March 2012 - dovecot - dovecot.org

[Dovecot] File/folder permission issues in 2.1.3
by Christian Rößner 04 Apr '12

04 Apr '12

Hi, I figured out that Dovecot does not honer secondary groups with auth/auth-worker (??), if doing LDAP/TLS stuff. I had to use file system acls to add the user "vmail" to /etc/ssl/private and to the corresponding key file: doveconf -n # 2.1.3: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-40-generic-pae i686 Ubuntu 10.04.4 LTS auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes hostname = mail.roessner-net.de lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_access_groups = vmail mail_gid = vmail mail_location = mdbox:~/mdbox mail_plugins = autocreate quota acl fts fts_solr zlib mail_log notify mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { list = children location = mdbox:%%h/mdbox prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox junkmail { special_use = \Junk } prefix = separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/mail/virtual/shared-mailboxes.db autocreate = Trash autocreate2 = Sent autocreate3 = Drafts autocreate4 = junkmail autosubscribe = Trash autosubscribe2 = Sent autosubscribe3 = Drafts autosubscribe4 = junkmail fts = solr fts_solr = break-imap-search url=http://localhost:8080/solr/ mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:User quota::file:%h/mdbox/dovecot-quota quota_rule = *:storage=300M:messages=20000 quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve service auth-worker { unix_listener auth-worker { user = vmail } user = vmail } service auth { unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service dict { unix_listener dict { mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = ::1 port = 24 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl_ca = </ca/psw_net/SSL123_CA_Bundle.pem ssl_cert = </ca/psw_net/mail_roessner-net_de.crt ssl_key = </ca/psw_net/mail_roessner-net_de.key userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = autocreate quota acl fts fts_solr zlib mail_log notify sieve } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags mail_max_userip_connections = 50 mail_plugins = autocreate quota acl fts fts_solr zlib mail_log notify imap_quota imap_acl imap_zlib } Normally, mail is placed under /var/mail/virtual as user vmail, group vmail. Is there something wrong with my config that prevents switching to secondary groups? /etc/dovecot/dovecot-ldap.conf.ext: uris = ldap://ldap0.roessner-net.de/ ldap://db.roessner-net.de/ sasl_bind = yes sasl_mech = EXTERNAL tls = yes tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt tls_cert_file = /etc/ssl/certs/mx0.roessner-net.de.pem tls_key_file = /etc/ssl/private/mx0.roessner-net.de.key.pem tls_require_cert = hard base = ou=people,ou=it,dc=roessner-net,dc=de user_attrs = rnsMSQuota=quota_rule=*:storage=%$,rnsMSMailboxHome=home user_filter = (&(objectClass=rnsMSDovecotAccount)(rnsMSRecipientAddress=%u)) pass_attrs = rnsMSDeliverToAddress=user,userPassword=password pass_filter = (&(objectClass=rnsMSDovecotAccount)(rnsMSRecipientAddress=%u)(rnsMSEnableDovecot=TRUE)) iterate_attrs = rnsMSDovecotUser=user iterate_filter = (objectClass=rnsMSDovecotAccount) default_pass_scheme = CRYPT Thanks in advance. -Christian --- Roessner-Network-Solutions Bachelor of Science Informatik Nahrungsberg 81, 35390 Gießen F: +49 641 5879091, M: +49 176 93118939 USt-IdNr.: DE225643613 http://www.roessner-network-solutions.com

2 1

Re: [Dovecot] Many messages clustered around the same date.saved value
by Joseph Tam 04 Apr '12

04 Apr '12

Timo Sirainen <tss(a)iki.fi> wrote: >>> Which mailbox format? With Maildir the date.saved is taken from >>> dovecot.index.cache file, and in some cases that might get dropped. If >>> it does, then it fallbacks to using the file's ctime. >> >> mbox. > > Ah, with mbox there isn't any usable fallback for date.saved. If it's > not in dovecot.index.cache, the current time is used. I'm a little confused as to why it needed a fallback. In other words, why wasn't date.saved put into the index as soon as the IMAP operation copied it into "Trash"? If this data isn't set at that time, when does it get instantiated? When I actually ask for it? Joseph Tam <jtam.home(a)gmail.com>

2 1

[Dovecot] Is it possible to migrating mail to dovecot using imapc?
by Dr Josef Karthauser 04 Apr '12

