December 2010 - dovecot

[Dovecot] Problem with requiring client certificates for external connections
by Frank Crawford 04 Jan '11

04 Jan '11

Folks, I'm trying to configure my dovecot installation to require client certificates for external/Internet connections, while still allowing my local network to not need certificates. This configuration is for Dovecot 2 (2.0.8 in Fedora 14), and I've tried to use the "remote" block to give different definitions for my local network vs the defaults. While most options seem to be set fine, if I set "auth_ssl_require_client_cert" to yes as the default, and reset it to no for my local network, dovecot still requests a client certificate and fails as one is not supplied. Am I correct that it can be reset in a "remote" block, or is it treated differently to other options? In fact do I have the configuration correct, as there doesn't really seem to be anything documenting "remote" or "remote_ip" or related items for Dovecot 2. Related to this, much of the documentation states that the variable is "ssl_require_client_cert", seems to be accepted by ignored, vs "auth_ssl_require_client_cert" which does have some effects. Also, in the configuration dump, it duplicates the netmask. The configuration is below, as generated with "dovecot -n". Regards Frank # 2.0.8: /etc/dovecot/dovecot.conf # OS: Linux 2.6.36.1 x86_64 Fedora release 14 (Laughlin) ext4 auth_ssl_require_client_cert = yes mail_location = maildir:/var/spool/maildir/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date mbox_write_locks = fcntl passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)crawford.emu.id.au ssl = required ssl_ca = </etc/pki/CA/cacert.pem ssl_cert = </etc/pki/tls/certs/dovecot.crt ssl_key = </etc/pki/tls/private/dovecot.key ssl_verify_client_cert = yes userdb { driver = passwd } protocol pop3 { pop3_uidl_format = %v.%u } remote 203.16.204.0/24/24 { auth_ssl_require_client_cert = no disable_plaintext_auth = no ssl = no ssl_verify_client_cert = no } remote fdd2:7aad:d478:1::/64/64 { auth_ssl_require_client_cert = no disable_plaintext_auth = no ssl = no ssl_verify_client_cert = no } remote 2001:44b8:62:140::/64/64 { auth_ssl_require_client_cert = no disable_plaintext_auth = no ssl = no ssl_verify_client_cert = no }

3 5

[Dovecot] Quota ignore subfolders
by Héctor Moreno Blanco 04 Jan '11

04 Jan '11

Hello, We have dovecot 2.0.8 in our servers with Scientific Linux SL release 5.2 (Boron). We want to ignore a mailbox and its child mailboxes. A few weeks ago Timo told me to do this in dovecot.conf, create a new namespace which will be the quotaless namespace and edit the quota: namespace { inbox = yes location = prefix = INBOX. separator = . type = private } namespace { location = maildir:%h/Maildir/carpeta1 prefix = carpeta1. separator = . type = private } plugin { quota = maildir:carpeta1:ns=INBOX. quota_warning = storage=75%% /usr/local/dovecot/bin/quota-warning.sh 75 quota_warning2 = storage=90%% /usr/local/dovecot/bin/quota-warning.sh 90 } We also have passdb and userdb with ldap, with dovecot-ldap.conf: pass_filter = (&(objectClass=qmailUser)(uid=%u)(accountActive=TRUE)) pass_attrs = uid=user,userPassword=password, mailQuotaSize=quota_rule=*:bytes=%$ user_attrs = mailMessageStore=home, mailQuotaSize=quota_rule=*:bytes=%$ user_filter = (&(objectClass=qmailUser)(|(mailAlternateAddress=%u)(mail=%u)(uid=%u))(accountActive=TRUE)) We also tried the easy solution which was to indicate a quota rule in order to ignore the mailbox but with no success. It still get every mailbox to calculate the quota. We set mail_debug=yes to see if there was any error, but everything seemed to be ok. Any suggestions? Thank you very much in advanced. Héctor Moreno Blanco. ______________________ This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it. ______________________ Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informacion clasificada por su emisor como confidencial en el marco de su Sistema de Gestion de Seguridad de la Informacion siendo para uso exclusivo del destinatario, quedando prohibida su divulgacion copia o distribucion a terceros sin la autorizacion expresa del remitente. Si Vd. ha recibido este mensaje erroneamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboracion. ______________________

2 1

[Dovecot] Renaming IMAP folders does not affect children
by Johannes Simon 04 Jan '11

