August 2007 - dovecot

[Dovecot] shared mailbox subfolder permissions
by David Leuschner 09 Sep '07

09 Sep '07

Hi all, when I create a subfolder in a public mailbox the dovecot-shared file is copied for the newly created subfolder and all mails get the owner, group and permissions from the file. Unfortunately the cur, new and tmp folders only get the permissions from the file but owner and group are set according to the creator. This effectivly makes the folder private to the creator. Is this the intended behavior? Is it a bug that has already been fixed in a later version? I am using 1.0.rc29. An example follows. Thanks for your help! David As an example .foobar was created manually (maildirmake) and permissions were setup using the shell: uml public # ls -al . .foobar .: total 24 drwxrwx--- 6 root pub 4096 Aug 18 13:05 . drwxrwxr-x 3 root mail 4096 Aug 18 11:10 .. drwxrwx--- 5 root pub 4096 Aug 18 11:42 .foobar drwxrwx--- 2 root pub 4096 Aug 18 10:50 cur -rw-rw---- 1 root pub 0 Aug 18 11:40 dovecot-shared drwxrwx--- 2 root pub 4096 Aug 18 10:50 new drwxrwx--- 2 root pub 4096 Aug 18 10:50 tmp .foobar: total 20 drwxrwx--- 5 root pub 4096 Aug 18 11:42 . drwxrwx--- 6 root pub 4096 Aug 18 13:05 .. drwxrwx--- 2 root pub 4096 Aug 18 11:42 cur drwxrwx--- 2 root pub 4096 Aug 18 11:42 new drwxrwx--- 2 root pub 4096 Aug 18 11:42 tmp After creating a subfolder 'baz' with Thunderbird the group of .baz is the group from dovecot-shared but the contained new/cur/tmp directories have the users primary group (instead of pub). uml public # ls -al . .baz .: total 28 drwxrwx--- 7 root pub 4096 Aug 18 13:09 . drwxrwxr-x 3 root mail 4096 Aug 18 11:10 .. drwxrwx--- 5 dleuschner pub 4096 Aug 18 13:09 .baz drwxrwx--- 5 root pub 4096 Aug 18 11:42 .foobar drwxrwx--- 2 root pub 4096 Aug 18 10:50 cur -rw-rw---- 1 root pub 0 Aug 18 11:40 dovecot-shared drwxrwx--- 2 root pub 4096 Aug 18 10:50 new drwxrwx--- 2 root pub 4096 Aug 18 10:50 tmp .baz: total 20 drwxrwx--- 5 dleuschner pub 4096 Aug 18 13:09 . drwxrwx--- 7 root pub 4096 Aug 18 13:09 .. drwxrwx--- 2 dleuschner dleuschner 4096 Aug 18 13:09 cur -rw-rw---- 1 dleuschner pub 0 Aug 18 13:09 dovecot-shared drwxrwx--- 2 dleuschner dleuschner 4096 Aug 18 13:09 new drwxrwx--- 2 dleuschner dleuschner 4096 Aug 18 13:09 tmp Here's my configuration: listen: localhost ssl_listen: * ssl_ca_file: /root/ca/ca.crt ssl_cert_file: /root/ca/crt/uml.crt ssl_key_file: /root/ca/keys/uml.key ssl_verify_client_cert: yes verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable: /usr/libexec/dovecot/imap-login namespace: type: private separator: . prefix: Priv. location: maildir:~/.maildir:CONTROL=~/.maildir/ctrl/priv:INDEX=~/.maildir/idx/priv inbox: yes namespace: type: public separator: . prefix: Pub. location: maildir:/var/mail/public:CONTROL=~/.maildir/ctrl/pub:INDEX=~/.maildir/idx/pub auth default: passdb: driver: pam args: * userdb: driver: passwd socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: -- David Leuschner Meisenweg 7 79211 Denzlingen Tel. 07666/912466

