August 2008 - dovecot

[Dovecot] [PATCH] Allow GSSAPI to work with multihomed hosts
by Jason Gunthorpe 13 Aug '08

13 Aug '08

I saw some past chatter on this in the list archives, but here is another stab and another rational. This patch follows a similar patch to openssh in that it allows any key in the specified keytab to match the incoming host key. This is necessary for multihomed hosts. See: https://bugzilla.mindrot.org/show_bug.cgi?id=928 IMAP/POP seem to be a strong candidate to be multihomed because they are very likely to have an internal to a firewall and external to a firewall name. Due to the way MIT kerberos handles host name resolution via reverse IP lookup this can often result in multiple principle names and there is simply nothing to be done about it. This is my situation.. When you add windows into the mix, which uses a totally different set of rules to determine the principle all hope seems to be lost to have a single service principle name for an imap server :( I was able to make things work for my environment using only the auth_gssapi_hostname feature if only MIT kerberos was used, but as soon as windows SSPI was involved it choose a different hostname. Thus we want to have GSSAPI to match any service principle in the keytab. As far as security concerns go, the admin can configure the keytab for dovecot to be seperate from the system key tab and contain only valid imap SPNs, but in truth it probably doesn't matter. I choose to just use the magic configurable: auth_gssapi_hostname = $ALL rather than introduce more configurables FWIW, after applying this I now am happy to say I have an Active Directory KDC, with dovecot providing gssapi auth to thunderbird on both linux (mit kerb 1.6) and windows (sspi).. --- dovecot-1.0.13/src/auth/mech-gssapi.c 2007-12-11 11:52:08.000000000 -0700 +++ dovecot-1.0.13-jgg/src/auth/mech-gssapi.c 2008-08-11 23:52:15.000000000 -0600 @@ -101,6 +101,13 @@ gss_name_t gss_principal; const char *service_name; + if (strcmp(request->auth->gssapi_hostname,"$ALL") == 0) { + auth_request_log_info(request, "gssapi", + "Using all keytab entires"); + *ret = GSS_C_NO_CREDENTIAL; + return GSS_S_COMPLETE; + } + if (strcasecmp(request->service, "POP3") == 0) { /* The standard POP3 service name with GSSAPI is called just "pop". */

2 2

[Dovecot] dovecot sieve sends vacation messages with null envelope sender
by Josef Liška 13 Aug '08

13 Aug '08

I am using this simple sieve script to do "vacation": require ["fileinto", "vacation"]; if exists "X-Spam-Flag" { stop; } vacation :days 1 :subject "Out of office reply" :addresses ["<email address hidden>", "<email address hidden>" ] "I am on vacation until 2008-08-07. If you have something urgent, please contact: Jan Novak <email address hidden> "; I use sql lookups for users and passwords. For some reason the default location ~/.dovecot-sieve did not work for some reason. However I prefer to put sieve scripts to /var/lib/sieve and when I added additional field to lookup with this location it started to work. But it sends vacation messages with null envelope sender, which is in my opinion undesirable, because many vacation messages are caught in spam filters. I think there could be same sender on envelope. In dovecot-sieve/src/sieve-cmu.c around line 380 is a call to smtp_client_open(src->addr, NULL, &f); NULL could be replaced with src->fromaddr Maybe some more patching may be necesary. I found similar patch for cyrus-imapd at http://oss.digirati.com.br/mail/cyrus.html <http://oss.digirati.com.br/mail/cyrus.html> My current system: 1) Ubuntu 8.04.1 jl@mail:~$ dovecot --version 1.0.15 It is a backported package from ubuntu intrepid ibex. However the same applies for dovecot 1.0.10 which is in ubuntu 8.04. Summary: I expect messages sent by vacation recipe should have envelope from same as user's e-mail address. This is then writen to Return-Path: header by receiving MTA NULL envelope from is used, resulting (in my case) to Return-Path: <> rewriten by postfix to Return-Path: <MAILER-DAEMON> by receiving MTA

7 6

[Dovecot] RfE: use HOSTNAME environment variable in hostpid_init()
by Heiko Schlichting 13 Aug '08

