April 2009 - dovecot - dovecot.org

[Dovecot] Setup Question
by Jeff Grossman 17 Apr '09

17 Apr '09

I really want to try and get this plus addressing working correctly with Dovecot and Postfix. After doing some reading I think I am going to change my Postfix setup from mailbox_command to mailbox_transport. I have a few questions to make sure I am thinking correctly. All of my users are system users. Their mail is delivered directly to their "/home/<user>/Maildir" directory. Everything works great and I have no problems. Here is what I am thinking of doing. 1. Create a new vmail user and group. 2. Have all mail delivered for each user to the "/home/vmail/<user>/" directory. All mail will be owned by vmail, but that is okay since Dovecot is the only thing touching the mail files anyway. 3. Change the mail_location setting in dovecot.conf to "mail_location = /home/vmail/%u 4. Uncomment the auth_socket_path = /var/run/dovecot/auth-master setting in dovecot.conf 5. Switch Postfix's main.cf to use "mailbox_transport = dovecot" and put the following line in master.cf: 1. dovecot unix - n n - - pipe flags=DR user=vmail:vmail argv=/usr/local/libexec/dovecot/deliver -f ${sender} -d ${recipient} -n -m ${extension} 6. Copy the current users mail to the new vmail location. What is the best way to copy it preserving date and time stamps on the mail? Did I cover all of the steps are am I missing something? Here is a copy of my current dovecot -n output. Thanks for any help you can offer me. # 1.2.rc3: /usr/local/etc/dovecot.conf # OS: Linux 2.6.29-1-amd64 x86_64 Debian squeeze/sid base_dir: /var/run/dovecot/ protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/certs/ssl.crt ssl_key_file: /etc/ssl/private/ssl.key ssl_cipher_list: ALL:!LOW:!SSLv2 disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_location: maildir:~/Maildir mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd plugin: sieve: sieve

3 10

[Dovecot] Active Directory LDAP authentication fails after a time
by noahisaac 17 Apr '09

17 Apr '09

Hi - I've got Dovecot version 1.0.7 running on a CentOS 5.2 machine. It's serving pop, imap and imaps and authenticating against an Active Directory machine. This all works fine at first, but after about two weeks or so, dovecot's authentication against AD starts to fail. All of dovecot's authentication attempts time out. I also have postfix on the same machine authenticating against the same AD, and it does not seem to experience this issue. If I restart dovecot, the authentication starts working again. I've gone over /var/log/maillog, but I don't see anything particularly useful. The only thing I really see is: dovecot: IMAP(noah): Disconnected for inactivity Here's some of the relevant portions of my configs: dovecot.conf auth default { mechanisms = plain passdb ldap { args = /etc/dovecot-ldap.conf } passdb passwd-file { args = /etc/dovecot/passdb master = yes } userdb static { args = uid=vmail gid=vmail home=/home/vmail/%u } user = root } dovecot-ldap.conf hosts = admachine.domain.com base = dc=domain,dc=com ldap_version = 3 auth_bind = yes auth_bind_userdn = DOMAIN\%u Does anybody have any ideas about why this is happening, or maybe just an idea about how to better troubleshoot it? If you need any more info, I'll be happy to provide it. Can I tell dovecot to be a little more verbose with it's log entries (I've already got auth_debug set to yes, but I'm not getting very much info)? Thanks! Noah -- View this message in context: http://www.nabble.com/Active-Directory-LDAP-authentication-fails-after-a-ti… Sent from the Dovecot mailing list archive at Nabble.com.

4 3

[Dovecot] SELinux and "i_stream_read() failed: Permission denied"
by James Butler 17 Apr '09

