July 2012 - dovecot - dovecot.org

[Dovecot] bcypt availability
by Nick Edwards 17 Jul '12

17 Jul '12

Dear Timo, Do you intend to introduce bcrypt into the built in password schemes? In lew of all these hacks lately many larger companies appear moving this way, we are looking at it too, but dovecot will then be the weakest link in the database security. So, are you planning on this and if so what sort of timeframe / version would you expect it to be in beta ? Nik

5 6

Re: [Dovecot] Issues with Plus addressing and detail part of subaddress.
by Sean Kamath 17 Jul '12

17 Jul '12

On Jul 15, 2012, at 4:34 AM, Charles Marcus wrote: > On 2012-07-15 4:50 AM, Sean Kamath <kamath(a)moltingpenguin.com> wrote: >> Before I dive in and upgrade everything, am I missing something simple? > > dovecot -n output maybe? Certainly (wasn't on the list of "things to put in a post" on the web site, so I missed it): # 2.0.13: /etc/dovecot/dovecot.conf # OS: SunOS 5.10 sun4u base_dir = /var/run/dovecot/ hostname = mail.enoent.net lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To lmtp_save_to_detail_mailbox = yes mail_location = sdbox:~/Mail:INDEX=/var/dovecot/indices/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { driver = pam } plugin { recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/.sieve } protocols = imap sieve ssl_cert = </etc/mail/certs/server.crt ssl_key = </etc/mail/certs/server.key userdb { driver = passwd } protocol lda { mail_plugins = " sieve" } Sean

2 4

[Dovecot] incremental backups of maildir via rsync
by Harald Dunkel 17 Jul '12

17 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, I would like to do incremental backups of the users' maildir directories to a dedicated backup host (using "rsync -SHa" and rsnapshot). Problem is: Dovecot bloats the incremental backup by changing the file names again and again. Is there some way to tell Dovecot to keep meta information separate from the file names? Any helpful comment would be highly appreciated. Harri -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlADpIsACgkQUTlbRTxpHjdS+ACgkPRnzRD2jrcz09kQx9jj9j5v Y1UAniJdRa14hc53gLbxkuBPbx5V5BCh =6nvA -----END PGP SIGNATURE-----

4 6

[Dovecot] Last login datetime on accounts
by Robert Blayzor 16 Jul '12

16 Jul '12

I have searching for the best way to tell if a Dovecot user is idle by finding the last time they have logged in. Right now the best way I can tell is to do something like "touch" a file in the users homedir via a post login exec. This seems like a LOT of overhead, to accomplish such a simple task, especially if your doing a lot of dozens of logins per second. Is there an easier/better way? Is there a way to possibly tell Dovecot to refresh the mod time on an index file whenever the user successfully auths or to refresh a separate file in the homedir, ie: ~/.lastlogin (not ~/Maildir/.lastlogin as that would obviously cause some issues) Seems like something that would be far less overhead than calling a shell, execing another command, etc. I'm open to other ideas/alternatives if they are out there! TIA -- Robert Blayzor INOC, LLC rblayzor(a)inoc.net http://www.inoc.net/~rblayzor/