13 Aug '08

Hi, All parts of dovecot except deliver uses the result of hostpid_init() in src/lib/hostpid.c as a hostname which only asks gethostname(). deliver honours environment variable HOSTNAME in src/deliver/deliver.c: getenv("HOSTNAME"); and uses the hostname of hostpid_init() as a fallback. Wouldn't it be consequent to evaluate the environment variable HOSTNAME in hostpid_init() with fallback to gethostname() and remove the special behavior from deliver? The dovecot master process should export $HOSTNAME to all childs in this case. Motivation: Dovecot uses the hostname as part of Maildir file names and gethostname() is not fully qualified on all operating systems (it is on IRIX but not on Linux). But unqualified hostnames are not unique and it is frequent that dovecot hosts are named "mail" oder "imap" as hostname. To distinguish between mail.domain1.com and mail.domain2.net would be easier if dovecot evaluate $HOSTNAME in all case not just deliver as program imap can create Maildir files as well. Heiko Heiko Schlichting Freie Universität Berlin heiko(a)FU-Berlin.DE Zentraleinrichtung für Datenverarbeitung (ZEDAT) Telefon +49 30 838-54327 Fabeckstraße 32 Telefax +49 30 838454327 14195 Berlin

2 1

[Dovecot] syslog with PID
by Heiko Schlichting 13 Aug '08

13 Aug '08

Hi, LOG_NDELAY is the only option for openlog() in dovecot 1.1.2. Wouldn't be LOG_NDELAY|LOG_PID as option parameter much more useful? Without logging the pid, it is impossible to match 'Disconnected' log entries and the corresponding session start/login. Therefore I suggest to use LOG_NDELAY|LOG_PID in the options of i_set_failure_syslog() at all 6 occurrences which passes it to openlog(). I know that it is possible to - use logging to file - patch it myself but I can't see good reasons in not using LOG_PID here. As far as I know, most other programs specify LOG_PID. Without LOG_PID: Jul 31 10:21:08 name dovecot: IMAP(hsg): Disconnected: Logged out bytes=28/242 With LOG_PID: Jul 31 10:21:08 name dovecot[17016]: IMAP(hsg): Disconnected: Logged out bytes=28/242 Heiko Heiko Schlichting Freie Universität Berlin heiko(a)FU-Berlin.DE Zentraleinrichtung für Datenverarbeitung (ZEDAT) Telefon +49 30 838-54327 Fabeckstraße 32 Telefax +49 30 838454327 14195 Berlin

3 5

[Dovecot] sieve - Sendmail process terminated abnormally, exit status 70
by Thomas Harold 13 Aug '08