17 Apr '09

Not a problem ... sharing a solution (this time)! Please correct my understanding of the process, if required. "i_stream_read() failed: Permission denied" is an error message generated when a large-ish file (>128kb in my case) is attached to a message that has been passed to Dovecot's deliver program when SELinux is being enforced. In my case, these messages are first run through Spamassassin, then passed to deliver, however the SELinux policy that is being violated relates to deliver, and not to Spamassassin, even though I do NOT generate the errors WITHOUT running Spamassassin. I'm not going to guess as to why that is. The policies below resolve the issue, and now large-ish (even LARGE) attachments come through without a whimper with Postfix+Spamassassin+Dovecot. The problem is that deliver is not running with the correct SELinux policy to be able to write to the global /tmp directory (in my case, after receiving the big attachment from SA), even if that directory's permissions allow it. (Bless you, SELinux!) Small-ish file attachments do not trigger this deliver functionality. Here's a complete error message, and its subsequent errors in the course of delivering a large-ish message+attachment: =================================================== deliver(user): unlink(/tmp/dovecot.deliver.. \ 1239836047.9469.46242b1037005551) failed: Permission denied deliver(user): copy: i_stream_read() failed: Permission denied deliver(user): read(mail, uid=1) failed: Permission denied deliver(user): read(mail, uid=1) failed: Permission denied deliver(user): msgid=: save failed to INBOX: Internal error occurred. \ Refer to server log for more information. [2009-04-15 17:54:07] =================================================== This is the final error series received before the policies were finally updated, and shows an error during deliver's attempt to "unlink()" (remove) the temporary file. Previous errors occurred during attempts to "stat()" and "creat()" (sic) the temporary files. Basically, the "dovecot_deliver_t" context needs to be able to create, read, write and remove files in the /tmp directory ("tmp_t" context). Below, I am pasting my "local_postfix.te" SELinux policy file. It includes instructions for using it, and for figuring out how to do other SELinux policy adjustments on your own. This is my COMPLETE Postfix+Dovecot SELinux policy group. I also have policies for Spamassassin, if anyone wants them. If you are running Sendmail or another MTA instead of Postfix, you can build on what you find below and establish your own policies. I hope this proves useful. Again, please feel free to correct any misunderstandings I may be promoting with this message. Use at your own risk, please! No guarantees ... it just worked, for me. James ## NOTE: I have broken lines in the following using the standard "\" notation to fix the email format better. However the local_postfix.te file should NOT have ANY lines broken. Remove my "\" notation and keep the lines together and you should be okay. ## ####### HOW TO USE THIS #################################################### # SELinux, Postfix, Dovecot # # SELinux needs help resolving Postfix+Dovecot context issues. # # This file + the following instructions should get you # # on your way to resolving the policies between those contexts. # # # # 1) Create this file with the data shown below: # # local_postfix.te # # 2) Compile this file: # # checkmodule -M -m -o local_postfix.mod local_postfix.te # # 3) Create SELinux policy package: # # semodule_package -o local_postfix.pp -m local_postfix.mod # # 4) Move policy package to normal SELinux modules directory: # # mv local_postfix.pp /etc/selinux/targeted/modules/active/modules/ # # 5) Update kernel with new policy package: # # semodule -i \ # # /etc/selinux/targeted/modules/active/modules/local_postfix.pp # # # # Test: Send mail from remote to this system. # # Check /var/log/maillog for mail errors and # # /var/log/messages & /var/log/audit/audit.log for more specific # # SELinux errors # # Also, SELinux will provide the command (sealert...) for more details # # Use the error info you see in messages (or sealert...) to create # # new