04 Apr '12

I'm excited to hear that dovecot now supports imap as a mailbox type. I've got a mailbox over on another imap server, which I want to migrate to dovecot. I was wondering whether I could use 'doveadm backup' to setup a two way synchronisation process between the old imap mailbox and the new dovecot mailbox. That way I can do the migration, and can coordinate the mail clients changing where they pick up their email from later. But, I can't find much documentation on imapc, other than it exists. Is this kind of move possible now? Would someone mind giving me some hints as to how to make it work please? Thanks :), Joe

2 9

[Dovecot] dovecot 2.1 breaks FTS + pre-auth?
by dm-list-email-dovecot＠scs.stanford.edu 04 Apr '12

04 Apr '12

Hi. I use dovecot in the simplest possible way, as an IMAP server in pre-auth mode over ssh or just locally over a unix-domain socket (e.g., with offlineimap, which runs much faster using dovecot for the local message store). Ideally I would like to avoid running any extra daemons or setting up anything as root. Until recently, this has worked fine by just setting the CONFIG_FILE environment variable to something in my home directory. Here is my configuration: $ export CONFIG_FILE=$HOME/etc/dovecot.conf $ dovecot -n # 2.1.3: /home/dm/etc/dovecot.conf # OS: Linux 3.2.13-1-ARCH x86_64 mail_location = maildir:~/Mail/inbox mail_plugins = " fts fts_squat" plugin { fts = squat fts_squat = partial=4 full=10 } doveconf: Error: ssl enabled, but ssl_cert not set doveconf: Fatal: Error in configuration file /home/dm/etc/dovecot.conf: ssl enabled, but ssl_cert not set Full text search used to work just fine with this configuration, and still does on a machine I have running dovecot 2.0.13. However, on the machine with 2.1, I get errors about /var/run/dovecot/index not existing. $ printf "a select INBOX\nb search text xyzzy\nc logout\n" \ | /usr/lib/dovecot/imap * PREAUTH [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE] Logged in as dm imap(dm): Error: net_connect_unix(/var/run/dovecot/indexer) failed: No such file or directory ... Needless to say, no dovecot.index.search or dovecot.index.search.uids file is created after this error. While I can't write /var/run/dovecot, this is not a permission issue. For example, adding base_dir=/home/dm (my home directory) to the configuration file yields the same error for /home/dm/indexer. I'm guessing something has changed where imap requires an indexer daemon and doesn't launch it in pre-auth mode any more, but I can't find anything about this in the documentation. In short, if anyone can tell me how to use FTS in conjunction with pre-auth mode or point me to a working example, I would appreciate it.

2 1

[Dovecot] Dovecot stones
by Timo Sirainen 03 Apr '12

03 Apr '12

For the last few days I've been thinking about my company and what it really should do, and as much as the current plan seems reasonable, I think in good conscience I really can't help but to bring up an alternative plan: The support for Dovecot is quite good already, but wouldn't it be better if it was GUARANTEED that your email server was ALWAYS working with zero downtime or other problems? After some thinking, planning and consulting with my spiritual guides I realized I really should just go ahead and do it: From now on you can buy blessed Dovecot stones (http://www.dovecot.org/tmp/stone1.jpg) which are guaranteed to keep your email server running. I don't think there's really any further reason for me to provide commercial support. Probably the whole Dovecot mailing list will be pretty much useless after this as well, so I might as well stop posting there. If you have any problems, you'll just buy a Dovecot stone and the problem will go away. If for any reason that doesn't work, it means that your problem is more difficult than most and you need to buy a few more stones. Please remember that each shipment may take up to 3 weeks to reach you, so get your stones early and in sufficient quantities. A small email server will be happy enough with a single small Dovecot stone, but the more users you have the more stones you'll likely need. This is because most people are rather unhappy with their lives, and they project their negative energies towards their surroundings, including their email servers. To overcome this negative energy you need to have a counterbalancing positive energy, which the Dovecot stones will provide you. The Dovecot stones are hand painted from the finest materials available to the sister of the author of Dovecot that she could find in the local shops. Each stone contains such love and dedication towards the well being of Dovecot that you will shed tears when you lay your eyes upon their physical being. The images provided here unfortunately don't do justice to them. http://www.dovecot.org/tmp/stone2.jpg - This is how i keep my home desktop running all day every day. I have NEVER broken a single hard drive in my life. I don't even bother to keep backups, because I KNOW it is useless for me. A small Dovecot stone can be bought for 10 euros, a medium sized stone for 100 euros and a large stone for 500 euros. Each large stone can usually handle around 1000-2000 users before you need to buy more. If you have millions of users we'll need to find you a larger rock from my parents' backyard. There are only a limited number of such rocks available (we disposed of most of them to our neighbors' yards years ago), so their prices need to be negotiated in advance.