04 Jan '11

Hi, we're using dovecot2.0 since August and very happy with it. Just recently Thunderbird users reported problems when renaming folders, and it seems that RFC 2060 (sec. 6.3.5) requires children of a renamed folder to be renamed, too. This however does not happen: Talking IMAP I get: * LIST (\HasChildren) "." "INBOX.NNN1" * LIST (\HasNoChildren) "." "INBOX.NNN1.NNN1a" . rename "INBOX.NNN1" "INBOX.NNN2" * LIST (\HasNoChildren) "." "INBOX.NNN1.NNN1a" * LIST (\HasNoChildren) "." "INBOX.NNN2" There seems to be no problem the filesystem rights, since this works: . rename "INBOX.NNN1.NNN1a" "INBOX.NNN2.NNN1a" * LIST (\HasChildren) "." "INBOX.NNN2" * LIST (\HasNoChildren) "." "INBOX.NNN2.NNN1a" Am I misunderstanding RFC 2060, or is my config wrong (doveconf -n below), or could it be a bug? Cheers, Johannes # 2.0.8 (e030df616faf): /etc/dovecot/dovecot.conf # OS: Linux 2.6.26-2-openvz-amd64 x86_64 Debian 5.0.7 default_client_limit = 2500 default_process_limit = 600 dotlock_use_excl = yes log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Dovecot 2 ready. mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = autocreate acl managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date mmap_disable = yes namespace { inbox = yes location = prefix = INBOX. separator = . type = private } namespace { list = yes location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = INBOX.shared.%%u. separator = . subscriptions = no type = shared } passdb { args = session=yes dovecot driver = pam } plugin { acl = vfile acl_shared_dict = file:/etc/dovecot/dict/shared-mailboxes autocreate = INBOX.Trash autocreate2 = INBOX.Junk autocreate3 = INBOX.Sent autocreate4 = INBOX.Junk_old autocreate5 = INBOX.Drafts autosubscribe = INBOX.Trash autosubscribe2 = INBOX.Junk autosubscribe3 = INBOX.Sent autosubscribe4 = INBOX.Drafts sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 service auth { unix_listener auth-userdb { mode = 0666 } } service dict { user = dovecot } service imap-postlogin { executable = script-login rawlog /etc/dovecot/postlogin.sh user = root } service imap { executable = imap imap-postlogin } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = blocking=yes driver = passwd } protocol imap { mail_max_userip_connections = 50 mail_plugins = autocreate acl imap_acl } protocol pop3 { mail_max_userip_connections = 3 }

2 1

[Dovecot] Doveadm search in public namespaces
by Thomas Leuxner 04 Jan '11

04 Jan '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Say I want to create a script to perform some 'doveadm' tasks. Is there any particular reason why "mailbox-guids" would not work for public namespaces? Let's search something to play with: $ doveadm search sentbefore 01-jan-2011 mailbox "Public/Mailing-Lists/Dovecot" adeffe1c8b7ba64bb3770000a998a2df 1021 […] Trying to fetch headers using mailbox-guids *fails*: $ doveadm fetch hdr mailbox-guid adeffe1c8b7ba64bb3770000a998a2df uid 1021 …while it works using mailbox name: $ doveadm fetch hdr mailbox Public/Mailing-Lists/Dovecot uid 1021 Seems odd. Regards Thomas -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin) iEYEARECAAYFAk0XSf8ACgkQ+meF/S97aXjqggCbBAL+FFTmHRXwuxLX46vYFclr 42UAn0dSEwvUzZUy8QU/Pvux+UzVdRlB =vWk6 -----END PGP SIGNATURE-----

2 7

[Dovecot] user xxx@mydomain.com doesn't exist
by G.Nau 04 Jan '11

04 Jan '11

new setup of Dovecot 2.0.8 with postfix local users are simply defined as Linux users named xxx, yyy et cetera; IMAP access is fine with that users. Postfix is delivering mails with two domains (to xxx(a)mydomain.com or xxx(a)mydomain.org) and these are rejected by dovecot with 550: user doesn't exist. I've tested the possible usernames with "doveadm user" xxx: okay xxx(a)mydoman.com: "userdb lookup: user xxx(a)mydomain.com doesn't exist" xxx(a)mydoman.org: "userdb lookup: user xxx(a)mydomain.org doesn't exist" Dovecot2 wiki says "Dovecot doesn't care much about domains in usernames" Okay, how to I get dovecot to ignore the domain part (or accept the two defined domains) when mails are delivered from postfix? Or do I have to configure Postfix to strip the domain part before delivering to dovecot? Regards Birte Nauer

2 1

[Dovecot] Dovecot Quota plugin as Couier quota
by Antonio Perez-Aranda 03 Jan '11

03 Jan '11

I get a similar behavior between dovecot quota plugin and courier quota with the attached patch. When the client change flags, then is forced to recalc. This is because I don't know how to get the changed flags on quota sync method. The courier quota behavior is avoid to count all deleted mails, include "mark as deleted" mails. -- Antonio Pérez-Aranda Alcaide aperezaranda(a)yaco.es Yaco Sistemas S.L. http://www.yaco.es/ C/ Rioja 5, 41001 Sevilla Teléfono +34 954 50 00 57 Fax +34 954 50 09 29