entries in local_postfix.te, then re-compile, package # # and update the kernel. # # # # Alternately, you can use this to generate a .te file automatically # # from the SELinux errors displayed in /var/log/audit/audit.log (or # # from /var/log/messages IF you do NOT have audit installed): # # # # audit2allow -m local -l -i /var/log/audit/audit.log > local_postfix.te # # # # (This is also helpful if you can't guess the correct domain/policy to # # use from reading the error messages.) Take the new stuff from what # # audit2allow creates and add it to this file, then re-compile, package # # and update the kernel. # ############################################################################ module local_postfix 1.0; require { type admin_home_t; type bin_t; type default_t; type dovecot_t; type dovecot_deliver_t; type dovecot_deliver_exec_t; type dovecot_var_log_t; type etc_runtime_t; type fs_t; type home_root_t; type httpd_config_t; type httpd_t; type initrc_t; type postfix_etc_t; type postfix_local_t; type postfix_master_t; type postfix_postdrop_t; type postfix_postqueue_exec_t; type postfix_public_t; type postfix_pipe_t; type sendmail_t; type sendmail_exec_t; type src_t; type tmp_t; type usr_t; type user_home_dir_t; type user_home_t; type var_log_t; class capability { sys_nice chown }; class file { append create execute execute_no_trans \ getattr ioctl link lock read rename setattr write unlink }; class dir { add_name getattr create read remove_name \ rename write search setattr rmdir }; class fifo_file { getattr write }; class filesystem getattr; class sock_file write; class unix_stream_socket { connectto getattr read write }; } #============= dovecot_t =============== allow dovecot_t home_root_t:file { create getattr link lock \ read rename setattr unlink write }; allow dovecot_t home_root_t:dir { add_name create remove_name write }; #============= dovecot_deliver_t ============== allow dovecot_deliver_t tmp_t:dir getattr; allow dovecot_deliver_t fs_t:filesystem getattr; allow dovecot_deliver_t dovecot_var_log_t:file append; allow dovecot_deliver_t initrc_t:unix_stream_socket connectto; allow dovecot_deliver_t tmp_t:dir { add_name remove_name search write }; allow dovecot_deliver_t tmp_t:file { create read unlink write }; allow dovecot_deliver_t var_log_t:dir search; allow dovecot_deliver_t var_log_t:file append; #============ httpd_t ================= allow httpd_t postfix_etc_t:dir search; #============= postfix_local_t ============== allow postfix_local_t home_root_t:file { create getattr link unlink write }; allow postfix_local_t admin_home_t:dir { create read write }; allow postfix_local_t home_root_t:dir { add_name create remove_name write }; allow postfix_local_t clamd_var_lib_t:dir { add_name create remove_name \ rename setattr write read }; allow postfix_local_t clamd_var_lib_t:file { create link lock read rename \ getattr setattr unlink write }; allow postfix_local_t home_root_t:dir { rename setattr }; allow postfix_local_t self:capability { sys_nice chown }; allow postfix_local_t sendmail_exec_t:file { read execute ioctl \ execute_no_trans }; allow postfix_local_t spamc_exec_t:file { execute execute_no_trans \ getattr read }; allow postfix_local_t usr_t:file { append execute execute_no_trans \ read getattr write }; allow postfix_local_t default_t:file { create getattr read write }; allow postfix_local_t default_t:dir { add_name remove_name search write }; allow postfix_local_t user_home_dir_t:file { read write getattr rename }; #============= postfix_master_t =============== allow postfix_master_t src_t:dir search; #============= postfix_pipe_t ============== allow postfix_pipe_t bin_t:file { execute execute_no_trans read }; allow postfix_pipe_t postfix_public_t:sock_file write; #============= postfix_postdrop_t =============== allow postfix_postdrop_t initrc_t:fifo_file { write getattr }; allow postfix_postdrop_t postfix_local_t:unix_stream_socket { getattr \ read write }; allow postfix_postdrop_t user_home_t:file append; #============= sendmail_t ============== allow sendmail_t postfix_local_t:fifo_file { getattr write }; allow sendmail_t postfix_postqueue_exec_t:file { execute \ execute_no_trans read };