2 1

[Dovecot] SSL connections frozen on Dovecot 1.0.0
by Thibault VINCENT 09 Sep '07

09 Sep '07

Hello, We are running Dovecot 1.0.0 (Debian Etch, Backports.org, OpenSSL) in a production environment and we experience sporadic SSL connection problems. At the moment, it's difficult to tell if the server goes back to normal operation after some time or if it can be reproduces at any time because we have to restart it as soon as we get Nagios alerts. Some tests with openssl s_client have shown difficulties to proceed the SSL handshake (hanging at different stages), or no response to IMAP commands. SSL client used: openssl s_client -host imap -port 993 - First case : s_client hangs on the first output "CONNECTED(00000003)" and there is no handshake at all; - Second case : like the first but the handshake starts after a few minutes; - Third case : the handshake goes fine but the "OK" server banner is never sent (no response to commands); - Fourth case : the greeting banner is received but dovecot will never answer. The configuration file is almost identical to the default and SSL certificate is not the autogenerated one. Log files do not show dying process. I've searched the ML archive for SSL issues but not found related bug. Does anyone use the Backport.org package of Dovecot ? Thank you :) -- Thibault VINCENT tibal(a)reloaded.fr thibault.vincent(a)reloaded.fr PGP Key : 0x4BA8A39B

2 3

[Dovecot] postfix + dovecot lda,
by Michael Moritz 09 Sep '07

09 Sep '07

I'm trying to replace procmail with deliver but I'm having problems with the group part of things. I keep getting: Aug 29 16:44:19 dingbat deliver(mimo): open(/var/mail/.temp.dingbat.3969.d1689935a308e0dd) failed: Permission denied Aug 29 16:44:19 dingbat deliver(mimo): file_lock_dotlock() failed with mbox file /var/mail/mimo: Permission denied My primary group is mimo and I think it's trying to use that. I changed it to mail and things work. But I do not want all my users to have a primary group mail. Is there a way I can force deliver to use group mail as group and ignore the per user gid? I tried chmod 6755 /usr/lib/dovecot/deliver but no change. This is on debian/etch, help appreciated.... mimo

3 4

[Dovecot] too many files opened
by Joshua, C.S. Chen 09 Sep '07

09 Sep '07

Hi folks, My institute's mail server was upgraded to RHEL5 with dovecot 1.0-2.1rc5 recently. And it uses PAM authentication which points to LDAP server. Now from time to time it gets Error like dovecot: Aug 29 09:23:59 Error: auth(default): pam(joshua,192.168.177.52): pipe() failed: Too many open files and users can not login. My config is like dovecot -n # /etc/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot info_log_path: /var/log/dovecot listen: * login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_greeting: ASIAA Dovecot ready. login_processes_count: 4 mail_location: mbox:/asiaa/home/%u/:/asiaa/home/%u/mail/:INBOX=/var/mail/%u:INDEX=/asiaa/home/%u/mail/dovecot_indexes mail_debug: yes mail_full_filesystem_access: yes mail_drop_priv_before_exec: yes mail_executable(default): /etc/dovecot_postlogin_beforeimap.sh mail_executable(imap): /etc/dovecot_postlogin_beforeimap.sh mail_executable(pop3): /etc/dovecot_postlogin_beforepop3.sh mail_process_size: 512 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %08Xv%08Xu auth default: passdb: driver: pam userdb: driver: passwd Any suggestion or help is appreciated Cheers Joshua

3 3

[Dovecot] Using NID_x500UniqueIdentifier as ssl_username_from_cert
by S. Wefel 09 Sep '07

09 Sep '07

Hi, please have a look at the attached patch for dovecot-1.0.3 These patch modifies ssl_proxy_get_peer_name() to use the NID_x500UniqueIdentifier as username instead of NID_commonName. The reason is, that the Common Name doesn't have to be unique for the whole mailserver. Example; in germany a lot of people got the first name "Andreas" and the last name "Schulz". Therefore a lot of certificates exists with subjects like this: C=DE,O=ABC,CN=Andreas Schulz/emailAddress=andreas.schulz(a)abc.de C=DE,O=DEF,CN=Andreas Schulz/emailAddress=andreas.schulz(a)def.de ... dovecot couldn't distinguish between these users. So we decide to use certificates with an X509v3 extension NID_x500UniqueIdentifier which allows to extend the subject by an unique ID, e.g. the unix-uid or a database unique key. The new certificates may look like this: C=DE,O=ABC,CN=Andreas Schulz/emailAddress=andreas.schulz(a)abc.de/x500UniqueIdentifier=user1 C=DE,O=DEF,CN=Andreas Schulz/emailAddress=andreas.schulz(a)def.de/x500UniqueIdentifier=user2 With the attached patch the user is taken from this extension and e.g. with userdb=ldap you can use the filter string user_filter = (&(objectClass=posixAccount)(uid=%u)) A good solution to use booth, the common name and the UniqueIdentifier is to extend settings like ssl_username_from_cert = no | yes | cn | uid where "yes" is similar to "cn". Regards, Sandro Wefel

