May 2009 - dovecot - dovecot.org

[Dovecot] [PATCH, RFC] add APOP authentication mechanism
by Andrey Panin 13 Aug '17

13 Aug '17

Hello all, this patch add APOP authentication mechanism to dovecot 1.0-test23. Please take a look. Best regards. -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

3 2

[Dovecot] Can't connect to auth server
by Phill Edwards 13 Feb '11

13 Feb '11

I'm trying to phase out procmail and move to dovecot-sieve instead. It ain't proving easy. I'll describe my setup: - Centos 5.2 box with dovecot 1.1.4 and dovecot-sieve 1.1.6 from ATrpms. - A single user account is used to store all our email (the account is called maildb). - Getmail is being used to fetch the email from various ISP mailboxes. I want to deliver mail to different folders in maildb's Maildir/ depending on who the email is addressed to (the procmail recipes currently do that). - Getmail destination section looks like this: [destination] type = MDA_external path = /usr/libexec/dovecot/deliver arguments = ("-d", "maildb") allow_root_commands = true - When I run getmail I get this error in dovecot.log: deliver(maildb): May 04 22:15:26 Error: Can't connect to auth server at /var/run/dovecot/auth-master: No such file or directory It's true that I don't have a file called auth-master. I guess I should have but until I started this dovecot-sieve work it was never a problem. I have no idea what that file should look like. As I installed from binary RPMs I would have thought one would have come with the install. Can anyone help? Regards, Phill

4 6

[Dovecot] Missing return-path on vacation messages
by Stephen Vaughan 30 Jul '09

30 Jul '09

Hi, I can see this has been discussed previously, was just wondering if it's been fixed in v1.1.x? -- Best Regards, Stephen

3 11

[Dovecot] Dovecot broken with newer OpenSSL
by Brad 27 Jul '09

27 Jul '09

After updating my system from OpenSSL 0.9.8j to 0.9.8k Dovecot has stopped functioning properly with TLS sessions. The version of Dovecot does not seem to matter as I tried 1.1.11 - 1.1.14. Other programs using SSL/TLS such as Postfix and lightty still work fine when built with the newer release of OpenSSL. The IMAP client doesn't matter. For the time being I have gone back to .13 linked against older OpenSSL. In the logs I see messages like the following... dovecot: Apr 16 23:12:18 Info: imap-login: Disconnected (no auth attempts): rip=2001:470:b01e:3:216:41ff:fe17:6933, lip=2001:470:1d:8c::2, TLS handshaking: Disconnected -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

5 16

[Dovecot] imaptest build problems
by Scott Haneda 26 Jul '09

26 Jul '09

I am not sure this is the correct list, please forgive if it is not, and point me in the right direction. I downloaded the latest http://www.imapwiki.org/ImapTest/Installation from http://dovecot.org/nightly/imaptest/imaptest-latest.tar.gz cd imaptest-20090401 $./configure checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Here is the config log http://dl.getdropbox.com/u/340087/Drops/05.28.09/config-4d3972ab-233922.log Some tests: $date Thu May 28 23:37:13 PDT 2009 $ls -lt total 2688 -rw-r--r--@ 1 me staff 4552 May 28 23:37 config.log drwxr-xr-x@ 28 me staff 952 May 28 23:33 src -rw-r--r--@ 1 me staff 27278 Mar 31 19:04 ChangeLog -rw-r--r--@ 1 me staff 1456 Mar 31 19:04 imaptest-config.h.in -rw-r--r--@ 1 me staff 19599 Mar 31 19:04 Makefile.in -rwxr-xr-x@ 1 me staff 671381 Mar 31 19:04 configure -rw-r--r--@ 1 me staff 262586 Mar 31 19:04 aclocal.m4 -rw-r--r--@ 1 me staff 925 Mar 31 19:04 configure.in -rw-r--r--@ 1 me staff 38 Jul 12 2008 AUTHORS -rw-r--r--@ 1 me staff 211 Jul 12 2008 COPYING -rw-r--r--@ 1 me staff 26536 Jul 12 2008 COPYING.LGPL -rw-r--r--@ 1 me staff 145 Jul 12 2008 Makefile.am -rw-r--r--@ 1 me staff 9498 Dec 2 2007 INSTALL -rwxr-xr-x@ 1 me staff 15936 Dec 2 2007 depcomp -rwxr-xr-x@ 1 me staff 9233 Dec 2 2007 install-sh -rwxr-xr-x@ 1 me staff 11014 Dec 2 2007 missing -rw-r--r--@ 1 me staff 0 Dec 2 2007 NEWS -rw-r--r--@ 1 me staff 0 Dec 2 2007 README -rw-r--r--@ 1 me staff 0 Dec 2 2007 stamp.h.in -rwxr-xr-x@ 1 me staff 42037 Jan 7 2007 config.guess -rwxr-xr-x@ 1 me staff 30253 Jan 7 2007 config.sub -rw-r--r--@ 1 me staff 198422 Jan 7 2007 ltmain.sh -- Scott * If you contact me off list replace talklists@ with scott@ *

