October 2012 - dovecot

[Dovecot] Problem about SSL for Dovecot.
by sheng-wei.lim 30 Oct '12

30 Oct '12

Hi All, With the below setting (cropped), the ssl certificate(signed by godaddy) don’t seems to work. It will still ask me if I want to accept this certificate. I have use the same certificate for apache host and postfix it works without any prompt. dovecot version : 2.0.19 # OS: Linux 3.2.0-32-generic-pae i686 Ubuntu 12.04.1 LTS Dovecot config: ssl = required ssl_cert = </aaa/4/merged5.crt ssl_key = </certs/proximityjobs.key userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } verbose_ssl = yes protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/sieve.log mail_plugins = quota sieve autocreate acl postmaster_address = root } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota autocreate acl imap_acl } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } Best Regards, Sheng Wei

1 0

[Dovecot] Save/restore IMAP session state
by Timo Sirainen 30 Oct '12

30 Oct '12

Some future Dovecot version will have "imap-idle" processes where IDLEing IMAP connections get moved, so the system wouldn't waste so much memory for all the IDLEing imap processes. A week ago I thought I'd see how easy it would be to implement this. I got a basic proof of concept working as a "X-STATE" command. Save the state: a x-state * STATE AQDLW45QdwAAAAMAAABuAQAAAAAAAFAcffYAPHnpFctbjlDbYQAAcEmzCwAA a OK State exported. Restore the state: b x-state AQDLW45QdwAAAAMAAABuAQAAAAAAAFAcffYAPHnpFctbjlDbYQAAcEmzCwAA b OK State imported. This could also be used to implement quick session state restoring for webmails (as suggested by Michael Slusarz). For getting the imap-idle process there would have to be code that: * triggers the session saving when process is IDLEing * figures out what filesystem paths the imap-idle should be looking at (i.e. paths to selected mailbox's dovecot.index.log file and maybe for e.g. maildir new/) * send the session state string, paths and imap connection fd to imap-idle process via UNIX socket * implement the actual imap-idle process * implement a way for imap-idle process to send back the state and connection fd to restore the imap process The patch is ugly and still missing many things. Anyway I thought I'd include it here just in case someone was really eager to continue implementing it. :) I'm not sure when I'll have time for it. A full patch would probably have to have some session_save()/session_restore() functions in lib-storage API. But a quick and dirty way is possible to implement for v2.1 as well, as long as some IMAP extensions aren't used (most importantly rfc5267).

2 2

Re: [Dovecot] Changing password for users
by Joseph Tam 30 Oct '12

30 Oct '12

Ben Morrow wrote: >> Maybe replace "/usr/bin/passwd" with htpasswd? > > Try pam_pwdfile with poppwd or some other poppassd that supports PAM. That's it! I was trying to remember the name of this PAM module. >>> and is there another way other than poppassd? >> >> Write your own PHP script -- it couldn't be more than a few dozen lines >> of code for a working skeleton. Or Google "php change password htpasswd". > > It's not as simple as you seem to think. Quite apart from getting the > password-changing itself right (have you considered what happens when > two users change their passwords at the same time? when Dovecot tries to > read the password file at the same time as you are changing it? when the > system crashes when you are halfway through rewriting the password > file?), you really shouldn't be running PHP as a user with write access > to a password file (even a virtual password file) in any case. I did consider it, and you're right, it is tricky to get it absolutely right. If robusteness and security was of utmost importance, I would abandon PHP too. I was scaling the solution to the OP's technical ability and apparent size of their operation -- if poppwd passes muster, this wouldn't be too far off. Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] does dovecot interpret any mail headers specially with maildir?
by Christoph Anton Mitterer 30 Oct '12

30 Oct '12

Hi. For mbox, http://wiki2.dovecot.org/MailboxFormat/mbox#Dovecot.27s_Metadata lists a numer of mail headers: - X-IMAPbase - X-IMAP - X-UID - Status - X-Status - X-Keywords - Content-Length that are treated specially by dovecot. It also suggests, that these should be stripped by the LDA (I guess in order that someone sending you such mail cannot set the status or keywords, or even "attack you" by setting a bogus Content-Length). I wondered, when using maildir, are there any headers that dovecote would treat specially, too? And which I therefore should strip? Thanks, Chris.

