November 2011 - dovecot

[Dovecot] Creating a password_scheme
by Jordi Llonch 16 Nov '11

16 Nov '11

Hello, I am trying to develop a password_scheme for the Django passwords. After building and installing the module in $module_dir/auth/password/djangopass.so, also tried libdjangopass.so and libdjangopass_plugin.so, Dovecot does not recognize the scheme: doveadm pw -l CRYPT MD5 MD5-CRYPT SHA SHA1 SHA256 SHA512 SMD5 SSHA SSHA256 SSHA512 PLAIN CLEARTEXT CRAM-MD5 HMAC-MD5 DIGEST-MD5 PLAIN-MD4 PLAIN-MD5 LDAP-MD5 LANMAN NTLM OTP SKEY RPA SHA256-CRYPT SHA512-CRYPT Please can you help me? Thanks -- Jordi Llonch # 2.0.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.40.3-0.fc15.x86_64 x86_64 Fedora release 15 (Lovelock) ext4 ----------password-scheme-django.c-------------------------- #include <stdio.h> #include <ctype.h> #include <stdlib.h> #include <string.h> #include <dovecot/lib.h> #include <dovecot/hex-binary.h> #include <dovecot/password-scheme.h> #define uchar unsigned char static bool djangopass_verify(const char *plaintext, const char *user, const unsigned char *raw_password, size_t size) { return TRUE; } void djangopass_generate(const char *plaintext, const char *user, const unsigned char **raw_password_r, size_t *size_r) { } struct password_scheme djangopass_scheme = { "DJANGO", PW_ENCODING_BASE64, 0, djangopass_verify, djangopass_generate }; struct module; void djangopass_init(struct module *module) { password_scheme_register(&djangopass_scheme); } void djangopass_deinit(void) { password_scheme_unregister(&djangopass_scheme); } ---------------------------------------------------------------------------

2 1

[Dovecot] setting namespaces using script-login environment in 2.0
by Alexander 'Leo' Bergolth 16 Nov '11

16 Nov '11

Hi! With dovecot 1.x, I was using a post-login script to dynamically add shared mailboxes using NAMESPACE_X.. environment variables, based on filesystem permissions: After login, the post-login script was executed with user permissions (mail_drop_priv_before_exec=yes). It added all subdirectories of "/var/spool/mail/Shared" as namespaces for which the user had write permissions. E.g.: NAMESPACE_2='maildir:/var/mail/Shared/spamrep:INDEX=~/Maildir/index/Shared/spamrep' NAMESPACE_2_PREFIX=Shared/spamrep/ NAMESPACE_2_SEP=/ NAMESPACE_2_TYPE=public NAMESPACE_2_LIST=yes See the attached post-pogin-script for details. After switching to 2.0.14 (using executable script-login -d...), the script actually gets executed but the namespace settings do not seem to be honored. Besides, I don't see any pre-set NAMESPACE_ environment variables anymore. Have environment based namespace settings been abandoned in 2.0? Does Dovecot 2.0 maybe provide a better way to only display those folders, for which the user has at least read permissions? (Unix-permission based) Thanks in advance, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

3 5

[Dovecot] Usage of director without LMTP
by Oliver Eales 16 Nov '11

16 Nov '11

Hello, we want to migrate our dovecot 1.2 installation to verison 2.0 and want to use the director feature of version 2. Currently we have a two tier archtiecture, with dovecot proxys and a mailstore togehter with indexes on NFS. (With the common problems of this setup...) For the final setup we want to utilize the director for all protocols (IMAP,POP,LMTP,SIEVE). During the transition phase we will not be able to use LMTP for mail delivery, but we are still stuck with deliver as LDA. So for mail delivery we will not have the fixed user/server assignment, but rather a random assignment. What NFS- and locking settings should be used on the backend servers in this case. And should i use different settings for the host the deliver is executed than the IMAP/POP3 hosts which are accessed through a director proxy. Thanks in advance, Oliver Eales

2 1

[Dovecot] Invalid "doveadm search" queries not rejected
by Peter Williams 16 Nov '11

16 Nov '11

Hello, I think I've encountered a bug in Dovecot 2.0.9 (as provided on CentOS 6). According to the doveadm-search-query(7) manual page, a "mailbox" specification can only come at the beginning of a search query. However, if I put a mailbox specification in the middle of a query, not only do I not get an error message, I get surprising results: $ doveadm search mailbox A |wc -l 6979 $ doveadm search mailbox B |wc -l 206 $ doveadm search mailbox A OR mailbox B |wc -l 42492 If it became possible to do boolean logic on mailbox queries, that'd be cool. But barring that, these invalid queries should be rejected. Relatedly, if I can only do simple mailbox filtering, does anyone know of a clever way to efficiently emulate more complex boolean logic? Please CC me on any replies as I'm not subscribed to the list. Thanks, Peter -- Peter Williams / peter(a)newton.cx

