May 2010 - dovecot - dovecot.org

[Dovecot] Dovecot LDAP problems
by Adam Pardy 20 May '10

20 May '10

I'm currently trying to configure a linux mailserver running centos to use an xserve running snow leopard. I am configuring the mailserver to run dovecot,sendmail,clamav,spam assassin and squirrelmail so it matches those used by the mac. The problem I am having is that I cannot get the server to authenticate properly to the macs LDAP database. As far as I can tell it is either a problem authenticating passwords or username and passwords. mail.app says its the password it cant authenticate Thunderbird says it could be either. It seems to be a problem in dovecot-ldap.conf, (as I can run ldapsearch from the linux server authenticate correctly and gain user information) What I'd like to know is there a standard set of settings required to authenticate to the LDAP on the mac? I'm currently running the od with no requirements for Kerberos, SSL or anything else it can authenticate with plain passwords (it will be once it is implemented I'm trying to have as few variables as possible at the moment). Copy of dovecot-ldap.conf below; 1. This file is opened as root, so it should be owned by root and mode 0600. # 1. http://wiki.dovecot.org/AuthDatabase/LDAP # 1. NOTE: If you're not using authentication binds, you'll need to give 2. dovecot-auth read access to userPassword field in the LDAP server. 3. With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should 4. already be something like this: 1. access to attribute=userPassword 2. by dn="<dovecot's dn>" read # add this 3. by anonymous auth 4. by self write 5. by * none 1. Space separated list of LDAP hosts to use. host:port is allowed too. hosts =hostname.com 1. LDAP URIs to use. You can use this instead of hosts list. Note that this 2. setting isn't supported by all LDAP libraries. #uris = 1. Distinguished Name - the username used to login to the LDAP server dn= uid=wmuser,cn=#####,dc=##,dc=###########,dc=### 1. Password for LDAP server dnpass = password 1. Use SASL binding instead of the simple binding. Note that this changes 2. ldap_version automatically to be 3 if it's lower. Also note that SASL binds 3. and auth_bind=yes don't work together. #sasl_bind = no 1. SASL mechanism name to use. #sasl_mech = 1. SASL realm to use. #sasl_realm = 1. SASL authorization ID, ie. the dnpass is for this "master user", but the 2. dn is still the logged in user. Normally you want to keep this empty. #sasl_authz_id = 1. Use TLS to connect to the LDAP server. #tls = no 1. Use authentication binding for verifying password's validity. This works by 2. logging into LDAP server using the username and password given by client. 3. The pass_filter is used to find the DN for the user. Note that the pass_attrs 4. is still used, only the password field is ignored in it. Before doing any 5. search, the binding is switched back to the default DN. auth_bind = yes 1. If authentication binding is used, you can save one LDAP request per login 2. if users' DN can be specified with a common template. The template can use 3. the standard %variables (see user_filter). Note that you can't 4. use any pass_attrs if you use this setting. # 1. If you use this setting, it's a good idea to use a different 2. dovecot-ldap.conf for userdb (it can even be a symlink, just as long as the 3. filename is different in userdb's args). That way one connection is used only 4. for LDAP binds and another connection is used for user lookups. Otherwise 5. the binding is changed to the default DN before each user lookup. # 1. For example: auth_bind_userdn = cn=%u,cn=users,dc=##,dc=###########,dc=### # #auth_bind_userdn = 1. LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 1. LDAP base. %variables can be used here. base = dc=##, dc=###########, dc=### 1. Dereference: never, searching, finding, always #deref = never 1. Search scope: base, onelevel, subtree #scope = subtree 1. User attributes are given in LDAP-name=dovecot-internal-name list. The 2. internal names are: 3. uid - System UID 4. gid - System GID 5. home - Home directory 6. mail - Mail location # 1. There are also other special fields which can be returned, see 2. http://wiki.dovecot.org/UserDatabase/ExtraFields user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid 1. Filter for user lookup. Some variables can be used (see 2. http://wiki.dovecot.org/Variables for full list): 3. %u - username 4. %n - user part in user@domain, same as %u if there's no domain 5. %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=posixAccount)(uid=%u)) 1. Password checking attributes: 2. user: Virtual user name (user@domain), if you wish to change the 3. user-given username to something else 4. password: Password, may optionally start with {type}, eg. {crypt} 5. There are also other special fields which can be returned, see 6. http://wiki.dovecot.org/PasswordDatabase/ExtraFields pass_attrs = uid=user,userPassword=password 1. If you wish to avoid two LDAP lookups (passdb + userdb), you can use 2. userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll 3. also have to include user_attrs in pass_attrs field prefixed with "userdb_" 4. string. For example: #pass_attrs = uid=user,userPassword=password 1. Filter for password lookups pass_filter = (&(objectClass=posixAccount)(uid=%u)) 1. Default password scheme. "{scheme}" before password overrides this. 2. List of supported schemes is in: http://wiki.dovecot.org/Authentication default_pass_scheme = PLAIN 1. You can use same UID and GID for all user accounts if you really want to. 2. If the UID/GID is still found from LDAP reply, it overrides these values. #user_global_uid = #user_global_gid =

