July 2012 - dovecot - dovecot.org

[Dovecot] Difference between proxy_refresh and proxy_timeout in director
by Angel L. Mateo 17 Jul '12

17 Jul '12

Hello, I know proxy_timeout is the timeout for the director operation. But what is the purpose for proxy_refresh? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 1

[Dovecot] imapc: Restrict the number of connections
by René Neumann 17 Jul '12

17 Jul '12

Hi, I have managed to get an imapc connection to another server and bind its contents to only one account (via global ACL). The namespace itself is created as public, though it does not seem to make a difference for this use case (i.e., it does not matter, whether its type is 'public', 'shared', or 'private'). namespace { hidden = no list = children location = imapc: prefix = Gemeinsam. separator = . subscriptions = no type = public } One problem remains: Though there is only one account that is allowed to use this imapc-connection, each imap-process opens a connection to the imapc'd server. Is this caused directly by the imapc_*-definitions in the config? Or is there a way of restricting this to only the account which actually uses it. Used dovecot version: 2.1.8 Thanks, René

2 1

[Dovecot] bcypt availability
by Nick Edwards 17 Jul '12

17 Jul '12

Dear Timo, Do you intend to introduce bcrypt into the built in password schemes? In lew of all these hacks lately many larger companies appear moving this way, we are looking at it too, but dovecot will then be the weakest link in the database security. So, are you planning on this and if so what sort of timeframe / version would you expect it to be in beta ? Nik

5 6

Re: [Dovecot] Issues with Plus addressing and detail part of subaddress.
by Sean Kamath 17 Jul '12

17 Jul '12

On Jul 15, 2012, at 4:34 AM, Charles Marcus wrote: > On 2012-07-15 4:50 AM, Sean Kamath <kamath(a)moltingpenguin.com> wrote: >> Before I dive in and upgrade everything, am I missing something simple? > > dovecot -n output maybe? Certainly (wasn't on the list of "things to put in a post" on the web site, so I missed it): # 2.0.13: /etc/dovecot/dovecot.conf # OS: SunOS 5.10 sun4u base_dir = /var/run/dovecot/ hostname = mail.enoent.net lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To lmtp_save_to_detail_mailbox = yes mail_location = sdbox:~/Mail:INDEX=/var/dovecot/indices/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { driver = pam } plugin { recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/.sieve } protocols = imap sieve ssl_cert = </etc/mail/certs/server.crt ssl_key = </etc/mail/certs/server.key userdb { driver = passwd } protocol lda { mail_plugins = " sieve" } Sean

2 4

[Dovecot] incremental backups of maildir via rsync
by Harald Dunkel 17 Jul '12

17 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, I would like to do incremental backups of the users' maildir directories to a dedicated backup host (using "rsync -SHa" and rsnapshot). Problem is: Dovecot bloats the incremental backup by changing the file names again and again. Is there some way to tell Dovecot to keep meta information separate from the file names? Any helpful comment would be highly appreciated. Harri -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlADpIsACgkQUTlbRTxpHjdS+ACgkPRnzRD2jrcz09kQx9jj9j5v Y1UAniJdRa14hc53gLbxkuBPbx5V5BCh =6nvA -----END PGP SIGNATURE-----

4 6

[Dovecot] Last login datetime on accounts
by Robert Blayzor 16 Jul '12

16 Jul '12

I have searching for the best way to tell if a Dovecot user is idle by finding the last time they have logged in. Right now the best way I can tell is to do something like "touch" a file in the users homedir via a post login exec. This seems like a LOT of overhead, to accomplish such a simple task, especially if your doing a lot of dozens of logins per second. Is there an easier/better way? Is there a way to possibly tell Dovecot to refresh the mod time on an index file whenever the user successfully auths or to refresh a separate file in the homedir, ie: ~/.lastlogin (not ~/Maildir/.lastlogin as that would obviously cause some issues) Seems like something that would be far less overhead than calling a shell, execing another command, etc. I'm open to other ideas/alternatives if they are out there! TIA -- Robert Blayzor INOC, LLC rblayzor(a)inoc.net http://www.inoc.net/~rblayzor/

4 4

[Dovecot] Multi Server Exim/Dovecot and NFS
by Robert Blayzor 16 Jul '12

16 Jul '12

In reading the Dovecot NFS WIKI entry: http://wiki2.dovecot.org/NFS It mentions a FreeBSD NFS client caching bug. I believe that bug only exists pre-8.x ? It seems that a patch in the PR notes was MFC'd and made it into 8.x at some point. (at least I checked the source in 8.3 and it was there). So I assume that FreeBSD 8.x mitigates the issue? Maybe not? So our deployment is multi server Dovecot/Exim running on FreeBSD servers, frontended by a layer3 load balancing switch and a NetApp NFSv3 datastore. The only real concern we have right now is race conditions and file write contention on the Dovecot index files. Our original plan was to use Dovecot LMTP on the servers to deliver to the inbox, but that doesn't seem to be recommended as we'll have a number of servers all acting as primary MX for domains and delivering to the same set of mailboxes. So are the Dovecot dotlock file locking mechanisms not enough for multiple servers trying to write/access index files in Maildirs? If we have to deliver straight to the ~/Maildir/new out of Exim, that's fine, also. We're just wondering if there is a added benefit of actually using LMTP. (other than making sure the index are kept the most recent). The other concern we have is client mailbox access. While we can make sessions "sticky" from one IP so they hit the same server, it doesn't help with the person that checks their email via POP from their PC while having their mobile phone access it via IMAP. (obviously from different IP addresses). So I guess there is some possibly index file write contention there as well. (though hopefully this should be rare). I'm curious as to know others experiences with a similar deployment. TIA -- Robert Blayzor INOC, LLC rblayzor(a)inoc.net http://www.inoc.net/~rblayzor/