2 2

[Dovecot] Deleting a mailbox and all its children
by Micah Anderson 16 Nov '11

16 Nov '11

I'm looking at scripting a mechanism to delete a mailbox, which is easy with 'doveadm mailbox delete' -- however it gets complicated when there are children of arbitrary depth, for example, I may have this: restored.daily1.INBOX restored.daily1.Sent restored.daily1.Mystuff restored.daily1.Mystuff.foo I would like to delete the 'restored' mailbox and all its children (and unsubscribe the folders), but the 'doveadm mailbox delete' command wont delete any children. I'm surprised that there isn't a -r (recursive) option to 'doveadm mailbox delete', but perhaps I am missing the easier way to handle this? thanks for any ideas or suggestions! micah --

3 2

[Dovecot] Excessive imap-logins, never die
by Nick Edwards 15 Nov '11

15 Nov '11

Hiya, Today I note there are 38 imap-logins that seem to be stale on our staff imap server, they do not seem to die off, new imap-logins are created with new logins and exit accordingly. Now, these are from our monitoring software that runs on another server on our LAN. Our corporate link was taken down for 2 hours for urgent relocation of fibre (demolishing old adjoining building, and just in case, they needed to move it which we were glad about), so, this begs the question, why would imap-logins be there I guess in some sort of wait state, even with a still working internal DNS (internal view as well) the only difference is no actual internet connection in this time. A week ago when they first started to working and we lost internet for 45 minutes I also saw a few extra stale imap-logins, but after todays events, I decided this is a bigger issue that needs to be looked into, as dovecot required a restart to clear it all (I wasnt going to sit there killing individual PIDs all evening). Dovecot version 1.2.17, built from source

2 2

Re: [Dovecot] default Dovecot-LDA CHGRP/CHMOD
by Chris Young 15 Nov '11

15 Nov '11

I am familiar with this article http://wiki.dovecot.org/LDA#multipleuids I want to disable setuid-root, but I don't know the default group and permissions. sudo chgrp root /usr/libexec/dovecot/dovecot-lda sudo chmod 00750 /usr/libexec/dovecot/dovecot-lda but my delivery is still failing Nov 9 18:22:39 vl42 postfix/pipe[23039]: DEC54700B1: to=<user(a)domain.com>, orig_to=<user(a)domain.com>, relay=dovecot, delay=0.05, delays=0.04/0/0/0.01, dsn=4.3.0, status=deferred (temporary failure. Command output: pipe: fatal: pipe_command: execvp /usr/libexec/dovecot/dovecot-lda: Permission denied ) Thoughts? Thanks Chris

