August 2010 - dovecot

[Dovecot] Live Mirror dovecot / OS X 10.6.4
by Eric Boltz (MMI/UPC) 24 Aug '10

24 Aug '10

I want to set up mirrored postfix/dovecot servers using two mac mini servers (OSX 10.6.4) located in different locations (Canada and the US to be specific) for redundancy. The idea is to have one as the primary MX ("mail.corp.com") and the other as the secondary ("webmail.corp.com"). If the primary goes down clients would revert to webmail until the primary is back up. The plan is to use rsync for this. My challenge, however, is what all I need to rsync to have a "live" backup. Rsync for backup isn't an issue, but I will need to rsync users (system and virtual). Anyone have experience with this? So far it seems that apple puts things in lots of non-standard locations. I suppose I could to a blanket rsync on /var, but that seems a bit much. Thanks in advance.

2 1

[Dovecot] Fully kerberized mail system
by Dr Matthew Williams 24 Aug '10

24 Aug '10

Hello, Is it possible to use Dovecot in a fully kerberized mail system? We have configured authentication via kerberos, now we would like the imap deamon to access a kerberized nfs file system. Has any one any experiences? Regards, Matthew. -- Dr Matthew Williams MEng PhD MBCS Systems Administrator - IT Services - Bangor University Prifysgol Bangor Tel: (44) (0)1248 382414 Adeilad Deiniol Mob: (44) (0)7979 778269 Ffordd Deiniol URL: www.bangor.ac.uk Bangor, Gwynedd LL57 2UX EMail: matthew.williams(a)bangor.ac.uk

2 1

[Dovecot] Messages causing an error from Solr.
by Erik Hetzner 23 Aug '10

23 Aug '10

Hi, I am trying to use the fts_solr plugin, and having some success. Unfortunately some spam messages I had lying around generate an error from Solr, e.g.: HTTP/1.1 400 ParseError at [row,col]:[5,29] Message: An invalid XML character (Unicode: 0xd84e) was found in the element content of the document. While I assume that these messages do indeed contain bad unicode, my searches seem to hang when they get an error back from Solr, causing other problems, so it would be nice if these messages did not cause an error from Solr. I isolated some of these messages and have attached them. I hope that the problematic characters come through properly. I have more messages that cause this problem (sometimes with difference unicode codepoints than the one in the message above), but I don’t want to clog the list up. Thank you for your help. best, Erik Hetzner Config: # 1.2.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-23-generic i686 Ubuntu 10.04.1 LTS log_timestamp: %Y-%m-%d %H:%M:%S protocols: imaps login_dir: /usr/local/stow/dovecot-1.2.13/var/run/dovecot/login login_executable: /usr/local/stow/dovecot-1.2.13/libexec/dovecot/imap-login mail_privileged_group: mail mail_plugins: virtual fts fts_solr namespace: type: private separator: / location: maildir:~/Maildir inbox: yes list: yes subscriptions: yes namespace: type: private separator: / prefix: virtual/ location: virtual:~/Maildir_virtual:LAYOUT=maildir++ list: yes subscriptions: yes auth default: passdb: driver: pam userdb: driver: passwd plugin: fts: solr fts_solr: url=http://localhost:8080/solr/ break-imap-search debug