5 7

[Dovecot] ACL with MySQL dict => full table scans
by Roland Rosenfeld 16 Jul '12

16 Jul '12

Hi! I'm just installing ACL support on 2.1.6. When a user changes these ACLs, this results in a full table scan on the dictionary, that tells dovecot who shares with whom. Here's what queries I see when I run $ doveadm acl delete -u user1 shared/user2/folder user=user1 1: SELECT dummy,to_user,from_user FROM imap_acl_shares 2: SELECT dummy,from_user FROM imap_acl_anyone 3: BEGIN 4: DELETE FROM imap_acl_shares WHERE to_user = 'user1' AND from_user = 'user1' 5: INSERT INTO imap_acl_shares (dummy,to_user,from_user) VALUES ('1','user1','user1') ON DUPLICATE KEY UPDATE dummy='1' 6: DELETE FROM imap_acl_shares WHERE to_user = 'user2' AND from_user = 'user1' 7: INSERT INTO imap_acl_shares (dummy,to_user,from_user) VALUES ('1','user2','user1') ON DUPLICATE KEY UPDATE dummy='1' 8: COMMIT Line 2 is okay, since imap_acl_anyone is always empty (I'm not able to disable this query, otherwise dovecot spawns errors about a missing map, but I can live with this). Don't ask me what lines 4/5 are repeated in 6/7, but these use indexes and I can live with this. But what the hell is line 1? Why doesn't dovecot use a WHERE clause here with either to_user='user1', to_user='user2', from_user='user1', or from_user='user2'? All these WHERE clauses would use an index and speedup the query. Without the WHERE clause I expect 100000 or more results on our production system, which could slow down it massively. Here's my setup: /etc/dovecot/dovecot-dict-sql.conf: connect = host=foo dbname=mail user=imap password=hidden map { pattern = shared/shared-boxes/user/$to/$from table = imap_acl_shares value_field = dummy fields { from_user = $from to_user = $to } } map { pattern = shared/shared-boxes/anyone/$from table = imap_acl_anyone value_field = dummy fields { from_user = $from } } And dovecot -n: # 2.1.6: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.5 auth_cache_negative_ttl = 5 mins auth_cache_size = 100 M auth_cache_ttl = 5 mins auth_default_realm = example.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " mail_fsync = always mail_gid = 999 mail_location = maildir:~/mail mail_plugins = acl quota mail_uid = 999 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave imapflags mmap_disable = yes namespace { list = children location = maildir:%%h/mail:INDEX=~/mail/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = prefix = separator = / type = private } passdb { args = /etc/dovecot/passwd.master driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl quota = maildir sieve = ~/.dovecot.sieve sieve_dir = ~/mail/sieve sieve_extensions = +imapflags } protocols = imap pop3 sieve service auth { unix_listener auth-master { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap { process_limit = 4000 } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { process_limit = 100 } service pop3 { process_limit = 1000 } shutdown_clients = no ssl = no syslog_facility = local2 userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 10 mail_plugins = quota imap_quota acl imap_acl } protocol pop3 { mail_plugins = quota pop3_no_flag_updates = yes pop3_uidl_format = %v.%u } Tschoeeee Roland

1 0

Re: [Dovecot] Maildir messages
by Nick＠5sg.eu 16 Jul '12

16 Jul '12

Hi Wojciech Thanks for your comeback.. > maybe - just as in article below > http://www.bishnet.net/tim/blog/tag/maildir-to-mbox/ > you like archive in such format I'm trying to switch dovecot to MBox, not just make archives. BTW: I use http://yergler.net/projects/one-off/maildir-to-mbox as it's much smaller and very simple to use to make archives. Does anyone else know the correct way to either switch the existing Maildir multiple file format to the single MBox file format. Failing that, though it will mean a LOT of work, how do I get dovecot to work in future in MBox single file format. I've entered 'mail_location = mbox:~/mail:INBOX=/%h/%u' in the 'dovecot.conf', but it still saves each message in a file of its own in the /new /cur /tmp directories ?? -------Original question -------- > Can someone guide me on changing the Maildir messages files > back to the single file format I used to have instead of the > dovecot.index /cur /tmp /new format my newer server currently > has. I'm running dovecot v1.2.9 postfix v2.7 on Ubuntu v10.4 Thanks, Nick. . . . . -- _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ . . . . . . . . ...---... (Stamp Out Spam and Save Our Servers) http://sosNow.ws -=[ do you know morse code ? ]=- . . . . . . . . _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/

2 1

[Dovecot] director: non standart ports at backends
by Костырев Александр Алексеевич 15 Jul '12

15 Jul '12

hello, I'm trying to figure out how to proxy pop3 and pop3s that listens on non-standart ports at backends. For example, pop3 is at 1110 and pop3s at 1995 (on backend side). is it possible? how should I separate this ports in director's config? it's easy for one port: for example lmtp - you just use passdb in protocol lmtp {}

3 5