October 2009 - dovecot

[Dovecot] how to config dovecot for multiple domains, multiple SSL certs, and conditional IP access -- with passwd-file passdb?
by PGNet Dev 09 Oct '09

09 Oct '09

at them moment, i've configured dovecot for a flat passwd-file, annd static userdb. from dovecot.conf, ... auth default { mechanisms = plain digest-md5 cram-md5 user = mail ... passdb passwd-file { args = /data/mail/users/imap_user_file } userdb static { args = static uid=mail gid=mail home=/data/mail/store/Domains/%d/Accounts/%n quota=maildir:storage=4096 nice=10 } ... i'd like to configure dovecot to, host multiple domains, each on a separate IP setup a separate SSL cert for each domain respond with a different login_greeting for each domain restrict access to, and access type (e.g., TLS req'd vs noTLS, secure auth OK) of, imap login based with conditional rules based on the guest's IP address. all of these things are currently implemented on the non-dovecot imap server i'm migrating _from_, and i'd like to preserve these capabilities. can any/all of these be accomplished with a passwd-file flatfile lookup? i know i can restrict IP access in passwd-file with 'allow_nets=', but atm i'm unclear how i'd do that for multiple domains, etc. i understand that much can be accomplished with custom SQL queries, but for a small install would _prefer_ to stay flat file. i'm finding bits & pieces of capability in docs, etc -- but, so far, nothing comprehensive/all-inclusive. which makes me wonder a bit -- why not? any comments/advice would be much appreciated. thanks!

3 2

[Dovecot] Move messages marked as Spam
by michel＠casa.co.cu 08 Oct '09

08 Oct '09

Hello I have implemented recently in my work bogofilter to mark messages as Spam or Ham, currently is working perfectly, but I want to move those messages marked as spam to a folder called spam. I installed dovecot-sieve with the intention of using fileinto to accomplish this. my question is: where I put this: require "fileinto"; if header :contains "X-Bogosity" "Spam" { fileinto "Spam"; } so that all messages that come to my users go into the spam folder? and how i handle messages that are marked as "Unsure" X-Bogosity: Unsure Thanks Michel ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

5 11

[Dovecot] Logging in with '+' delimiter
by Jerry 07 Oct '09

07 Oct '09

Dovecot v1.2.4 FreeBSD-7.2 I have Postfix configured to use Virtual Users & Domains and use Dovecot for virtual delivery. Postfix also sends, dovecot correctly places mail with '+'addressing; i.e., "foo+bar(a)domain.com" into "path-to-mail/domain.com/foo+bar". The problem is when I attempt to access the mailbox, the user name: foo+bar(a)domain.com is rejected. Is this by design, or is there a way to circumvent this problem? -- Jerry gesbbb(a)yahoo.com Fortune favors the lucky.