4 4

[Dovecot] Multi Server Exim/Dovecot and NFS
by Robert Blayzor 16 Jul '12

16 Jul '12

In reading the Dovecot NFS WIKI entry: http://wiki2.dovecot.org/NFS It mentions a FreeBSD NFS client caching bug. I believe that bug only exists pre-8.x ? It seems that a patch in the PR notes was MFC'd and made it into 8.x at some point. (at least I checked the source in 8.3 and it was there). So I assume that FreeBSD 8.x mitigates the issue? Maybe not? So our deployment is multi server Dovecot/Exim running on FreeBSD servers, frontended by a layer3 load balancing switch and a NetApp NFSv3 datastore. The only real concern we have right now is race conditions and file write contention on the Dovecot index files. Our original plan was to use Dovecot LMTP on the servers to deliver to the inbox, but that doesn't seem to be recommended as we'll have a number of servers all acting as primary MX for domains and delivering to the same set of mailboxes. So are the Dovecot dotlock file locking mechanisms not enough for multiple servers trying to write/access index files in Maildirs? If we have to deliver straight to the ~/Maildir/new out of Exim, that's fine, also. We're just wondering if there is a added benefit of actually using LMTP. (other than making sure the index are kept the most recent). The other concern we have is client mailbox access. While we can make sessions "sticky" from one IP so they hit the same server, it doesn't help with the person that checks their email via POP from their PC while having their mobile phone access it via IMAP. (obviously from different IP addresses). So I guess there is some possibly index file write contention there as well. (though hopefully this should be rare). I'm curious as to know others experiences with a similar deployment. TIA -- Robert Blayzor INOC, LLC rblayzor(a)inoc.net http://www.inoc.net/~rblayzor/

5 7

[Dovecot] ACL with MySQL dict => full table scans
by Roland Rosenfeld 16 Jul '12

16 Jul '12

Hi! I'm just installing ACL support on 2.1.6. When a user changes these ACLs, this results in a full table scan on the dictionary, that tells dovecot who shares with whom. Here's what queries I see when I run $ doveadm acl delete -u user1 shared/user2/folder user=user1 1: SELECT dummy,to_user,from_user FROM imap_acl_shares 2: SELECT dummy,from_user FROM imap_acl_anyone 3: BEGIN 4: DELETE FROM imap_acl_shares WHERE to_user = 'user1' AND from_user = 'user1' 5: INSERT INTO imap_acl_shares (dummy,to_user,from_user) VALUES ('1','user1','user1') ON DUPLICATE KEY UPDATE dummy='1' 6: DELETE FROM imap_acl_shares WHERE to_user = 'user2' AND from_user = 'user1' 7: INSERT INTO imap_acl_shares (dummy,to_user,from_user) VALUES ('1','user2','user1') ON DUPLICATE KEY UPDATE dummy='1' 8: COMMIT Line 2 is okay, since imap_acl_anyone is always empty (I'm not able to disable this query, otherwise dovecot spawns errors about a missing map, but I can live with this). Don't ask me what lines 4/5 are repeated in 6/7, but these use indexes and I can live with this. But what the hell is line 1? Why doesn't dovecot use a WHERE clause here with either to_user='user1', to_user='user2', from_user='user1', or from_user='user2'? All these WHERE clauses would use an index and speedup the query. Without the WHERE clause I expect 100000 or more results on our production system, which could slow down it massively. Here's my setup: /etc/dovecot/dovecot-dict-sql.conf: connect = host=foo dbname=mail user=imap password=hidden map { pattern = shared/shared-boxes/user/$to/$from table = imap_acl_shares value_field = dummy fields { from_user = $from to_user = $to } } map { pattern = shared/shared-boxes/anyone/$from table = imap_acl_anyone value_field = dummy fields { from_user = $from } } And dovecot -n: # 2.1.6: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.5 auth_cache_negative_ttl = 5 mins auth_cache_size = 100 M auth_cache_ttl = 5 mins auth_default_realm = example.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " mail_fsync = always mail_gid = 999 mail_location = maildir:~/mail mail_plugins = acl quota mail_uid = 999 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave imapflags mmap_disable = yes namespace { list = children location = maildir:%%h/mail:INDEX=~/mail/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = prefix = separator = / type = private } passdb { args = /etc/dovecot/passwd.master driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl quota = maildir sieve = ~/.dovecot.sieve sieve_dir = ~/mail/sieve sieve_extensions = +imapflags } protocols = imap pop3 sieve service auth { unix_listener auth-master { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap { process_limit = 4000 } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { process_limit = 100 } service pop3 { process_limit = 1000 } shutdown_clients = no ssl = no syslog_facility = local2 userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 10 mail_plugins = quota imap_quota acl imap_acl } protocol pop3 { mail_plugins = quota pop3_no_flag_updates = yes pop3_uidl_format = %v.%u } Tschoeeee Roland

