June 2012 - dovecot - dovecot.org

[Dovecot] Problem with Dovecot and AD LDAP auth
by Алексей Переклад 07 Jun '12

07 Jun '12

Hi. Seems it's a bug in dovecot auth. I have FreeBSD 8.1-RELEASE-p1 and I tried 1.2.17 and 2.1.7 versions of Dovecot, and still no luck. The problem: when I set in dovecot-ldap.conf: base = CN=Users,DC=domain,DC=local everything works fine. But if I set: base = DC=domain,DC=local mail client can't authorize. /var/log/dovecot.log says: =============================================== Jun 07 18:07:17 auth: Debug: auth client connected (pid=14611) Jun 07 18:08:11 auth: Debug: client in: AUTH 1 PLAIN service=imap session=G1//aeLB6wAKAABu lip=10.0.0.3 rip=10.0.0.110 lport=143 rport=55787 resp=AGdhdGV3YXkAVU82eUpuUXQ= Jun 07 18:08:11 auth: Debug: ldap(gateway,10.0.0.110,<G1//aeLB6wAKAABu>): bind search: base=DC=domain,DC=local filter=(&(objectClass=person)(sAMAccountName=gateway)) Jun 07 18:08:11 auth: Debug: ldap(gateway,10.0.0.110,<G1//aeLB6wAKAABu>): result: uid missing Jun 07 18:10:18 imap-login: Info: Disconnected: Inactivity during authentication (disconnected while authenticating, waited 127 secs): user=<>, method=PLAIN, rip=10.0.0.110, lip=10.0.0.3, session=<G1//aeLB6wAKAABu> Jun 07 18:10:18 auth: Debug: client in: CANCEL 1 Jun 07 18:10:18 auth: Debug: auth client connected (pid=14706) Jun 07 18:10:26 auth: Debug: client in: AUTH 1 PLAIN service=imap session=n6IBcuLB7AAKAABu lip=10.0.0.3 rip=10.0.0.110 lport=143 rport=55788 resp=AGdhdGV3YXkAVU82eUpuUXQ= Jun 07 18:10:26 auth: Debug: ldap(gateway,10.0.0.110,<n6IBcuLB7AAKAABu>): bind search: base=DC=domain,DC=local filter=(&(objectClass=person)(sAMAccountName=gateway)) Jun 07 18:10:26 auth: Error: ldap(gateway,10.0.0.110,<n6IBcuLB7AAKAABu>): Connection appears to be hanging, reconnecting Jun 07 18:10:26 auth: Debug: ldap(gateway,10.0.0.110,<n6IBcuLB7AAKAABu>): result: uid missing Jun 07 18:10:26 auth: Error: ldap(gateway,10.0.0.110,<G1//aeLB6wAKAABu>): Request lost Jun 07 18:10:26 auth: Error: ldap(gateway,10.0.0.110,<n6IBcuLB7AAKAABu>): ldap_search(base=DC=domain,DC=local filter=(&(objectClass=person)(sAMAccountName=gateway))) failed: Operations error Jun 07 18:10:26 auth: Error: LDAP: Reply with unknown msgid 2 Jun 07 18:10:26 auth: Error: LDAP: Reply with unknown msgid 2 Jun 07 18:10:26 auth: Error: LDAP: Reply with unknown msgid 2 Jun 07 18:10:26 auth: Error: LDAP: Reply with unknown msgid 2 Jun 07 18:10:28 auth: Debug: client out: FAIL 1 user=gateway temp Jun 07 18:10:28 auth: Debug: client out: FAIL 1 user=gateway temp Jun 07 18:13:18 imap-login: Info: Disconnected: Inactivity (auth failed, 1 attempts in 172 secs): user=<gateway>, method=PLAIN, rip=10.0.0.110, lip=10.0.0.3, session=<n6IBcuLB7AAKAABu> ============================================ My dovecot-ldap.conf: =============================== ldap_version = 3 hosts = ad.domain.local base = DC=hrom,DC=local scope = subtree dn = CN=mailserver,CN=Users,DC=domain,DC=local dnpass = here_is_pass auth_bind = yes pass_attrs = uid=user pass_filter = "(&(objectClass=person)(sAMAccountName=%u))" user_attrs = name=mail=maildir:/var/mail/virtual/hrom.local/%n user_filter = "(&(objectClass=person)(sAMAccountName=%u))" =================================================== I need base = DC=domain,DC=local for searching for user's accounts in different OU of my AD. If I set base = CN=Users,DC=domain,DC=local, Dovecot can't authorize user accounts from OU. P.S.: Postfix with base = DC=domain,DC=local works perfectly, so the problem is not with our domain controller (LDAP server as well) .

