June 2012 - dovecot - dovecot.org

[Dovecot] Hardware infrastructure for email system
by Michael Wessel 27 Jun '12

27 Jun '12

Hi, I'm currently (re-)planning my email setup and have been doing some research. I have done some searches and read several threads in the areas of my questions here. While there are some that come close I haven't yet been able to get all my questions answered. I currently run a postfix, dovecot & roundcube setup and have about 2000 active accounts. I have a separate SMTP server for outbound mail and auth is done against a separate LDAP server. In front of the POP/IMAP server I have another SMTP (4 in parallel actually) server that receives and filters inbound mail through a company specific, proprietary filter before the mail hits the POP/IMAP server. LDAP & SMTP servers are ESXi VMs. So right now both dovecot and roundcube run on the same box which is a Dell PE2950 with dual quad-core Xeon, 16GB RAM and 6 1TB disks in RAID 6, so only local storage using maildir. So far it's been holding up fine, but it's beginning to show signs of overload now. I also expect an increase in users over the next few months up to somewhere between 10 - 20,000 mail boxes. Hence the re-planning. My first priority in redesigning my setup is reliability. I definitely need something fail-save and as close to always on as possible. Next is performance. And while the budget is of course limited for the moment I'm setting that aside and will worry about that when the time comes. Now here is my question(s): In order to support up to 20,000 mailboxes (distributed over several times-zones so they won't all be used at the same time) with a very reliable service with good performance, what do I actually need? Do I need(ul) SAN or is it just a "would be nice to have"? If yes, why and what would be appropriate for my needs? Or will a setup with a few more servers like the ones I already have, using something like DRBD and distributing services (imap, http, spamd etc) onto different boxes do? I know I have more reading to do on all the different options out there, but would like some input from people that have experience in this area so I can focus on the stuff that's right for my situation. Michael

10 15

[Dovecot] doveadm proxy kick in director setups
by Tom Pawlowski 27 Jun '12

27 Jun '12

Something I noticed on a 2.1.7 director test cluster (two directors, three backends): 'doveadm proxy kick user' will kick all connections for that user on that director only. Any additional connections on other directors will remain active unless the command is run on all directors. Are the proxy and director sub-commands intended to be separate and distinct in their operation? If so, then this makes sense, as a proxy isn't necessarily a director. Are there any plans for a proxy kick equivalent that would work across directors? -- Tom Pawlowski OIT-CSS System Administrator office: Hill 145 email: tompru(a)jla.rutgers.edu phone: (732) 445-2634

2 1

[Dovecot] director map and mysql
by Костырев Александр Алексеевич 27 Jun '12

27 Jun '12

hello! Is "doveadm director map" command suppose to work when I store "host" value in mysql table? It gives me nothing in output with no errors in log. I've successfully setup directors with static passdb, and decided to give a try setup with storing host value in mysql table. The proxying is actually working, I'm just unhappy with no output from "doveadm director map". on the other hand output from "doveadm director map" is not empty, when I configure my password_query not to return host from table. director's settings in dovecot.sql is: passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf } userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf } director_servers = 192.168.5.125 director_mail_servers = 192.168.5.110 192.168.5.111 service doveadm { inet_listener { port = 24245 } } protocol doveadm { auth_socket_path = director-userdb } doveadm_proxy_port = 24245 in /etc/dovecot/dovecot-sql.conf at director there's password_query = SELECT \ NULL AS password,\ 'Y' as nopassword, \ 'Y' AS proxy, \ MBOX_NAME as user, \ host2 as host \ from M_MAILBOX \ where MBOX_NAME = '%u' user_query = SELECT \ MBOX_NAME AS username, \ MAIL_DIRECTORY as home \ from M_MAILBOX \ where MBOX_NAME = '%u'; iterate_query = select MBOX_NAME AS username from M_MAILBOX; backend's conf: service doveadm { inet_listener { port = 24245 } }

2 3

[Dovecot] pop3c_master_user
by Martin Schitter 27 Jun '12

27 Jun '12

the configuration keyword "pop3c_master_user" mentioned in the dsync migration documentation (http://wiki2.dovecot.org/Migration/Dsync) does not work for dovecot 2.1.7. a config line like: "pop3c_master_user = cyrus" will produce this error: doveconf: Fatal: Error in configuration file /etc/dovecot/local.conf line 33: Unknown setting: pop3c_master_user it's not defined in: src/lib-storage/index/pop3c/pop3c-settings.* is this feature not enabled with intention? btw. another question: will 'doveadm backup' mirror all the IMAP ACL information? thanks martin