2 6

[Dovecot] PATCH: SQL connect crash
by Leandro Santi 23 Aug '10

23 Aug '10

Hi! Dovecot 2.0.0 auth process seems to crash while attempting to connect to a nonexistent SQL database. A shallow look at the code reveals that NULL module->conn in passdb-sql.c is being erroneously dereferenced while trying to clean up after a failed connection attempt: (gdb) bt #0 0x0806240e in sql_query_callback (result=0x8076c40, sql_request=0x808ff90) at passdb-sql.c:70 #1 0x08069b66 in sqlpool_request_abort (_request=<value optimized out>) at driver-sqlpool.c:114 #2 0x0806ab2a in driver_sqlpool_deinit (_db=0x808b970) at driver-sqlpool.c:448 #3 0x0806970a in sql_deinit (_db=0x808b5bc) at sql-api.c:87 #4 0x0805a3ac in db_sql_unref (_conn=0x807fc60) at db-sql.c:119 #5 0x08062be2 in userdb_deinit (userdb=0x807fc48) at userdb.c:177 #6 0x0804ff4b in auths_deinit () at auth.c:213 #7 0x0805b7bc in main (argc=1474660693, argv=0xec835356) at main.c:160 gdb) print ((struct sql_passdb_module *) _module)->conn $20 = (struct sql_connection *) 0x0 It seems that module->conn for passdb is being zeroed at auth_deinit(), passdb_deinit() completes succesfully but then userdb_deinit() does the illegal access. The following hack seems to eliminate the symptom, however I'd strongly recommend to take a deeper look at the issue. I suspect that a higher level fix would be more appropriate. --- dovecot-2.0.rc6.orig/src/auth/passdb-sql.c 2010-07-21 14:13:29.000000000 +0000 +++ dovecot-2.0.rc6.patched/src/auth/passdb-sql.c 2010-08-18 21:07:05.000000000 +0000 @@ -67,7 +67,7 @@ ret = sql_result_next_row(result); if (ret < 0) { - if (!module->conn->default_password_query) { + if (!module->conn || !module->conn->default_password_query) { auth_request_log_error(auth_request, "sql", "Password query failed: %s", sql_result_get_error(result)); Leandro

2 2

[Dovecot] Authentication woes - Couldn't drop privileges: Mail access not allowed for root
by Ralph Seichter 23 Aug '10

23 Aug '10

I'm currently trying to set up a Dovecot 2.0.0 server for backup purposes. There's an existing server which I successfully migrated to Dovecot 2.0.0, and it uses LDAP for authentication. For the backup server, which will not be exposed to users, I tried both PAM and PASSWD authentication, but all I are syslog entries like these: dovecot: imap-login: Login: user=<foo>, method=PLAIN, rip=[...], lip=[...], mpid=20059, TLS dovecot: imap(foo): Error: user foo: Couldn't drop privileges: Mail access not allowed for root dovecot: imap(foo): Error: Internal error occurred. Refer to server log for more information. Here is my current configuration: # doveconf -n # 2.0.0: /usr/local/dovecot-2.0/etc/dovecot/dovecot.conf # OS: Linux 2.6.35-gentoo-r1-v3 x86_64 Gentoo Base System release 2.0.1 auth_mechanisms = plain login base_dir = /var/run/dovecot/ listen = * mail_location = maildir:~/.maildir passdb { args = scheme=crypt /usr/local/dovecot-2.0/etc/dovecot/passwd driver = passwd-file } protocols = imap ssl_cert = </usr/local/dovecot-2.0/etc/dovecot/server.crt ssl_key = </usr/local/dovecot-2.0/etc/dovecot/server.key The password file contents: # cat /usr/local/dovecot-2.0/etc/dovecot/passwd foo:{CRYPT}xxx:1000:1000:Foo Backup:/home/foo:/bin/bash I searched the Dovecot Wiki and also tried MARC and Google, but I can't seem to find a solution for this problem. Could you please point me in the right direction? I have probably missed something. Thanks! -Ralph

