March 2009 - dovecot - dovecot.org

[Dovecot] how to handle CA CRL updates with client certificate verification context ?
by Raphael PRECIGOUT 13 Mar '09

13 Mar '09

Hello, As far as I can read in the Dovecot SSL configuration wiki page, each CA cert must be followed by the related CA CRL in the client certificate verification context ("ssl_ca_file" setting). In my company we do have our own PKI and as soon as Client certificate is compromised we do revoke it and update the related CA's CRL. Does that mean that I have to issue a new "ssl_ca_file" file as soon as our issuing CA CRL is updated ? If yes, does someone has an idea on how to do so ? Is it then necessary to restart dovecot process (to take the "ssl_ca_file" file changes into account) ? Does Dovecot have a way to check the issuing CA CRL automatically ? (the CRL is published in DER format and is accessible though http, the URI is mentionned in the CRL Distribution points of the CA certificate) Thanks in advance for your help. Regards, Raphael

2 1

[Dovecot] Problem with sasl auth with postfix...
by Douglas M. Stanley 13 Mar '09

13 Mar '09

Hello list, I'm running into some problems, and I couldn't find any info about this anywhere on the net. I recently set up a new debian lenny machine, and used my notes from the last debian etch machine I set up, which basically is for postfix + dovecot for sasl auth. On my old etch box, in the dovecot.conf, in the auth default section, I have a socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } However, if I use the same config on my lenny setup, dovecot fails to start, and I see this in my logs: Mar 13 19:16:30 mailserver dovecot: Dovecot v1.0.15 starting up Mar 13 19:16:30 mailserver dovecot: auth(default): User doesn't exist: postfix Mar 13 19:16:30 mailserver dovecot: Auth process died too early - shutting down Mar 13 19:16:30 mailserver dovecot: child 4623 (auth) returned error 89 Now if I comment out the user and group lines, it works fine, but the socket is owned by root, and so I have to change the mode line so that it's world readable in order for postfix to use it. The version of dovecot in etch is: 1.0.rc15-2etch4 and the version in lenny is: 1.0.15-2.3 Any ideas why this might be happening? Did the syntax to do this change between those versions? Any input? I guess I don't mind leaving it world readable, but I wasted an entire morning trying everything to get it to work, so I guess I'm hoping some one atleast has an answer as to why it doesn't work. Thanks, Doug

3 5

[Dovecot] Using LDAP for Dovecot extra/regular fields
by Jack Stewart 13 Mar '09

13 Mar '09

Hi, We're moving to a dovecot proxy / server configuration in order to make sure that a users go to a specific server. If someone has used these LDAP for this, there are a few things that I wish to verify. Dovecot does not verify that type of the LDAP attribute, only that the returned value works. If a boolean is used for a yes/no field, then FALSE sets the field to no and TRUE sets the field to yes. If a multivalue attribute is used for a single value field, the last returned value for the LDAP lookup is used in that field (i.e. host will use the last value). If a string attribute is returned for a yes/no field and has any value, then the associated field is set to true. There is no automatic failover with the host field so if the remote host is down, the IMAP connection no longer works. I'm fairly sure of all of these except for the boolean. Now this is just due diligence. I don't know that turning on/off or switching LDAP attributes is the right way to go to handle failover but it might work for phased rollout. My feeling is the best configuration will be using a secondary IP address that has to be manually turned on for a host after a reboot or shutdown. This creates a poor mans "fencing". The secondary can either be brought up on another host or handled via a load balance with DSR/backup server. As a practical matter, it is probably worth setting sensible attributes for each field (i.e. numeric for host, boolean for proxy/proxy_maybe etc). Any interest in registering an LDAP object class for dovecot? ---Jack