13 Aug '08

How do we start troubleshooting this? deliver(user(a)example.com): Aug 12 18:27:19 Error: Sendmail process terminated abnormally, exit status 70 deliver(user(a)example.com): Aug 12 18:27:19 Info: sieve runtime error: Vacation: Error sending mail deliver(user(a)example.com): Aug 12 18:27:19 Info: msgid=<48A20E3C.7070307(a)example.com>: saved mail to INBOX deliver(user(a)example.com): Aug 12 18:27:19 Error: sieve_execute_bytecode(/var/vmail/example.com/user//Home/.dovecot.sievec) failed It seems to only choke on the vacation portion. It creates entries in the ".dovecot.lda-dupes" file. But then dies while sending the reply e-mail. The contents of the user's .dovecot.sieve file is: ------------------------------------- require ["fileinto", "include", "vacation"]; # Move spam to spam folder if exists "X-Spam-Flag" { fileinto "spam"; # Stop here so that we do not reply on spams stop; } include :personal "sieve-vacation"; ------------------------------------- And the "" file looks like: ------------------------------------- require ["vacation"]; vacation # Reply at most once a day to a same sender :days 1 :subject "Out of office reply" # List of recipient addresses which are included in the auto replying. # If a mail's recipient is not on this list, no vacation reply is sent for it. :addresses "user(a)example.com" "blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah, user(a)example.com"; ------------------------------------- If I comment out the "include :personal "sieve-vacation";" line, then it works, but obviously not the vacation portion. Deliver does at least not die horribly. I get the same error if I move the content of the vacation include file into the main ".dovecot.sieve" file. # ls -la /usr/local/libexec/dovecot/lda/ -rwsr-xr-x 1 root root 802824 Aug 12 18:12 deliver # ls -la /usr/libexec/dovecot/ total 5728 drwxr-xr-x 2 root root 4096 Jul 31 04:04 . drwxr-xr-x 11 root root 4096 Jul 25 04:39 .. -rwxr-xr-x 1 root root 58416 Jul 24 06:32 checkpassword-reply -rwxr-xr-x 1 root root 666128 Jul 24 06:32 convert-tool -rwxr-xr-x 1 root root 802824 Jul 24 06:32 deliver -rwxr-xr-x 1 root root 164176 Jul 24 06:32 dict -rwxr-xr-x 1 root root 350384 Jul 24 06:32 dovecot-auth -rwxr-xr-x 1 root root 674176 Jul 24 06:32 expire-tool -rwxr-xr-x 1 root root 59200 Jul 24 06:32 gdbhelper -rwxr-xr-x 1 root root 245872 Jul 24 06:32 idxview -rwxr-xr-x 1 root root 854488 Jul 24 06:32 imap -rwxr-xr-x 1 root root 157216 Jul 24 06:32 imap-login -rwxr-xr-x 1 root root 61248 Jul 24 06:32 listview -rwxr-xr-x 1 root root 61800 Jul 24 06:32 logview -rwxr-xr-x 1 root root 74200 Jul 24 06:32 maildirlock -rwxr-xr-x 1 root root 931 Jul 24 06:27 mkcert.sh -rwxr-xr-x 1 root root 787464 Jul 24 06:32 pop3 -rwxr-xr-x 1 root root 149152 Jul 24 06:32 pop3-login -rwxr-xr-x 1 root root 83968 Jul 24 06:32 rawlog -rwxr-xr-x 1 root root 165152 Jun 11 03:21 sievec -rwxr-xr-x 1 root root 157216 Jun 11 03:21 sieved -rwxr-xr-x 1 root root 62584 Jul 24 06:32 ssl-build-param (output of "yum list") dovecot.x86_64 :1.1.2-2_77.el5 installed dovecot-sieve.x86_64 1.1.5-8.el5 installed I'm not finding any AVC errors in the SELinux audit.log file. And I'm not sure what other switches I can turn on to get better error information as to what sendmail/deliver are choking on in this virtual (setuid) environment where we use Dovecot as the LDA.

3 3

[Dovecot] Marking as Read causes Body.Peek on ALL messages - Reasonable?
by Daniel Watts 13 Aug '08

13 Aug '08

I've noticed when I select a folder of messages (Thunderbird) and mark them all as read (or unread) it produces the following IMAP transcript: Source Destination Info c.c.c.c s.s.s.s Request: DONE s.s.s.s c.c.c.c Response: 20 OK Idle completed. c.c.c.c s.s.s.s Request: 21 uid store 1:20 -Flags (\Seen) s.s.s.s c.c.c.c Response: * 1 FETCH (UID 1 FLAGS (\Recent NonJunk)) c.c.c.c s.s.s.s Request: 22 UID fetch 2 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 2 FETCH (UID 2 RFC822.SIZE 1339 BODY[] {1339} c.c.c.c s.s.s.s Request: 23 UID fetch 3 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 3 FETCH (UID 3 RFC822.SIZE 1342 BODY[] {1342} c.c.c.c s.s.s.s Request: 24 UID fetch 5 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 5 FETCH (UID 5 RFC822.SIZE 1344 BODY[] {1344} c.c.c.c s.s.s.s Request: 25 UID fetch 6 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 6 FETCH (UID 6 RFC822.SIZE 1350 BODY[] {1350} c.c.c.c s.s.s.s Request: 26 UID fetch 7 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 7 FETCH (UID 7 RFC822.SIZE 1344 BODY[] {1344} c.c.c.c s.s.s.s Request: 27 UID fetch 8 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 8 FETCH (UID 8 RFC822.SIZE 1325 BODY[] {1325} c.c.c.c s.s.s.s Request: 28 UID fetch 9 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 9 FETCH (UID 9 RFC822.SIZE 1323 BODY[] {1323} c.c.c.c s.s.s.s Request: 29 UID fetch 10 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 10 FETCH (UID 10 RFC822.SIZE 1338 BODY[] {1338} c.c.c.c s.s.s.s Request: 30 UID fetch 11 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 11 FETCH (UID 11 RFC822.SIZE 1333 BODY[] {1333} c.c.c.c s.s.s.s Request: 31 UID fetch 12 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 12 FETCH (UID 12 RFC822.SIZE 1344 BODY[] {1344} c.c.c.c s.s.s.s Request: 32 UID fetch 13 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 13 FETCH (UID 13 RFC822.SIZE 1335 BODY[] {1335} c.c.c.c s.s.s.s Request: 33 UID fetch 15 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 15 FETCH (UID 15 RFC822.SIZE 1323 BODY[] {1323} c.c.c.c s.s.s.s Request: 34 UID fetch 16 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 16 FETCH (UID 16 RFC822.SIZE 1325 BODY[] {1325} c.c.c.c s.s.s.s Request: 35 UID fetch 17 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 17 FETCH (UID 17 RFC822.SIZE 1333 BODY[] {1333} c.c.c.c s.s.s.s Request: 36 UID fetch 18 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 18 FETCH (UID 18 RFC822.SIZE 1327 BODY[] {1327} c.c.c.c s.s.s.s Request: 37 UID fetch 19 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 19 FETCH (UID 19 RFC822.SIZE 1343 BODY[] {1343} c.c.c.c s.s.s.s Request: 38 UID fetch 20 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 20 FETCH (UID 20 RFC822.SIZE 1337 BODY[] {1337} c.c.c.c s.s.s.s Request: 39 IDLE s.s.s.s c.c.c.c Response: + idling NOTE: c.c.c.c = client (thunderbird) s.s.s.s = server (dovecot 1.1.2) Is this reasonable? I thought it would be possible to just send a list of message UIDs and say mark these as /seen /unseen etc. Of course this could (is probably) just Thunderbird being braindead but confirmation would be appreciated. Thanks, Daniel

