August 2012 - dovecot

[Dovecot] antispam_plugin prevents IMAP login (error 3) [Dovecot 2.0.19]
by dof＠projektfabrik.com 13 Sep '12

13 Sep '12

Hi everybody, trying to get the Dovecot antispam_plugin to work and I must be doing something wrong, because as soon as it is enabled with a certain backend, imap logins do not work anymore (the session is immediately closed after a successful login). Interestingly, pipe and spool2dir are working (that is, the session won't be closed), dspam-exec and crm114-exec are not. If this happens, mail_debug output is as follows: imap-login: Login: user=<dof>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=10420, secured imap: Debug: Loading modules from directory: /usr/lib/dovecot/modules imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib20_autocreate_plugin.so imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib20_fts_plugin.so imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib21_fts_squat_plugin.so imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib90_antispam_plugin.so imap(dof): Debug: Effective uid=23244, gid=8, home=/var/spool/dovecot/userdata/dof imap(dof): Debug: Home dir not found: /var/spool/dovecot/userdata/dof master: Error: service(imap): child 10420 returned error 3 Without the plugin I get: imap-login: Login: user=<dof>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=10469, secured imap: Debug: Loading modules from directory: /usr/lib/dovecot/modules imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib20_autocreate_plugin.so imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib20_fts_plugin.so imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib21_fts_squat_plugin.so imap(dof): Debug: Effective uid=23244, gid=8, home=/var/spool/dovecot/userdata/dof imap(dof): Debug: Home dir not found: /var/spool/dovecot/userdata/dof imap(dof): Debug: fs: root=/var/spool/dovecot/mail/dof, index=, control=, inbox=/var/spool/dovecot/mail/dof/INBOX, alt= imap(dof): Debug: Namespace : Using permissions from /var/spool/dovecot/mail/dof: mode=0755 gid=-1 Hopefully this is just a configuration problem. I tried the plugin in the Ubuntu repository (I'm using LTS 12.04) and even checked out the source from git and compiled it myself, but to no avail. Thanks a lot in advance and best regards, Florian ------------------- dovecot -n output: auth_cache_size = 128 k auth_cache_ttl = 20 mins auth_failure_delay = 10 secs auth_mechanisms = plain login disable_plaintext_auth = no login_greeting = Projektfabrik IMAP ready. mail_gid = mail mail_home = /var/spool/dovecot/userdata/%u mail_location = maildir:/var/spool/dovecot/mail/%u:INBOX=/var/spool/dovecot/mail/%u/INBOX:LAYOUT=fs mail_uid = dovemail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { antispam_backend = dspam-exec antispam_dspam_binary = /usr/bin/dspam antispam_signature = X-DSPAM-Signature antispam_signature_missing = error antispam_spam = Spam antispam_trash = trash;Trash;Deleted Items; Deleted Messages autocreate = INBOX/Sent Mail autocreate2 = INBOX/Spam autocreate3 = INBOX/Trash autosubscribe = INBOX/Sent Mail autosubscribe2 = INBOX/Spam autosubscribe3 = INBOX/Trash fts = squat sieve = /var/spool/dovecot/sieve/%u/defaultbc sieve_before = /etc/dovecot/sieve/spam.sieve sieve_dir = /var/spool/dovecot/sieve/%u } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0600 user = postfix } unix_listener auth-userdb { mode = 0600 user = dovemail } user = dovenull } service imap-login { inet_listener imap { address = localhost port = 143 } inet_listener imaps { address = localhost XX.XXX.XX.XXX port = 993 } service_count = 1 user = dovenull } service managesieve-login { inet_listener sieve { address = localhost port = 2000 } service_count = 1 user = dovenull } service pop3-login { inet_listener pop3 { address = localhost port = 110 } inet_listener pop3s { address = XX.XXX.XX.XXX port = 995 } service_count = 1 user = dovenull } ssl_ca = </etc/ssl/dovecot/cacert.pem ssl_cert = </etc/ssl/dovecot/cert.pem ssl_key = </etc/ssl/dovecot/key.pem protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = antispam autocreate fts fts_squat } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_lock_session = yes } protocol lda { mail_fsync = optimized mail_plugins = sieve postmaster_address = postmaster(a)projektfabrik.com }

2 1

[Dovecot] ACL MySQL dict: to_user==from_user entries
by Roland Rosenfeld 11 Sep '12