1 0

[Dovecot] Email auto purging applied to all mail folders
by Joe V Aldeguer 07 Jun '12

07 Jun '12

Hello, Is it possible to have this done not only for spam and trash folder but lets say like the user inbox and any user created mail folders too? My ultimate goal is to have a way to automate the email deletion process of emails stored in the user inbox or mail folders when it reaches a specified date. My boss wants to force users to keep emails only a month old anything beyond that will be deleted. Has anyone done this using dovecot and are there any guides available? I am also open to suggestions for commercial solutions but so far searching online for solutions only comes up with email archiving. The dovecot version I have installed is version 2.0.19. Thanks in advance. - Joe

2 1

[Dovecot] dsync backup doubles quota
by Patrick Westenberg 07 Jun '12

07 Jun '12

Hi everyone, I recognized a very strange behavior when doing backups of my mdbox mailboxes. After the backup the quota for each mailbox is twice as much as before the backup and I have to recalculate the quota to get the former/correct information. root@mb01:~# doveadm quota get -u test(a)example.com User quota STORAGE 5 10240 User quota MESSAGE 11 - root@mb01:~# doveadm backup -u test(a)example.com mdbox:/home/example.com/test root@mb01:~# doveadm quota get -u test(a)example.com User quota STORAGE 10 10240 User quota MESSAGE 22 - root@mb01:~# doveadm quota get -u test(a)example.com root@mb01:~# doveadm quota get -u test(a)example.com User quota STORAGE 5 10240 User quota MESSAGE 11 - Is this a bug or normal behavior? Regards Patrick

2 1

[Dovecot] best practises for mail systems
by Костырев Александр Алексеевич 06 Jun '12

06 Jun '12

hello! Can someone point me to some best practices in building high-available scalable mail system or! share your own success stories. I've read article in LJ "Building a Scalable High-Availability E-Mail System with Active Directory and More" but it seemed to be outdated and there's a single point of failure (Master node). What I want to achieve: high-available, horizontaly scalable, with no single point of failure mail solution. Available hardware: intel mfsys25 modular server with 2 storage controllers, 2 switches, 4 power supply blocks with - 2 blade-servers in mfsys with: 2xIntel Xeon E5620 @ 2.40GHz with 8 cores each - promise vtrak e610s (2 storage controllers, 2 power supply blocks) - 6x 2TB SATA Hitachi HDS72302 We decided to go for KVM virtualization and glusterfs for live migration for vm image but that's not what this is all about :) We installed centos on host systems. for now while we could think of two ways to go: The first way (currently at testing stage): On each host system we created one VM and passed through 3x2TB disks into it. In guests vms on top of this disks we made XFS and fired up glusterfs with distributed replicated volumes for our mailstorage. so it looks like this: vm1 replicate vm2 disk1 ------------> disk4 disk2 ------------> disk5 disk3 ------------> disk6 in each vm we mounted glusterfs and pointed dovecot to that dir for mail creation (as ltmp) and imap4 user access. also we use exim as smtp. So, with glusterfs as mailstorage we can go for LVS to load balancing for exim and dovecot. so wherenever one of host systems (hence one of mail vms) goes down, users don't notice that 'cause LVS points them to working smtp and imap4 servers and they get their mail 'cause of glusterfs. Pros: - high-available - horizontaly scalable - with no single point of failure Cons: - not quite sure if glusterfs is production ready solution 'cause I've experienced split-brains during setting it up - IO performance issue. Though we didn't yet run any io tests, but glusterfs uses fuse to mount on clients. And guys on #gluster told me writing to the glusterfs mount will not be strictly local io. The second way: split up the users mail with: two back-end VMs each other on DIFFERENT host system with - fat mailstorage with raid1+linear mode (mdadm)+XFS - dovecot/exim-back-ends and two VMs for nginx-based proxy servers for imap4 and smtp - nginx can redirect user to right back-end through HTTP-php-based logic. Pros: - we split up not only load for exim/dovecot but users mail IOs too - no split-brains Cons: - If one of the host systems (hence one of back-end VMs with storage) goes down, half of our users is unhappy P.S. Sorry if this place is way wrong to ask for such things.