2 1

[Dovecot] Server Timed Out: Outlook Express
by Jackie Hunt 09 Sep '07

09 Sep '07

Hi all, We just started running Dovecot this fall here on campus v 1.0. I've started getting some trouble reports from users. An Outlook Express users reported seeing the "Server has not responded in 60 seconds" messages. Waiting longer doesn't help, he has to stop/start Outlook Express to get connected again. Also have a Thunderbird user who is seeing that type of behavior first thing in the morning after being logged in all night. He has to stop/restart Thunderbird. Also, have had some reports of "disconnected" showing up on the Outlook2007 status bar. I've looked at the Dovecot log, and don't see any errors. I do see lots of "Disconnected", "Disconnected in IDLE" and "Disconnected: Logged Out". These last two seem normal, if I just see "Disconnected" is that a flag that we're losing connections abnormally? I know version 1.0.3 is out. I've looked at the changes, and the only one I can see that might be related to what we are seeing is the IDLE commmand fix. Was hoping for some advice on whether upgrading might resolve these issue. Any insight would be greatly appreciated. Jackie --- Jackie Hunt ACNS Voice: (970) 663-3789 Colorado State University FAX: (970) 491-1958 Fort Collins, CO 80523 Email: jackie.hunt(a)colostate.edu

3 2

[Dovecot] LDA bouncing mails after upgrade -- again
by Milan Holzäpfel 09 Sep '07

09 Sep '07

Hi Timo, some time ago (2007-03-24 and following) I asked whether it was intended that Dovecot deliver bounces mails (by terminating with status 89) if the deliver version is older than the rest of the dovecot installation. You replied that it was a bug, and that it had been fixed in <URL:http://dovecot.org/list/dovecot-cvs/2007-March/008346.html>. When I upgraded from Dovecot 1.0.2 to 1.0.3 a few days ago, I found out that this problem probably still exists: | Aug 28 09:38:03 host.example.org deliver(user(a)example.org): Module is for different version 1.0.3: /usr/lib/dovecot/lda/lib10_quota_plugin.so | Aug 28 09:38:03 host.example.org postfix/pipe[18356]: <ID>: to=<user(a)example.org>, relay=dovecot, delay=0.4, delays=0.13/0.09/0/0.18, dsn=5.3.0, status=bounced (Command died with status 89: "/usr/libexec/dovecot/postfix-deliver/deliver") The error message I posted in march was: | Mar 22 20:29:20 host.example.org deliver(user(a)example.org): Module is for different version 1.0.rc27: /usr/lib/dovecot/lda/lib10_quota_plugin.so | Mar 22 20:29:20 host.example.org postfix/pipe[17344]: <ID>: to=<user(a)example.org>, relay=dovecot, delay=1.9, delays=1.5/0/0/0.35, dsn=5.3.0, status=bounced (Command died with status 89: "/usr/libexec/dovecot/postfix-deliver/deliver") I suppose you still want to fix it. Regards, and thanks for all your work, Milan -- Milan Holzaepfel <mail(a)mjh(d)name> <URL:http://mjh.name/> pub 4096R/C790FC23 EB8E 5E81 81E3 53A9 9B74 B895 5179 54C0 C790 FC23

2 1

[Dovecot] processing Dovecot maildirs with shell scripts
by M. Fioretti 09 Sep '07