2 1

[Dovecot] IMAP inbox: cannot delete tagged messages or change their tag
by Epimedia 13 Aug '08

13 Aug '08

Hello, a bit of a problem with Dovecot. Version is 1.0.15 and is a default install (no changes to config) from FC8 repository... except that Dovecot is configured to use Maildir I have a user on the system who uses the tags in Thunderbird (Important, Personal etc). When she tags the messages they cannot be deleted and their tags cannot be changed. When deleting a message from the IMAP inbox it momentarily disappears and moves a copy to the Trash but when the IMAP inbox is reloaded the message reappears. The same happens when I try to change a tag: it comes back with the previous tag. Untagged messages can be freely deleted. Also, this problem does not happen if the messages are in a IMAP folder. They can be freely deleted. The problem seems specific to Dovecot, not Thunderbird, as I am able to tag and delete messages in another IMAP account. Also, accessing the same IMAP account using OS X Mail the messages come back after deleting them. Where should I start looking for a solution to this problem?

2 1

[Dovecot] Trying to Hide Namespace - new configuration options?
by Daniel Watts 13 Aug '08

13 Aug '08

Using 1.1.2 We have: # default namespace namespace private { separator = / prefix = inbox = yes #location = maildir:/home/virtual/%h #Maildir } # for backwards compatibility: namespace private { separator = / prefix = mail/ location = maildir:%h/Maildir/ #Maildir hidden = yes list = no } The 'hidden=yes' seemed to do nothing but saw earlier in this list a reply to add 'list=no'. This has worked to hide all folder but we still have /mail/Trash showing and it refuses to go away even after unsubscribing. mail/Trash appears when I set my email client to use folder prefix "mail/". If i set the prefix to blank I only see my Inbox and Deleted folders. Interestingly it shows 'Deleted' not 'Trash'. I guess Thunderbird renames 'Trash'. What other configs are there to try? Is there a list of config changes for 1.1.x anywhere? We were not aware of the list=no config. Thanks, Daniel

