May 2009 - dovecot - dovecot.org

[Dovecot] NTLM configuration
by Cédric Laruelle 06 May '09

06 May '09

Hi all, Im actually running samba 3 as a primary domain controller. The workstations of my network are all running windows (some xp, some vista) and use Outlook 2007 as a web client. Samba is set up with the following parameters : security = user passdb backend = tdbsam unix password sync = Yes domain master = yes domain logons = yes Everything works fine on samba side, meaning that the machines are part of the domain, and users do authenticate correctly. For the moment, the users are getting their mail (pop3 or imap) through dovecot (running on the same box as samba). Dovecot is configured with mechanisms = plain. I would like to secure it by using mechanisms = ntlm, but still using the system users. I found much information on how to authenticate against an active directory, but nothing that allows me to keep my actual authentication against system users. Indeed, if I just change the mechanisms to ntlm, dovecot does not start anymore complaining that NTLM mechanism can't be supported with given passdbs Any help would be much appreciated as I already tried the whole day yesterday to get it working Best regards, Cédric Laruelle

2 2

[Dovecot] Testing POP3 with telnet - password always wrong
by Timothy Legg 06 May '09

06 May '09

Hello, I just installed the postfix and dovecot packages according to the document, http://www.debianadmin.com/debian-mail-server-setup-with-postfix-dovecot-sa… And it has been quite helpful. It looks like Dovecot works because I can communicate with it on port 110. I can't help but feel I am doing something stupid though... The web page listed above told me to test the POP3 server using Outlook Express, and well, I am just not going to do that. Not when I can do it by hand... legg@debian:~$ telnet 192.168.10.171 110 Trying 192.168.10.171... Connected to 192.168.10.171. Escape character is '^]'. +OK Dovecot ready. USER test(a)192.168.10.171 +OK PASS password1 -ERR Authentication failed. But why do I always get the password wrong? I twice set the password for the test user and also restarted Dovecot, but the password is always wrong. Note that disable_plaintext_auth=no. I'm sure there must be something stupid I have overlooked. Any suggestions? Thank you very much!!!! Tim Legg Here is some additional data that I am volunteering... # dovecot -n # 1.0.15: /etc/dovecot/dovecot.conf log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps pop3 pop3s disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login mail_privileged_group: mail mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv auth default: passdb: driver: pam userdb: driver: passwd # dovecot --version 1.0.15

3 2

[Dovecot] Unable To Send Mail
by Carlos Williams 05 May '09

05 May '09

I just installed CentOS 5 + Postfix + Dovecot. Now When I send mail via telnet from one user to another via Postfix (MTA), I have no problem. The recipient gets the message perfectly. Now this tells me that Postfix is working fine (I assume) but then I configured Dovecot to use IMAP4 and then configured my Thunderbird client. Now all the messages I previously sent using Telnet showed up in Thunderbird Inbox but then when I attempt to send a message via Thunderbird, the message appears to send fine however the recipient never gets it and I get no delivery failrures back of any kind. I check the Postfix (MTA) mail queue and it shows empty. What is causing this anyone? Does anyone know why this is not working? Here is my postconf -n for Postfix (MTA) [root@nat home]# postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix debug_peer_level = 2 home_mailbox = mail/ html_directory = no inet_interfaces = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain mydomain = wtf.com myhostname = nat.wtf.com myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES sample_directory = /usr/share/doc/postfix-2.3.3/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtpd_banner = $myhostname ESMTP $mail_name unknown_local_recipient_reject_code = 550 ================================================================ Here is what is 'UNCOMMENTED' in my /etc/dovecot.conf protocols = imap imaps mail_location = maildir:~/mail protocol imap { imap_client_workarounds = delay-newmail outlook-idle netscape-eoh } login_process_size = 64 protocol pop3 { protocol lda { protocol lda { postmaster_address = carlos(a)wtf.com } auth default { mechanisms = plain passdb pam { } userdb passwd { } user = root } dict { } plugin { } Anyone know what is causing this problem above? Sending internal email works fine via Telnet however when I try using my mail client / imap4, nothing happens.