2 2

[Dovecot] Maildir dirty syncs
by Timo Sirainen 13 Mar '09

13 Mar '09

http://dovecot.org/patches/1.1/maildir-dirty-syncs.diff This patch adds a new maildir_very_dirty_syncs setting. If set to "yes", Dovecot assumes it's the only one changing the cur/ directory (so other MDAs can add mails to new/ without problems). This makes it possible to avoid rescanning the cur/ directory all the time looking for filenames. It also looks like (in stress testing) it still scans the cur/ directory unneededly in some situations, but it shouldn't be common. Maybe I'll look into it some day to see why. I'd be interested in hearing how large performance benefits it gives, if any. If they're big I could consider adding it to v1.1.12. If they're pretty much irrelevant I probably won't even bother adding the code to v1.2. I guess you mainly see the performance benefits with large/huge mailboxes.

4 5

[Dovecot] General approach question - am I doing this the right way?
by Alan Bates 13 Mar '09

13 Mar '09

Quick outline of my current working setup: I'm running dovecot 1.0.5 as an IMAP mail server on my ubuntu home server, which i connect to with my phone and several other machines to check my mail etc. i use getmail to collect mail from my various pop accounts. getmail filters the mail using spamassassin via a Filter_external, before moving it to my Maildir on the home server. Then when I connect to the home server from my various machines, IMAP manages the status of all the mail, so unread messages are common etc. All works very nicely. However I'd like to fix a minor annoyance... ...Spamassassin marks mail as SPAM but the mail client has to do the job of moving it to the Junk folder. I'd like the mail to be filtered on the home server on receipt. Am I just making things really complicated for myself? Is there a simpler setup for what I'm trying to do? Thanks in advance for any thoughts or suggestions

4 6

Re: [Dovecot] Imap logout message on Dovecot restart
by RutgerM 13 Mar '09

13 Mar '09

> On Thu, 2009-03-12 at 21:50 +0100, RutgerM wrote: >> #!/bin/sh >> unset LOG_TO_MASTER >> export USE_SYSLOG=1 >> exec /usr/lib/dovecot/imap >> >> But this logs the user that runs the script into the imap server and >> when >> I terminate this terminal I get a "Disconnected" message for the local >> linux user, which I don't need of course. > > I don't really understand what you mean by this. It should log > everything the exact same way, except directly to syslog. This is not happening indeed. I get a IMAP screen where I can do LIST commands and so on. This happens when I execute imap. >> Is there a way to get to what I want ? I want to log my IMAP statics for >> every day and I need to "disconnect" my imap clients for it in some way >> to >> receive the Disconnected message and count from there. > > Actually I just realized there is a simple way: > > killall imap > This solution also works great indeed. But I still would like to know why the exec way doesn't work.

1 0

[Dovecot] Extremely custom mailbox locations
by Steve Kemp 13 Mar '09

13 Mar '09

I'm in the position where I'd like to offer IMAP access to a collection of email accounts which are stored in a very odd manner. Files are stored as: /blah/$dd-$mm-$yy/$domain/1234/1234 For example: /reject/12-3-2009/cvsrepository.org/35199/35199639 There is a single file for each mail, which I guess technically probably counts as an mbox folder, but only just. I can handle the custom login requirements I have, but I see no obvious way to create a mailstore from this information unless I build up a parallel symlink farm, such as: /imap/cvsrepository.org/{new cur tmp} I suspect if I fill cur/ with symlinks to each of the individual messages things will mostly work out OK, but I wonder if that is the best solution, or if there is a slim chance that I could serve this hierarchy without the intermediate step? Steve -- Debian GNU/Linux System Administration http://www.debian-administration.org/

4 6

[Dovecot] which architecture to use?
by GVG GVG 13 Mar '09

13 Mar '09

Dear List, Based on the following installed environment: - OpenBSD (latest version!) - PostgreSQL - dovecot with SSL would like to have a mail server which accepts system as well as virtual users and being able to connect to their mailboxes either via an MUA (Thunderbird etc.) or a web interface (squirrel mail?). When using the web interface, non registered users should be able to creat e-mail accounts which will be dovecot virtual users! Which components should I use? Thanks

