July 2011 - dovecot - dovecot.org

[Dovecot] dovecot and tcpwrappers
by Kees Lemmens 23 Aug '11

23 Aug '11

Hi, I used dovecot 1.x for quite a while and it worked fine. However, I used it through inetd and used hosts.allow/deny to restrict access to only certain groups of systems. Since yesterday I have dovecot 2.0.13. But in version 2.0.13 it seems that starting using inetd doesn't work anymore : I only get a strange error message if I try to connect using telnet : telnet localhost imap doveconf: Fatal: execvp(imap-login) failed: No such file or directory I tried a lot of things but couldn't get it going over inetd so I decided to start it directly using an init script, also because you say in the wiki this is (now) the preferred method. That indeed works fine, but I realised today that dovecot is now completely ignoring all my hosts.allow/deny settings and so is worldwide accessible ! Is dovecot indeed ignoring hosts.allow/deny ? And if so, how can I have the same amount of protection as I previously had with dovecot 1.x over inetd ? BTW: I tried to post on the mailinglist but it seems I can't access them it the moment, altough I did subscribe and login. Is there anything wrong ? Thanks for your reply ! -- With best regards, Kees Lemmens. ----------------------------------------------------------------------- Delft Institute of Applied Mathematics (DIAM), Faculty Electrical Engineering, Mathematics and Computer Science, Delft University of Technology, Delft, The Netherlands,

3 5

[Dovecot] zlib plugin doesn't read concatenated .gz mailbox
by Dmitry Nezhevenko 23 Aug '11

23 Aug '11

Hi, I've observed that dovecot doesn't displays all mails from compressed via gzip mailbox (mbox). At the same time "mutt -f mailbox.gz" displays it correctly with all messages. I'm using archivemail to archive old mails. Internally it creates new "gzip" archive with "expired" messages and then concatenates it with archive. The easiest way to reproduce it without archivemail is to create two mailboxes, gzip them independently and then concatenate to one gzip archive. mutt, gunzip and other tools understands such archives. Also I've shared such mbox: http://dion.org.ua/uploads/2011/07/dovecot_test_gzip.gz It should contains ~20 messages. dovecot will "see" only two first. PS. % sudo dovecot --version 2.0.13 -- WBR, Dmitry

2 1

[Dovecot] segfault in dovecot 2.0.9
by Morten P.D. Stevens 18 Aug '11

18 Aug '11

Hi folks, I noticed the following in the dovecot log files: /var/log/maillog Jun 9 00:12:34 mail dovecot: master: Error: service(imap): child 8970 killed with signal 11 (core dumps disabled) Jun 9 00:12:34 mail dovecot: imap-login: Login: user=<username>, method=PLAIN, rip=IP, lip=IP, mpid=8987, TLS Jun 9 00:12:34 mail dovecot: master: Error: service(imap): child 8987 killed with signal 11 (core dumps disabled) /var/log/messages Jun 9 00:12:34 mail kernel: imap[8970]: segfault at 0 ip 00007fe4b2fe432d sp 00007fff29383740 error 4 in libdovecot-storage.so.0.0.0[7fe4b2fb8000+d1000] Jun 9 00:12:34 mail kernel: imap[8987]: segfault at 0 ip 00007f949de1532d sp 00007fff120721b0 error 4 in libdovecot-storage.so.0.0.0[7f949dde9000+d1000] # dovecot -n # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-71.29.1.el6.x86_64 OS: Scientific Linux 6.0 (Red Hat Enterprise Linux 6.0) Filesystem: ext4 I think this is a bug. Any ideas? Best regards, Morten