2 1

Re: [Dovecot] started with dovecot sieve
by Daniel Parthey 27 Jun '12

27 Jun '12

Rolf wrote: > Jun 25 20:22:54 rolf14 dovecot: lda(rolf): Error: setegid(privileged) failed: Operation not permitted Manual page "man 2 setegid" states that setegid() sets the effective group ID of the calling process. Unprivi- leged user processes may only set the effective group ID to the real group ID, the effective group ID or the saved set-group-ID. Your "postfix" user is a member of group "mail", but "mail" which you configured as "mail_privileged_group = vmail" is neither the primary group of user "postfix", nor is it the effective group id of the calling postfix process. Therefore you might get the error as documented in the manpage setegid(2): EPERM The calling process is not privileged (Linux: does not have the CAP_SETUID capability in the case of seteuid(), or the CAP_SET- GID capability in the case of setegid()) and euid (respectively, egid) is not the real user (group) ID, the effective user (group) ID, or the saved set-user-ID (saved set-group-ID). Regards Daniel -- https://plus.google.com/103021802792276734820

2 1

[Dovecot] Dovecot performance under high load (vs. Courier)
by email builder 27 Jun '12

27 Jun '12

Hi, We are building a new system that will support a large number of users (high volume, high concurrent usage, etc). We have played with Dovecot, but in most serious applications we have traditionally used Courier IMAP. It's my (lay) understanding that with indexing and perhaps other things in Dovecot, it might perform better than Courier in larger environments like this. Am I correct or is it less clear-cut? Any tips on making the migration (not migrating an existing system, I mean migrating our paradigm - things to consider, things to watch out for)? TIA

10 36

[Dovecot] Virtual users - what is better Maildir or mbox?
by Kaya Saman 26 Jun '12

26 Jun '12

Hi, I'm trying to configure a server to use SAMBA and Winbind to authenticate to Active Directory.... I managed to get this portion up and running even the Dovecot portion. For reference something similar to this guide: http://www.whitneytechnologies.com/?p=119 However PAM is slightly different: # cat /etc/pam.d/dovecot auth sufficient pam_krb5.so no_user_check validate account sufficient pam_permit.so This is what my dovecot.conf file looks like: # cat dovecot.conf # v1.2+: auth_use_winbind = yes auth_winbind_helper_path = /usr/local/bin/ntlm_auth protocols = imap # It's nice to have separate log files for Dovecot. You could do this # by changing syslog configuration also, but this is easier. log_path = /var/log/dovecot.log info_log_path = /var/log/dovecot-info.log # Disable SSL for now. ssl = no disable_plaintext_auth = no # We're using Maildir format #mail_location = maildir:~/Maildir mail_location = mbox:/mail:INBOX=/mail/%u # Authentication configuration: auth_verbose = yes auth_debug = yes auth_username_format = %n auth_mechanisms = plain ntlm login userdb { driver = static # args = uid=501 gid=1001 home=/mail/%u args = home=/mail/%u driver = static } passdb { driver = pam args = failure_show_msg=yes } Now what I would like to know is, which is better for "virtual hosting" Maildir or mbox? Basically my requirement is that I would like to separate users via either individual folders and then put each user's mbox or Maildir in the created directory, or simply name each mbox or Maildir according to the user name. First up is this possible? Secondly, how would I go about doing it? My users are not allowed to login to the system outside of IMAP as it's a Mail only server. Currently I've been looking at many links: http://satish-linuxbug.blogspot.co.uk/2008/08/freebsd-with-active-directory… http://joseph.randomnetworks.com/2005/11/08/freebsd-users-and-groups-with-s… http://wiki2.dovecot.org/HowTo/ActiveDirectoryNtlm http://wiki2.dovecot.org/Authentication/Mechanisms/Winbind http://wiki2.dovecot.org/TestInstallation http://wiki2.dovecot.org/VirtualUsers http://www.linuxmail.info/active-directory-dovecot-pam-authentication/ http://wiki2.dovecot.org/HowTo/SimpleVirtualInstall I'm running dovecot version 2.1.7 on FreeBSD 8.2 x64 RELEASE. The system is not being used as an MTA server meaning that only IMAP transfers are being done using MS Outlook then filtered by Thunderbird. Regards, Kaya