4 9

[Dovecot] index_mailbox_set_recent_uid error on 1.1.14
by Mike Abbott 05 May '09

05 May '09

Seen this error a few times from dovecot-1.1.14, Mac OS X, 64-bit Intel. Pretty sure NFS was not used. Panic: IMAP(user): file index-sync.c: line 39 (index_mailbox_set_recent_uid): assertion failed: seq_range_exists(&ibox->recent_flags, uid) The backtrace is: 0 libSystem.B.dylib 0x00007fff85025166 __kill + 10 1 libSystem.B.dylib 0x00007fff850a80e0 abort + 83 2 imap 0x0000000100069f3e default_fatal_finish + 70 3 imap 0x0000000100069f8c i_syslog_fatal_handler + 0 4 imap 0x00000001000696eb i_info + 0 5 imap 0x000000010003b86b index_mailbox_set_recent_uid + 74 6 imap 0x000000010003b8cb index_mailbox_set_recent_seq + 58 7 imap 0x0000000100018f5d maildir_sync_index + 2163 8 imap 0x0000000100017ba5 maildir_sync_context + 662 9 imap 0x0000000100017d8e maildir_storage_sync_init + 104 10 imap 0x000000010000c037 imap_sync_init + 132 11 imap 0x000000010000c289 cmd_sync_delayed + 477 12 imap 0x0000000100006ae8 client_handle_input + 409 13 imap 0x0000000100006bc2 client_input + 148 14 imap 0x0000000100070f83 io_loop_handler_run + 272 15 imap 0x0000000100070348 io_loop_run + 55 16 imap 0x000000010000db95 main + 1635 17 imap 0x0000000100001010 start + 52

2 2

[Dovecot] mail_index_sync_map error on 1.1.14
by Mike Abbott 05 May '09

05 May '09

Seen this error a few times from dovecot-1.1.14, Mac OS X, 64-bit Intel. NFS may have been used. Panic: IMAP(user): file mail-index-sync-update.c: line 843 (mail_index_sync_map): assertion failed: (map->hdr.indexid == index- >indexid || map->hdr.indexid == 0) Two different backtraces to this error are: 0 libSystem.B.dylib 0x00007fff87b775ea __kill + 10 1 libSystem.B.dylib 0x00007fff87bf9fc8 abort + 83 2 imap 0x0000000100069f3e default_fatal_finish + 70 3 imap 0x0000000100069f8c i_syslog_fatal_handler + 0 4 imap 0x00000001000696eb i_info + 0 5 imap 0x0000000100051d3a mail_index_sync_map + 144 6 imap 0x000000010004a22c mail_index_map + 212 7 imap 0x0000000100046a0f mail_index_refresh + 14 8 imap 0x0000000100016e4b maildir_sync_header_refresh + 24 9 imap 0x0000000100016ee6 maildir_sync_quick_check + 61 10 imap 0x000000010001796a maildir_sync_context + 91 11 imap 0x0000000100017d8e maildir_storage_sync_init + 104 12 imap 0x000000010003eb1b mailbox_sync + 31 13 imap 0x00000001000048a8 cmd_select_full + 224 14 imap 0x00000001000049f3 cmd_select + 11 15 imap 0x000000010000677e client_command_input + 33 16 imap 0x000000010000693f client_command_input + 482 17 imap 0x0000000100006a3e client_handle_input + 239 18 imap 0x0000000100006bc2 client_input + 148 19 imap 0x0000000100070f83 io_loop_handler_run + 272 20 imap 0x0000000100070348 io_loop_run + 55 21 imap 0x000000010000db95 main + 1635 22 imap 0x0000000100001010 start + 52 0 libSystem.B.dylib 0x00007fff863125ea __kill + 10 1 libSystem.B.dylib 0x00007fff86394fc8 abort + 83 2 deliver 0x000000010005f82d default_fatal_finish + 70 3 deliver 0x000000010005f8fb i_set_failure_syslog + 0 4 deliver 0x000000010005efda i_info + 0 5 deliver 0x000000010004867e mail_index_sync_map + 144 6 deliver 0x0000000100040b70 mail_index_map + 212 7 deliver 0x000000010003d353 mail_index_refresh + 14 8 deliver 0x0000000100044219 mail_index_transaction_commit_v + 988 9 deliver 0x0000000100032e1c index_transaction_finish_commit + 90 10 deliver 0x000000010000fc4d maildir_transaction_commit + 130 11 deliver 0x0000000100032cb9 index_transaction_commit + 63 12 lib10_quota_plugin.so 0x000000010021efd9 quota_get_mail_user_quota + 1907 13 deliver 0x00000001000354ac mailbox_transaction_commit + 48 14 deliver 0x0000000100001844 deliver_save + 572 15 deliver 0x0000000100003244 main + 6266 16 deliver 0x0000000100000948 start + 52

