October 2013 - dovecot

[Dovecot] Dovecot connection problem - Too many invalid commands (no auth attempts) - v2.0.19
by Thomas Standaert 12 Dec '13

12 Dec '13

Hello. This might be a silly problem, but I'm a bit a newbie at this, and the internet didn't give me a solution to this yet. I installed a mail server with postfix, dovecot, postfixadmin and a mysql DB for authentification, using this tutorial : <http://www.exratione.com/2012/05/a-mailserver-on-ubuntu-1204-postfix-doveco t-mysql/> http://www.exratione.com/2012/05/a-mailserver-on-ubuntu-1204-postfix-dovecot -mysql/. Except step 4. The complete tutorial worked on a virtual machine, but doesn't work here on a vps from ovh.net. Connecting via telnet localhost 143 works, I can connect. When I try to connect via thunderbird, the domain name is picked up, but gives me a bad login/password combination. Mail.log, mail.err and error don't show anything. Via MS Outlook, I seem to get stuck on the connection page, and I get the following errors in mail.log: dovecot: imap-login: Disconnected: Too many invalid commands (no auth attempts): rip=x, lip=y dovecot: pop3-login: Disconnected (no auth attempts): rip=x, lip=y dovecot: imap-login: Disconnected (no auth attempts): rip=x, lip=y, TLS: Disconnected dovecot: pop3-login: Disconnected (no auth attempts): rip=x, lip=y, TLS: Disconnected dovecot: pop3-login: Aborted login (no auth attempts): rip=x, lip=y dovecot: imap-login: Disconnected (no auth attempts): rip=x, lip=y, TLS: Disconnected dovecot: imap-login: Disconnected (no auth attempts rip=x, lip=y dovecot: imap-login: Disconnected (no auth attempts): rip=x, lip=y, TLS handshaking: Disconnected dovecot: pop3-login: Disconnected (no auth attempts): rip=x, lip=y, TLS handshaking: Disconnected And after a while asks to try to connect via plain method. Doveconf -n gives me this # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-042stab068.8 x86_64 Ubuntu 12.04.2 LTS simfs auth_mechanisms = plain login first_valid_uid = 150 last_valid_uid = 150 mail_gid = mail mail_location = maildir:/var/vmail/%d/%n mail_uid = vmail passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = " imap pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } Hope you guys can help me, and thanks in advance for it. Greetings, Thomas Standaert

4 4

[Dovecot] proxy, userdb and passdb
by Jogi Hofmüller 03 Dec '13

03 Dec '13

Dear all, We are getting closer to the migration of our mailsystem. Now I have a special question. We are successfully using passdb { driver = pam } and that is good. Now, how would I tell dovecot to proxy certain users (the ones not yet migrated) to the old server? My attempts to configure an additional userdb failed since this seems to override the passdb setting. Grateful for any hints! Cheers, -- j.hofmüller Optimism doesn't alter the laws of physics. - Subcommander T'Pol

4 5

[Dovecot] Crash in dovecot 2.2.6
by Ed W 19 Nov '13

19 Nov '13

Hi, I recently upgraded from a dovecot 2.1 version to 2.2.6. I now have a single user who occasionally triggers a crash (just this one user it seems?). The user connects via LiveMail (v14.0.8117.) and IMAP. Oct 29 08:05:26 mail1 dovecot: imap(customer(a)example.org): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x6575a) [0xd94cc75a] -> /usr/lib/dovecot/libdovecot.so.0(+0x657cb) [0xd94cc7cb] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0xd9481991] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_transaction_export+0xa69) [0xd95e3e09] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xa9618) [0xd95e2618] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_transaction_commit_full+0xd1) [0xd95e2b31] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_transaction_commit+0x23) [0xd95e2c23] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_sync_commit+0xe9) [0xd95ec0c9] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x527d2) [0xd958b7d2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x51b0c) [0xd958ab0c] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x51eea) [0xd958aeea] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_storage_sync_init+0xef) [0xd958b2af] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x3b) [0xd959c4ab] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x3f) [0xd959c5ef] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x48) [0xd95cabc8] -> /usr/lib/dovecot/lib20_fts_plugin.so(+0xb362) [0xd928f362] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x49) [0xd959da79] -> dovecot/imap [customer(a)example.org 176.35.111.117 STATUS](imap_status_get+0x73) [0x8064503] -> dovecot/imap [customer(a)example.org 176.35.111.117 STATUS](cmd_status+0x189) [0x80591d9] -> dovecot/imap [customer(a)example.org 176.35.111.117 STATUS](command_exec+0x32) [0x805d762] -> dovecot/imap [customer(a)example.org 176.35.111.117 STATUS]() [0x805c747] -> dovecot/imap [customer(a)example.org 176.35.111.117 STATUS]() [0x805c891] -> dovecot/imap [customer(a)example.org 176.35.111.117 STATUS](client_handle_input+0x125) [0x805cae5] -> dovecot/imap [customer(a)example.org 176.35.111.117 STATUS](client_input+0x72) [0x805ce92] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x44) [0xd94def84] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xce) [0xd94dff7e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0xd94dea40] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x2e) [0xd94874be] System is gentoo 32bit. Do you need configs? Thanks for any advice Ed W