3 2

[Dovecot] mdbox and doveadm purge
by Morten P.D. Stevens 18 Aug '11

18 Aug '11

Hi, We are currently testing Dovecot 2.0.13 with mdbox. If I delete large objects with refcount=0 the index is not updated apparently. Here's an example: [root@mail-004 storage]# ls -l total 194776 -rw------- 1 vmail vmail 482960 Jul 9 14:58 dovecot.map.index -rw------- 1 vmail vmail 4584 Jul 9 16:06 dovecot.map.index.log -rw------- 1 vmail vmail 32856 Jul 9 14:50 dovecot.map.index.log.2 [root@mail-004 mdbox]# du storage/ 194788 storage/ [root@mail-004 mdbox]# doveadm dump /var/vmail/example.org/user/mdbox/storage/ | grep 'ref.*\b0\b' - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) [root@mail-004 mdbox]# doveadm purge -A [root@mail-004 mdbox]# du storage/ 142072 storage/ [root@mail-004 mdbox]# doveadm dump /var/vmail/example.org/user/mdbox/storage/ | grep 'ref.*\b0\b' - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) - ext 3 ref : 0 (0000) [root@mail-004 mdbox]# cd storage/ [root@mail-004 storage]# ls -l total 142060 -rw------- 1 vmail vmail 482960 Jul 9 14:58 dovecot.map.index -rw------- 1 vmail vmail 4584 Jul 9 16:06 dovecot.map.index.log -rw------- 1 vmail vmail 32856 Jul 9 14:50 dovecot.map.index.log.2 [root@mail-004 mdbox]# doveadm purge -A [root@mail-004 mdbox]# cd storage/ [root@mail-004 storage]# ls -l total 142060 -rw------- 1 vmail vmail 482960 Jul 9 14:58 dovecot.map.index -rw------- 1 vmail vmail 4936 Jul 9 16:12 dovecot.map.index.log -rw------- 1 vmail vmail 32856 Jul 9 14:50 dovecot.map.index.log.2 [root@mail-004 storage]# doveadm dump /var/vmail/example.org/user/mdbox/storage/ | grep 'ref.*\b0\b' [root@mail-004 storage]# The index is updated only after the second run of doveadm purge -A ? Best regards, Morten

3 2

[Dovecot] [PATCH] net_connect_*(): Wait for fd to complete connect(2) when fd is non-blocking
by SATOH Fumiyasu 15 Aug '11

15 Aug '11

Hi, Dovecot ignores EINPROGRESS on connect(2) for non-blocking fd. This is wrong. After that, read(2) to fd (or write(2) to fd) fails with ENOTCONN if the connection of fd is not completed. The attached patch fixes this problem. -- -- Name: SATOH Fumiyasu (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- Personal Home: http://www.SFO.jp/blog/

2 4

[Dovecot] Parallel auth
by Bernhard Schmidt 15 Aug '11

15 Aug '11

Hello, we run a Dovecot 2.0.13 instance purely as SASL backend for Postfix, authenticating against a local passwd-file and our central LDAP database. # dovecot -n # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32.36-0.5-default x86_64 SUSE Linux Enterprise Server 11 # (x86_64) auth_mechanisms = plain login auth_verbose = yes passdb { args = /etc/dovecot/dovecot-passwd driver = passwd-file } passdb { args = /etc/dovecot/dovecot-ldap-simauth.conf.ext driver = ldap } protocols = none service auth { unix_listener /var/spool/postfix-postout/private/auth { group = postfix mode = 0660 user = postfix } } ssl = no There is only a single user in the passwd-file for monitoring. We monitor authentication delays for both this local user and one user from LDAP. Due to a firmware bug, our six-figures NAS causes extremely high LDAP delays (in the range of 20-60 seconds, instead of the usual 50ms) once an hour. The weird thing is, I also see these delays in the graph for the local user. Which got me thinking * are authentication requests handled serially by dovecot/auth? * any way to solve this situation for the local user (not to be blocked by the delayed LDAP query)? * any way to solve this situation for LDAP users? We could possibly do some loadbalancing if the auth-daemon opened several LDAP connections Thanks, Bernhard

2 1

[Dovecot] How to "scramble" emails
by Vincent Richomme 15 Aug '11

15 Aug '11

Hi, I am working on a webmail project using dovecot as imap server and I would need to make a demo however I don't want to show all my emails addresses. So my question is knowing that I am using the maildir format, would it ne possible to do a kind of search and replace of all emails/cc/to and replace them by fake ones or will it break something like indexes ? Thanks

