October 2011 - dovecot

[Dovecot] Intermittent authentication failures
by Eric Shubert 03 Oct '11

03 Oct '11

I'm running dovecot with vpopmail. Here's the configuration: [root@wong log]# dovecot -n # 2.0.11: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-238.9.1.el5 i686 CentOS release 5.6 (Final) auth_cache_size = 32 M auth_mechanisms = plain login digest-md5 cram-md5 auth_username_format = %Lu first_valid_uid = 89 log_path = /var/log/dovecot.log login_greeting = Dovecot toaster ready. mail_fsync = always mail_nfs_index = yes mail_nfs_storage = yes mmap_disable = yes namespace { inbox = yes location = prefix = separator = . type = private } passdb { args = cache_key=%u webmail=127.0.0.1 driver = vpopmail } plugin/quota = maildir protocols = imap ssl_cert = </var/qmail/control/servercert.pem ssl_key = </var/qmail/control/servercert.pem userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } protocol imap { imap_client_workarounds = delay-newmail } Most clients use TLS and PLAIN login for verification, which works flawlessly. I also run SquirrelMail that is slightly dated and has no TLS capability, so it is using CRAM-MD5. CRAM-MD5 works sometimes: Sep 30 08:15:43 imap-login: Info: Login: user=<userA(a)domain.com>, method=CRAM-MD5, rip=192.168.252.8, lip=192.168.252.14, mpid=20301 but (seemingly more frequently) the authentication fails: Sep 30 08:16:41 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<userA(a)domain.com>, method=CRAM-MD5, rip=192.168.252.8, lip=192.168.252.14 I restarted dovecot, and that apparently cleared the problem for one user, but not others. Is this perhaps a bug in dovecot, or would the problem lie with vpopmail? TIA for any pointers. -- -Eric 'shubes'

2 6

[Dovecot] Multiple LDAP authentication servers
by Romer Ventura 03 Oct '11

03 Oct '11

Hello, We are performing a Domain migration and I was wondering if there was any way to get Dovecot to authenticate to more than 1 LDAP server? Currently dovecot is configure to query the "mail" attribute from Active Directory and when found it binds with the credentials the user provided. This works fine, but when migrating user accounts, they get disabled in the source domain so that the user can no longer log on to it. But disabling the account in the source domain, causes the user to be unable to use his email account. Is there any way to get dovecot to try a second LDAP server if the first one fails to authenticate..? ~# dovecot -n # 1.2.11: /etc/dovecot/dovecot.conf # OS: Linux 2.6.29-xs5.5.0.15 i686 Debian 5.0.4 ext3 log_timestamp: %Y-%m-%d %H:%M:%S protocols: imaps imap ssl_cert_file: /etc/ssl/certs/smtpd.crt ssl_key_file: /etc/ssl/private/smtpd.key login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login login_user: postfix mail_privileged_group: mail mail_uid: vmail mail_gid: vmail mail_location: maildir:/srv/mail/vmail/%Ud/%Ln/Maildir mbox_write_locks: fcntl dotlock imap_client_workarounds: delay-newmail outlook-idle netscape-eoh lda: postmaster_address: postmaster(a)h-st.com auth_socket_path: /var/run/dovecot/auth-master log_path: /var/log/dovecot-deliver.log info_log_path: /var/log/dovecot-deliver-info.log auth default: mechanisms: plain login passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth-client mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail Thanks -------- Romer Ventura

2 4

[Dovecot] clarifications on shared mailboxes
by Frank Bonnet 03 Oct '11

03 Oct '11

Hello I need some clarifications on shared mailboxes. Actually we use MBOX format with "real" unix users , but I've been asked to create some shared mailboxes for some users who need to have some for their working groups. What would be the best way to create those shared mailboxes ? Would it be possible to create some "shared space" on the server in maildir format to get advantage of the last seen flag ? If yes some config examples would be a great help. See attach the doveconf -n output ( certificates names have been obscured ;-) ) Thank you.