3 3

[Dovecot] compiling issue 1.2.6 - Solaris
by Jernej Porenta 07 Oct '09

07 Oct '09

Heya, I am expiriencing compiling issues on Solaris 8 and Solaris 10 boxes with dovecot 1.2.6. On Solaris 8 the compiler is gcc 64bit 3.2.2, on Solaris 10 gcc 3.4.3. On both systems the compiling fails with: /bin/bash ../../libtool --tag=CC --mode=link gcc -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -L/opt/gcc-3.1-64bit/lib -R/opt/gcc-3.1-64bit/lib -L/usr/local/ssl/lib -R/usr/local/ssl/lib -L/opt/kerberos-heimdal/lib -R/opt/kerberos-heimdal/lib -o imap-login client.o client-authenticate.o imap-proxy.o ../login-common/liblogin-common.a ../lib-imap/libimap.a ../lib-auth/libauth.a ../lib/liblib.a -lssl -lcrypto -ldl -lrt -lnsl -lsocket -lrt libtool: link: gcc -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -o imap-login client.o client-authenticate.o imap-proxy.o -L/opt/gcc-3.1-64bit/lib -L/usr/local/ssl/lib -L/opt/kerberos-heimdal/lib ../login-common/liblogin-common.a ../lib-imap/libimap.a ../lib-auth/libauth.a ../lib/liblib.a -lssl -lcrypto -ldl -lnsl -lsocket -lrt -R/opt/gcc-3.1-64bit/lib -R/usr/local/ssl/lib -R/opt/kerberos-heimdal/lib Undefined first referenced symbol in file SSL_COMP_get_name ../login-common/liblogin-common.a(ssl-proxy-openssl.o) SSL_get_current_compression ../login-common/liblogin-common.a(ssl-proxy-openssl.o) ld: fatal: Symbol referencing errors. No output written to imap-login collect2: ld returned 1 exit status The configure script is the same on both systems: CPPFLAGS='-I/usr/local/ssl/include -I/opt/kerberos-heimdal/include' LDFLAGS='-L/usr/local/ssl/lib -R/usr/local/ssl/lib -L/opt/kerberos-heimdal/lib -R/opt/kerberos-heimdal/lib' ./configure --prefix=/opt/dovecot --with-ssldir=/usr/local/ssl/certs --with-ssl=openssl --without-passwd-file --with-passwd --with-shadow --without-bsdauth --without-static-userdb --without-prefetch-userdb --without-checkpassword --with-gssapi=yes --without-pgsql --without-sql --without-ldap --without-vpopmail --without-sia --enable-header-install Install prefix . : /opt/dovecot File offsets ... : 64bit I/O polling .... : poll I/O notifys .... : none SSL ............ : yes (OpenSSL) GSSAPI ......... : yes passdbs ........ : passwd shadow pam : -passwd-file -checkpassword -bsdauth -sia -ldap -sql -vpopmail userdbs ........ : passwd : -static -prefetch -passwd-file -checkpassword -ldap -sql -vpopmail -nss SQL drivers .... : : -pgsql -mysql -sqlite Version 1.2.4 compiles with no problems... regards, Jernej

7 10

[Dovecot] IMAP fchown failed: Operation not permitted
by Juergen Obermann 07 Oct '09