2 5

[Dovecot] Dovecot 2.0 and BSDI 4.X
by The Doctor 23 Aug '10

23 Aug '10

All right, I am trying to migrating to 2.0 but running into problems. from my typescript: Script started on Wed Aug 18 23:24:58 2010 doctor.nl2k.ab.ca//usr/home/doctor$ tail -f /var/log/maillog | egrep dovecot Aug 18 23:25:31 doctor dovecot: master: Dovecot v2.0.0 starting up (core dumps disabled) Aug 18 23:25:31 doctor dovecot: log: Error: net_accept() failed: Invalid argument Aug 18 23:25:31 doctor dovecot: master: Warning: service(anvil): process_limit reached, client connections are being dropped quit ^C doctor.nl2k.ab.ca//usr/home/doctor$ /usr/doc veo cot/sbin/dovecot -n # 2.0.0: /usr/dovecot/etc/dovecot/dovecot.conf # OS: BSD/OS 4.3 i386 auth_cache_negative_ttl = 3600 s base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_uid = 100 listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_debug = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_log_prefix = %Us(%u): mdbox_rotate_size = 2048 passdb { args = /etc/master.passwd driver = passwd-file } protocols = pop3 imap service auth { executable = /usr/dovecot/libexec/dovecot/auth user = root vsz_limit = 256 } service imap-login { chroot = login client_limit = 256 executable = /usr/dovecot/libexec/dovecot/imap-login inet_listener imaps { address = 204.209.81.1 } process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot vsz_limit = 64 } service imap { executable = /usr/dovecot/libexec/dovecot/imap process_limit = 512 vsz_limit = 256 } service pop3-login { chroot = login client_limit = 256 executable = /usr/dovecot/libexec/dovecot/pop3-login inet_listener pop3s { address = 204.209.81.1 } process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot vsz_limit = 64 } service pop3 { executable = /usr/dovecot/libexec/dovecot/pop3 process_limit = 512 vsz_limit = 256 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2 ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } userdb { args = /etc/passwd driver = passwd-file } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot/lib/dovecot/imap } protocol pop3 { mail_max_userip_connections = 3 mail_plugin_dir = /usr/dovecot/lib/dovecot/pop3 pop3_enable_last = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_format = %08Xu%08Xv } You have new mail in /var/mail/doctor doctor.nl2k.ab.ca//usr/home/doctor$ exit exit Script done on Wed Aug 18 23:26:07 2010 telneting into the ports work, but the clients seem to stuck in an infinite loop. -- Member - Liberal International This is doctor(a)nl2k.ab.ca Ici doctor(a)nl2k.ab.ca God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! http://twitter.com/rootnl2k http://www.facebook.com/dyadallee Australia!! Vote to throw the REpublicans to the sharks!

5 10

[Dovecot] Over-quota bounces seeming to lack sender
by Dave Brenner 23 Aug '10

23 Aug '10

We're seeing an issue with 1.2.12 where over-quota rejection messages are appearing in the logs with <> as the sender. The sender of the original message sees the appropriate sender (postmaster@) on the rejection, but as the message makes its way through the postfix/amavis chain, I can see that the sender address is missing. Aug 20 10:55:56 inet1 amavis[21822]: [ID 702911 mail.info] (21822-05) Checking: rGDWxOHFPBdY <> -> <xxxx(a)toledotel.com> Aug 20 03:12:39 inet1 amavis[9724]: [ID 702911 mail.info] (09724-37) skip local delivery(3): <> -> <bad-header-quarantine> Aug 19 10:15:47 2010 (1570) xxxxxxxx-users: bounce message w/no discernable addresses: <dovecot-1282238146-79394-0@inet1> (that last one is from Mailman logs) Has anyone else run into this? -- Dave Brenner - david(a)toledotel.com The Toledo Telephone Company, Inc.

2 1

[Dovecot] imap, imaps, ports; config for secure-only service
by Ronald Leach 23 Aug '10