2 6

[Dovecot] UW-IMAP migration to namespaces
by Jernej Porenta 17 Apr '09

17 Apr '09

Hello, I am trying to migrate existing UW-IMAP installation to dovecot 1.1.14 and I am having troubles with namespaces. As you know UW-IMAP allows full system access to home directory of a user and you can set up dovecot to do that as well, but I would like to use namespaces. If I set my namespaces like this: namespace private { separator = / prefix = inbox = yes location = mbox:~/:INBOX=~/.mailbox hidden = yes list = yes } namespace private { separator = / prefix = mail/ location = mbox:~/mail prefix = mail/ hidden = yes } Everything is working fine, but I am seeing also all other files in home directory of a user, but this is annoying if you have users with public_html folder with millions of files in it. Dovecot indexing makes index.log file for every file seen in namespace, so you have several million index files for files that are not mailboxes. So I was wondering is there a way to skip certain directories in namespaces or a way to setup namespaces in a way, that you would have: - INBOX in home directory - some folders in home directory (via .subscriptions) - some folders in %h/mail/ directory - and not seeing all other files/directories in home dir Thanks in advance, regards, Jernej

2 1

[Dovecot] Multiple instances and/or separate certificates per email address
by Simon L Jackson 17 Apr '09

17 Apr '09

Hi, We have a mail server with multiple instances of Postfix each listening on a different IP address to create a set of virtual mail servers. There are various reasons why separate instances of Postfix seems to work best to achieve this goal, but I wont divert into that discussion here. I would like so match this with Dovecot. The listening side isn't a problem as Dovecot can listen on multiple explicit IP addresses. However, we would prefer a separate SSL certificate for each virtual mail server i.e. for each IP address. Would it be better to have multiple instances of Dovecot on the server (not sure what the issues might be with this) or would it be better/easier to be able to specify separate SSL certificates for each listen address, since there isn't any other reason I can see to have multiple instances. Any thought? Is there a way to do this now or would this be a new feature request? Cheers -- Simon L Jackson Carringbush.Net +- Carringbush.Net Hosting * Development * Advice Web: www.carringbush.net <http://www.carringbush.net/> Email: simon.jackson(a)carringbush.net <mailto:simon.jackson@carringbush.net> Office: +61 3 9411 4400 Support: +61 3 9411 4444 Fax: +61 3 9411 4499 Level 1 15 Bedford Street Collingwood VIC 3066 Australia P.O. Box 1464 Collingwood VIC 3066 Australia +-

2 1

Re: [Dovecot] v1.1.14 and v1.2.rc3 released
by Wolfgang.Friebel＠desy.de 17 Apr '09

17 Apr '09

I was already going to report a bug with rc2 where the server crashed when a client tried to access a Maildir folder with wrong permissions. After installation of rc3 the server correctly reports the wrong permissions and keeps running: IMAP(user1): stat(/var/spool/mail/user1/Maildir/tmp) failed: Permission denied (euid=12807(user1) egid=200(grp1) missing +x perm: /var/spool/mail/user1/Maildir) Great work, thanks Timo! -- Wolfgang Friebel Deutsches Elektronen-Synchrotron DESY Phone/Fax: +49 33762 77372/216 Platanenallee 6 Mail: Wolfgang.Friebel AT desy.de D-15738 Zeuthen Germany

1 0

[Dovecot] v1.1.14 and v1.2.rc3 released
by Timo Sirainen 17 Apr '09

17 Apr '09

http://dovecot.org/releases/1.1/dovecot-1.1.14.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.14.tar.gz.sig http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc3.tar.gz http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc3.tar.gz.sig Fixed lots of bugs in v1.2 related to shared mailboxes and virtual mailboxes. Keep on testing and sending bug reports and hopefully we'll get v1.2.0 release out soon. :) Also v1.3 branch has started and it's coming along nicely. Multi-dbox is working and looks like its performance is very nice. LMTP server is basically implemented, except master process doesn't start it. Adding the master code started becoming so annoying that I think I'll finally finish the master process rewrite, or at least the most important parts of it. So looks like v1.3 might become v2.0 after all. v1.1.14 2009-04-16 Timo Sirainen <tss(a)iki.fi> * IMAP: Don't allow APPEND to specify INTERNALDATE more than 2 hours into future. With Maildir future INTERNALDATEs may mess up incremental backups. - Date: header was always being added to cache file when saving messages, even if clients didn't really want it. This caused POP3-only users to have dovecot.index.cache file unneededly. - Character set conversion in specific mails may have caused Dovecot to allocate all the available memory (in default configuration dying after having allocated 256 MB). This happened only while searching messages. - Message address parser didn't handle empty group:; correctly. - imap/pop3-login: Don't crash when shutting down and destroying clients. - deliver wasn't using mail_access_groups setting. - mbox: When doing autodetection, if mbox didn't find an existing mail directory it just went and created it anyway, instead of failing the storage creation. - Fixed some error handling in maildir and index code. v1.2.rc3 2009-04-16 Timo Sirainen <tss(a)iki.fi> * IMAP proxy no longer simply forwards tagged reply from remote authentication command. It's now done only if the remote server sent a [resp-code], otherwise all failure strings are converted to Dovecot's "Authentication failed." to make sure that if remote isn't using Dovecot it won't reveal user's existence. + Quota roots can now specify which namespace's quota they're tracking. This is probably the most useful for giving public namespaces a quota. + Added imap_idle_notify_interval setting. - Fixes to shared mailbox handling - Fixes to virtual mailboxes - Fixed compiling with some FreeBSD and NetBSD versions - THREAD REFS still might have returned one (0) at the beginning. - deliver wasn't using mail_access_groups setting. - Fixed some error handling in maildir and index code.