07 Oct '09

Hello, today I switched from dovecot 1.1.17 to 1.2.6 and since then the following new error messages appeared. To me they seems to be harmless, as I noticed no problems so far. But can I be sure? Oct 7 08:39:13 smail dovecot: [ID 583609 local0.error] IMAP(sv4073): fchown(/home/smailw9/sv4073/Mail/.imap/INBOX/dovecot.index.cache.lock, -1, 6(mail)) failed: Operation not permitted (egid=3229(smailw9), group based on /var/mail/sv4073) Oct 7 08:39:34 smail dovecot: [ID 583609 local0.error] IMAP(sv8785): fchown(/home/smail05/sv8785/Mail/.imap/INBOX/dovecot.index.cache.lock, -1, 6(mail)) failed: Operation not permitted (egid=3265(smail05), group based on /var/mail/sv8785) Oct 7 08:41:32 smail dovecot: [ID 583609 local0.error] IMAP(sv7662): fchown(/home/smailz6/sv7662/Mail/.imap/INBOX/dovecot.index.cache.lock, -1, 6(mail)) failed: Operation not permitted (egid=3256(smailz6), group based on /var/mail/sv7662) Oct 7 08:47:39 smail dovecot: [ID 583609 local0.error] IMAP(su8501): fchown(/home/smailt3/su8501/Mail/.imap/INBOX/dovecot.index.cache.lock, -1, 6(mail)) failed: Operation not permitted (egid=3193(smailt3), group based on /var/mail/su8501) Oct 7 08:49:22 smail dovecot: [ID 583609 local0.error] IMAP(sv2131): fchown(/home/smailv4/sv2131/Mail/.imap/INBOX/dovecot.index.tmp, -1, 6(mail)) failed: Operation not permitted (egid=3214(smailv4), group based on /var/mail/sv2131) Oct 7 08:49:22 smail dovecot: [ID 583609 local0.error] IMAP(sv2131): fchown(/home/smailv4/sv2131/Mail/.imap/INBOX/dovecot.index.cache.lock, -1, 6(mail)) failed: Operation not permitted (egid=3214(smailv4), group based on /var/mail/sv2131) Oct 7 08:51:22 smail dovecot: [ID 583609 local0.error] IMAP(sw2109): fchown(/home/smail23/sw2109/Mail/.imap/INBOX/dovecot.index.tmp, -1, 6(mail)) failed: Operation not permitted (egid=3283(smail23), group based on /var/mail/sw2109) Oct 7 08:51:22 smail dovecot: [ID 583609 local0.error] IMAP(sw2109): fchown(/home/smail23/sw2109/Mail/.imap/INBOX/dovecot.index.log.newlock, -1, 6(mail)) failed: Operation not permitted (egid=3283(smail23), group based on /var/mail/sw2109) Oct 7 08:51:22 smail dovecot: [ID 583609 local0.error] IMAP(sw2109): fchown(/home/smail23/sw2109/Mail/.imap/INBOX/dovecot.index.tmp, -1, 6(mail)) failed: Operation not permitted (egid=3283(smail23), group based on /var/mail/sw2109) Oct 7 08:56:53 smail dovecot: [ID 583609 local0.error] IMAP(sv2483): fchown(/home/smailv6/sv2483/Mail/.imap/INBOX/dovecot.index.cache.lock, -1, 6(mail)) failed: Operation not permitted (egid=3216(smailv6), group based on /var/mail/sv2483) Oct 7 08:57:42 smail dovecot: [ID 583609 local0.error] IMAP(sv2483): fchown(/home/smailv6/sv2483/Mail/.imap/INBOX/dovecot.index.tmp, -1, 6(mail)) failed: Operation not permitted (egid=3216(smailv6), group based on /var/mail/sv2483) Oct 7 08:57:42 smail dovecot: [ID 583609 local0.error] IMAP(sv2483): fchown(/home/smailv6/sv2483/Mail/.imap/INBOX/dovecot.index.log.newlock, -1, 6(mail)) failed: Operation not permitted (egid=3216(smailv6), group based on /var/mail/sv2483) This is a Solaris 9 system that acts as a NFS-Server for mailboxes in /var/mail and home directories under automounter control in /home/group/user. Thanks for any help. # 1.2.6: /opt/local/etc/dovecot.conf # OS: SunOS 5.9 sun4u syslog_facility: local0 protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/server.crt ssl_key_file: /etc/ssl/server.key disable_plaintext_auth: no version_ignore: yes login_dir: /opt/local/var/run/dovecot/login login_executable(default): /opt/local/libexec/dovecot/imap-login login_executable(imap): /opt/local/libexec/dovecot/imap-login login_executable(pop3): /opt/local/libexec/dovecot/pop3-login login_process_per_connection: no login_processes_count: 12 max_mail_processes: 4096 mail_location: mbox:~/Mail:INBOX=/var/mail/%u mmap_disable: yes mail_nfs_storage: yes mail_nfs_index: yes mail_executable(default): /opt/local/libexec/dovecot/imap mail_executable(imap): /opt/local/libexec/dovecot/imap mail_executable(pop3): /opt/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /opt/local/lib/dovecot/imap mail_plugin_dir(imap): /opt/local/lib/dovecot/imap mail_plugin_dir(pop3): /opt/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %08Xv%08Xu pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: private separator: / prefix: Mail/ hidden: yes list: no subscriptions: yes lda: postmaster_address: postmaster(a)hrz.uni-giessen.de auth default: passdb: driver: pam userdb: driver: passwd plugin: quota: fs:Home-Verzeichnis:noenforcing -- Hochschulrechenzentrum der | Mail: Juergen.Obermann(a)hrz.uni-giessen.de Justus-Liebig-Universitaet | WWW: http://www.uni-giessen.de/~g033 Heinrich-Buff-Ring 44 | Tel: 0641-99-13054 (0641-99-13001) D-35392 Giessen, Germany | Fax: 0641-99-13009

2 1

[Dovecot] Is it possible to authenticate against Active Direcotry using the whole e-mail?
by Δημήτριος Καραπιπέ ρης 07 Oct '09

07 Oct '09

Hi all! Is it possible to authenticate against Active Directory, using the whole e-mail address and not the user part (%n), so that if you support mutiple domains, all users should authenticate with their e-mail addresses. I use auth_bind_userdn = DOMAIN \ %u but somehow the *mail* attribute of Active/LDAP should be employed. thanks in advance Dimitrios Karapiperis

3 4

[Dovecot] Fwd: Re: "Time just moved backwards" in Dovecot in a Xen DomU
by Patrick Domack 07 Oct '09

