October 2012 - dovecot

[Dovecot] noisy auth-worker messages in logs (dovecot 2.1.8 FreeBSD)
by Philippe Chevalier 02 Oct '12

02 Oct '12

Hello, I don't know if it's been addressed before, but anyway : In my dovecot setup, I have local and virtual users. So, I need multiple passdb backends. Namely, passwd for the local users and ldap for the virtual users. passdb { driver = passwd } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf driver = ldap } Everything work correctly : when a user logs in (imap/pop3) there's a lookup in passwd and if it fails there's a lookup in ldap (if I understand the process correctly), which eventually succeeds. Except that every time a virtual user logs in, dovecot logs an error, like : dovecot: auth-worker(99126): Error: passwd(xxx(a)domain.org,12.34.254.255): getpwnam() failed: Invalid argument I guess it's because the login is a full email that getpwnam fails. Anyway, the user logs in just fine. But I would like to know if/how I can get rid of the messages filling my logs ? I tried : auth_debug_passwords = no auth_verbose = no But no dice. I used dovecot 1.x before and there was no such messages. Thanks for any advice. K. -- Kyoko Otonashi's shrine / Le temple de Kyoko Otonashi My tribute to Maison Ikkoku / Mon hommage a Maison Ikkoku Visit http://www.kyoko.org/

2 4

[Dovecot] LTMP Proxy fails when backend server connection refused
by Jack Bates 02 Oct '12

02 Oct '12

Version: 2.1.9 Connecting directly to the proxy server on the LMTP port, issue lhlo, mail from, rcpt to, data. After the . closing of data, it just hangs there. The logs on the proxy server show: Sep 27 19:55:12 proxy1 dovecot: lmtp(9398): Connect from 69.8.2.71 Sep 27 19:55:24 proxy1 dovecot: lmtp(9398): Error: lmtp client: connect(lmtp, 7025) failed: Connection refused root 9398 1102 0 19:53 ? 00:00:00 dovecot/lmtp The proxy server is hard coded (not director in this case). I purposefully shut it down to see how the system would handle failures. Unfortunately, it appears that the process just hangs there. For fun, I tried a separate protocol lmtp option in the config to try proxy_timeout. It made no difference. Missing some error handling? protocol lmtp { passdb { driver = static args = proxy=y host=%s nopassword=y proxy_timeout=120 } } Jack

2 5

[Dovecot] Antispam plugin problem (CRM114)
by Davide 02 Oct '12

02 Oct '12

Hi to all, sorry in advance for my poor english, this is the first time that i wrote to a list if i make mistake .... excuseme. My problem is this: i have dovecot 2.1.8 installed and functioning from 2 years one week ago i have installed crm114 for my last spam detection filter "version 20100106-BlameMichelson (TRE 0.8.0 (BSD))" My mail system is qmail that through .qmail default correctly tag with X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-27CA1CFB X-CRM114-CacheID: sfid-20120927_105129_798028_B0035817 X-CRM114-Status: GOOD ( 28.64 ) headers dovecot.conf is as follow: plugin { . . . antispam_signature = X-CRM114-CacheID antispam_verbose_debug = 1 antispam_debug_target = stderr antispam_backend = crm114 antispam_signature_missing = error antispam_trash = Trash antispam_spam = SPAM antispam_unsure = UNSURE antispam_crm_binary = /opt/crm114/mailreaver.crm antispam_crm_args = --fileprefix=/opt/crm114/ . . . } protocol imap { . . . mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = $mail_plugins quota imap_quota mail_log antispam . . . } I have a sieve default compiled script that automatically put mails in SPAM folder or UNSURE folder if respectively in message hedere there is the evaluation of crm114 (UNSURE or SPAM). When i move mails incorrectly tagged by crm (for example from SPAM to my inbox or from UNSURE to SPAM) thunderbird (company official mail client ver 15.01) go in error with the following message: "Operation failed over folder 'UNSURE'. Server for account davide.marchi(a)mail.cgilfe.it said: [CANNOT] Failed to call crm114 binary.." I dont'know where is my mistake if someone can help me is much appreciated Thank you -- */Davide Marchi /Teorema Ferrara Srl /(Tel: /**/+39 0532 783161)/**/ (Fax: +/**/39 0532 783368/**/)/**//**/ /**//**/Davide.Marchi(a)mail.cgilfe.it <mailto:davide.marchi@mail.cgilfe.it?subject=Info> /CONFIDENZIALITA’ *** Questo messaggio, inclusi gli eventuali allegati, è indirizzato solo ai destinatari e può contenere informazioni riservate e confidenziali. Se avete ricevuto il messaggio senza esserne un destinatario, siete pregati di non utilizzare, copiare o distribuire questo messaggio o i suoi allegati. Se avete ricevuto il messaggio per errore, siete pregati di cancellarlo dal vostro sistema, assieme a tutti gli allegati, e di informare immediatamente il mittente,sia ai sensi dell'art. 616 c.p., sia ai sensi del DL n. 196/03. *CONFIDENTIALITY*** This message and any attachments are intended only for the use of the addressee(s) and may contain information that is privileged and/or confidential. If the reader of the message is not the intended recipient(s) or an authorized representative of the intended recipient(s), please do not use, copy, distribute this email or its attachments or take action based on them. If you have received this communication in error, please notify us immediately by email and delete the message and any attachments from your system. *Teorema FerraraSrl - Via Spronello, 7 - 44121 Ferrara Italia - P. IVA 01244490387** P**S**tampa questo messaggio solo se veramente necessario, pensa alla natura! - Please consider whether it is necessary to print this e-mail*