1 0

[Dovecot] LDAP against Novell eDirectory: 'Confidentiality required'
by Jim Moseby 20 May '10

20 May '10

Hi list! I am trying to get dovecot to authenticate users against Novell eDirectory via LDAP. I have successfully gotten open-xchange to authenticate, and I have written a PHP module that authenticates, however I cannot seem to get Dovecot working. If I turn on TLS and restart dovecot, I get: dovecot: 2010-05-20 09:22:05 Error: auth(default): LDAP: ldap_start_tls_s() failed: Connect error dovecot: 2010-05-20 09:22:05 Error: auth(default): LDAP: ldap_start_tls_s() failed: Local error If I turn it off, it starts without error, but returns this when a user tries to authenticate: dovecot: 2010-05-20 08:48:39 Error: auth(default): ldap(jkmoseby,127.0.0.1): ldap_bind() failed: Confidentiality required I have tried all combinations of host:port, and LDAP uri strings I can think of, nothing seems to work. Thanks in advance, config files follow. Jim -------------------------------------------------------- 'dovecot -n' returns: # 1.0.15: /etc/dovecot/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot.log info_log_path: /var/log/dovecot.log log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap login_dir: /var/run/dovecot//login login_executable: /usr/lib/dovecot/imap-login login_greeting: EFA mail server ready. mail_privileged_group: mail auth default: passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf --------------------------------------------------------- 'grep -v '^ *$#.*$\?$' dovecot-ldap.conf' returns: hosts = 10.1.10.200 tls = yes auth_bind = yes auth_bind_userdn = cn=%u,o=GSO,o=EFA base = o=EFA scope = subtree user_filter = (&(objectClass=posixAccount)(uid=%u))

2 2

[Dovecot] POP3 Problem with SPAM-Mail's over sieve
by Michael Niehren 20 May '10

20 May '10

Hi together, i am currently using dovecot 1.2.10 with the sieve-plugin and use a sieve-filter to sort the SPAM-Mail's directly into a Junk-Folder: require "fileinto"; # rule:[junkfilter] if header :contains "X-Spam-Flag" "YES" { fileinto "Junk"; } My problem is now, if i try to retrieve the Mails via POP3, i did not get the SPAM-Mail's in the Junk-Folder, only the normal ones, that are not filtered over the sieve plugin. Could anyone tell me how to solve that issue ? best regards Michael -- Michael Niehren __ _ powered by / / (_)__ __ ____ __ / /__/ / _ \/ // /\ \/ / /____/_/_//_/\_,_/ /_/\_\

3 2

[Dovecot] Receive Mail via lmtp/tcp
by Denny Schierz 20 May '10

20 May '10

hi, we have IMAP and SMTP (sendmail(solaris)) on different hosts. Sendmail delivers Mails via LMTP to Cyrus and Cyrus puts the mails into the (hopefully) right box. Now I want to replace the Cyrus host with Dovecot. I've searched a bit in Google but there isn't much about LMTP via TCP in combination with DoveCot. Version 2 seems to be get the feature, but we have round about 5k users, so beta is no choice. Also I red something about maidag (mailutils from Gnu) that could do the Job, but maybe there is a better way. I do not want to install Postfix (or any other SMTP service) on that IMAP Server. So I'm asking is there anybody who has the same construct. Important is, that Quota full etc. messages (RFC) gets back to sendmail, so that the MTA reject the mails, before accepting. cu denny

3 4

Re: [Dovecot] Receive Mail via lmtp/tcp
by Denny Schierz 20 May '10

20 May '10

hi, Am Donnerstag, den 20.05.2010, 13:39 +0400 schrieb Andrey Melnikoff: > Drop sendmail, use exim. sendmail need over complicated configuration > for checking quotas, etc. or using thrid party milters. thanks for that hint, and I will remember next time for this solution :-) At the moment Postfix is the best solution until DoveCot 2.x releases. cu denny

1 0

Re: [Dovecot] draft-ietf-morg-list-specialuse-01 - IMAP LIST extension for special-use mailboxes
by Nikolay Shopik 20 May '10

20 May '10

On 20.05.2010 13:55, Timo Sirainen wrote: > On 20.5.2010, at 11.10, Nikolay Shopik wrote: > >> What you think about this draft is it good enough to make patch based on it for dovecot? We would like to see this functionality in 2.0 dovecot release but it's not clear when this draft become standards track. Will you accept patch based on drafts? > > Have you read the discussion about it in morg list? I don't remember what the last conclusions were :) Anyway I'd probably accept patch to Dovecot, but maybe not yet advertise supporting SPECIAL-USE in capability. > > But the main thing I'm not sure about is where should the flag information be stored? Should it even be per-user option? If yes, should it maybe be combined with autocreate plugin? > Yeah advertise SPECIAL-USE before IANA registred keyword isn't good thing. I don't think this really need per-user option. This is basically "system folders" and MUA will decide on their local names. Combining with autocreate plugin seems reasonable.

