July 2009 - dovecot - dovecot.org

[Dovecot] SMTP Auth Issue for non /etc/passwd accounts
by Mark R. Baith 17 Jul '09

17 Jul '09

Folks - With Dovecot 1.0.7, we're seemingly unable to authenticate users for out-going SMTP access who are not residing directly within the main system passwd/shadow files. (I.e. the users seeded within our non-system "dovecot" userdbs & passwd files have no "smtp-auth" joy! (Ye olde "Relaying denied. Proper authentication required") I've mucked around with this from several different angles and clearly saslauthd is the sticking point in terms of "locking-in" on the /etc system files ONLY for smtp-auth. Our defined dovecot user/passwd files are entirely ignored. Can anyone provide a direction regarding the appropriate smtp-auth in-road? Thanks, -M Regards, M

3 5

[Dovecot] Question regarding layout.
by Johan Hendriks 17 Jul '09

17 Jul '09

Hello all. I have a question regarding my mail flow. We have some users who are in a mail group (alias), and these alias receives a lot of attached documents. So i have the document in all the mailboxes of the alias. If the attached document is 2MB and that is not rare, i have 10 times 2 MB on my mail server. Is there a way to tackle this. Maybe by making the alias a mailbox itself and give other users acces or are there other options. Also i have very lame and lazy users. They refuse to clean thrash cans (i asked about that earlier,and got that tackled through the expire plugin.),also the do not remove old mail not even reading it. So is there also a option to remove mail that is not been opened, and is older than xx days or weeks. Thanks -- _______________________ *Johan Hendriks* *Schavemaker Transport* Tel: +31 (0)251 229098 Fax: +31 (0)251 212016 email: j.hendriks(a)schavemaker.com <mailto:j.hendriks@schavemaker.com> web: http://www.schavemaker.com _______________________

2 2

[Dovecot] exim4 dovecot sasl problem
by Tristan Rex Santiago 17 Jul '09

17 Jul '09

hi! i'm trying to do smtp authentication using dovecot and exim4 by following this guide http://wiki.dovecot.org/HowTo/EximAndDovecotSASL. for the exim4 part, i got an authenticator dovecot: cannot find authenticator driver "dovecot" error after i entered the codes in /etc/exim4/exim4.conf.template and reloaded exim4 with the update-exim4.conf command. i'm running debian lenny. here's the authentication section of exim4.conf.template: begin authenticators cram_md5: driver = cram_md5 public_name = CRAM-MD5 client_name = ${extract{1}{:}{${lookup{$ host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}} client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}} PASSWDLINE=${sg{\ ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}\ }\ {\\N[\\^]\\N}\ {^^}\ } plain: driver = plaintext public_name = PLAIN .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS client_send = "<; ${if !eq{$tls_cipher}{}\ {^${extract{1}{:}{PASSWDLINE}}\ ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}\ }fail}" .else client_send = "<; ^${extract{1}{:}{PASSWDLINE}}\ ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}" .endif login: driver = plaintext public_name = LOGIN .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS # Return empty string if not non-TLS AND looking up $host in passwd-file # yields a non-empty string; fail otherwise. client_send = "<; ${if and{\ {!eq{$tls_cipher}{}}\ {!eq{PASSWDLINE}{}}\ }\ {}fail}\ ; ${extract{1}{::}{PASSWDLINE}}\ ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}" .else # Return empty string if looking up $host in passwd-file yields a # non-empty string; fail otherwise. client_send = "<; ${if !eq{PASSWDLINE}{}\ {}fail}\ ; ${extract{1}{::}{PASSWDLINE}}\ ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}" .endif dovecot_login: driver = dovecot public_name = LOGIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1 dovecot_plain: driver = dovecot public_name = PLAIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1 How can I fight insomnia? Discover how on Yahoo! Answers. http://ph.answers.yahoo.com

2 1

[Dovecot] user unknown with deliver
by Nikolay Shopik 16 Jul '09

16 Jul '09

I'm getting user unknown when trying to deliver to Sent folder messages. My master.cf part is: copy2sent unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${sasl_username} -m Sent But it still won't work. I'm running 1.0.15 pluto postfix/pipe[30934]: 7470890C4DA: to=<bcc(a)bcc.example.com>, relay=copy2sent, delay=0.03, delays=0.02/0/0/0.01, dsn=5.1.1, status=bounced (user unknown)

3 10

[Dovecot] Can Dovecot Proxy GMail?
by Paul Carter-Brown 16 Jul '09

16 Jul '09

Hi, We are using gmail (google apps) across our company with most users using outlook (windoze) or evolution (linux) and imap/pop based on user preference. We are having issues in that our internet links are fairly slow and when users download mails they get frustrated with the time it takes and often get timeouts and issues where outlook fails to fetch a mail yet gmail thinks it was retrieved - users then complain of "missing" emails. Is there a way that we could use dovecot (or similar?) to act as an imap "proxy" and users connect to dovecot while dovecot connects to gmail? Thanks Paul

3 2

[Dovecot] sieve / managesieve: unknown Sieve capability 'imapflags'
by Ralf Hildebrandt 16 Jul '09

16 Jul '09

$HOME/.dovecot.sieve.log reports: main_script: line 8: error: require command: unknown Sieve capability 'imapflags'. main_script: line 8: error: require command: unknown Sieve capability 'notify'. main_script: error: validation failed. I'm using sieve (not cmusieve) and managesieve with dovecot-1.2. SquirrelMail 1.4 is using the avelsieve plugin to created/edit the sieve rules. What am I doing wrong here? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