1 0

Re: [Dovecot] Maildir messages
by Nick＠5sg.eu 16 Jul '12

16 Jul '12

Hi Wojciech Thanks for your comeback.. > maybe - just as in article below > http://www.bishnet.net/tim/blog/tag/maildir-to-mbox/ > you like archive in such format I'm trying to switch dovecot to MBox, not just make archives. BTW: I use http://yergler.net/projects/one-off/maildir-to-mbox as it's much smaller and very simple to use to make archives. Does anyone else know the correct way to either switch the existing Maildir multiple file format to the single MBox file format. Failing that, though it will mean a LOT of work, how do I get dovecot to work in future in MBox single file format. I've entered 'mail_location = mbox:~/mail:INBOX=/%h/%u' in the 'dovecot.conf', but it still saves each message in a file of its own in the /new /cur /tmp directories ?? -------Original question -------- > Can someone guide me on changing the Maildir messages files > back to the single file format I used to have instead of the > dovecot.index /cur /tmp /new format my newer server currently > has. I'm running dovecot v1.2.9 postfix v2.7 on Ubuntu v10.4 Thanks, Nick. . . . . -- _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ . . . . . . . . ...---... (Stamp Out Spam and Save Our Servers) http://sosNow.ws -=[ do you know morse code ? ]=- . . . . . . . . _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/

2 1

[Dovecot] director: non standart ports at backends
by Костырев Александр Алексеевич 16 Jul '12

16 Jul '12

hello, I'm trying to figure out how to proxy pop3 and pop3s that listens on non-standart ports at backends. For example, pop3 is at 1110 and pop3s at 1995 (on backend side). is it possible? how should I separate this ports in director's config? it's easy for one port: for example lmtp - you just use passdb in protocol lmtp {}

3 5

[Dovecot] Issues with Plus addressing and detail part of subaddress.
by Sean Kamath 16 Jul '12

16 Jul '12

Hi all, So, it's been a while. I'm just ramping back up with Dovecot after a hiatus of a few years. I've been using it fine, complete with Sieve, for about a year, with little or no issues. I finally got around to setting up a second account, to start figuring out how I want to do some plus address filtering. In a nutshell, I want to put mail for foo+bar in foo's 'bar' folder. That's in the wiki. I did this: require ["fileinto", "envelope", "subaddress"]; if header :contains "subject" ["test"] { fileinto "Test"; } if envelope :detail "to" "test" { fileinto "test"; stop; } So, this fails miserably. No error message, nothing in the logs, no nothing. Yet, when I run sieve-test .dovecot.sieve /path/to/testmessage it works just fine. I even run sieve-test -e .dovecot.sieve /path/to/testmessage and it files it just fine into the folder. I tried adding some debug logging, but it looks like vnd.dovecot.debug isn't in my version. I searched the archives, and found a bit about adding (explicitly) the delimiter to the plugin section of 90-sieve.conf. So I did that. I'm running 2.0.13 of dovecot, and pigeonhole 0.2.3 on Solaris 10. Before I dive in and upgrade everything, am I missing something simple? The "test" bit works just fine (and in another account as well), so I think something's just not seeing the detail in subaddressing when mail is delivered (even though it works just fine with sieve-test). Thanks, Sean

3 3

[Dovecot] Migrating with dsync and INBOX.INBOX namespace issue
by Nikolai Schupbach 15 Jul '12