5 5

[Dovecot] No ports listening
by Marco 06 Jun '12

06 Jun '12

Please forgive my newbie post but this has me stumped. I've been a happy Dovecot 0.X and 1.X admin for years but something in my first 2.X configuration is oddly broken. It loads fine, logs no errors, but doesn't listen to any network ports! Thanks in advance for any help. Marco # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 2.6.35.14 x86_64 Ubuntu 10.10 ext4 auth_debug = yes auth_mechanisms = plain login first_valid_gid = 111 first_valid_uid = 111 login_greeting = example.com pop/imap ready mail_location = mbox:/var/mail/%u.imap:INBOX=/var/mail/%u passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0666 } } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 } process_limit = 50 } service pop3-login { inet_listener pop3 { address = * port = 110 } inet_listener pop3s { address = * port = 995 } process_limit = 50 } ssl_cert = </etc/ssl/mail.example.com.crt ssl_key = </etc/ssl/mail.example.com.key syslog_facility = local0 userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } valid_chroot_dirs = /var/mail verbose_proctitle = yes verbose_ssl = yes protocol lda { postmaster_address = postmaster(a)example.com }

1 0

Re: [Dovecot] dovecot-metadata-9 released
by Dennis Schridde 06 Jun '12

06 Jun '12

Hello Nick! I am sorry - I forgot to mention that you need attached patch for dovecot. Kind regards, Dennis Am Dienstag, 5. Juni 2012, 11:28:27 schrieb Nick Rosier: > Hi Dennis, > > I'm trying to compile the plugin on FreeBSD 9 with Dovecot 2.1.7 and get > the following error: > > libtool: compile: gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I.. > -I/usr/local/include/dovecot -g -O2 -MT mailbox-ext.lo -MD -MP -MF > .deps/mailbox-ext.Tpo -c mailbox-ext.c -fPIC -DPIC -o > .libs/mailbox-ext.o mailbox-ext.c:25:19: error: missing binary operator > before token "(" > mailbox-ext.c: In function 'mailbox_get_guid_string': mailbox-ext.c:32: > error: 'MAIL_GUID_128_SIZE' undeclared (first use in this function) > mailbox-ext.c:32: error: (Each undeclared identifier is reported only > once mailbox-ext.c:32: error: for each function it appears in.) > mailbox-ext.c:33: warning: implicit declaration of function > 'mailbox_get_guid' > *** Error code 1 > Stop in /root/work/dovecot-metadata-plugin-6fe39779d758/src. *** Error > code 1 > > Removing DOVECOT_PREREQ and "forcing" to use the 2.1 definition fixes > that (I couldn't find anywhere where that macro was defined). > > Next I get another error, again caused by the DOVECOT_PREREQ: > > libtool: compile: gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I.. > -I/usr/local/include/dovecot -g -O2 -MT imap-metadata-plugin.lo -MD -MP > -MF .deps/imap-metadata-plugin.Tpo -c imap-metadata-plugin.c -fPIC > -DPIC -o .libs/imap-metadata-plugin.o > imap-metadata-plugin.c: In function 'is_valid_rfc5464_entry_name': > imap-metadata-plugin.c:162: warning: comparison is always false due to > limited range of data type > imap-metadata-plugin.c:513:19: error: missing binary operator before > token "(" > imap-metadata-plugin.c: In function 'cmd_getmetadata': > imap-metadata-plugin.c:516: warning: passing argument 2 of > 'mail_namespace_find' from incompatible pointer type > imap-metadata-plugin.c: In function 'setmetadata_helper': > imap-metadata-plugin.c:596: warning: 'return' with a value, in function > returning void > imap-metadata-plugin.c:672:19: error: missing binary operator before > token "(" > imap-metadata-plugin.c: In function 'cmd_setmetadata': > imap-metadata-plugin.c:675: warning: passing argument 2 of > 'mail_namespace_find' from incompatible pointer type > *** Error code 1 > > Am I missing something on my system? > > Rgds, > N. > > Dennis Schridde wrote: > > Hello everyone! > > > > I just released dovecot-metadata-8, which is an implementation of RFC 5464 > > (IMAP METADATA), allowing to add comments/annotations/metadata to folders > > of an email account. > > > > 2012-06-04: Version 9 > > > > * Added Dovecot 2.1 compatibility > > * Fixed compliance with RFC 5464 Section 3.2 > > * Separated backend code into library > > * Synced code of imap-annotatemore with imap-metadata > > * Improved error messages > > * Several bugfixes (incl. segfaults) > > * Minor cleanups > > > > Please get the code from [1] and send me an email for any problem you > > find. > > > > For more information please refer to my email from Sun, 12 Jun 2011 > > 15:55:57 +0200 titled "dovecot-metadata-8 released". > > > > Kind regards, > > Dennis > > > > [1] http://hg.dovecot.org/dovecot-metadata-plugin