2 1

[Dovecot] dovecot crashes after reloading service
by Alan Morais 15 Aug '11

15 Aug '11

Hello, I just made a fresh install of dovecot using Iredmail, and works just fine, but, after changing a parameter on /etc/dovecot.conf, and reloading service, the daemon crashes, with the message as follows: * restarting the service instead of reload works fine. ############# Error message dovecot: Panic: file dict-process.c: line 154 (dict_listener_input): assertion failed: (listener->process es == NULL) Jul 22 10:50:52 dovecot: Error: Raw backtrace: /usr/sbin/dovecot [0x805adb0] -> /usr/sbin/dovecot [0x805ae93] -> /usr/sbi n/dovecot [0x80529c6] -> /usr/sbin/dovecot [0x805a65c] -> /usr/sbin/dovecot [0x804cd60] -> /usr/sbin/dovecot [0x805ece0] -> /usr/sbin/dovecot [0x805ddc8] -> /usr/sbin/dovecot [0x805337d] -> /lib/i686/nosegneg/libc.so.6(__libc_start_main+0xdc) [0x6cce9c] -> /usr/sbin/dovecot [0x804a571] ############## Commands executed included parameter "login_greeting =xxxxxxxxxxxxxx" on dovecot.conf /etc/init.d/dovecot reload ##################### config [root@correio221 ~]# dovecot -n # 1.2.16: /etc/dovecot.conf # OS: Linux 2.6.18-128.el5xen i686 CentOS release 5.3 (Final) nfs log_path: /var/log/dovecot.log protocols: pop3 pop3s imap imaps managesieve listen(default): * listen(imap): * listen(pop3): * listen(managesieve): *:2000 ssl_ca_file: /etc/pki/tls/certs/iRedMail_CA.pem ssl_cert_file: /etc/pki/tls/certs/iRedMail_CA.pem ssl_key_file: /etc/pki/tls/private/iRedMail.key login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_executable(managesieve): /usr/libexec/dovecot/managesieve-login login_greeting: SIANET POP/IMAP login_process_size: 512 login_processes_count: 128 login_max_processes_count: 256 login_max_connections: 1024 max_mail_processes: 256 first_valid_uid: 5000 last_valid_uid: 5000 mail_uid: 5000 mail_gid: 5000 mail_location: maildir:/home/vmail/%d/%Ln/Maildir mmap_disable: yes mail_nfs_storage: yes mail_nfs_index: yes lock_method: dotlock mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_executable(managesieve): /usr/libexec/dovecot/managesieve mail_process_size: 512 mail_plugins(default): quota imap_quota autocreate mail_plugins(imap): quota imap_quota autocreate mail_plugins(pop3): quota mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 mail_plugin_dir(managesieve): /usr/lib/dovecot/managesieve imap_client_workarounds(default): tb-extra-mailbox-sep imap_client_workarounds(imap): tb-extra-mailbox-sep imap_client_workarounds(pop3): imap_client_workarounds(managesieve): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh pop3_client_workarounds(managesieve): namespace: type: private prefix: INBOX. inbox: yes list: yes subscriptions: yes lda: postmaster_address: root auth_socket_path: /var/run/dovecot/auth-master mail_plugins: quota sieve autocreate sieve_global_path: /home/vmail/sieve/dovecot.sieve log_path: /var/log/sieve.log auth default: mechanisms: plain login default_realm: sianet.com.br user: vmail verbose: yes passdb: driver: sql args: /etc/dovecot-mysql.conf userdb: driver: sql args: /etc/dovecot-mysql.conf socket: type: listen client: path: /var/spool/postfix/dovecot-auth mode: 438 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 438 user: vmail group: vmail plugin: quota_warning: storage=85%% /usr/local/bin/dovecot-quota-warning.sh 85 quota_warning2: storage=90%% /usr/local/bin/dovecot-quota-warning.sh 90 quota_warning3: storage=95%% /usr/local/bin/dovecot-quota-warning.sh 95 quota: maildir quota: dict:user::proxy::quotadict quota_rule: *:storage=0 expire: Trash 7 Trash/* 7 Junk 30 expire_dict: proxy::expire auth_socket_path: /var/run/dovecot/auth-master sieve_global_dir: /home/vmail/ sieve_before: %Lh/dovecot.sieve.before sieve: /%Lh/dovecot.sieve sieve_global_path: /home/vmail/dovecot.sieve global_script_path: /home/vmail/dovecot.sieve autocreate: INBOX autocreate2: INBOX.Sent autocreate3: INBOX.Trash autocreate4: INBOX.Drafts autocreate5: INBOX.Junk autosubscribe: INBOX autosubscribe2: INBOX.Sent autosubscribe3: INBOX.Trash autosubscribe4: INBOX.Drafts autosubscribe5: INBOX.Junk dict: expire: db:/var/lib/dovecot/expire/expire.db quotadict: mysql:/etc/dovecot-used-quota.conf Thanks in advance. -- Alan Morais Analista de Suporte Fone: (11) 2125-9222 E-mail: alan.morais(a)sianet.com.br [1] Links: ------ [1] http://www.sianet.com.br

2 1

[Dovecot] director monitoring?
by Kelsey Cummings 05 Aug '11

05 Aug '11

I'm working the kinks of a new director based setup for the eventual migration away from courier. At this point, with everything basically working I'm trying to ensure that things are properly monitored and I've run into an issue. There doesn't appear to be a way to get dovecot to tell if it is (or is not) connected and properly synced with the other director servers in the ring apart from the logs. It seems like this is an important piece of information -- without it, it isn't apparent how you would be able to tell if your director servers have lost track of each other. I'm also curious what people are doing to health check their director servers when they are running load balancing upstream of them as well. It doesn't seem like it is a good idea to let the load balancers check all the way through to the real servers since a failure on the target real server could end up leading to a director being dropped from the pool (if so, it is most likely that the other directors would be dropped as well.) Otherwise, the health check failure tolerance at the load balancer must be greater than the tolerance for failure of the real servers on the director- a dead director could end up in the pool for longer than desired, or anyway, long enough to be sure that it isn't a transient failure on the real server behind it. A better method would seem to be for the load balancers to query the director for the number of active back-end servers and, so long as it was over a given threshold, to assume that the director is otherwise able to do its job and rely on external monitoring to pickup internal failures where dovecot isn't able to successfully proxy the connection to one of the real servers. So, how are people doing this in the real world? -- Kelsey Cummings - kgc(a)corp.sonic.net sonic.net, inc. System Architect 2260 Apollo Way 707.522.1000 Santa Rosa, CA 95407

