October 2011 - dovecot

[Dovecot] Glued-together private namespaces
by Mark Moseley 16 Nov '11

16 Nov '11

I've been goofing with this all day with 2.0.15 and I'm starting to realize that either a) I'm not that smart, b) it's been so long since I messed with namespaces that I'm going about it completely wrong, or c) it's just not possible. I haven't posted 'doveconf -n' and other details, because mainly I'm just looking for 'yes, this is possible' or 'no, you're smoking crack' before posting further details. At this point, it's all maildir and moving to mdbox, while highly desirable in the future, is not possible in the near- to medium-term. I'm trying to glue a namespace underneath INBOX: namespace INBOX { type = private separator = . prefix = INBOX. # Yes, this used to be on Courier inbox = yes list = yes hidden = no subscriptions = yes location = maildir:~/Maildir } namespace archive { type = private separator = . prefix = INBOX.Archives. inbox = no list = children subscriptions = yes location = maildir:~/Maildir-Archive } I've tried putting namespace archive's 'prefix' as just "Archives", but Tbird doesn't seem to see this namespace, regardless of how much I futz with the imap settings in tbird. With the above setup, it actually seems to work correctly (provided ~/Maildir-Archive exists), though I'm sure a big gotcha is waiting in the wings. I can move messages around, create subfolders, subscribe to folders in ~/Maildir-Archive). The only thing I can't seem to get working is quotas. With my password_query like: password_query = ... CONCAT( '*:bytes=', "1M" ) AS 'userdb_quota_rule', \ CONCAT( '*:messages=10' ) AS 'userdb_quota_rule2', \ CONCAT( 'INBOX.Archives:bytes=+4900M' ) AS 'userdb_quota_rule3', \ CONCAT( 'INBOX.Archives:messages=+3900' ) AS 'userdb_quota_rule4' ... only the default quota seems to be in place for any subfolder of INBOX.Archives and for INBOX.Archives itself, i.e. *:bytes still applies to INBOX.Archives. The debug log show that: Debug: Quota root: name=User quota backend=maildir args= Debug: Quota rule: root=User quota mailbox=* bytes=1048576 messages=0 Debug: Quota rule: root=User quota mailbox=* bytes=1048576 messages=10 Debug: Quota rule: root=User quota mailbox=INBOX.Archives bytes=+5138022400 messages=0 Debug: Quota rule: root=User quota mailbox=INBOX.Archives bytes=+5138022400 messages=+3900 These are wildly stupid quotas but they're just there to test. With INBOX already at capacity (byte-wise; only set to a meg), copying large messages inside INBOX.Archives fails (only copying a 800k message but the quota should be 5gig now). Again, before I post configs, I'm just curious if what I'm trying to do isn't remotely possible, or that I'm approaching this entirely wrongly. Thanks!

2 6

[Dovecot] setting namespaces using script-login environment in 2.0
by Alexander 'Leo' Bergolth 16 Nov '11

16 Nov '11

Hi! With dovecot 1.x, I was using a post-login script to dynamically add shared mailboxes using NAMESPACE_X.. environment variables, based on filesystem permissions: After login, the post-login script was executed with user permissions (mail_drop_priv_before_exec=yes). It added all subdirectories of "/var/spool/mail/Shared" as namespaces for which the user had write permissions. E.g.: NAMESPACE_2='maildir:/var/mail/Shared/spamrep:INDEX=~/Maildir/index/Shared/spamrep' NAMESPACE_2_PREFIX=Shared/spamrep/ NAMESPACE_2_SEP=/ NAMESPACE_2_TYPE=public NAMESPACE_2_LIST=yes See the attached post-pogin-script for details. After switching to 2.0.14 (using executable script-login -d...), the script actually gets executed but the namespace settings do not seem to be honored. Besides, I don't see any pre-set NAMESPACE_ environment variables anymore. Have environment based namespace settings been abandoned in 2.0? Does Dovecot 2.0 maybe provide a better way to only display those folders, for which the user has at least read permissions? (Unix-permission based) Thanks in advance, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