11 Sep '12

Hi! We run dovecot 2.1.6 with ACL support and MySQL dict for shared/shared-boxes/user/$to/$from. When a user does a SETACL (via IMAP) to himself he is added as $to and $from to the MySQL dict. Se for example this IMAP conversation: 5 GETACL INBOX * ACL "INBOX" "user@domain" lrwstipekxacd 5 OK Getacl completed. 6 SETACL INBOX user@domain lrwstipekxacd 6 OK Setacl complete. 7 GETACL INBOX * ACL "INBOX" "user@domain" akxeilprwtscd 7 OK Getacl completed. As you can see, user@domain sets the ACL of his INBOX to the same value it was set before (reading it from the server after this idempotent write changed the order but none of the flags). But after "SETACL INBOX user@domain lrwstipekxacd" I see a new entry in my imap_acl_shares table where to_user and from_user both contain the value "user@domain". As far as I can see, this entry does not make much sense in the database, because every user should be able so see its own folders. But adding this line may blow up the database especially according to the full table scan problem for acl dict rebuild mentioned in http://www.dovecot.org/list/dovecot/2012-August/067548.html. Does it make sense to run a daily cron job, that removes all entries with from_user=to_user or may this cause other inconsistencies? If you need to have a look at my complete setup, it's in http://www.dovecot.org/list/dovecot/2012-July/067130.html, so I don't have to clone this here. Tschoeeee Roland

2 1

[Dovecot] Is it possible to save only some messages compressed to mdbox? (2.1.6)
by Jost Krieger 11 Sep '12

11 Sep '12

I'm trying to save some messages as compressed (via zlib plugin) and it doesn't seem to work. Here's a log line (I'm logging to stderr): d k 1345467448.705591500 1345467448.705596500 1345467448.974808500 1650 <XXXXXXXXXXXXXXXXXXXXXXXXXX(a)YYY.ruhr-uni-bochum.de> local.jost.krieger+hirn(a)ruhr-uni-bochum.de 10909 80 Extra: -o plugin/zlib_save_level=9 -o plugin/zlib_save=bz2 lda(kriegjcb): Info: msgid=<20120820125728.58CC9172B6C(a)c2-4-7.noc.ruhr-uni-bochum.de>: saved mail to Hirn-2012-08 did 0+0+1 This probably doesn't make much sense to anyone except the last line but 1. It is a somewhat complicated qmail/maildrop/dovecot setup, which works for the standard cases. The Extra gets interpolated into the lda command and this works because an incorrect option blows up the delivery. The mails arrive uncompressed. So here's the questions: 1. Is it possible to have compressed/uncompressed mails mixed in an mdbox? 2. Will it work via "-o" in lda delivery? I tried to find out in the source but found it hard to see which options are pulled in when. Thanks Jost Krieger -- | Helft Spam ausrotten! HTML in Mail ist unhöflich. | | Postmaster, JAPH, manchmal Wahrsager am RZ der RUB | | Wahre Worte sind nicht gefällig, gefällige Worte sind nicht wahr.| | Lao Tse, Tao Te King 81 |

2 2

[Dovecot] Auth worker max line size
by Emmanuel Dreyfus 09 Sep '12

09 Sep '12

Hello I have been playing with some exotic authentication scheme with Dovecot and PAM. That involves sending really large base64 encoded data as the IMAP password, and I have hit a line limit in Dovecot, with AUTH_WORKER_MAX_LINE_LENGTH set to 1024. This limit is especially frustrating since other parts of the software use much larger limits: MAX_INBUF_SIZE 4096 MAX_IMAP_LINE 8192 AUTH_CLIENT_MAX_LINE_LENGTH 8192 I had to make the patch attached below to get my authentication working. I can live with this local patch, but given the much more liberal limits of MAX_INBUF_SIZE at 4096 makes we wonder if this 1024 limit on AUTH_WORKER_MAX_LINE_LENGTH could not be a bug. Or is there a security concern at using more than 1kB? Opinions? (please Cc: me, I'm not subscribed ot the list) --- src/auth/auth-worker-client.h.orig 2009-06-23 18:32:15.000000000 +0200 +++ src/auth/auth-worker-client.h 2009-06-23 18:32:33.000000000 +0200 @@ -1,8 +1,8 @@ #ifndef AUTH_WORKER_CLIENT_H #define AUTH_WORKER_CLIENT_H -#define AUTH_WORKER_MAX_LINE_LENGTH 1024 +#define AUTH_WORKER_MAX_LINE_LENGTH 4096 struct auth_worker_client *auth_worker_client_create(struct auth *auth, int fd); void auth_worker_client_destroy(struct auth_worker_client **client); void auth_worker_client_unref(struct auth_worker_client **client); -- Emmanuel Dreyfus manu(a)netbsd.org