2 2

[Dovecot] Disabling users whilst still allowing logins with a 'master password'
by Dominic Hargreaves 05 May '09

05 May '09

Hi, I'm having trouble coming up with an authentication configuration that does what we want with dovecot, and thought it would be worth passing it by the list in case anyone can spot an easy fix, or confirm my suspicions that code changes are required. You should probably be aware that this is to support a migration away from Dovecot to a certain Microsoft-provided mail platform, so if this makes you feel uncomfortable, you may choose not to respond ;) We have the following configuration: - the passdb in use is pam (for pam_krb5) - the userdb in use is passwd (for nss_ldap) - GSSAPI is also supported - We support both IMAP and POP - Dovecot 1.0.9 - users have their own uid/gid and the following requirement, in order to support the migration process: - Access to mailstore should be allowed by means of a master password or user (ideally configurable, so we have a fine degree of control over which users are exposed to the migration process at a given time) - Migration process accesses mailstore via IMAP - During migration, users should not be allowed to log in with their Kerberos password, nor with GSSAPI We've achieved the first requirement with master passwords roughly as described at the bottom of http://wiki.dovecot.org/Authentication/MasterUsers by configuring another passdb with the master password hash in place for the users we want to be enabled to migrate. Our standard auth config looks like: auth default { gssapi_hostname = imap210.herald.ox.ac.uk mechanisms = plain login gssapi passdb pam { } userdb passwd { args = blocking=yes } socket listen { master { path = /var/run/dovecot/auth-master } } } and my first try at satisfying my requirements was: auth default { gssapi_hostname = imap-dev.herald.ox.ac.uk mechanisms = plain login gssapi passdb sql { args = /etc/dovecot/dovecot-sql-master.conf } passdb sql { args = /etc/dovecot/dovecot-sql-deny.conf deny = yes } passdb pam { } userdb passwd { args = blocking=yes } socket listen { master { path = /var/run/dovecot/auth-master } } } where /etc/dovecot/dovecot-sql-master.conf describes a query representing those users accessible by the master password (and a hash of the master password) and /etc/dovecot/dovecot-deny.conf describes a query representing those users who should not be allowed to log in with their normal password (or GSSAPI). This almost works, but unfortunately (as documented) the GSSAPI mechanism does not check any passdbs, so does not get checked against the deny passdb. Normally to disable logins for a user we chmod their mail store to 0 so they can't access it, which has the same effect, but this obviously also prevents the master password from being able to access it. It would seem to be generally useful to be able to check GSSAPI logins against a deny passdb, but is this a valid code change? Alternatively, could the *userdbs* could be extended to cope with the idea of a deny form, since the GSSAPI login process already uses them (although it would have to return USERDB_RESULT_USER_UNKNOWN). Alternatively, does anyone have any other ideas about how I could achieve the same effect? Thanks for listening. Dominic. -- Dominic Hargreaves, Systems Development and Support Team Computing Services, University of Oxford

3 5

Re: [Dovecot] Unexplainable problem with POP3 quotas
by Marco Marongiu 05 May '09

05 May '09

Hello Rick, and thanks for replying First of all, the attached script had an error (I attached the wrong one :-\, the "export" line reads: export PATH="/usr/bin:/bin" 2009/4/30 <dovecot(a)dovecot.org>: > > It's a dumb question, but you are running the script via cron or manually > right? (dovecot doesn't execute it in it's own). >From the documentation, I'd expect it does. In http://wiki.dovecot.org/Quota/1.1 I read: >>>You can configure Dovecot to run an external command when user's quota exceeds a specified limit. so I expect that it will run the script. Am I wrong? Ciao --bronto

2 4

Re: [Dovecot] Problem with BODYSTRUCTURE (wrong charset)
by Craig Craig 05 May '09