2 1

[Dovecot] Postfix, Dovecot SASL and Entourage smtps authentication fails.
by Mart Pirita 17 Apr '09

17 Apr '09

Tere. Recently just migrated from Sendmail 8.14.3 to Postfix 2.5.6 and switched from Cyrus-sasl 2.1.22 to Dovecot 1.1.13 sasl, all are compiled from source and I have used Dovecot for a long time, since alpha versions. Everything worked well for Outlook Express, Outlook and Thunderbird clients, but Microsoft Entourage 2004 or 2008 clients smtps fails - "Authentication failed because Entourage doesn't support any of the available authentication methods." Similar case like - http://archives.neohapsis.com/archives/postfix/2008-09/thread.html#145 I tried everything, the config is like described in Postfix and Dovecot sites - http://wiki.dovecot.org/HowTo/PostfixAndDovecotSASL I also tried in main.cf smtpd_sasl_security_options =forward_secrecy like described in http://www.postfix.org/postconf.5.html#smtpd_sasl_security_options But none helped. So I switched back to Cyrus-sasl and Entourage works well like before with sendmail. I started to search what may be the reason, and seems with Dovecot sasl Postfix wont advertise needed stuff in ehlo: With Cyrus: telnet localhost 25 Trying 127.0.0.1... Connected to localdomain.localhost. Escape character is '^]'. 220 my.host.ee ESMTP EHLO example.com 250-my.host.ee 250-PIPELINING 250-SIZE 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN starttls 220 2.0.0 Ready to start TLS With dovecot: telnet localhost 25 Trying 127.0.0.1... Connected to localdomain.localhost. Escape character is '^]'. 220 my.host.ee ESMTP EHLO example.com starttls 220 2.0.0 Ready to start TLS Setting with Cyrus in main.cf smtpd_tls_auth_only = no gives even more but still nothing with Dovecot: telnet localhost 25 Trying 127.0.0.1... Connected to localdomain.localhost. Escape character is '^]'. 220 my.host.eeESMTP EHLO example.com 250-my.host.ee 250-PIPELINING 250-SIZE 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN So is this a Entourage or Dovecot or Postfix bug? I really like to drop the Cyrus and use only Dovecot sasl. Any hint is welcome. -- Mart

3 15

[Dovecot] public folders question
by Xueron Nee 17 Apr '09

17 Apr '09

Hi, Shared folders is ok now. and when I create a public folder follow the doc http://wiki.dovecot.org/SharedMailboxes/Public, I can not get the boxes listed. namespace: type: public separator: / prefix: public/ location: maildir:/home/data/public:INDEX=~/Maildir/public list: children # ls /home/data/public/ -a . .. dovecot-shared .test1 .test2 .test3 And then, I checked the shared folders created by 'setacl' command, and add a dovecot-acl-list file in the root public folder, ok, I got it. # cat /home/data/public/dovecot-acl-list 1239108915 test1 so, 'dovecot-acl-list' should be created manually or any other methods? Thanks! -- Xueron Nee http://www.xueron.com

2 1

[Dovecot] Is there any more detailed docs about dict configuration
by Xueron Nee 17 Apr '09

17 Apr '09

Hi, I am looking for some help on dict configration. I'm trying to config shared and public mailbox, and use sql as acl backend. Here is my config: table: CREATE TABLE `shared_dict` ( `id` int(10) NOT NULL AUTO_INCREMENT, `from_user` char(50) NOT NULL, `to_user` char(50) NOT NULL, `status` int(10) NOT NULL DEFAULT '1', PRIMARY KEY (`id`), KEY `from_user` (`from_user`), KEY `to_user` (`to_user`) ) dovecot-dict-sql.conf map { pattern = shared/shared-boxes/user/$from/$to table = shared_dict value_field = status fields { from_user = $from to_user = $to } } dovecot.conf acl_shared_dict = proxy::shared_dict It works, and when i use 'setacl', it can add a record. All I want are some more detailed docs about the `pattern' line, and such as how to add a `group' function. :) Detailed on quota/expire dict configration are welcome, too. :) Thanks! -- Xueron Nee http://www.xueron.com

3 8