2 5

[Dovecot] Problems with ioloop on MacOS
by David Abrahams 26 Jul '09

26 Jul '09

I've been using the macports version of dovecot, which is 1.1.11, on MacOS 10.5.6 $ /opt/local/sbin/dovecot --exec-mail imap Fatal: kevent(EV_ADD, 0) failed: Operation not supported This version is configured --with-ioloop=kqueue The problem seems to be known, if not understood: http://lists.apple.com/archives/Darwin-userlevel/2008/Dec/msg00010.html However, if I use --with-ioloop=poll, I eventually get IMAP(dave): [9079]: invalid I/O fd 0, callback 0x9330 (not from the above command; it's a little later when Gnus tries to interact with dovecot through the shell) I've been unable to build/install any later versions of dovecot on MacOS. autogen.sh fails like this: ... glibtoolize: putting auxiliary files in `.'. glibtoolize: copying file `./ltmain.sh' glibtoolize: Consider adding `AC_CONFIG_MACRO_DIR([m4])' to configure.in and glibtoolize: rerunning glibtoolize, to keep the correct libtool macros in-tree. glibtoolize: Consider adding `-I m4' to ACLOCAL_AMFLAGS in Makefile.am. configure.in:281: installing `./config.guess' configure.in:282: required file `./config.rpath' not found configure.in:281: installing `./config.sub' configure.in:5: installing `./install-sh' configure.in:5: installing `./missing' src/auth/Makefile.am: installing `./depcomp' autoreconf: automake failed with exit status: 1 -- Dave Abrahams BoostPro Computing http://www.boostpro.com

2 1

[Dovecot] v3.0 architecture
by Timo Sirainen 15 Jul '09

15 Jul '09

I just had a thought. It's probably going to be too big of a change for v2.0, so something to think about for v3.0: Supporting multiple UIDs is difficult. Currently expire-tool and v2.0's LMTP server are implemented in a way that it's always running as root and only temporarily dropping privileges. So any security hole in there gives the attacker root privileges. Not very nice. With a single UID it's possible (or will be) to just use that one UID for the process without running as root. User sharing mailboxes to another user with different UID is even more difficult. Currently the only practical way to implement this is to assign read-write permissions to some group and have all mail files owned by that group. Not very nice. Sharing mailboxes between users located in different servers is impossible if the disk isn't somehow shared. All of these can be solved the same way: 1. imap, pop3, lmtp, etc. processes will be running without any privileges, very much like imap/pop3-login nowadays. Nobody-chrooted to empty directory. 2. Create storage processes that are started as needed. They can be configured in different security/performance settings: One storage process per user, one storage process per UID, setuid-root style shared storage process for multiple UIDs. 3. Mail processes talk to storage processes via some protocol. They can talk via UNIX socket or TCP/IP. If an existing connection can't handle the target UID, a new connection is made that either reuses an existing storage proces or creates a new one. 4. IMAP can finally implement truly simultaneously running queries (where it makes sense) by creating more storage processes if existing ones are busy handling longer-running commands. This also allows using the same storage process for multiple simultaneous IMAP connections and mail deliveries (and etc). The storage processes can also hang around and keep mailboxes open after all connections have closed it (dynamically figured out when it makes sense) to handle webmail clients that create lots of short-living connections or POP3 clients who poll for new mail every minute. The big problem is what the protocol should be. Use some existing RPC protocol? It should be something extensible so that a plugin in imap process can talk to a plugin in storage process, without the base processes knowing anything about the details (e.g. imap-quota plugin asking quota usage from storage's quota plugin). In any case the client side API should be asynchronous. That can make it annoyingly difficult to use though. Wonder if I could switch to erlang or something for the imap/pop3 processes :)

9 13

[Dovecot] Can expire-tool skip folders with "expire time in future" errors?
by Ralph Seichter 10 Jul '09

10 Jul '09

Hi folks, when I run expire-tool, I often see messages like the following: # dovecot --exec-mail ext /usr/libexec/dovecot/expire-tool Info: user/Trash: stop, expire time in future: Fri May 22 17:42:23 2009 the server's dovecot.conf contains the following line: expire = Trash 2 Junk 7 */News 30 */Reports 7 >From what I observe, an error of "expire time in future" in one of the Trash folders stops expire-tool alltogether, meaning that remaining folders like News or Reports don't get processed at all? Is this interpretation correct? If so, can I convince expire-tool to skip errors and continue processing other folders? -R

4 23

[Dovecot] GSSAPI cross-realm fixed
by Bryan Jacobs 07 Jul '09

07 Jul '09

Attached is a patch which in my environment (Linux/Heimdal 1.2.1) fixes cross-realm GSSAPI authentication. Changes it makes: 1. When using krb5_kuserok, do not call gss_compare_name to check that authn_name and authz_name are the same. Instead, make TWO calls to krb5_kuserok, one for each ID. If both IDs are acceptable, allow the login. 2. Disable checking that the name is a GSS_KRB5_PRINCIPAL_NAME, as this doesn't appear to be always the case for the authz_name. If I create a .k5login listing both username@REALM1 and username@REALM2, and make that file follow the appropriate security restrictions (world read, user only write permissions), this lets me use GSSAPI logins with principals from either REALM1 or REALM2. This leaves untouched the behavior in the case where krb5_kuserok is not available. Bryan Jacobs

2 3

[Dovecot] Connecting to dovecot
by Grant Lowe 06 Jul '09

06 Jul '09

Hi All, I've got a brand new dovecot installation. I'm new to dovecot, so please be gentle :-) Anyway, I'm getting some errors when I try to connect to dovecot. I've tried searching the web and haven't been able to find a lot of information. Here's the config info: # dovecot --version 1.1.2 # dovecot -n sudo dovecot -n # 1.1.2: /usr/local/etc/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot.log ssl_disable: yes disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable: /usr/local/libexec/dovecot/imap-login mail_location: /var/mail/%u auth default: verbose: yes passdb: driver: passwd-file args: /etc/dovecot/passwd userdb: driver: static args: uid=vmail gid=vmail home=/var/mail/%u # Here are the errors I'm getting. dovecot: Sep 16 18:44:15 Info: imap-login: Login: user=<wfoatst>, method=PLAIN, rip=172.20.58.4, lip=172.20.8.215 dovecot: Sep 16 18:44:15 Error: IMAP(wfoatst): mail_location not set and autodetection failed: Mail storage autodetection failed with ho me=/var/mail/wfoatst Thanks!

3 3