1 0

[Dovecot] logging
by James Devine 20 May '10

20 May '10

I am looking through the logging options and wondering if there are a couple of things that we can do 1. Logouts don't seem to show the IP address of the logout, we typically see multiple sessions at a time and wondering if there is a way to tie the logouts to an IP 2. POP logouts show the number of messages retrieved/deleted but I don't see a way to do this with IMAP, is there a logout option for this with imap? Thanks

1 1

Re: [Dovecot] looking for IMAP testing tool
by Phil Howard 19 May '10

19 May '10

On Wed, May 19, 2010 at 12:49, Mailing List <anonmous(a)dovecot.org> wrote: > Hi Phil, > > I've got an hack piece of regression perl code that we might be a good > starting point. I'd love to turn it into a better piece of hack code > that we could offer up. It does SSL/TLS. > > Right now it is pretty basic and forks 1K-10K simultaneous IMAP > login/logout connections. Its goal is to find the sink point for the > IMAP server and/or test client so that tuning exceeds current usage. > > Let me know if you are interesting in looking at it and cleaning it up. > > ---Jack > The best I could do with something in Perl is rewrite it into something else. I'm still kinda weak on Python (don't know all the cool tricks, yet), and Pike isn't found universally, so things would need to be in C for me to do it and it to be widely usable. And that's for later when I get some free time.

1 0

[Dovecot] looking for IMAP testing tool
by Phil Howard 19 May '10

19 May '10

I'm looking for an IMAP testing tool, suitable to use with Dovecot IMAP. It needs to support TLS, STARTTLS, and login/authentication. It needs to be able run from command line, shell scripts, and even do so under cron jobs (e.g. a way to supply the password to use w/o a terminal prompt). Typical interactive mail clients just don't cut it (even the text mode ones). One reason is I need to do the tests on a number of machines, under a number of user and domain names, and with a variety of parameters or destinations. This is for a suite of regression tests I am putting together intended to verify that configuration changes do not break things (or unbreak things that are supposed to not work). Anyone ever heard of such a tool? Open source would be preferred (better yet, my favorite programming languages: C, Pike, Python).

10 19

[Dovecot] postfix+lda+ virtual users, confusion
by Harry Lachanas 19 May '10

19 May '10

I thought it would be nice to have vboxes insead of user logins ... Now I am confuesed and in trouble .. My server serves 2 domains so user1(a)domain1.com is the same as user1(a)domain2.org I've created the mail_location string with %n and static userdb with %n dovecot creates 2 mail user directories user1(a)domain1.com user1(a)domain2.org What the heck am I missing .. ?? Your help is appreciated Regards Harry Here is my config --------------------------------------------------------------------------------------- base_dir = /var/run/dovecot/ protocols = imap imaps log_timestamp = "%Y-%m-%d %H:%M:%S " ssl_cert_file = /etc/postfix/sasl/cacert.org/mail.pem ssl_key_file = /etc/postfix/sasl/cacert.org/mail.pem ssl_ca_file = /etc/postfix/sasl/cacert.org/cacert.org-root.crt login_greeting = Hi buddy, have an account ?? mail_location = maildir:/home/vmail/%n/Maildir/ namespace private { separator = / prefix = location = maildir:~/Maildir/ inbox = yes } namespace public { prefix = Public/ separator = / location = maildir:/home/Public-Folders-Mail/Public-RO:INDEX=~/Maildir/p1-idx:CONTROL=~/Maildir/p1-ctrl hidden=no subscriptions=no inbox = no list=no } namespace public { prefix = Public-Shared/ separator = / location = maildir:/home/Public-Folders-Mail/Public-RW:INDEX=~/Maildir/p2-idx hidden = no subscriptions = no inbox = no list = no } mail_privileged_group = mail mail_debug = yes verbose_proctitle = yes valid_chroot_dirs = /var/mail:/home/Public-Folders-Mail dbox_rotate_size = 2048 dbox_rotate_min_size = 16 dbox_rotate_days = 0 protocol imap { mail_plugins = zlib autocreate expire imap_client_workarounds = outlook-idle } protocol pop3 { pop3_uidl_format = %08Xu%08Xv mail_plugins = expire } protocol lda { postmaster_address = harry(a)domainxxx.com hostname = mail.domain1.com sendmail_path = /usr/sbin/sendmail auth_socket_path = /var/run/dovecot/auth-master mail_plugins = expire } auth default { mechanisms = plain passdb passwd-file { args = scheme=plain-md5 username_format=%n /usr/local/dovecot/etc/imap.pass3 } userdb static { args = uid=1001 gid=1001 home=/home/vmail/%n } userdb passwd { } user = root socket listen { master { path = /var/run/dovecot/auth-master mode = 0600 user = vmail group= vmail } client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } dict { expire = db:/var/lib/dovecot/expire.db } plugin { autocreate = Spam autosubscribe = Spam autocreate1 = Public-Shared/Info autosubscribe1 = Public-Shared/Info autocreate2 = Undetected-Spam autosubscribe2 = Undetected-Spam expire = Trash 2 Trash/* 2 Spam 4 expire_dict = proxy::expire auth_socket_path = /var/run/dovecot/auth-master } -------------------------------------------------------------------------------------

2 1