2 2

[Dovecot] How to do line breaks in sieve scripts?
by CJ Keist 13 Aug '08

13 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In working with auto vacation replies I'd like to do a sieve script as follows: require ["vacation"]; vacation :days 30 :addresses "cj.keist(a)colostate.edu" :subject "Out of Office" "***************** Out of Office ****************** I'm away -- send mail to foo in my absence ***************************************************"; But the libsieve-php.sourceforge.net check site doesn't like the line breaks. Is there a way to do line breaks in sieve scripting? I've tried "\" at the end of the lines but that didn't work. - -- C. J. Keist Email: cj.keist(a)colostate.edu UNIX/Network Manager Phone: 970-491-0630 Engineering Network Services Fax: 970-491-5569 College of Engineering, CSU Ft. Collins, CO 80523-1301 All I want is a chance to prove 'Money can't buy happiness' -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFIm2UwA29OFr7C6jcRAn7mAKCokJxNCkTiwyXuSo1qDjZ+9xqVfgCdG3vC DC+/BIiQVqZN+U8CzwWdxgQ= =4+0r -----END PGP SIGNATURE-----

3 3

[Dovecot] problems with sieve and lda
by Harondel J. Sibble 13 Aug '08

13 Aug '08

Okay, after reading the wiki and list archives, I am confused. I am attemping to get the deliver LDA working on a centos 5.1 system # rpm -qa | grep dovecot dovecot-1.0.7-2.el5 dovecot-sieve-1.0.2-6.el5 # rpm -qa | grep postfix postfix-2.3.3-2 so that I can use Sieve for mail filtering to imap folders, I am using the mbox format Following the wiki here for system users http://wiki.dovecot.org/LDA/Postfix I never get any info in the logs about cmusieve, the only way I see anything show up is if I add the transport settings to postfix/master.cf or see below >From reading the list archives, as best as I can tell, the only time I need to make the changes in postfix's master.cf is if I am using a virtual environment, otherwise for local delivery, all I need is the mailbox_command setting in postfix/main.cf However with that setting, I get nothing! If I then run deliver from the command line as per a couple of mailling postings, cat /etc/hosts | /usr/libexec/dovecot/deliver -d localaccount(a)mydomain.com -f mygmailaccount(a)gmail.com I get deliver(localaccount(a)mydomail.com): Aug 10 22:07:17 Info: Loading modules from directory: /usr/lib/dovecot/lda deliver(localaccount(a)mydomail.com): Aug 10 22:07:17 Info: Module loaded: /usr/lib/dovecot/lda/lib90_cmusieve_plugin.so deliver(localaccount(a)mydomail.com): Aug 10 22:07:17 Error: Can't connect to auth server at /var/run/dovecot/auth-master: No such file or directory Config stuff (dovecot -n) # 1.0.7: /etc/dovecot.conf log_path: /var/log/dovecot/dovecot.log info_log_path: /var/log/dovecot/dovecot.log protocols: imaps pop3s listen(default): *:143 listen(imap): *:143 listen(pop3): [::] ssl_listen(default): *:943 ssl_listen(imap): *:943 ssl_listen(pop3): ssl_cert_file: /etc/pki/dovecot/certs/dovecot.cert ssl_key_file: /etc/pki/tls/private/my.domain.tld.key verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail:INBOX=/var/spool/mail/%u:INDEX=~/mail/.imap/.imap/indexes/ mail_debug: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd postfix/main.cf has mailbox_commmand = /usr/libexec/dovecot/deliver A .dovecot.sieve file with the following contents for testing purposes is located at ~/mail require "fileinto"; if header :comparator "i;ascii-casemap" :contains "Subject" "**SPAM**" { fileinto "Trash"; stop; } The LDA section from the dovecot.conf file protocol lda { # Address to use when sending rejection mails. # postmaster_address = # Hostname to use in various parts of sent mails, eg. in Message-Id. # Default is the system's real hostname. #hostname = # Support for dynamically loadable plugins. mail_plugins is a space separated # list of plugins to load. mail_plugin_dir = /usr/lib/dovecot/lda mail_plugins = cmusieve # Binary to use for sending mails. #sendmail_path = /usr/lib/sendmail # UNIX socket path to master authentication server to find users. #auth_socket_path = /var/run/dovecot/auth-master #sieve_global_path = script_path = ~/.dovecot.sieve log_path = /var/log/dovecot/deliverlog info_log_path = /var/log/dovecot/deliverlog debug = yes } What am I missing here to getting this working -- Harondel J. Sibble Sibble Computer Consulting Creating solutions for the small business and home computer user. help(a)pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com (604) 739-3709 (voice/fax) (604) 686-2253 (pager)

4 7