2 17

[Dovecot] BUG to compile dovecot 2.1.10 on Debian 4.0, using gcc 4.1.2
by Fabio Depin 01 Oct '12

01 Oct '12

Hello, Today I needed to compile dovecot 2.1.10 on Debian 4.0, using gcc 4.1.2. When running 'make' getting the following error: -------------------------------------------------- -------- db-checkpassword.c: In function 'sigchld_handler': db-checkpassword.c: 426: error: assignment of read-only member '__in' db-checkpassword.c: 429: error: assignment of read-only member '__in' db-checkpassword.c: 431: error: assignment of read-only member '__in' db-checkpassword.c: 432: error: assignment of read-only member '__in' make [3]: ** [db-checkpassword.o] Error 1 make [3]: ** Waiting for other processes to finish. mv-f .deps / auth-worker-server.Tpo .deps / auth-worker-server.Po make [3]: Leaving directory `/ usr/src/dovecot/dovecot-2.1.7/src/auth ' make [2]: ** [all-recursive] Error 1 make [2]: Leaving directory `/ usr/src/dovecot/dovecot-2.1.7/src ' make [1]: ** [all-recursive] Error 1 make [1]: Leaving directory `/ usr/src/dovecot/dovecot-2.1.7 ' make: ** [all] Error 2 -------------------------------------------------- -------- -To work did the following: -------------------------------------------------- -------- 417a418 + Int stat = status-> status; 426c427 - If (WIFSIGNALED (status-> status)) { --- + If (WIFSIGNALED (stat)) { 429c430 - Dec2str (status-> pid), WTERMSIG (status-> status)); --- + Dec2str (status-> pid), WTERMSIG (stat)); 431.432 c432, 433 -} Else if (WIFEXITED (status-> status)) { - Request-> exit_status WEXITSTATUS = (status-> status); --- +} Else if (WIFEXITED (stat)) { + Request-> exit_status WEXITSTATUS = (stat); -------------------------------------------------- -------- With this change worked perfectly ntanto in debian 4 with gcc 4.1.2, as in debian 6 with gcc 4.4.5. -I wonder if I made the change may affect any function of dovecot, or if it is correct. Thank you for your attention. Fabio Depin

2 1

[Dovecot] Logging IP address for failed login
by Scott Neville 01 Oct '12

01 Oct '12

Hi, I am trying to use the logs to show the IP that brute force activity comes from, but Im not succeeding. I have read the archives and seen the advice others have had. I can see logs for repeated bad logins, but I need the IP address from the attempts. dovecot 2.0.12 / CentOS 5.4 / imaps only (993) I have tried a bunch of different combinations of 10-logging.conf settings. This is what I have currently (that does not work the way I want): auth_verbose = yes #auth_verbose_passwords = no #auth_debug = yes #auth_debug_passwords = no #mail_debug = no I *dont* want to see the passwords, either failed or successful. I just want to see failed logins for whatever reason and the IP they came from. In /var/log/maillog I get lines like this: Oct 1 04:19:12 olive dovecot: auth: pam(marketing): unknown user Oct 1 04:19:17 olive dovecot: auth: pam(marketing): unknown user When i had debugging turned on, I would get lines like this: Sep 9 01:14:59 olive dovecot: auth: Debug: passwd(dbelan,62.128.300.94): lookup but only for successful logins. The brute force attempts dont log like that: Sep 16 00:02:57 olive dovecot: auth: Debug: pam(backup): lookup service=dovecot Sep 16 00:02:57 olive dovecot: auth: Debug: pam(backup): lookup service=dovecot Sep 16 00:02:57 olive dovecot: auth: Debug: pam(backup): #1/1 style=1 msg=Password: Sep 16 00:02:57 olive dovecot: auth: Debug: pam(backup): #1/1 style=1 msg=Password: Sep 16 00:02:57 olive dovecot: auth: Debug: pam(backup): lookup service=dovecot Sep 16 00:02:57 olive dovecot: auth: Debug: pam(backup): #1/1 style=1 msg=Password: Sep 16 00:02:58 olive dovecot: auth: pam(backup): unknown user No IP anywhere in that. fail2ban seems to rely on the pop-login or imap-login lines to pull the IP from. I get an imap-login for my real logins: Oct 1 12:38:56 olive dovecot: imap-login: Login: user=<dbelan>, method=PLAIN, rip=62.128.300.94, lip=204.152.189.165, mpid=20360, TLS but no similar line for the failed logins. So is this a dovecot logging configuration combination I need to find? Is it getting lost in pam? Is it specific to CentOS? Any help appreciated - happy to read up on it myself, but would need a pointer, since the docs so far either assume I get an imap-login line for failed logins which I dont, or they assume I just want to see the repeated attempts/passwords. Scott.