3 5

[Dovecot] Managing public folder ACL files
by Keith Edmunds 14 Nov '11

14 Nov '11

We have a customer with a large public folder hierarchy. They occasionally make requests to have the public folder ACLs changed; for example: "please give user X access to all public folders" (that's nearly 1700 folders). Worse: "please give user Y access to all sales folders" (there are 1450 sales folders). The problem is that there are (naturally) spaces in the folder names, which makes command line manipulation challenging. We've ended up with some astonishingly hacky Python scripts that enter each folder starting with (for example) ".sales" and replacing the dovecot-acl file to try to fulfil the above requests. One day our script are going to get it wrong, or requests will become more complex ("give X access all sales/CustA folders, Y access to all sales/CustB folders, and Z access to all sales folders). There must be a Better Way. How do others manage divergent ACLs within large public folder hierarchies? Thanks, Keith

5 4

[Dovecot] Restarting dovecot periodically fails with "Socket already exists: /var/run/dovecot/anvil"
by James Page 11 Nov '11

11 Nov '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello restarting dovecot regularly fails with version 2.0.13 on Ubuntu 11.10 due to a running child process exiting after the main dovecot process. Oct 13 15:04:58 ubuntu dovecot: master: Error: service(anvil): Socket already exists: /var/run/dovecot/anvil Oct 13 15:04:58 ubuntu dovecot: master: Error: service(anvil): Socket already exists: /var/run/dovecot/anvil-auth-penalty Oct 13 15:04:58 ubuntu dovecot: master: Fatal: Failed to start listeners Oct 13 15:04:58 ubuntu kernel: [11132.825253] init: dovecot main process (8668) terminated with status 89 The dovecot/anvil process appears to be the cause of the problem (snapshot of running dovecot processes just after main dovecot process stops): root 8418 8080 0 15:02 pts/0 00:00:00 stop dovecot root 8419 1 0 15:02 ? 00:00:00 dovecot/anvil root 8422 8420 0 15:02 ? 00:00:00 grep dovecot This is an Ubuntu specific issue as we use upstart to manage dovecot which monitors the status of the main dovecot process; the Debian init script appears to make provision for this happening. I can work around this in the upstart configuration but it does look like a potential bug in the sub-process handling in dovecot. Any help much appreciated - please feel free to comment on https://bugs.launchpad.net/ubuntu/+source/dovecot/+bug/873390 as well. Regards - -- James Page Ubuntu Core Developer - ----------------------------------- dovecot -n # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 3.0.0-12-generic-pae i686 Ubuntu 11.10 mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 sieve ssl_cert = </etc/ssl/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 10 } protocol pop3 { mail_max_userip_connections = 10 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCAAGBQJOlwAJAAoJEL/srsug59jD1e4QAIB0/OhBhgr7HYqJNh3d1f69 8vGl6LSb2jjJb6bI+GX8QRHDDHXs6g3RadpHTEnDngJPLRPJxnnmr/mqcG+sAeYa 92shRyWnZQFEHJkl9hE1t1OS7skpLezWgSl6nOtzkRxm3yB0+w81PyQZVH2QArKf dATww3t0hMd3ybPEJnZwSlIQ/82i79qd8RZd1orERdIKN1wIyhb2uOi1XXBvGHZo hZKhO1sv3vz1RLpJXeWIVUNK8RQHJcvAOdqvTeT7kzx1gdxy3ycr7WOTUFY3Nc83 SYFyV9/miSNc45n+eDnsoknwggn0JWMkMA1jzRQz9OGCWFkJVFIuOE9jwJcFP6HY +8OnWwgdu5qNQ6nrn4+M1dB1MrFV5aFQmSuXsuAFXkCYywajdVhNyTkC8wERUBf1 NMv4PQRP0tA/UOOy9qNnNf9y3kQ1ItJ5ZhBTOO5WctnowYHDTWtnoxD7m0aEM1rA NH1TFolUgeiT6B9xFcreq42qEVYItKV60o2gv8fMDXwtkSjfDfJ2/88/45dcTOuK t+qUZnpI+AgCak7AfYShj1SjYN80BbpPpQ0WtG6MObXBZZl84paNpAUibUfN0tPy cEscYqUhkkptbfenJe3ldz0S2AhlrDTFk3cWGKwwlKY+29vBsoZtbgIamgrOKLX9 AbdvqFx8gnYe5af1k3eL =6Mfk -----END PGP SIGNATURE-----