07 Oct '09

Dunno, your email provider doesn't want to talk to me, heh, screw them :) They claim i'm on an rbl, no rbl checks verify this. Even tried to submit a request using their website, but it's broken and doesn't work (http://postmaster.ausics.net/pmg.php) ----- Forwarded message from patrickdk(a)patrickdk.com ----- Date: Tue, 06 Oct 2009 23:31:37 -0400 From: Patrick Domack <patrickdk(a)patrickdk.com> Subject: Re: [Dovecot] "Time just moved backwards" in Dovecot in a Xen DomU To: Noel Butler <noel.butler(a)ausics.net> yes, using a pool server for that isn't good. but atleast it will let us know if it's just an internet path, or ALL internet paths for him that is causing issues, as it should give a good random sampling. I have a few servers in the pool set to gigabit speeds. If people configure their settings correctly, the dsl/cable ones shouldn't get selected very often. And the pool servers aren't the cause of his issues, as he isn't using any pools servers. I think he has a network issue personally. Quoting Noel Butler <noel.butler(a)ausics.net>: > On Tue, 2009-10-06 at 23:08 -0400, Patrick Domack wrote: > > >> >> Jitter stops ntp from doing it's job properly. I'm not sure what is >> causing you jitter to be so bad, but it's caused by the delay amount >> changing from packet to packet. The delay should stay consistant (like >> a ping time). If it keeps bouncing all over the place, ntp can't >> figure out what time it really is, cause it doesn't know how long that >> packet was on the network. You can safely ignore offset, it is just >> how much different your clock is from what the other computer is. >> >> Try adding some of the pool servers in there, like: >> server 0.us.pool.ntp.org >> server 1.us.pool.ntp.org >> server 2.us.pool.ntp.org >> > > > this can also be the cause of it all, there is no QA on hosts in pools, > I've seen DSL and cable connected hosts in pools causing all sorts of > problems for some, I'm lucky enough to be in a position where we have > access to atomic servers so I can avoid all that, but most people are > not. > > > -- > Kind Regards, > Noel Butler > L.C.P #251002 (http://counter.li.org) > > ________________________________________________________________________ > This Email, including any attachments, may contain legally privileged > information, therefor remains strictly confidential and is protected > under Australian Laws and international treaties. You may not > disseminate or reveal any part to anyone without the authors express > written authority to do so. If you are not the intended recipient, > please notify the sender and delete all relevance of this message > including attachments immediately. Confidentiality and legal privilege > are not waived or lost by reason of the mistaken delivery of this > message. Only PDF or ODF documents are accepted, do not send Microsoft > proprietary formatted documents - see > http://www.gnu.org/philosophy/no-word-attachments.html > > ________________________________________________________________________ > ----- End forwarded message -----

2 1

Re: [Dovecot] Samba AD and Dovecot
by Timo Sirainen 07 Oct '09

07 Oct '09

Ccing mailing list, since I'm not all-knowing.. On Oct 7, 2009, at 12:49 AM, Trever L. Adams wrote: > Timo Sirainen wrote: >> On Oct 7, 2009, at 12:36 AM, Trever L. Adams wrote: >>> 1) I have seen how to configure for LDAP and Kerberos. AD uses both >>> together. All user information is in AD/LDAP and authentication is >>> AD/Kerberos. How can I configure Dovecot to use both appropriately? >> You could forget about the Kerberos part and just use AD as an LDAP >> server. > I really want to use kerberos/SPNEGO everywhere I can for various > reasons. The LDAP would be for the configuration. Do you actually want the IMAP/POP3 clients to use Kerberos? For plaintext auth I don't see any benefit in Dovecot using Kerberos rather than LDAP (and it doesn't support that, except via pam_kerberos or whatever I guess). But for clients to use Kerberos (GSSAPI) and authenticate against AD while Dovecot is in the middle... I've no idea. I guess that's possible somehow. >>> 2) For example if I have a directory /var/mail/domain/user. Can >>> I have Dovecot auto create (with proper permissions) the domain/user >>> part? These would be used for maildir. >> If you're using the same UNIX UID for all users, there's really >> nothing you need to do. Dovecot tries to create missing directories >> automatically. > No, I will be using the new Samba IDMAP stuff that hashes all the > parts > of the windows ID to a 32 bit UID. Anyway to do to this, or will I > need > to find another solution (not for mailing, but for directory > creation)? There's no great way to do this.. A couple of kludgy ways. Like chmod 01777 /var/mail. Or override mail_executable setting to a script that still runs as root and can create the directory with proper permissions. http://wiki.dovecot.org/PostLoginScripting