2 1

[Dovecot] BUG to compile Plugin - deleted-to-trash on dovecot 2.1+
by Fabio Depin 01 Oct '12

01 Oct '12

Hello, Today I needed to compile the plugin deleted-to-trash for dovecot 1.2.10 (> 2.1) and had problems compiling. To solve the problem efetuei changes below: -------------------------------------------------- -------------------- deleted-to-trash-plugin.c 79.80 C79 - Mailbox_alloc box = (list, name, MAILBOX_FLAG_KEEP_RECENT | - MAILBOX_FLAG_NO_INDEX_FILES); --- + Box = mailbox_alloc (list, name, MAILBOX_FLAG_NO_INDEX_FILES); 136c135 - If (keywords! = NULL) mailbox_keywords_unref (trash_box, & keywords); --- + If (keywords! = NULL) mailbox_keywords_unref (& keywords); -------------------------------------------------- -------------------- I would like to verify that this is correct, or can generate a problem. Thank you for your attention. Fabio Depin

1 0

[Dovecot] Log NAT IP address?
by Charles Marcus 01 Oct '12

01 Oct '12

Hi Timo/everyone, Currently we are logging the remote IP, but is there a way to show the IP address that the NAT connection is coming from? The reason I ask is, we are changing ISPs, and I would like to see in the logs when an external connection is coming from our OLD ISP connection, and when it is coming through our new one. We have a Watchguard firewall, and I have both External connections setup and working, and have just pointed our DNS records to the new public IP, and would like to be able to see which WAN connection/IP they are coming from. Thanks, -- Best regards, Charles

5 6

[Dovecot] Problem: dovecot-lda doesn't auto-create folders
by Karim 'Kasi Mir' Senoucci 01 Oct '12

01 Oct '12

Hello everyone, I recently updated to dovecot 2.0.19 (in fact, I updated the whole system to Ubuntu 12.04 LTS, I am using the dovecot from the Ubuntu packages) and just today found out that the dovecot-lda for some reason doesn't auto-create missing folders anymore as it did with my old installation (1.0.10). I have a "system users" layout and send my mails through a user-specific procmail filter. Every delivery in those filters is done via dovecot-lda using a line list this: > |$DELIVER -d archive -m lists.hylafax-`date "+%Y%m"` where $DELIVER is set to > DELIVER="/usr/bin/sudo /usr/lib/dovecot/dovecot-lda" (I use the sudo because some of the procmail lines deliver the mail to folders in a different user's mailbox.) This works fine for all users, unless the mail folder to be delivered to doesn't exist yet. Here's an example of such a delivery attempt: > Oct 01 10:57:09 lda: Debug: auth input: archive > system_groups_user=archive uid=1002 gid=1002 home=/home/archive > Oct 01 10:57:09 lda(archive): Debug: Effective uid=1002, gid=1002, > home=/home/archive > Oct 01 10:57:09 lda(archive): Debug: Namespace : type=private, > prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes > location=maildir:/home/archive/Maildir > Oct 01 10:57:09 lda(archive): Debug: maildir++: > root=/home/archive/Maildir, index=, control=, > inbox=/home/archive/Maildir, alt= > Oct 01 10:57:09 lda(archive): Debug: none: root=, index=, control=, > inbox=, alt= > Oct 01 10:57:09 lda(archive): Debug: Destination address: xxx(a)xxxx.de > (source: user@hostname) > Oct 01 10:57:09 lda(archive): Debug: Namespace : > /home/archive/Maildir/.lists.hylafax-201210 doesn't exist yet, using > default permissions > Oct 01 10:57:09 lda(archive): Debug: Namespace : Using permissions > from /home/archive/Maildir: mode=0755 gid=-1 > Oct 01 10:57:09 lda(archive): Debug: Namespace : > /home/archive/Maildir/.lists.hylafax-201210 doesn't exist yet, using > default permissions > Oct 01 10:57:09 lda(archive): Debug: Namespace : Using permissions > from /home/archive/Maildir: mode=0755 gid=-1 > Oct 01 10:57:09 lda(archive): Info: > msgid=<201210010954.02813.hylafax_resp(a)earthshod.co.uk>: save failed > to open mailbox lists.hylafax-201210: Mailbox doesn't exist: > lists.hylafax-201210 > Oct 01 10:57:09 lda(archive): Info: > msgid=<201210010954.02813.hylafax_resp(a)earthshod.co.uk>: saved mail to > INBOX Can anyone tell me what goes wrong here and how to fix it? From what I could find out dovecot-lda should auto-create those mailbox folders, but somehow it doesn't. Any help is appreciated. Thanks in advance Kasi Mir

2 2