2 2

[Dovecot] LDAP expired password
by roberto palmarin 10 Nov '11

10 Nov '11

hi all, I'm using postfix, LDAP, dovecot and horde for webmail. user and password information is stored in LDAP. I'm attempting to get password aging working properly and am not having much luck. even if password has expired user can login, can i tell dovecot to control the LDAP field shadowexpired? or is there some other way to check properly that the password is expired before allowing the user log in? thank's /roby

4 5

[Dovecot] Attachements with SIS : shauld all the same files share the same inode ?
by Yann Dupont 08 Nov '11

08 Nov '11

Hello. I configured SIS , and all seems to work well, but I noticed something strange : For exemple, this attachement : 6e/2d# ls -al 6e2df299* | sort -n 104 instance of -rw------- 104 vmail vmail 346584 16 oct. 17:47 6e2df299fa96daec9b4735d07c494046429be4d6-ffd0d1xxxx The files are hardlinked, so it seems ok, but I also see 9 others files in the same directory : -rw------- 1 vmail vmail 346584 16 oct. 17:47 6e2df299fa96daec9b4735d07c494046429be4d6-0519df2a94fc9a4e1f4100008a6b99b6 -rw------- 1 vmail vmail 346584 16 oct. 17:47 6e2df299fa96daec9b4735d07c494046429be4d6-1790b92994fc9a4e1a4100008a6b99b6 as you can see, same prefix, If I compare them with diff, they are all the same files. ls -i show that 104 have the same inode, as expected, and the 9 remaining files have different inodes. I expected all the files share the same inodes. Is there something wrong here ? My setup is debian squeeze + auto packages from http://xi.rename-it.nl/debian/ dovecot is 2:2.0.15-0~auto+21 thanks, -- Yann Dupont - Service IRTS, DSI Université de Nantes Tel : 02.53.48.49.20 - Mail/Jabber : Yann.Dupont(a)univ-nantes.fr

2 2

[Dovecot] Accessing a strange mailbox
by Micah Anderson 07 Nov '11

07 Nov '11

I have a user who has a mailbox called: A----->B It seemed to work in courier fine, they managed to create it, and there are mails in it. However, dovecot is not letting the user access it, the IMAP server gives an error. I tried to rename it but I would also get an error: # doveadm mailbox rename A-----\>B AtoB doveadm(root): Error: Can't rename mailbox A----->B to AtoB: Mailbox doesn't exist: A----->B # doveadm mailbox rename A----->B AtoB doveadm(root): Error: Can't rename mailbox A----- to AtoB: Mailbox doesn't exist: A----- # doveadm mailbox rename 'A----->B' AtoB doveadm(root): Error: Can't rename mailbox A----->B to AtoB: Mailbox doesn't exist: A----->B # doveadm mailbox rename "A----->B" AtoB doveadm(root): Error: Can't rename mailbox A----->B to AtoB: Mailbox doesn't exist: A----->B # How can I deal with this mailbox (using mdbox here)? Thanks! --