05 May '09

From: Timo Sirainen<tss(a)iki.fi> > On Mon, 2009-05-04 at 16:18 +0200, Craig Craig wrote: > > Content-Type: multipart/mixed; > > Message-ID:=<d2788bc14788ff16e67e63941937c1e1(a)foo.de>; > > boundary="000XMAIL000" > > The problem is the Message-ID parameter. It's not legal to have ':' > before '='. I added a workaround to v1.2+, but v1.1's code is different > and I'd rather not change it much anymore. > > http://hg.dovecot.org/dovecot-1.2/rev/05a98aaf0aaf > Thanks, I had already figured out that it somehow depended on the headers and that helped a lot! :) For the archive: another problem was, that the Message-ID was not unique...and putting it between "Content-Type" and "boundary" does not seem to be a good idea at all... Thanks, Craig

1 0

Re: [Dovecot] fts-solr plugin issue (Marked invalid)
by Nikolai Derzhak 05 May '09

05 May '09

Send mail body with wrong Content-Type. If put this in maildir indexing raise 500 error. If fix Content-Type to "application/octet-stream" all OK. Because TEXT/*; content dovecot try to index and solr raise 500, on each search. On Tue, 05/05/2009 at 3:01pm, "Nikolai Derzhak" <nikolai(a)6zap.com> wrote: > On Mon, 05/04/2009 at 6:23pm, "Timo Sirainen" <tss(a)iki.fi> wrote: >> On May 4, 2009, at 10:16 AM, Nikolai Derzhak wrote: >> >>> OK. Concentrating problem in one question. >>> How to ignore "bad" message and index next one in indexing procedure >>> (fts plugin) ?. >>> Now, one "error 500" from solr and dovecot (# 1.1.11: /etc/dovecot/ >>> dovecot.conf >>> # OS: Linux 2.6.21.7-2.fc8xen i686 Ubuntu 8.04.2 ext3 >>> ) stop and each next search query repeat the story. >> >> Maybe simply using 1.1.14 would help? I already fixed one Solr issue: http:/ >> / >> hg.dovecot.org/dovecot-1.1/rev/678c3252a454 >> > I've merge back this commit to 1.1.11 code, cause this is my request about > special chars ;). > >> If that's not the problem, it would help to have one of those mails >> that breaks it. > Yes. Now i have two new issue: > 1. "Content-Type:" header in mail wrong - so it's TEXT/mspowerpoint for > example, but it's binary *.ppt file. > 2. many html from repository change-set(many commit's to html) in text/plain > mail > > In both cases we have "Error 500" from solr (HTMLStripReader class) (in solr > log: "Marked inlalid"). > And in both cases we can not detect this in dovecot code (or it's hard to do) > . > So for now i need some method to ignore "bad" messages. > Because we can not catch all variants, but indexing die on first error like > this. > > > > Powered by the 6zap. Sign up at http://www.6zap.com for an account that > provides advanced e-mail, calendar and contacts capabilities. Powered by the 6zap. Sign up at http://www.6zap.com for an account that provides advanced e-mail, calendar and contacts capabilities.

1 0

Re: [Dovecot] fts-solr plugin issue (Marked invalid)
by Nikolai Derzhak 05 May '09

05 May '09

On Mon, 05/04/2009 at 6:23pm, "Timo Sirainen" <tss(a)iki.fi> wrote: > On May 4, 2009, at 10:16 AM, Nikolai Derzhak wrote: > >> OK. Concentrating problem in one question. >> How to ignore "bad" message and index next one in indexing procedure >> (fts plugin) ?. >> Now, one "error 500" from solr and dovecot (# 1.1.11: /etc/dovecot/ >> dovecot.conf >> # OS: Linux 2.6.21.7-2.fc8xen i686 Ubuntu 8.04.2 ext3 >> ) stop and each next search query repeat the story. > > Maybe simply using 1.1.14 would help? I already fixed one Solr issue: http:// > hg.dovecot.org/dovecot-1.1/rev/678c3252a454 > I've merge back this commit to 1.1.11 code, cause this is my request about special chars ;). > If that's not the problem, it would help to have one of those mails > that breaks it. Yes. Now i have two new issue: 1. "Content-Type:" header in mail wrong - so it's TEXT/mspowerpoint for example, but it's binary *.ppt file. 2. many html from repository change-set(many commit's to html) in text/plain mail In both cases we have "Error 500" from solr (HTMLStripReader class) (in solr log: "Marked inlalid"). And in both cases we can not detect this in dovecot code (or it's hard to do). So for now i need some method to ignore "bad" messages. Because we can not catch all variants, but indexing die on first error like this. Powered by the 6zap. Sign up at http://www.6zap.com for an account that provides advanced e-mail, calendar and contacts capabilities.

1 0