4 7

[Dovecot] Expire plugin - where to start?
by Frank Leonhardt 15 Jul '09

15 Jul '09

I'm running Dovecot 1.1.3 on FreeBSD 7.0 with procmail 3.22 sorting the output of Spamassassin. Just for me and a few friends. I didn't like the ageing 'standard' IMAP implementation so I thought I'd give Dovecot a try and it's really impressive. However, I'm a complete newbie to its inner workings. Spamassassin is able to find plenty to chew on so the "Probable spam" mbox (note) fills up fast. I obviously want to zap the old stuff in there automatically. It seems to me that the expire plugin is the thing I need BUT reading the documentation: http://wiki.dovecot.org/Plugins/Expire Leaves me to scared to try anything. It's all working and I don't want to break it or delete anyone's mail. The problem that the wiki isn't accurate to the version I'm running. For example /usr/libexec/dovecot/expire-tool.sh doesn't exist. Okay, this isn't Linux, and there's something likely where I'd expect it on BSD (/usr/local/...) - but it's a binary, not a shell script. It may be a direct replacement AFAIK, but it may not. I've been reading the old mailing list about problems with 1.2 and this reinforces the feeling that the wiki is out-of-sync. Am I being paranoid? Possibly, but I don't want to be posting a "Help! I've wrecked my config and deleted all my friend's mail" type message. (Okay, I'd take a backup first). So could some kind person point me at the latest documentation? Thanks, Frank.

2 2

[Dovecot] multiple authentication mechanisms/passwords for same account
by Tapani Tarvainen 15 Jul '09

15 Jul '09

This may be trivial but reading the documentation I can't find a clear answer: If multiple authentication mechanisms (or multiple databases for one) are defined, does it allow one user account to have several (at least two) alternative passwords (so that any of them would work)? Or does it first map an account to a fixed authentication mechanism/password and if it fails, others won't be tried? -- Tapani Tarvainen

2 3

[Dovecot] RESOLVED: strange quota behaviour with dovecot 1.1.7
by listacc＠gmx.de 15 Jul '09

15 Jul '09

Hi, I just wanted to tell you that my problems are resolved now. Seems that Timo had the essential hint for me. Thank you very much!! :-) On 27.06.2009 23:40, Timo Sirainen wrote: >> passdb: >> driver: pam >> passdb: >> driver: sql >> args: /etc/dovecot/dovecot-sql.conf > > Do you really want to have system users too? No, I don´t want to :-) I switched this off. >> password_query = SELECT username AS user, password, '/drbd/mail/vmail/%d/%n' AS userdb_home, 'maildir:/drbd/mail/vmail/%d/%n' AS userdb_mail, 5001 AS userdb_uid, 5001 AS userdb_gid FROM mailbox WHERE username = '%u' AND active = '1' > > You're also not using userdb prefetch, so all these usedb_* fields are > ignored here. > Seems that was it! Now quota works very fine! > After growing quota, mails to the account are accepted again. But my Thunderbird with Quota plugin continues showing the old quota setting. When more mails are sent to this account, it shows a quota > 100%. > (...) > If I try now, as a user, to delete mails from the "overfilled" Inbox, it is denied with a "quota exceeded" message. But I´m able to send further mails to this account. The only way to get the account working properly again is to delete the messages directly on the server´s filesystem. > This happens again even after correcting the MySQL query, but it´s very easy to fix when the user logs out and in again (e.g. closes and reopens his Thunderbird) :-) Thank you very much for the fix and this very nice imap server!!! Andreas -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

1 0

[Dovecot] v3.0 architecture
by Timo Sirainen 15 Jul '09

15 Jul '09

I just had a thought. It's probably going to be too big of a change for v2.0, so something to think about for v3.0: Supporting multiple UIDs is difficult. Currently expire-tool and v2.0's LMTP server are implemented in a way that it's always running as root and only temporarily dropping privileges. So any security hole in there gives the attacker root privileges. Not very nice. With a single UID it's possible (or will be) to just use that one UID for the process without running as root. User sharing mailboxes to another user with different UID is even more difficult. Currently the only practical way to implement this is to assign read-write permissions to some group and have all mail files owned by that group. Not very nice. Sharing mailboxes between users located in different servers is impossible if the disk isn't somehow shared. All of these can be solved the same way: 1. imap, pop3, lmtp, etc. processes will be running without any privileges, very much like imap/pop3-login nowadays. Nobody-chrooted to empty directory. 2. Create storage processes that are started as needed. They can be configured in different security/performance settings: One storage process per user, one storage process per UID, setuid-root style shared storage process for multiple UIDs. 3. Mail processes talk to storage processes via some protocol. They can talk via UNIX socket or TCP/IP. If an existing connection can't handle the target UID, a new connection is made that either reuses an existing storage proces or creates a new one. 4. IMAP can finally implement truly simultaneously running queries (where it makes sense) by creating more storage processes if existing ones are busy handling longer-running commands. This also allows using the same storage process for multiple simultaneous IMAP connections and mail deliveries (and etc). The storage processes can also hang around and keep mailboxes open after all connections have closed it (dynamically figured out when it makes sense) to handle webmail clients that create lots of short-living connections or POP3 clients who poll for new mail every minute. The big problem is what the protocol should be. Use some existing RPC protocol? It should be something extensible so that a plugin in imap process can talk to a plugin in storage process, without the base processes knowing anything about the details (e.g. imap-quota plugin asking quota usage from storage's quota plugin). In any case the client side API should be asynchronous. That can make it annoyingly difficult to use though. Wonder if I could switch to erlang or something for the imap/pop3 processes :)

9 13