3 2

[Dovecot] Samba AD and Dovecot
by Trever L. Adams 07 Oct '09

07 Oct '09

Hello All, I haven't seen the answer to this, maybe I am just using the wrong searches. I have two queries related to this: 1) I have seen how to configure for LDAP and Kerberos. AD uses both together. All user information is in AD/LDAP and authentication is AD/Kerberos. How can I configure Dovecot to use both appropriately? 2) I can cause Samba to create certain directories on login, etc. However, I am needing to do this for Dovecot (and Postfix using Dovecot deliver). I would prefer to use Dovecot functionality for this, not Samba.This is not the autocreate folder/subscribe stuff, at least I think not. For example if I have a directory /var/mail/domain/user. Can I have Dovecot auto create (with proper permissions) the domain/user part? These would be used for maildir. Thank you, Trever Adams

2 1

[Dovecot] "Time just moved backwards" in Dovecot in a Xen DomU
by PGNet Dev 07 Oct '09

07 Oct '09

i've dovecot --version 1.2.5 hg log | grep changeset | head -n 1 changeset: 9407:a3e16df805e3 in my logs, i'm seeing ... Oct 05 16:51:40 dovecot: Error: Time just moved backwards by 1 seconds. I'll sleep now until we're back in present. http://wiki.dovecot.org/TimeMovedBackwards Oct 05 17:07:22 dovecot: Error: Time just moved backwards by 1 seconds. I'll sleep now until we're back in present. http://wiki.dovecot.org/TimeMovedBackwards Oct 05 17:23:15 dovecot: Error: Time just moved backwards by 1 seconds. I'll sleep now until we're back in present. http://wiki.dovecot.org/TimeMovedBackwards Oct 05 17:38:23 dovecot: Error: Time just moved backwards by 1 seconds. I'll sleep now until we're back in present. http://wiki.dovecot.org/TimeMovedBackwards ... i'm running Dovecot in a Xen DomU, uname -a Linux mail 2.6.27.29-0.1-xen #1 SMP 2009-08-15 17:53:59 +0200 x86_64 x86_64 x86_64 GNU/Linux reading @, http://wiki.dovecot.org/TimeMovedBackwards Bugs/Issues * With Xen you should run ntpd only in dom0. Other domains should synchronize time automatically (see this Xen FAQ). @ my Dom0, ps ax | grep ntp\.conf 5696 ? Ss 1:05 /usr/sbin/ntpd -p /var/run/ntp/ntpd.pid -g -u ntp:ntp -i /var/lib/ntp -c /etc/ntp.conf and, grep localtime /etc/xen/vm/mail.cfg localtime = 0 looking at my ntp logs around the same time(s). ... 5 Oct 16:41:17 ntpd[5696]: synchronized to 64.125.78.85, stratum 1 5 Oct 16:51:38 ntpd[5696]: time reset -2.140133 s 5 Oct 16:56:40 ntpd[5696]: synchronized to 66.220.9.122, stratum 1 5 Oct 17:01:28 ntpd[5696]: synchronized to 64.125.78.85, stratum 1 5 Oct 17:07:20 ntpd[5696]: time reset -2.137760 s 5 Oct 17:11:49 ntpd[5696]: synchronized to 204.152.184.72, stratum 1 5 Oct 17:15:01 ntpd[5696]: synchronized to 207.200.81.113, stratum 1 5 Oct 17:20:49 ntpd[5696]: synchronized to 66.220.9.122, stratum 1 5 Oct 17:23:14 ntpd[5696]: time reset -2.221749 s 5 Oct 17:27:57 ntpd[5696]: synchronized to 64.125.78.85, stratum 1 5 Oct 17:32:52 ntpd[5696]: synchronized to 207.200.81.113, stratum 1 5 Oct 17:38:22 ntpd[5696]: time reset -2.104476 s 5 Oct 17:42:48 ntpd[5696]: synchronized to 66.220.9.122, stratum 1 ... 1 second is not a terribly big deal, but it IS an error ... not clear to me as to what/where the problem actually is. i've not seen an other dameons report any time issues; of course, i'm not sure they're _checking_ :-/ any suggestions as to what/how to fix? thanks!

5 14