2 9

[Dovecot] Problems with Virtual and mail-search.c
by Levent Dane 29 Oct '12

29 Oct '12

First, I don't know why but dovecot gots this error. Oct 15 13:24:02 widder dovecot: imap(limon): Panic: file mail-search.c: line 90 (mail_search_args_init_sub): assertion failed: (arg->value.keywords == NULL) Then, when I tried to run SELECT "INBOX/Code" (UNSEEN) virtual plugin got a segfault. Oct 15 13:24:03 widder kernel: imap[22749]: segfault at 2c ip b757f8ec sp bfa3a160 error 4 in lib20_virtual_plugin.so[b7579000+d000][b74b0000+d000] I'm running gentoo with kernel 2.6.32.12. My dovecot version is 2.1.10. I applied http://hg.dovecot.org/dovecot-2.1/raw-diff/0306792cc843/src/lib-storage/mai… But still, i'm getting this problem. Thanks, Levent Dane

2 6

[Dovecot] No failover from director to backend?
by Patrick Westenberg 29 Oct '12

29 Oct '12

Hi everyone, short version: Is there no built in failover mechanism for the director service to handle a backend failure? Long version: I have a frontend server running the director service and two backends. Due to maintenance I had to shut down one of the backends which caused connection errors for the users being directed to this backend. I was very surprised as I expected the director to redirect these users to the remaining backend. Am I wrong or is the director not working as expected? Regards Patrick # 2.1.6: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.5 auth_mechanisms = plain login director_mail_servers = 172.17.1.1 172.17.1.2 director_servers = 172.17.1.3 172.17.1.4 lmtp_proxy = yes log_path = /var/log/dovecot.log managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { address = 172.17.1.3 port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director } service lmtp { inet_listener lmtp { address = 172.17.1.3 port = 24 } } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl_cert = </etc/ssl/certs/imap.xx.crt ssl_key = </etc/ssl/private/imap.xx.key protocol !smtp { passdb { args = proxy=y nopassword=y starttls=any-cert driver = static } } protocol smtp { passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } } protocol lmtp { auth_socket_path = director-userdb }

4 5

[Dovecot] INBOX permissios woes
by Josep L. Guallar-Esteve 29 Oct '12

29 Oct '12

Hello, I have a dovecot system that uses winbind authentication against Active Directory. I set it up by following the directions in the wiki. That works great. When a new user receives an email, the inbox is created with permissions 600 (rw- --- --) and ownership user:mail , even though I did chmod 02770 /var/spool/mail. And then, when dovecot tries to access the inbox, it throws the error: Oct 29 13:47:59 imap-login: Info: Login: user=<user1>, method=PLAIN, rip=10.0.0.6, lip=10.0.0.26, mpid=29047, secured Oct 29 13:47:59 imap(user1): Error: stat(/var/mail/user1) failed: Permission denied Oct 29 13:47:59 imap(user1): Error: stat(/var/mail/user1) failed: Permission denied Accessing users' Sent, Trash, creating new folders.... all that works fine. I've been looking at the documentation, reading the wiki, searching on google, asking on IRC. If you have any hint or documentation that I've must have overlooked, please let me know. Here's my dovecot information: [josep@testmail ]$ dovecot --version 2.0.9 [josep@testmail ]$ dovecot -n # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-279.11.1.el6.x86_64 x86_64 CentOS release 6.3 (Final) auth_mechanisms = plain ntlm login auth_use_winbind = yes auth_username_format = %Lu base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot-debug.log listen = * log_path = /var/log/dovecot.log mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail mbox_write_locks = fcntl passdb { driver = pam } protocols = imap service auth { unix_listener auth-userdb { mode = 0600 } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = uid=503 gid=503 home=/home/vmail/%u driver = static } userdb { driver = passwd } [josep@testmail ]$ Thank you in advance, Josep This transmission is intended for the use of the entity or individual to which or whom it is addressed. The transmission or any documents accompanying the transmission may contain confidential information. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or action taken in reliance on the contents of the transmission or the documents is strictly prohibited. If you have received this confidential transmission in error, please destroy it and any accompanying documents and notify the sender immediately. Thank you.