2 2

[Dovecot] Shared Folders via Symlinking
by Adrian Mardlin 01 Jan '11

01 Jan '11

Hi folks, I'm trying to set up shared folders via symlinking and have come across a problem. I created a folder for one user, then symlinked it to another. I figured that one thing that is likely to happen at some point is that user 2 is going to decide they don't want to look at that folder any more, and will delete it, so I tried this. Much to my relief, it didn't delete the actual mails, just the symlink. However, it did alter the dovecot.index.cache file to indicate that the folder had been removed, and subsequent attempts to select this folder via the primary user resulted in an error, "NO Mailbox was deleted under us". I had to delete dovecot.index.cache to get it working again. Sorry - can't bring myself to call folders mailboxes... ;-) Adrian Mardlin in charge @ The Very Good Email Company t 01442 892641 m 07920 102401 f 01442 808081 w www.verygoodemail.com The content of this email and any attachment is private and may be legally privileged. If you are not the intended recipient, any use, disclosure, copying or forwarding of this email and/or its attachments is unauthorised. If you have received this email in error please notify the sender by email and delete this message and any attachments immediately from this system. The Very Good Email Company is a trading style of APM Internet Limited. APM Internet Limited is a limited company incorporated in England and Wales with registration number 04601087 and whose registered office is at Charter Court, Midland Road, Hemel Hempstead, Hertfordshire HP2 5GE

2 4

[Dovecot] Sieve rule issue with certain character sets
by Thomas Leuxner 01 Jan '11

01 Jan '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have a global sieve rule in place to filter mailing-lists. This has worked well so far. Recently however one subscriber on a list seems to create strange character set encodings in the 'From' and 'To' headers. This leads to unprocessed/unfiltered mails (no errors thrown). Is this a configuration or Pigeonhole issue (latest HG used)? Headers from failing mail: From: "=?UTF-8?B?VG9yaW50aGllbA==?=" <user(a)domain.tld> To: "=?UTF-8?B?ImJpbmQtdXNlcnNAbGlzdHMuaXNjLm9yZyI=?=" <bind-users(a)lists.isc.org> Relevant sieve rule: if allof (address :is ["To","CC"] ["bind-users(a)lists.isc.org","bind-users(a)isc.org","comp-protocols-dns-bind(a)isc.org"], header :contains "List-Id" "bind-users.lists.isc.org") { fileinto "Public/Mailing-Lists/Bind-Users"; } Regards Thomas -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin) iEYEARECAAYFAk0dvZ4ACgkQ+meF/S97aXgYTACfZC70bsYn3d4/VRY2GfK5lF0k xOIAnRsBliv9EErA919vc5KoTAHhq3rC =IE3C -----END PGP SIGNATURE-----

3 13

[Dovecot] Dovecot 1.2.12 + Postfix + virtual domains: delivering to system users
by Ran Talbott 01 Jan '11

01 Jan '11

As mentioned in my previous posting, I've set up a mailserver for a domain of Winboxen, authenticated through Active Directory. After some struggles, I finally got that working. But I also need to receive emails for a few system users on the mailserver (like postmaster, and a couple of accounts set up for maintaining the system). I thought, based on the way I read the documentation, that I could just add a "userdb passwd", ahead of the "userdb ldap", and deliver would find their home directory maildirs. The virtual users would fail the passwd search, fall through to the LDAP check, and deliver would drop their mail into their maildirs in the /var/mailstore tree. I knew the system users wouldn't be able to login to the IMAP server, but this isn't a concern. Instead, the system users' mail got bounced, after an auth check via the "master" socket (from Postfix, I guess: it's a transient process) whose details don't get logged. And the virtual users' lookups (done by deliver) returned made-up UIDs and GIDs, and maildir locations (/home/<realm>/<username>) completely different from what the LDAP lookup normally returns (/var/mailstore/<username>). So what am I missing here? I managed to work around this by adding the system users to the Postfix virtual.db, but it would be nice to not need to do that. It would also be nice to neable the system users to check email by logging in to the IMAP serve, but I'm reluctant to even try that after the way delivery went completely wonky. Thanks, Ran

4 7

[Dovecot] Can doveadm rebuild thread indexes?
by David Warden 30 Dec '10

30 Dec '10

I'm already using "doveadm search" to update my squat fts indexes (dovecot.index.search and dovecot.index.search.uids) but I'd like to also update dovecot's thread index file (dovecot.index.thread) using doveadm. I checked the new wiki and the archives but didn't see any option for this. (I'm running 2.0.8) The alternative (AFAIK) is to write a script that signs in to IMAP and does "thread references UTF-8 ALL" in each folder. As an aside, could the dovecot LDA do any of this work? I'd surely be willing to spend the resources at delivery time to keep those indexes updated if it meant I didn't have to run a cron job to keep them updated. -David Warden

2 1