2 1

Re: [Dovecot] auth trouble
by Joseph Tam 06 Jun '12

06 Jun '12

Glenn English wrote: >> Maybe someone is brute forcing your server's Postfix authenticated >> SMTP service since Postfix can be configured to use Dovecot's SASL >> authentication framework. > > and for the suggestion -- I do have Postfix using Dovecot-Auth checking > for SASL. > > I think I'm going to re-install and run Tripwire... Tripwire? If the purpose of your query is to automate blocking of brute forcers, this software is not what you want (which detects tampering of critical system files). I suggest trying to find where Postfix failed login reports go, then use your fail2ban or what-have-you to detect and block hosts that repeatedly fail authentication. (First Google hit I did on this subject) http://scottlinux.com/2011/05/26/prevent-postfix-brute-force/ The log entries might look like {timestamp} {servername} postfix/smtpd[{pid}]: lost connection after AUTH from {remote-hostname}[{remote-ip}] Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] INBOX help needed, dovecot + squirrelmail
by jeep＠rahul.net 05 Jun '12

05 Jun '12

Im trying to figure out how to get dovecot to deliver to my mail_location (example: /opt/imapdata/j/jeff/INBOX/inbox) AND work with squirrelmail. Ive worked on this for hours reading the docs etc with no luck so far. I get dovecot-lda to deliver to: /opt/imapdata/j/jeff/INBOX/inbox but when I use squirrelmail, I see the following in the log: dovecot: imap(jeff): Debug: Effective uid=1006, gid=999, home=/opt/imapdata/j/jeff/INBOX/inbox dovecot: imap(jeff): Error: chdir(/opt/imapdata/j/jeff/INBOX/inbox) failed: Not a directory dovecot: imap(jeff): Debug: Namespace : type=private, prefix=INBOX/, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/opt/imapdata/j/jeff:INBOX=/opt/imapdata/j/jeff/INBOX:LAYOUT=fs:DIRNAME=mmDIR:INDEX=~/indexes It complains that 'inbox' isnt a directory, but I want it to use: /opt/imapdata/j/jeff/INBOX What parameter do I need to tweak to get this to work? Ive tried the 'folder options' in squirrelmail but that doesnt appear to have any effect here (or at least at this point in my testing). It seems that the only parameter to tweak is 'mail_location' which Im having no luck getting to work correctly. Also namespace may play a part but every combination Ive tried does not result in getting it work thus far. On a sidenote when I send more than 1 email, it doesnt seem to honor 'maildir', it seems its doing 'mbox' instead? I get one flat file. Im lost and confused. my variables: mail_location = maildir:/opt/imapdata/%1n/%n:INBOX=/opt/imapdata/%1n/%n:LAYOUT=fs:DIRNAME=mmDIR:INDEX=~/indexes namespace { type = private separator = / prefix = INBOX/ inbox = yes } Your help is appreciated! Thanks, Jeff /mf/home/jeep/shell/.signature

2 5

[Dovecot] Customization of "Rejected" message.
by Malloc Kilobyte 04 Jun '12

04 Jun '12

Helo, I'm using Dovecot 2.1.1 with Postfix 2.3.3. I've enabled the quota plugin, so that Dovecot LDA reject e-mails, when user's mailbox is out of space. By default, when mailbox is near quota, and someone tries to send huge message, a reply is automatically send to the sender. It's being send from postmaster named as Mail Delivery Subsystem. And here is my question: Is there some way to customize that auto-reply, so that it is not only being send to the sender but also to recipient gets some notice about failed attempt ? I've also noticed, that this reply has attachment, which is rejected message, but it appears to be empty. Can I configure Dovecot to send back whole rejected message ? Regards malloc4k

1 0

[Dovecot] dovecot-metadata-9 released
by Dennis Schridde 04 Jun '12

04 Jun '12

Hello everyone! I just released dovecot-metadata-8, which is an implementation of RFC 5464 (IMAP METADATA), allowing to add comments/annotations/metadata to folders of an email account. 2012-06-04: Version 9 * Added Dovecot 2.1 compatibility * Fixed compliance with RFC 5464 Section 3.2 * Separated backend code into library * Synced code of imap-annotatemore with imap-metadata * Improved error messages * Several bugfixes (incl. segfaults) * Minor cleanups Please get the code from [1] and send me an email for any problem you find. For more information please refer to my email from Sun, 12 Jun 2011 15:55:57 +0200 titled "dovecot-metadata-8 released". Kind regards, Dennis [1] http://hg.dovecot.org/dovecot-metadata-plugin

2 1