2 2

[Dovecot] Seg fault in dovecot/auth 2.0.15
by Mark Goldey 15 Nov '11

15 Nov '11

Folks: I've been running Dovecot 2.0.7 on a Qmail / Vpopmail installation built on Debian Squeeze, with no problems for about a year. Dovecot is used for IMAP/S auth only. Dovecot is built from source. I just upgraded to 2.0.15 but it segfaults whenever an IMAP auth is attempted, regardless of the user who tries to login, whether by webmail (Roundmail) Android phone (K-9 Mail) or iPad (Roundmail) I downgraded to 2.0.13 but the segfault persisted. Re-installed 2.0.7 and that cleared it right up. Here's the pertinent details from 2.0.15. Anything else I can provide? root@XXX:/# uname -a Linux XXX 2.6.32-5-686 #1 SMP Wed Jan 12 04:01:41 UTC 2011 i686 GNU/Linux root@XXX:/# dovecot -n # 2.0.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-686 i686 Debian 6.0.3 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no first_valid_uid = XXXX last_valid_uid = XXXX log_path = /var/log/dovecot.log mail_debug = yes passdb { driver = vpopmail } protocols = imap service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 } process_limit = 128 vsz_limit = 64 M } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = vpopmail } verbose_ssl = yes Here's a failed login transaction from /var/log/dovecot [snip -- 10 lines or so. The SSL handshake completes OK] Nov 15 14:08:43 auth: Debug: client in: AUTH 1 PLAIN service=imap secured lip=192.xxx.xxx.xxx rip=174.79.xxx.xxxlport=143 rport=55437 resp=XYXYXYXYXYXXYXYXYXYXYXYXYXYX== Nov 15 14:08:43 auth-worker: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Nov 15 14:08:43 auth-worker: Debug: vpopmail(user(a)mydomain.net,174.79.xxx.xxx): lookup user=user domain=domain.net Nov 15 14:08:43 auth: Debug: client out: OK 1 user=user(a)mydomain.net Nov 15 14:08:43 auth: Debug: master in: REQUEST 2710831105 686 1 XYXYXYXYXYXXYYXYXYX Nov 15 14:08:43 auth-worker: Debug: vpopmail(user(a)domain.net,174.79.xxx.xxx): lookup user=user domain=domain.net Nov 15 14:08:43 auth: Error: auth worker: Aborted request: Worker process died unexpectedly Nov 15 14:08:43 master: Error: service(auth-worker): child 690 killed with signal 11 (core dumped) Nov 15 14:08:43 auth: Debug: master out: FAIL 2710831105 Nov 15 14:08:43 imap: Error: Internal auth failure (client-pid=686 client-id=1) Nov 15 14:08:43 imap-login: Info: Internal login failure (pid=686 id=1) (auth failed, 1 attempts): user=<user(a)domain.net>, method=PLAIN, rip=174.79.xxx.xxx, lip=192.xxx.xxx.xxx, mpid=691, TLS Nov 15 14:08:43 imap-login: Warning: SSL alert: where=0x4008, ret=256: warning close notify [174.79.xxx.xxx] Nov 15 14:08:43 auth-worker: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth I ought to mention that /usr/local/lib/dovecot/auth is empty. Here's the backtrace: root@XXX:/# gdb /usr/local/libexec/dovecot/auth /usr/local/var/run/dovecot/core GNU gdb (GDB) 7.0.1-debian [snip] Reading symbols from /usr/local/libexec/dovecot/auth...done. warning: Can't read pathname for load map: Input/output error. Reading symbols from /usr/local/lib/dovecot/libdovecot.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot.so.0 Reading symbols from /lib/i686/cmov/libcrypt.so.1...Reading symbols from /usr/lib/debug/lib/i686/cmov/libcrypt-2.11.2.so...done. (no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libcrypt.so.1 Reading symbols from /home/vpopmail/lib/libvpopmail.so...(no debugging symbols found)...done. Loaded symbols for /home/vpopmail/lib/libvpopmail.so Reading symbols from /lib/i686/cmov/libdl.so.2...Reading symbols from /usr/lib/debug/lib/i686/cmov/libdl-2.11.2.so...done. (no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libdl.so.2 Reading symbols from /lib/i686/cmov/librt.so.1...Reading symbols from /usr/lib/debug/lib/i686/cmov/librt-2.11.2.so...done. (no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/librt.so.1 Reading symbols from /lib/i686/cmov/libc.so.6...Reading symbols from /usr/lib/debug/lib/i686/cmov/libc-2.11.2.so...done. (no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libc.so.6 Reading symbols from /lib/ld-linux.so.2...Reading symbols from /usr/lib/debug/lib/ld-2.11.2.so...done. (no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/i686/cmov/libpthread.so.0...Reading symbols from /usr/lib/debug/lib/i686/cmov/libpthread-2.11.2.so...done. (no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libpthread.so.0 Reading symbols from /home/vpopmail/etc/vpopmail.authmodule...(no debugging symbols found)...done. Loaded symbols for /home/vpopmail/etc/vpopmail.authmodule Core was generated by `dovecot/auth -w'. Program terminated with signal 11, Segmentation fault. #0 0x00000000 in ?? () (gdb) bt full #0 0x00000000 in ?? () No symbol table info available. #1 0x08059890 in auth_worker_handle_user (client=0x82b34d0) at auth-worker-client.c:405 auth_request = 0x82b56e8 userdb_id = 1 #2 auth_worker_handle_line (client=0x82b34d0) at auth-worker-client.c:534 id = 2 #3 auth_worker_input (client=0x82b34d0) at auth-worker-client.c:614 _data_stack_cur_id = 3 line = <value optimized out> ret = 232 #4 0xb785f021 in io_loop_call_io (io=0x82b3688) at ioloop.c:384 ioloop = 0x82a6398 t_id = 2 #5 0xb78600d3 in io_loop_handler_run (ioloop=0x82a6398) at ioloop-epoll.c:213 ctx = 0x82b1f38 event = 0x82b1f78 list = 0x82b36b0 io = 0x829e2b0 tv = {tv_sec = 2147483, tv_usec = 0} msecs = 1 ret = 1 i = 0 j = 0 call = 192 #6 0xb785efa0 in io_loop_run (ioloop=0x82a6398) at ioloop.c:405 No locals. #7 0xb784abaa in master_service_run (service=0x82a62e8, callback=0x805c470 <worker_connected>) at master-service.c:481 No locals. #8 0x0805c828 in main (argc=2, argv=0x82a61c0) at main.c:298 c = <value optimized out> (gdb) --mhg

2 1

[Dovecot] Dovecot SASL on another machine
by Tobias Hachmer 15 Nov '11

15 Nov '11

Hello list, is there a way to use Dovecot SASL Authentication for submission on a different machine dovecot runs? e.g.: Dovecot machine <-> postfix machine(for submission) How can I authenticate my senders on a different physical machine against Dovecot SASL? Thanks, Tobias

3 6

[Dovecot] indexes permissions problem
by Mark Hanford 15 Nov '11

15 Nov '11

Hey all, I did a search but didn't find the answer to my problem, so here goes. I've got a centos 6 server running Dovecot 2.0.beta6 (3156315704ef). For legacy reasons (I'm moving mail from a Dovecot 1.1.1 and FreeBSD box with user home directories NFS mounted), my index files are setup to be in /u/indexes/ On the Dovecot 1.1.1 installation, the perms on the indexes directory is 777 with root:mail ownership. The same thing on the Dovecot 2 / Centos server results in a 'permission denied' error when Dovecot tries to create files. So, I guess my main question is, what perms and ownership should /u/indexes be set to? I've tried several different things before this cry for help... Thanks. Mark

2 1