1 0

[Dovecot] 1.2.17 Program terminated with signal 11, Segmentation fault.
by Andrew Hearn 03 Oct '11

03 Oct '11

Hello, We've had seg faults a couple of times a day on our servers, we upgraded to 1.2.17 and still have them. running a coredump through dbg says: Reading symbols from /usr/local/libexec/dovecot/imap-login...done. [New Thread 27962] Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fff083f4000 Core was generated by `imap-login -D'. Program terminated with signal 11, Segmentation fault. #0 0x000000000041388b in io_file_unlink (_io=<value optimized out>, closed=true) at ioloop.c:70 70 if (io->next != NULL) dovecot -n is at http://pastebin.ca/SQjrseJD (pass timo) Linux 2.6.18-274.3.1.el5 #1 SMP Tue Sep 6 20:13:52 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux We use NFS for mail store, and ramdisk for dovecot indexes. We do run the mail_log plugin. Let me know if you need any more info though. -- Andrew Hearn. AAISP Technical Support Team Leader Tel: 03333 400999

1 0

[Dovecot] problem with getting outlook to work with IMAP server
by Daminto Lie 03 Oct '11

03 Oct '11

Hi, I am having difficulty in getting the outlook 2010 to connect to my server running on Ubuntu Server 10.04. I can login to Squirrelmail webmail, and am able to send & receive emails through squirrelmail with no problem whatsoever. However, this morning, I was trying to add a new account for the same user on Outlook 2010 and I got the following error from outlook as follows Send test e-mail message: Your outgoing (SMTP) e-mail server has reported an internal error. The server responded: 554 5.7.7 No Spoofing Allowed. I then, went to check /var/log/mail.log and I found the following Oct 3 12:19:27 mymailServer dovecot: auth(default): ldap(sbernett,50.4.39.163): pass search: base=ou=accounts,dc=example,dc=com scope=subtree filter=(&(objectClass=posixAccount)(uid=sbernett)) fields=uid,userPassword,homeDirectory,uidNumber,gidNumber Oct 3 12:19:27 mymailServer dovecot: auth(default): ldap(sbernett,50.4.39.163): result: uid(user)=sbernett uidNumber(userdb_uid)=106 gidNumber(userdb_gid)=106 userPassword(password)={CRYPT}xGHI86Ktls homeDirectory(userdb_home)=/home/vmail/sbernett Oct 3 12:19:27 mymailServer dovecot: auth(default): client out: OK#0111#011user=sbernett Oct 3 12:19:27 mymailServer dovecot: auth(default): master in: REQUEST#0114#0112686#0111 Oct 3 12:19:27 mymailServer dovecot: auth(default): passwd(sbernett,50.4.39.163): lookup Oct 3 12:19:27 mymailServer dovecot: auth(default): passwd(sbernett,50.4.39.163): unknown user Oct 3 12:19:27 mymailServer dovecot: auth(default): master out: USER#0114#011sbernett#011uid=106#011gid=106#011home=/home/vmail/sbernett Oct 3 12:19:27 mymailServer dovecot: imap-login: Login: user=<sbernett>, method=PLAIN, rip=50.4.39.163, lip=50.4.39.164 Oct 3 12:19:27 mymailServer dovecot: IMAP(sbernett): Disconnected in IDLE bytes=9/292 Oct 3 12:19:27 mymailServer postfix/smtpd[2766]: warning: No server certs available. TLS won't be enabled Oct 3 12:19:27 mymailServer postfix/smtpd[2766]: connect from localhost[127.0.0.1] Oct 3 12:19:27 mymailServer postfix/smtpd[2766]: 182292400AE: client=localhost[127.0.0.1] Oct 3 12:19:27 mymailServer postfix/smtpd[2766]: lost connection after DATA (0 bytes) from localhost[127.0.0.1] Oct 3 12:19:27 mymailServer postfix/smtpd[2766]: disconnect from localhost[127.0.0.1] Next, I tried to see if there are any the difference in the mail.log when logging into the squirrelmail (which is working for me) Oct 3 12:31:32 mymailServer dovecot: auth(default): ldap(sbernett,127.0.0.1): pass search: base=ou=accounts,dc=example,dc=com scope=subtree filter=(&(objectClass=posixAccount)(uid=sbernett)) fields=uid,userPassword,homeDirectory,uidNumber,gidNumber Oct 3 12:31:32 mymailServer dovecot: auth(default): ldap(sbernett,127.0.0.1): result: uid(user)=sbernett