1 0

[Dovecot] [dovecot} Invalid mailbox name.
by Alexander Weber 29 Oct '12

29 Oct '12

Hi, I've got some trouble here.. i created some sieve rules, but the debug log says that there is a invalid mailbox name error: msgid=<*>: failed to store into mailbox '/home/shared/.automail.Bugtracker/': Invalid mailbox name. ~/.dovecot.sieve if address :is "to" "mantis-admin@<*>" { fileinto "/home/shared/.automail.Bugtracker/"; } here's my doveconf -n output # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-32-generic x86_64 Ubuntu 12.04.1 LTS base_dir = /var/run/dovecot/ disable_plaintext_auth = no hostname = * mail_debug = yes mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { list = yes location = maildir:/home/shared:CONTROL=~/.Maildir/control/Shared:INDEX=~/.Maildir/index/Shared prefix = shared/ separator = / subscriptions = yes type = public } namespace { inbox = yes location = prefix = separator = / type = private } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } postmaster_address = postmaster@* protocols = imap sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } ssl_ca = </etc/ssl/* ssl_cert = </etc/ssl/* ssl_cipher_list = HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3 ssl_key = </etc/ssl/* userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol imaps { imap_client_workarounds = delay-newmail mail_max_userip_connections = 10 } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { mail_plugins = " zlib, acl, imap_zlib" } any idea? Mit freundlichen Gruessen / best regards papaya Software GmbH i.A. Alexander Weber -- papaya Software GmbH | Im MediaPark 5 | 50670 Koeln | Germany Tel./Ph.: +49-221-5743-8070 | Fax: +49-221-5743-8099 mailto:weber@papaya-cms.com | http://www.papaya-cms.com/ -- Geschaeftsfuehrer: Andreas Jacobi, André Schnitzler, Daniel Schäfer Sitz& Registergericht: Koeln | HRB 60030 | USt.-Id.-Nr.: DE 255642963 --

2 4

[Dovecot] Overlapping userdb/passdbs
by James Devine 29 Oct '12

29 Oct '12

I have an ldap server for which each entry includes the email address and the username portion of the email address for authentication. Authentication works by username if the username is unique among all the entries. I need to now add some users which must authenticate even if the username is not unique. I figured one way to do this would be to add a second user/pass db which puts further restrictions on the ldap query to make it unique for those users. This doesn't seem to work however as if the user is found in the first ldap query but the password does not match it does not try the second. I would use the password as part of the query but this setup requires me to allow the client to hash the password. Is there a way to do this? Or maybe I am approaching the problem wrong.

2 1

[Dovecot] dovecot lda - Permission denied
by tony.blue.mailinglist＠gmx.de 29 Oct '12

29 Oct '12

Hallo, please excuse my bad english. But I am not a native speaker. I changed my cyrus to dovecot (alltogehter: fetchmail - procmail - exim4 - dovecot). But I get (I think from /usr/lib/dovecot/deliver) the following error-message in my syslog: ... Oct 25 23:37:13 gustav dovecot: lda: Error: userdb lookup: connect(/var/run/dovecot/auth-userdb) failed: Permission denied (euid=501(andy) egid=100(users) missing +w perm: /var/run/dovecot/auth-userdb, dir owned by 0:0 mode=0755) ... Oct 25 23:37:14 gustav dovecot: lda: Error: userdb lookup: connect(/var/run/dovecot/auth-userdb) failed: Permission denied (euid=500(tony) egid=100(users) missing +w perm: /var/run/dovecot/auth-userdb, dir owned by 0:0 mode=0755) ... Dovecot is installed as !include auth-passwdfile.conf.ext. For all users there is a entry in der /etc/dovecot/users. Usaly the user rights are set to 600. I tryed 755, but I get the same errormessage. ... service auth { unix_listener auth-userdb { mode = 0755 user = mailstore group = mailstore } ... If I try "ls /var/run/dovecot/auth-userdb -la" - i get: srwxr-xr-x 1 mailstore mailstore 0 Okt 25 23:36 /var/run/dovecot/auth-userdb How can I solve this problem? Tony

2 1