15 Jul '12

I'm working on migrating IMAP users from Mirapoint Message Servers to Dovecot servers. The Mirapoint IMAP server uses INBOX as a namespace for private mailboxes. I created the same namespace in Dovecot, but when I migrate mailboxes dsync seems to ignore/miss the namespace on Mirapoint and I end up with all mailboxes under a INBOX.INBOX hierarchy. Mirapoint Source Server ----------------------- * OK server.name Mirapoint IMAP4 3.8.3-GA server ready 1 LOGIN test(a)test.com test 1 OK User logged in 2 NAMESPACE * NAMESPACE (("INBOX." ".")) (("user." ".")) (("" ".")) 2 OK Completed 3 LIST "" * * LIST () "." "INBOX" * LIST () "." "INBOX.Draft" * LIST () "." "INBOX.Sent" * LIST () "." "INBOX.Trash" 3 OK Completed Running Dsync ------------- # doveadm -v -o imapc_host=server.name imapc_user=test(a)test.com -o imapc_password=test backup -R -u test(a)test.com imapc: dsync(test(a)test.com): Info: INBOX.INBOX.Sent: only in source (guid=7d3c7eaa71cdf47ee8a1192687cda8cd) dsync(test(a)test.com): Info: INBOX.INBOX.Draft: only in source (guid=a6a03ff3d6ec9066b46013f4affb109a) dsync(test(a)test.com): Info: INBOX.INBOX.Trash: only in source (guid=b36f688eae08506001091708006abe5a) dsync(test(a)test.com): Info: INBOX: only in source (guid=c92f64f79f0d1ed01e6d5b314f04886c) Dovecot Destination Server Post Dsync ------------------------------------- * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. 1 LOGIN test(a)test.com test 1 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE QUOTA ACL RIGHTS=texk] Logged in 2 NAMESPACE * NAMESPACE (("INBOX." ".")) NIL NIL 2 OK Namespace completed. 3 LIST "" * * LIST (\HasChildren) "." "INBOX" * LIST (\HasNoChildren) "." "INBOX.INBOX.Sent" * LIST (\HasNoChildren) "." "INBOX.INBOX.Trash" * LIST (\HasNoChildren) "." "INBOX.INBOX.Draft" 3 OK List completed. I noticed that Mirapoint IMAP also advertises a third empty namespace and I was wondering if this was causing it, but even if I explicitly set -n "INBOX." I still have the same issue. Below is my doveconf -n output: # 2.1.6: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.0-RELEASE-p3 amd64 auth_cache_negative_ttl = 0 auth_verbose = yes default_vsz_limit = 512 M deliver_log_format = subject=%s msgid=%m: %$ disable_plaintext_auth = no imapc_features = rfc822.size mail_gid = vmail mail_home = /mailstore/domains/%d/%n mail_location = mdbox:~/mdbox mail_plugins = quota acl mail_log notify mail_temp_dir = /var/tmp mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave spamtest namespace { inbox = yes location = prefix = INBOX. separator = . } passdb { args = /usr/local/etc/dovecot/dovecot-ldap-passdb.conf driver = ldap } plugin { acl = vfile:/usr/local/etc/dovecot/global-acls mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:User quota::file:%h/.dovecot-quota quota_warning = storage=95%% quota-warning 95 %u sieve = ~/.dovecot.sieve sieve_extensions = +spamtest sieve_max_redirects = 32 sieve_spamtest_max_value = 10 sieve_spamtest_status_header = X-Spam-Score sieve_spamtest_status_type = score } service auth-worker { user = $default_internal_user } service auth { client_limit = 5420 unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = $default_internal_user } service imap-login { process_min_avail = 12 service_count = 0 vsz_limit = 512 M } service imap { process_limit = 4096 vsz_limit = 512 M } service lmtp { process_min_avail = 12 user = vmail } service pop3-login { process_min_avail = 12 service_count = 0 vsz_limit = 512 M } service pop3 { process_limit = 1024 vsz_limit = 512 M } service quota-warning { executable = script /usr/local/bin/quota-warning unix_listener quota-warning { user = vmail } user = vmail } ssl = no userdb { args = /usr/local/etc/dovecot/dovecot-ldap-userdb.conf driver = ldap } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 50 mail_plugins = quota acl mail_log notify imap_quota imap_acl } protocol lmtp { mail_plugins = quota acl mail_log notify sieve } Any help would be much appreciated. Regards, Nikolai.

1 1