3 5

[Dovecot] Vpopmail Dynamic Authentication Module
by Eric Sisolak 08 Sep '12

08 Sep '12

Hello, We currently use qmail with vpopmail for e-mail and are looking to switch from courier-imap to dovecot for IMAP on our RedHat EL 5 systems. Our goal is to use the dovecot RPM supplied by RH (v1.0.7) if at all possible. We can do this if we are able to dynamically load the vpopmail auth module. The wiki (http://wiki.dovecot.org/CompilingSource) notes that this should be possible: Dovecot can also dynamically load authentication modules from the $prefix/lib/dovecot/auth/ directory. Binary packages builders should use them for authentication modules which require external libraries (e. g. LDAP and vpopmail). There is no standard way to build them as modules currently, but something like this should work: gcc -shared -fPIC -DHAVE_CONFIG_H -DUSERDB_VPOPMAIL -DPASSDB_VPOPMAIL \-I../.. -I../lib userdb-vpopmail.c passdb-vpopmail.c -o vpopmail.so \-lvpopmail I had to modify the command to build the module, but was able to successfully build it: gcc -shared -fPIC -DHAVE_CONFIG_H -DUSERDB_VPOPMAIL -DPASSDB_VPOPMAIL -I../.. -I../lib -I/home/vpopmail/include -I/home/vpopmail/lib userdb-vpopmail.c passdb-vpopmail.c -o vpopmail.so -L/home/vpopmail/lib/libvpopmail.a I am unable to get the module to load properly. Dovecot built with --with-vpopmail works perfectly. When I start dovecot and it tries to load the module it reports: Aug 23 16:48:18 ctd-nix1 dovecot: Dovecot v1.0.7 starting up Aug 23 16:48:18 ctd-nix1 dovecot: auth(default): dlopen(/usr/lib64/dovecot/auth/vpopmail.so) failed: /usr/lib64/dovecot/auth/vpopmail.so: undefined symbol: vclose Aug 23 16:48:18 ctd-nix1 dovecot: auth(default): dlsym(passdb_vpopmail) failed: dovecot-auth: undefined symbol: passdb_vpopmail Aug 23 16:48:18 ctd-nix1 dovecot: auth(default): Unknown passdb driver 'vpopmail' (typo, or Dovecot was built without support for it? Check with dovecot --build-options) Aug 23 16:48:18 ctd-nix1 dovecot: Auth process died too early - shutting down Sometimes instead the last line is replaced with: Aug 23 15:02:45 ctd-nix1 dovecot: child 5412 (auth) returned error 89 Thanks! Eric

2 2

Re: [Dovecot] about postlogin in dovecot2
by Joseph Tam 07 Sep '12

07 Sep '12

<bmalik(a)ihlas.net.tr> writes: > where do i have to locate the passwd-file in dovecot2 For what purpose? Master user? Password/user lookup? passdb { driver = passwd-file master = yes args = /anywhere/you/want/master-users pass = yes } passdb { driver = passwd-file args = /anywhere/you/want/passwd } userdb { driver = passwd-file args = /anywhere/you/want/passwd } Joseph Tam <jtam.home(a)gmail.com>

4 7

[Dovecot] pop3 migration
by TeTeHacko 07 Sep '12

07 Sep '12

Hi, I have problems with pop3 migration, the server disconect the dovesync when fetching mails after 5 minutes with this error in server log: xx.xx.xx.xx [28F4] 11:54:05 <<< RETR 6548 xx.xx.xx.xx [28F4] 11:54:05 >>> +OK 47522 octets xx.xx.xx.xx [28F4] 11:54:05 <<< RETR 6549 xx.xx.xx.xx [28F4] 11:54:05 >>> +OK 355289 octets xx.xx.xx.xx [28F4] 11:54:05 <<< RETR 6550 xx.xx.xx.xx [28F4] 11:54:05 >>> +OK 9638 octets xx.xx.xx.xx [28F4] 11:54:05 <<< RETR 6551 xx.xx.xx.xx [28F4] 11:54:05 >>> +OK 2188 octets xx.xx.xx.xx [28F4] 11:59:05 >>> -ERR Command unrecognized: "" xx.xx.xx.xx [28F4] 11:59:05 *** <info(a)istan.cz> 6551 477693894 00:12:55 ERROR xx.xx.xx.xx [28F4] 11:59:05 Disconnected and this in dovecot log: dsync(info(a)istan.cz): Debug: imapc(mail.stable.cz:143): Authenticated successfully dsync(info(a)istan.cz): Debug: pop3c(mail.stable.cz): Looking up IP address dsync(info(a)istan.cz): Debug: pop3c(mail.stable.cz): Connecting to 88.86.120.212:110 dsync(info(a)istan.cz): Debug: pop3c(mail.stable.cz): Authenticating as info(a)istan.cz dsync(info(a)istan.cz): Error: pop3c(mail.stable.cz): Server disconnected unexpectedly dsync(info(a)istan.cz): Error: pop3_migration: Failed to get header for msg 1: Disconnected dsync(info(a)istan.cz): Error: pop3_migration: Failed to get header for msg 2: Disconnected dsync(info(a)istan.cz): Error: pop3_migration: Failed to get header for msg 3: Disconnected dsync(info(a)istan.cz): Error: pop3_migration: Failed to get header for msg 4: Disconnected is there any timeout in dovecot for 300s? can anybody point me where may be some problem? This error occurs everytime i test it and the mail box has cca 2GB, on small mailboxes is no problem, i try this patch: http://hg.dovecot.org/dovecot-2.1/rev/ab6a4455b27d on dovecot version 2.1.7 but the problem isn't solved. Thanks for help Tomas Herceg

