applications. It is "strongly recommended" by the Samba team, and was already proposed even in this maillist 3 year ago (see f.e. http://www.dovecot.org/list/dovecot/2004-September/004775.html ). I hope there are no any serious performance issues for such a "complex way" -- f.e. with our web proxy, using this way, ~200 users do not feel any actual delays etc. I've successfully tested this patch with NTLM against AD domain. This patch can considerably improve the situation of "Email client on Windows desktop under Windows domain, but imap/pop at UNIX server". Currently, windows users have to specify their "login/password" for email accounts manually. There is an "SPA" (Secure Password Authentication) alternative for them, where just the desktop's login is used transparently, but it cannot be used now, because Dovecot cannot perform NTLM against, say, Active Directory domain. Since "dovecot-auth" daemon can be utilized by MTA as well (Postfix and other), the support of "ntlm_auth" in Dovecot can satisfy both SMTP and IMAP servers at UNIX side, and solve the issue completely. Questions and requests: - I try to code things most close to used style, i.e. using Dovecot's memory-management and io-pipe routines etc., but could someone look at it and check whether I've missed something or not? - Perhaps some names (of routines, modules) could be chosen better? - Maybe some other options should be implemented, i.e. "auth_winbind_helper_ntlm" and "auth_winbind_helper_spnego" to specify the helper's cmdline exactly ? - Currently I strip domain part of the username returned, i.e. from "DOMAIN\user" just to "user". Maybe better add some option "auth_winbind_strip_domain" for this? Certainly, it will be fine if someone else check it more, especially for "GSS-SPNEGO" which I cannot test for a while. Regards, Dmitry Butskoy http://www.fedoraproject.org/wiki/DmitryButskoy

2 6