3 2

[Dovecot] Safely restoring backups
by Micah Anderson 05 Nov '11

05 Nov '11

I'm trying to determine what the best way to restore mail with mdbox is. Restoring using maildir was trivial, I just used rsync --ignore-existing which wrote any mails that were removed and didn't touch things that already existed[1]. With mdbox things have become more complicated, and I haven't found a way to restore mail that doesn't result in many message duplicates. My backup setup is simple, I'm doing daily rsync backups of user's mailstores, as well as weekly backups, so I end up having on my backup server daily.1, daily.2, daily.3, daily.4, weekly.1, weekly.2... each containing the entire contents of the user's mdbox. The different restore methods I've tried are: 1. I tried rsyncing the different backup directories back to the mail storage host, and then doing: 'dsync -R backup -u $user mdbox:/path/to/to/daily.1/mdbox'[2] 'dsync -R backup -u $user mdbox:/path/to/to/daily.2/mdbox' This works ok, but it gives duplicates of every mail that already exists for every daily/weekly I dsync. This is what the rsync --ignore-existing avoided. This is particularly annoying if I restore the weekly, and multiple daily directories, because then you get a copy for every one you restore. I had thought that the individual message's GIDs would keep them from being duplicated? 2. I also tried to use 'doveadm import' in two different ways. The first way I created a 'restored_from_backups' folder and then import each of the daily.#, weekly.# mdboxes into their own subfolder within that folder, for example: 'doveadm import -u $username mdbox:/path/to/daily.1/mdbox restored_from_backups/daily1 all' 'doveadm import -u $username mdbox:/path/to/daily.2/mdbox restored_from_backups/daily2 all' ... etc. I then go through and subscribe the new folders[3] and the user ends up with a folder structure like this: restored_from_backups/ daily.1/ INBOX Trash folder1 folder2 daily.2 INBOX Trash folder1 folder2 etc. This works fine, except that it results in the user having a entire duplicate copies of their mailbox for each daily/weekly that I restore. That will quickly bring people over quota. 3. I also tried to use 'doveadm import' to import all the different directories all into the same restored_from_backups directory, so there are no subdirectories for each daily/weekly under restored_from_backups, like so: 'doveadm mailbox create -u $user -s restored_from_backups' 'doveadm -v -D import -u $user mdbox:/path/to/daily.1/mdbox restored_from_backups all' I then go through and subscribe the folders[3]. Using this method, the 'restored_from_backups' mailbox is created, and populated with the folders. The only problem with this method is the same as method #1: for every backup I restore, mails are duplicated. Is there a way I can restore things from backup and avoid duplicates? Is there another method I should try? thanks for any ideas, pointers, suggestions for improvement, etc. micah 1. this would of course bring back mails that were deleted, but that was fine as the user could deal with that. 2. yes, I know I could setup dsync on the backup server, and use dsync directly to pull the mails from there, but this is complicated in my situation due to how the backupserver works. 3. why doesn't doveadm import have a -s option to subscribe? --

2 1

[Dovecot] dsync with quotas
by Micah Anderson 05 Nov '11

05 Nov '11

I have been working on converting people from courier maildir -> dovecot mdbox and during some of the dsync runs I'm seeing the quota_exceeded_message be printed as an Error: dsync(<user>): Error: Can't save message to mailbox INBOX: You are over quota. To avoid losing mail, immediately empty your Trash and Sent folders and \ delete emails with large attachments. dsync(<user>): Info: INBOX: Couldn't keep all uids^M Its possible the user was over quota on the originating courier side, but I would still like to migrate their mail proprely to mdbox, but it seems like being over quota is inhibiting that. Are the quota calculations including both the maildir files as well as the converted mdbox files, resulting in a double counting? I'm not entirely sure if the messages above indicate that the migration failed for that user or not, so I've been manually increasing their quota, then redoing the dsync mirror until it works properly. I wonder if it would be better if I turned off quota entirely during migration so I don't run into this problem? thanks, micah --

2 2

[Dovecot] Group ACL
by Daniel L. Miller 05 Nov '11

05 Nov '11

Using Dovecot 2.0, LDAP userdb & passdb, with prefetch: hosts = myhost.mydomain dn = cn=x,cn=y dnpass = xyz123 auth_bind = yes auth_bind_userdn = uid=%n,ou=users,dc=x ldap_version = 3 base = ou=Users, dc=x user_attrs = =home=/var/mail/%d/%n, \ =mail=mdbox:/var/mail/%d/%n/mdbox, \ =uid=vmail, \ =gid=mail user_filter = (&(objectClass=inetOrgPerson)(mail=%u)) pass_attrs = mail=user, \ userPassword=password, \ =userdb_home=/var/mail/%d/%n, \ =userdb_mail=mdbox:/var/mail/%d/%n/mdbox, \ =userdb_uid=vmail, \ =userdb_gid=mail, \ =userdb_acl_groups='allshared' pass_filter = (&(objectClass=inetOrgPerson)(mail=%u)) iterate_attrs = mail=user iterate_filter = (&(objectClass=inetOrgPerson)(mail=*)) default_pass_scheme = plain I have added permissions for "$allshared" to a mailbox's Inbox. It does not appear in the shared folders list. Other mailboxes, with explicit permission for a given username, work fine. What am I doing wrong? -- Daniel

2 1