6 12

[Dovecot] Sieve - Backtrace after deliver(brabax): Panic: file sieve-cmu.c: line 264 (part_save): assertion failed: (buf->used - 1 == part->body_size.physical_size)
by brabax2 13 Mar '09

13 Mar '09

Hello, It's my first mailserver I set up. Thanks to everybody who contributes to dovecot. Dovecot works great for me! One thing I want to get rid off is this traceback error using dovecot with sieve. Somebody can help on this? System: Ubuntu server 8.10 dovecot --version 1.1.4 I filter for keywords in mail body with sieve. Mail is stored at lokal harddrive. I already deleted dovecot.index.cache - no success. Here is what logs say: sudo dovecot -n # 1.1.4: /etc/dovecot/dovecot.conf log_timestamp: %Y-%m-%d %H:%M:%S login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login mail_privileged_group: mail mail_location: maildir:~/Maildir auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth-client mode: 432 user: postfix group: postfix /var/syslog Mar 10 22:19:01 aquarius /USR/SBIN/CRON[23838]: (root) CMD (/etc/webmin/fetchmail/check.pl --owner --errors) Mar 10 22:19:04 aquarius deliver(brabax): Panic: file sieve-cmu.c: line 264 (part_save): assertion failed: (buf->used - 1 == part- >body_size.physical_size) Mar 10 22:19:04 aquarius deliver(brabax): Raw backtrace: /usr/lib/dovecot/deliver [0xb8068e01] -> /usr/lib/dovecot/deliver(i_syslog_fatal_handler+0x38) [0xb8068ee8] -> /usr/lib/dovecot/deliver [0xb8068695] -> /usr/lib/dovecot/modules/lda/lib90_cmusieve_plugin.so [0xb7e394b6] -> /usr/lib/dovecot/modules/lda/lib90_cmusieve_plugin.so [0xb7e3ac24] -> /usr/lib/dovecot/modules/lda/lib90_cmusieve_plugin.so [0xb7e43b34] -> /usr/lib/dovecot/modules/lda/lib90_cmusieve_plugin.so [0xb7e43e13] -> /usr/lib/dovecot/modules/lda/lib90_cmusieve_plugin.so(sieve_eval_bc+0x47e) [0xb7e4533e] -> /usr/lib/dovecot/modules/lda/lib90_cmusieve_plugin.so(sieve_execute_bytecode+0x125) [0xb7e4b4d5] -> /usr/lib/dovecot/modules/lda/lib90_cmusieve_plugin.so(cmu_sieve_run+0x325) [0xb7e3a785] -> /usr/lib/dovecot/modules/lda/lib90_cmusieve_plugin.so [0xb7e38456] -> /usr/lib/dovecot/deliver(main+0x1229) [0xb7ff2c39] -> /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xb7e6b685] -> /usr/lib/dovecot/deliver [0xb7ff0531]

1 0

[Dovecot] 1.1.12 release candidate
by Timo Sirainen 13 Mar '09

13 Mar '09

http://dovecot.org/tmp/dovecot-1.1.12.rc.tar.gz I would have already released 1.1.12, but it needed the MAILBOXDIR change described below, and I'm slightly worried that it might have broken some special setup. So please test first and I'll release in v1.1.12 then in a few days. * Added :MAILBOXDIR= to mail_location to specify the root dir for mailboxes. dbox users should migrate to ":MAILBOXDIR=mailboxes", because that's going to be the default in v1.2+. - IMAP: SELECT didn't always return first unseen message in reply - POP3: pop3_lock_session=yes didn't use mail_privileged_group while dotlocking. - mbox: Don't crash if >=8192 bytes long line begins with "From ". - Maildir: More fixes to handling over 26 keywords. - Several logging fixes and improvements - Fixed authentication caching with non-plaintext mechanisms when using a blocking passdb (e.g. MySQL) - Fixed DIGEST-MD5 authentication with user@domain style usernames.

1 0