uidNumber(userdb_uid)=106 gidNumber(userdb_gid)=106 userPassword(password)={CRYPT}xGHI86Ktls homeDirectory(userdb_home)=/home/vmail/sbernett Oct 3 12:31:32 mymailServer dovecot: auth(default): client out: OK#0111#011user=sbernett Oct 3 12:31:32 mymailServer dovecot: auth(default): master in: REQUEST#0114#0112485#0111 Oct 3 12:31:32 mymailServer dovecot: auth(default): passwd(sbernett,127.0.0.1): lookup Oct 3 12:31:32 mymailServer dovecot: auth(default): passwd(sbernett,127.0.0.1): unknown user Oct 3 12:31:32 mymailServer dovecot: auth(default): master out: USER#0114#011sbernett#011uid=1004#011gid=1004#011home=/home/vmail/sbernett Oct 3 12:31:32 mymailServer dovecot: imap-login: Login: user=<sbernett>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured The only thing I noticed different between the two is the IP addresses in rip and lip. Is there a way to tell the IMAP server to allow the remote IP addresses to connect. Here is my dovecot.conf # 1.2.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-34-generic-pae i686 Ubuntu 10.04.3 LTS ext4 log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap listen: *:143 ssl: no disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login verbose_proctitle: yes first_valid_uid: 106 last_valid_uid: 1000 mail_privileged_group: mail mail_location: maildir:/home/vmail/%u/Maildir mbox_write_locks: fcntl dotlock mail_plugins: quota imap_quota imap_client_workarounds: delay-newmail outlook-idle netscape-eoh lda: postmaster_address: postmaster(a)mailtest.dyndns-free.com mail_plugins: quota sendmail_path: /usr/lib/sendmail rejection_reason: Your message to <%t> was automatically rejected:%n%r auth_socket_path: /var/run/dovecot-auth-master auth default: mechanisms: plain login username_format: %Lu verbose: yes debug: yes debug_passwords: yes passdb: driver: pam passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: passwd userdb: driver: static args: uid=106 gid=106 home=/home/vmail/%u allow_all_users=yes socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: mail master: path: /var/run/dovecot-auth-master mode: 432 user: vmail group: vmail plugin: quota: maildir quota_rule: *:storage=3GB quota_rule2: Trash:storage=20%% quota_rule3: Spam:storage=10%% quota_warning: storage=95%% /usr/local/bin/quota-warning.sh 95 quota_warning2: storage=80%% /usr/local/bin/quota-warning.sh 80 Here is my postfix.cf myhostname = mymailserver mydomain = example.com mydestination = localhost.$mydomain,localhost,$mydomain,$myhostname local_recipient_maps = ldap:/etc/postfix/ldap-user-auth.cf virtual_transport = dovecot virtual_mailbox_domains = vexample.com virtual_mailbox_base = /home/vmail virtual_mailbox_maps = hash:/etc/postfix/virtual_mailboxes virtual_minimum_uid = 100 virtual_uid_maps = static:106 virtual_gid_maps = static:106 relayhost = mynetworks = 127.0.0.0/8, 192.168.1.0/24, 50.4.39.163, 50.4.39.164 mynetworks_style = subnet mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all inet_protocols = ipv4 mail_spool_directory = /var/spool/mail smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_exceptions_networks = $mynetworks smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanomymous smtpd_tls_auth_only = yes smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,reject_sender_login_mismatch smtpd_sasl_local_domain = vexample.com dovecot_destination_recipient_limit = 1 Any help would be greatly appreciated. Thank you

1 0

Re: [Dovecot] FTS and compound searches
by Nikolai Schupbach 01 Oct '11

01 Oct '11

>> New subscriber here. I noticed that the FTS index is not used in compound searches. >> Is this expected? Tested in 2.0.0 and 2.0.8: > >Yep. It's been in TODO for a while. I know this thread is quite old, but we have the same issue with v2.0.14 and squat. Would this issue also affect the Solr FTS backend? Thanks, Nikolai.

2 1