09 Sep '07

Hello, I have a postfix server which uses procmail as its delivery agent to deliver incoming messages to several maildirs. For several reasons, not really relevant here, I need to process/refilter/sort again the content of these mailboxes before delivering the messages to the _other_ maildirs which Dovecot sees and serves to local or remote imap users. Basically, I need to write some shell scripts that, from cron jobs, regularly do this: foreach file in some_incoming_mailbox/new/ do #process the file and/or set some variable according to its content delete the file or mv it to some_other_maildir/new/ where the actual action and value of some_other_maildir is set every time by the "process the file" part of the script. The part that I still miss is guidelines to do these things safely, that is without losing or corrupting messages or doing anything else that would confuse dovecot. For example, under which conditions it is sure to move or delete (the Unix way, with mv or rm) a message from mailbox1/new/ to mailbox2/new, when the latter is served via dovecot to remote users? What is advisable and most efficient? Use locks (how?), only work on file which are at least one minute old? Should I move the messages to tmp instead of new? What else? Tips or pointers about this are very welcome. Ciao, Marco

3 5

[Dovecot] How can i complie and install the dict modules
by Oliver Eales 09 Sep '07

09 Sep '07

Hello, I want to migrate from courier-imap to dovecot and now i am trying out dovecot1.1.alpha3 But i have problems getting the expire plugin to work. At startup i get the message: Unknown dict module: db As far as i understood i have to compile the backend manually an copy it into tho appropirate place. But how can i do this ? Thanks in advance, Oliver Eales

2 1

[Dovecot] BUG REPORT - Stops logging after sleep
by Bruce Bodger 09 Sep '07

09 Sep '07

Version: dovecot --version: 1.0.0 OS: OS X - 10.4.9 Architecture: G5 Dual/1.8Ghz Had a fairly normal time correction last night: May 9 20:56:56 G518X2 ntpd[219]: time set -1.212733 s Which dovecot duly noted: May 9 20:56:56 G518X2 dovecot: auth(default): Time just moved backwards by 1 seconds. I'll sleep now until we're back in present. This morning all of the dovecot processes are running fine but dovecot has stopped logging. (I have modified nothing in dovecot.conf relative to logging: dovecot logs to syslog using the "mail" syslog_facility.) ps -aux | grep dovecot root 53 0.0 -0.0 27772 544 ?? Ss 4:23PM 0:04.69 /usr/local/sbin/dovecot -F root 79 0.0 -0.0 28176 556 ?? S 4:23PM 0:03.21 dovecot-auth dovecot 9548 0.0 -0.0 27780 496 ?? S 7:12AM 0:00.05 imap-login dovecot 9631 0.0 -0.0 27780 500 ?? S 7:17AM 0:00.03 imap-login dovecot 9632 0.0 -0.0 27780 500 ?? S 7:17AM 0:00.03 imap-login I am starting dovecot via OS X's launchdaemon facility thus the "-F" command line switch requirement. Sending a "kill -HUP" to the process did not get it to start logging. Sending a "Kill -9" to the process forced a restart and logging began again. ps -aux | grep dovecot root 9738 0.0 -0.0 27772 540 ?? Ss 7:26AM 0:00.03 /usr/local/sbin/dovecot -F root 9739 0.0 -0.0 28176 544 ?? S 7:26AM 0:00.02 dovecot-auth dovecot 9740 0.0 -0.0 27780 500 ?? S 7:26AM 0:00.02 imap-login dovecot 9751 0.0 -0.0 27780 500 ?? S 7:27AM 0:00.01 imap-login dovecot 9762 0.0 -0.0 27780 500 ?? S 7:27AM 0:00.01 imap-login Before posting this bug I compared v1.0.0's /src/lib/ioloop.c to that in the nightly snapshot and saw no adjustments in, what I presumed to be, the relevant portion of the code. Output of "dovecot -n" protocols: imap ssl_disable: yes disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login first_valid_uid: 490 mail_extra_groups: mail mail_location: mbox:~/Library/Mail/IMAP:INBOX=/var/mail/%u:INDEX=%h/ Library/Mail/DOVECOT.indexes dotlock_use_excl: yes auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd Thank you.

4 14