3 5

[Dovecot] [BUG?] LDAP authentication with aliases issues
by Paweł Lęcznar 04 Aug '11

04 Aug '11

Hello, I am trying to configure Dovecot with LDAP authentication. My LDAP tree structure is as following: dc=root,dc=pl \_ ou=Users \_ uid=test \_ ou=Mail \_ ou=domain.pl \_ uid=alias_to_test I cannot authenticate using 'uid=alias_to_test,ou=domain.pl,ou=Mail,dc=root,dc=pl'. If I try to authenticate using 'uid=alias_to_test,ou=domain.pl,ou=Mail,dc=root,dc=pl', following entry appears in the Dovecot's log file: #v+ auth: Debug: client in: AUTH 1 PLAIN service=imap secured lip=127.0.0.1 rip=127.0.0.1 lport=993 rport=59818 resp=YWxpYXMxQGFsaWFzeS5wbABhbGlhczFAYWxpYXN5LnBsAGFzZHF3ZWFzZA== auth: Debug: ldap(alias_to_test(a)domain.pl,127.0.0.1): pass search: base=uid=alias_to_test,ou=domain.pl,ou=Mail,dc=root,dc=pl scope=base filter=(&(objectClass=posixAccount)) fields=uid,userPassword auth: Debug: auth(alias_to_test(a)domain.pl,127.0.0.1): username changed alias_to_test(a)domain.pl -> test auth: Debug: ldap(test,127.0.0.1): result: uid(user)=test userPassword(password)={CRYPT}ACnZvF4.K46UI auth: Debug: client out: OK 1 user=test auth: Debug: ldap(test,127.0.0.1): user search: base=uid=test,ou=,ou=Mail,dc=root,dc=pl scope=base filter=(&(objectClass=posixAccount)(uid=test)) fields=homeDirectory,uidNumber,gidNumber auth: Debug: master out: FAIL 2551840769 #v- In the LDAP server log file, following entries appear during authentication attempt #v+ ldap slapd[11729]: conn=1125 op=0 BIND dn="cn=Manager,dc=root,dc=pl" method=128 ldap slapd[11729]: conn=1125 op=0 BIND dn="cn=Manager,dc=root,dc=pl" mech=SIMPLE ssf=0 ldap slapd[11729]: conn=1125 op=0 RESULT tag=97 err=0 text= ldap slapd[11729]: conn=1125 op=1 SRCH base="uid=alias_to_test,ou=domain.pl,ou=Mail,dc=root,dc=pl" scope=0 deref=3 filter="(&(objectClass=posixAccount))" ldap slapd[11729]: conn=1125 op=1 SRCH attr=uid userPassword ldap slapd[11729]: conn=1125 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= ldap slapd[11729]: conn=1125 op=2 do_search: invalid dn: "uid=test,ou=,ou=Mail,dc=root,dc=pl" ldap slapd[11729]: conn=1125 op=2 SEARCH RESULT tag=101 err=34 nentries=0 text=invalid DN #v- It seems that LDAP AuthDatabase doesn't change the context when looking up for the target object, to which the alias points. Futhermore, the filter for the target object '(&(objectClass=posixAccount)(uid=test))' was not defined by me anywhere in the configuration file 'dovecot-ldap.ext'. I have tried both authentication ways: 'password lookups' and 'authentication binding' with the same result. However, There is no problem to authenticate as 'uid=test,ou=Users,dc=root,dc=pl' (of cource after modifying the configuration file listed at the end). I suppose that it can be a bug in LDAP AuthDatabase, so I am writing this post as a potential bug report. Below are my configuration data: *************** # dovecot -n # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.38.8-1 x86_64 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = plain listen = * mail_debug = yes mail_gid = 2000 mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)domain.pl protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/openssl/certs/vmail.pem ssl_key = </etc/openssl/private/vmail.key userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_ssl = yes *************** # cat /etc/dovecot/dovecot-ldap.ext uris = ldap://X.Y.Z.V/ dn = cn=Manager,dc=root,dc=pl dnpass = password auth_bind = no ldap_version = 3 base = uid=%n,ou=%d,ou=Mail,dc=root,dc=pl deref = always scope = base pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=posixAccount)) default_pass_scheme = CRYPT

1 1