12 12

[Dovecot] dsync redesign
by Timo Sirainen 03 Apr '12

03 Apr '12

In case anyone is interested in reading (and maybe helping!) with a dsync redesign that's intended to fix all of its current problems, here are some possibly incoherent ramblings about it: http://dovecot.org/tmp/dsync-redesign.txt and even if you don't understand that, here's another document disguising as an algorithm class problem :) If anyone has thoughts on how to solve it, would be great: http://dovecot.org/tmp/dsync-redesign-problem.txt It only deals with saving new messages, not expunges/flag changes/etc, but those should be much simpler.

9 17

[Dovecot] Problem compiling dovecot-antispam on Ubuntu 11.10 using Doveot 2.0.13
by Guillaume Hilt 31 Mar '12

31 Mar '12

Hello, Last dovecot available version on Ubuntu 11.10 AMD64 is dovecot 2.0.13. dovecot-antispam package is compiled for dovecot 2.0.15. So, i'm trying to compile a new dovecot antispam plugin. I followed dovecot wiki but i'm running into this error : Successfully compiled dspam.c (plugin). mailbox.c: In function 'antispam_save_begin': mailbox.c:138:12: error: 'struct mail_save_context' has no member named 'copying_via_save' mailbox.c: In function 'antispam_save_finish': mailbox.c:174:12: error: 'struct mail_save_context' has no member named 'copying_via_save' Failed to compile mailbox.c (plugin)! Any hint please ? Regards, -- Guillaume Hilt

2 2

[Dovecot] Problem managing mbox
by PSTM 31 Mar '12

31 Mar '12

Hello, I have a problem with dovecot. seems that do not erase mail that mail client request to be erased. And I have this errors: > Error: Next message unexpectedly corrupted in mbox file Info: > dovecot-2.1.1-2.0.cf.fc16.i686 > root 5979 0.0 0.1 3208 1260 ? Ss 20:18 0:00 > /usr/sbin/dovecot -F > dovenull 5985 0.0 0.2 7060 2280 ? S 20:18 0:00 > dovecot/imap-login > vmail 5988 0.0 0.1 7888 1848 ? S 20:18 0:00 > dovecot/imap permissions on mail dir: > total 4 > drwxr-xr-x 9 vmail mail 4096 ene 21 21:43 vmail Any suggestion? Regards, -- -- http://www.0pc.eu/

3 2

[Dovecot] Proxying Authentication on both sides
by Andy Dills 30 Mar '12

30 Mar '12

I've recently set up a director proxy environment on my test servers, with the intention of deploying on our cluster soon. One thing I found confusing in the proxying documentation [1] was the first bit about their being two ways to do the authentication...either you have the proxy forward the auth to the real server for authentication, or you have the proxy authenticate it and then login to the real server with a master password. Well, we use /bin/checkpassword authentication which hooks into a variety of subsytems for various specific customer needs, and sometimes we need to know the username AND password of the user in order to determine their home directory information. So, using a master password (which requires the back-end server not getting the user password) is out. However, when we have the front-end server do a static director proxy, the problem is that authentication failures are logged on the back-end server with a source IP of the proxy, and no authentication failure with the client IP address is logged on the proxy. So, fail2ban (which is a MUST these days, at least for us) will not be able to properly filter out the brute force attackers. My solution was an alternative: I authenticate with our /bin/checkpassword on the proxy, which authenticates the user and only at that point returns the proxy=y nopassword=y switch to proxy the connection and forward the authentication. As a result, we get logs on the proxy for failed attempts, and the full username and password is supplied to the back-end server for proper processing. Food for thought in case anybody else is implementing this. Thanks, Andy [1] http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/Proxy --- Andy Dills Xecunet, Inc. www.xecu.net 301-682-9972 ---

2 3

[Dovecot] Multiple instances
by Timo Sirainen 30 Mar '12

30 Mar '12

v2.1 now saves the base_dir and instance_name to /var/lib/dovecot/instances when starting up. If you have for example two instances with names "backend" and "proxy", you can then use: doveadm -i proxy proxy list instead of something like: doveadm -c /etc/dovecot-proxy/dovecot.conf proxy list The same -i parameter works for all dovecot programs. I also added a couple of new doveadm commands: # doveadm instance list path name last used running /var/run/dovecot proxy 2012-02-06 21:41:39 yes # doveadm instance remove proxy It would be possible to add commands to start/shutdown some/all instances using doveadm, but is it all that useful? I'd guess people would have their own init.d scripts anyway doing that. Anything else that could be useful related to this?

2 2