23 Aug '10

Hello, having difficulty setting up a 'secure-only' service on a non-standard port. Objective is to open a secure Dovecot service on an internet-visible port, while also using an insecure service for hosts on an internal network (so that one particular client which is not SSL/TLS-capable can continue to use the service). Checking wiki1 and wiki2, I think that port 143 can be used for a service in both encrypted and unencrypted operations. (Wiki2 describes how port 143 can be used with or without STARTTLS.) I've managed to run both TB/Vista, and KMail/Debian on 143 from local machines, and they seem to work fine. (Though they do only work if the clients are set to use 'unencrypted logins' such as KMail's 'clear text' setting, and TB's 'don't use secure authentication'.) Dovecot's SSL certificate on the server expires in 2028. But I cannot get my 'secure-only service' working at all. I've chosen port 10943 for that service, and have been testing from both KMail on the server, and TB/Vista on another local machine. Here's the config: protocol imap { # inet users, and also users presented from offsite via an SSH tunnel, # will use IMAP (any capability) on 143. listen = *:143 # 143 will not be reachable from outside the internal network (except # via an SSH tunnel) # # External users will be allowed only to use port 10943 (as forwarded # from the gateway), and will have to use SSL ssl_listen = *:10943 } Other settings include: #other settings protocols = imap imaps disable_plaintext_auth = no ssl_disable = no ssl_cert_file = /etc/ssl/certs/dovecot.pem ssl_key_file = /etc/ssl/private/dovecot.pem ssl_verify_client_cert = no ssl_cipher_list = ALL:!LOW ssl_require_client_cert = no ssl_username_from_cert = no mail_location = maildir:~/Maildir #log and debug settings mail_debug = yes auth_debug = yes Log from a successful session on port 143: Logs (using port 143, KMail on the server) 14:43:22 auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Isecured^Ilip=127.0.0.1^Irip=127.0.0.1^Iresp=<hidden> 14:43:22 auth(default): client out: OK^I1^Iuser=ron 14:43:22 auth(default): master in: REQUEST^I1^I4057^I1 14:43:22 auth(default): master out: USER^I1^Iron^Isystem_user=ron^Iuid=1001^Igid=1001^Ihome=/home/ron 14:43:22 IMAP(ron): Effective uid=1001, gid=1001 14:43:22 IMAP(ron): maildir: data=/home/ron/Maildir 14:43:22 IMAP(ron): maildir: root=/home/ron/Maildir, index=/home/ron/Maildir, control=, inbox= 14:43:22 imap-login: Login: user=<ron>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Unsuccessful session Logs (using 10943, KMail on the server) - absolutely no sign of any authentication, and the client reports a timeout. 17:03:30 imap-login: Disconnected: Inactivity: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 17:04:06 imap-login: Disconnected: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 17:05:08 imap-login: Disconnected: Inactivity: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 143 works fine, so Dovecot is (of course) perfectly good at managing the auth and service, so I must have something wrong in the config. I cannot see it. Could anyone share a config they've used for *secure-only* IMAP service on an internet-visible port? I'd like to compare the settings. regards, Ron

4 3

[Dovecot] Build failure building dbox and gnutls
by Elisamuel Resto 23 Aug '10

23 Aug '10

Hello! I'm having two issues building dovecot, one is with dbox storage, and another building gnutls as the SSL backend (builds fine with openssl). Software versions are Dovecot v2.0.0, GnuTLS 2.8.6 and OpenSSL 1.0.0a Configure: ./configure --prefix=/usr --sysconfdir=/etc/dovecot --localstatedir=/var --libexecdir=/usr/lib --with-moduledir=/usr/lib/dovecot/modules --with-zlib --with-sqlite --with-ssl=openssl --with-ssldir=/etc/ssl --with-gssapi --with-pam --with-bzlib --with-docs --without-mysql --without-vpopmail --without-sia --without-bsdauth --with-libcap --with-ioloop=epoll --with-storages=maildir,mbox,dbox,mdbox For the dbox build error, the log states: libdovecot-storage.so: undefined reference to `dbox_storage' Configure: http://pastie.org/1106301 - Make: http://pastie.org/private/qtt76kxomhmwqwii20oroq Configure: ./configure --prefix=/usr --sysconfdir=/etc/dovecot --localstatedir=/var --libexecdir=/usr/lib --with-moduledir=/usr/lib/dovecot/modules --with-zlib --with-sqlite --with-ssl=gnutls --with-ssldir=/etc/ssl --with-gssapi --with-pam --with-bzlib --with-docs --without-mysql --without-vpopmail --without-sia --without-bsdauth --with-libcap --with-ioloop=epoll For the gnutls build error, the log states quite a few errors, so see the linked logs. Configure: http://pastie.org/1108356 - Make: http://pastie.org/private/dxmmmopnodptut77o6fx2g -- Elisamuel Resto <ryuji(a)codemages.net> http://www.simplysam.us/ - Simply Sam Blog

3 4

[Dovecot] Mobile phone client detects 'PUSH' server
by Ron Leach 22 Aug '10

22 Aug '10

Does Dovecot really provide a 'PUSH' email service? The mobile phone client (standard with SonyEricsson C510, in this case) reported that the server (our Dovecot installation) offered PUSH email service. I hadn't seen that in the documentation that I'd read and had understood the client-server protocol to be a client-PULL service, in that the clients decide which folders to retrieve, and check what messages there are and fetch any new messages. The clients we've used so far have settings for frequency of these checks. I didn't explore the option further, yet, being unsure whether there was a genuine PUSH service from our server or whether the phone was using a proxy somewhere (not ours) which would provide an intermediate fetch/aggregation/'pull then push' service of some sort - perhaps similar to the public offers from Yahoo etc. regards, Ron

2 2