6 15

[Dovecot] started with dovecot sieve
by mailinglist 26 Jun '12

26 Jun '12

As I am new to dovecot and sieve I am really happy to get it working in a straight forward way. Thanks for the documentation to whom it concerns. Now I came to my limits with this failure messages in /home/rolf/.dovecot.sieve.log: sieve: info: started log at Jun 25 20:22:54. error: msgid=<1340648569.94073.YahooMailClassic(a)web190304.mail.sg3.yahoo.com>: failed to store into mailbox 'INBOX': BUG: Unknown internal error. with this messages in mail.info: Jun 25 20:22:54 rolf14 postfix/smtpd[21674]: connect from localhost[127.0.0.1] Jun 25 20:22:54 rolf14 postfix/smtpd[21674]: 90898E0190: client=localhost[127.0.0.1] Jun 25 20:22:54 rolf14 postfix/cleanup[21669]: 90898E0190: message-id=<1340648569.94073.YahooMailClassic(a)web190304.mail.sg3.yahoo.com> Jun 25 20:22:54 rolf14 postfix/qmgr[21172]: 90898E0190: from=<stephanie.otavy(a)live.com>, size=5291, nrcpt=1 (queue active) Jun 25 20:22:54 rolf14 postfix/smtpd[21674]: disconnect from localhost[127.0.0.1] Jun 25 20:22:54 rolf14 dovecot: lda(rolf): Error: setegid(privileged) failed: Operation not permitted Jun 25 20:22:54 rolf14 dovecot: lda(rolf): Error: sieve: msgid=<1340648569.94073.YahooMailClassic(a)web190304.mail.sg3.yahoo.com>: failed to store into mailbox 'INBOX': BUG: Unknown internal error Jun 25 20:22:54 rolf14 dovecot: lda(rolf): Error: sieve: script /home/rolf/.dovecot.sieve failed with unsuccessful implicit keep (user logfile /home/rolf/.dovecot.sieve.log may reveal additional details) I guess the mentioned mail is spam. However, does this tell about some wrong configuration or access rights? Any indication what to improve? I get such an error about every 6 minutes.

2 2

[Dovecot] Director + managesieve: is it posible?
by Joseba Torre 26 Jun '12

26 Jun '12

Hi, I've just tried to add managesieve to our director server, and when I try to connect they fail with Jun 26 12:28:13 director2 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=sieve#011secured#011session=5LNQjl3DjQAKAAsR#011lip=10.0.100.75#011rip=10.0.11.17#011lport=4190#011rport=39309#011resp=<hidden> Jun 26 12:28:13 director2 dovecot: managesieve-login: Error: proxy: host not given: user=<test1>, method=PLAIN, rip=10.0.11.17, lip=10.0.100.75, TLS, session=<5LNQjl3DjQAKAAsR> Jun 26 12:28:13 director2 dovecot: managesieve-login: Disconnected (internal failure, 1 succesful auths): user=<lgsfeacd>, method=PLAIN, rip=10.0.11.17, lip=10.0.100.75, TLS, session=<5LNQjl3DjQAKAAsR> Is it posible to use director for this? Or only static proxy is allowed? Aaaaaaaaagur.

2 1

[Dovecot] dsync error: "Mailboxes don't have unique GUIDs"
by Jeff Gustafson 25 Jun '12

25 Jun '12

I'm getting an error backing up mailboxes. I'm using the mirror command: dsync -fvo mail_home=/home/users/bob mirror ssh vmail(a)10.1.4.1 dsync -o mail_home=/home/.incoming_mail_migrations/users/bob dsync-remote(vmail): Error: Mailboxes don't have unique GUIDs: 1ef6ee37c694894d783100000581a675 is shared by INBOX and INBOX dsync-remote(vmail): Error: command BOX-LIST failed dsync-local(vmail): Error: Worker server's mailbox iteration failed The mail user doesn't yet exist on the destination yet, thus the use of the mail_home parameter. I found a mailing list message where a person was having a similar problem but I couldn't find confirmation that the issue was resolved. In our case, the backup goes from maildir to mdbox format (we can't to convert to mdbox). Things seemed to be moving along, but there are quite a few examples of dsync failing. I think the issue happens more often with large mailboxes ( > 50GB ). We're running version 2.0.13. doveconf -n: # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-274.12.1.el5 x86_64 CentOS release 5.7 (Final) auth_mechanisms = plain login default_client_limit = 15000 default_process_limit = 10000 disable_plaintext_auth = no listen = * mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = zlib mail_uid = vmail mmap_disable = yes namespace { inbox = yes location = prefix = INBOX. separator = . } passdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } plugin { zlib_save = gz } protocols = imap pop3 service auth { client_limit = 10000 unix_listener auth-userdb { mode = 0666 } } service imap-postlogin { executable = script-login /usr/bin/postlogin-imap.sh user = $default_internal_user } service imap { drop_priv_before_exec = yes executable = imap process_limit = 10000 } service pop3-postlogin { executable = script-login /usr/bin/postlogin-pop.sh user = $default_internal_user } } service pop3 { drop_priv_before_exec = yes executable = pop3 process_limit = 2500 } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = zlib } protocol lda { mail_plugins = zlib } protocol imap { mail_max_userip_connections = 100 mail_plugins = zlib } protocol pop3 { mail_max_userip_connections = 30 mail_plugins = zlib } ...Jeff

4 6