2 2

Re: [Dovecot] Removing specific entry in user/auth cache
by Joseph Tam 07 Sep '12

07 Sep '12

Francisco Wagner C. Freire <wgrcunha(a)gmail.com> writes: > On Wed, Jun 27, 2012 at 9:24 AM, Timo Sirainen <tss(a)iki.fi> wrote: > >> On 27.6.2012, at 14.10, Angel L. Mateo wrote: >> >>> We have dovecot configured with auth cache. Is there any way to >> remove a specific entry (not all) from this cache? >> >> Nope. What do you need it for? > > I dont known about Angel, but for me is useful because sometimes i need to > deactivate smtp/imap/pop access from accounts, or change their home after > storage migration, and removing a specific record i can use a long time > cache. I'm not sure that the auth cache holds that information, but I think you can at least invalidate a particular auth cache entry by 1) Changing the user password (and save the previous hash) 2) Authenticate using the new credentials (and invalidate the auth cache entry). For example, you can just do a manual connection on your dovecot server x login someuser newpassword This will replace the cache entry with a new one. 3) When you are ready to put the account back online, change the password back to the original. A password mismatch forces a resync to your authentication system which will restore the auth cache. Joseph Tam <jtam.home(a)gmail.com>

4 8

[Dovecot] dovecotadm error
by Michael 07 Sep '12

07 Sep '12

When I use the following command: doveadm expunge -A mailbox Junk savedbefore 28d I get: doveadm(root): Error: User listing returned failure In the mail log file it says: dovecot: auth-worker(18549): Error: sql: Iterate query failed: Table 'system.users' doesn't exist (using built-in default iterate_query: SELECT username, domain FROM users) However this is setup: dovecot-sql.conf: iterate_query = SELECT username AS user FROM accounts though I have had to comment the following from dovecot.conf: #iteratedb { # args = /usr/local/etc/dovecot/dovecot-sql.conf # driver = sql #} because it errors on dovecot start up. I have already spent a bit of time on the Dovecot website and Google trying to find an answer. I want to get the expires plugin working. Any leads please? dovecot -n # 2.1.9: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.29.6-rt24-smp i686 Slackware 13.1.0 auth_master_user_separator = * auth_mechanisms = plain login dict { expire = mysql:/usr/local/etc/dovecot/dovecot-dict-expire.conf quotadict = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no first_valid_gid = 1000 first_valid_uid = 1000 mail_access_groups = dovecot mail_location = Maildir:%h/Maildir mail_plugins = " expire" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } plugin { autocreate = Drafts autocreate2 = Junk autocreate3 = Sent autocreate4 = Trash autosubscribe = Drafts autosubscribe2 = Junk autosubscribe3 = Sent autosubscribe4 = Trash expire = Junk expire_dict = proxy::expire quota = dict:user::proxy::quotadict sieve = %h/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/before.sieve sieve_dir = %h/sieve sieve_global_dir = /var/lib/dovecot/sieve/global/ } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service dict { unix_listener dict { group = dovecot mode = 0660 } } service imap-login { inet_listener imap { address = DELETED } } service managesieve-login { executable = /usr/local/libexec/dovecot/managesieve-login } service managesieve { executable = /usr/local/libexec/dovecot/managesieve } ssl_cert = </etc/ssl/private/DELETED.pem ssl_key = </etc/ssl/private/DELETED.pem userdb { args = /usr/local/etc/dovecot/dovecot-sql.lda.conf driver = sql } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = autocreate quota imap_quota zlib imap_zlib } protocol pop3 { mail_plugins = quota } protocol lda { hostname = DELETED mail_plugins = quota sieve postmaster_address = DELETED sendmail_path = /usr/sbin/sendmail } protocol sieve { mail_debug = yes }

2 1

[Dovecot] Length of attachment filenames
by Fuhrmann, Hauke 06 Sep '12

06 Sep '12

Hi there, I have a beginners question to Dovecot: does it have a restriction on the supported length and character encodings of filenames of attachments? Can filenames be arbitrary large? Cheers, Hauke -- Diese E-Mail kann vertrauliche und/oder rechtlich geschuetzte Informationen enthalten. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender durch eine Antwortmail und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. Wir danken fuer Ihre Kooperation. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient or have received this e-mail in error, you are on notice of its status. Please notify the sender immediately by reply e-mail and delete this e-mail from your systems. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly prohibited. Thank you for your cooperation.

3 2