2 3

[Dovecot] Replication on v2.2.6 - I'm stuck (again)
by IT geek 31 10 Nov '13

10 Nov '13

Hi, I'm trying to get Dovecot replication working between two servers. I didn't have much luck on v2.1.3, so after receiving advice from the list I have upgraded to v2.2.6. I now get the error: Oct 30 11:50:16 server1 dovecot: doveadm(mark): Error: user mark: Auth PASS lookup failed Oct 30 11:50:16 server2 dovecot: doveadm(mark): Error: sync: /var/run/dovecot/auth-userdb: passdb lookup failed (to see if user is proxied, because doveadm_port is set) Here is my config: # 2.2.6: /usr/pkg/etc/dovecot/dovecot.conf # OS: NetBSD 5.2 cobalt auth_mechanisms = plain login doveadm_password = mylittlesecret doveadm_port = 12345 dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u listen = 192.168.1.1 login_greeting = Go on then, let's have it... mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = " notify replication" passdb { driver = passwd } plugin { mail_replica = remote:vmail@server2.mydomain.com replication_full_sync_interval = 1 hours } protocols = imap service aggregator { fifo_listener replication-notify-fifo { mode = 0600 user = vmail } unix_listener replication-notify { mode = 0600 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service doveadm { inet_listener { port = 12345 } } service imap-login { inet_listener imap { port = 0 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } ssl_cert = </etc/openssl/certs/mail.mydomain.com.crt ssl_key = </etc/openssl/private/mail.mydomain.com.key userdb { driver = passwd } protocol lda { postmaster_address = postmaster(a)mydomain.com Can anyone give me some guidance on where I've gone wrong with my config? Any help would be appreciated, -Mark

2 7

[Dovecot] (Maybe stupid) question about selecting mailbox
by kjonca＠o2.pl 05 Nov '13

05 Nov '13

Does mailbox with "\NoSelect" can be select or examine? I'm not sure but IMVHO "select x" should not work. $/usr/lib/dovecot/imap * PREAUTH [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE COMPRESS=DEFLATE] Logged in as kjonca 2 LIST "x" "*" * LIST (\Noselect \HasChildren) "/" "x" * LIST (\HasNoChildren) "/" "x/y" 2 OK List completed. 3 SELECT x * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1376977764] UIDs valid * OK [UIDNEXT 1] Predicted next UID * OK [NOMODSEQ] No permanent modsequences 3 OK [READ-WRITE] Select completed. 4 logout IMAP(kjonca): Info: Disconnected: Logged out in=35 out=813 * BYE Logging out 4 OK Logout completed. doveconf -n # 2.1.17 (d463fab6db95): /etc/dovecot/dovecot.conf # OS: Linux 3.8.9+1 x86_64 Debian wheezy/sid auth_debug = yes auth_mechanisms = plain digest-md5 cram-md5 login auth_username_format = %n auth_verbose = yes listen = alfa log_path = /var/log/dovecot mail_debug = yes mail_location = maildir:~/Mail/1:LAYOUT=fs:INBOX=~/Mail/1/INBOX mail_log_prefix = "%Us(%u): " mail_plugins = zlib passdb { args = scheme=PLAIN /etc/security/dovecot.pwd driver = passwd-file } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mail_log_fields = uid box msgid size from flags sieve = ~/.dovecot.sieve sieve_execute_bin_dir = %h/sieve/bin sieve_execute_exec_timeout = 86400s sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.filter sieve_filter_bin_dir = %h/sieve/bin sieve_filter_exec_timeout = 86400s sieve_pipe_bin_dir = %h/sieve/bin sieve_pipe_exec_timeout = 86400s sieve_plugins = sieve_extprograms } protocols = " imap lmtp" service auth { user = root } ssl = no ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { driver = passwd } protocol lmtp { mail_plugins = zlib sieve } protocol lda { deliver_log_format = msgid=%m: %$ log_path = ~/log/deliver.log mail_plugins = zlib sieve postmaster_address = root@localhost } protocol imap { mail_max_userip_connections = 20 mail_plugins = zlib imap_zlib mail_log notify acl } -- http://blogdebart.pl/2009/12/22/mamy-chorych-dzieci/ The goal of Computer Science is to build something that will last at least until we've finished building it.

2 2

[Dovecot] [bug] ssl-params hangs when FIPS is enabled
by Michal Hlavinka 05 Nov '13

05 Nov '13

Hi, we found a bug in ssl-params. It calls openssl DH generator for 512 and 1024 bits, but in FIPS mode, openssl won't generate anything for less than 1024, so it fails with: error:0506A06E:Diffie-Hellman routines:DH_BUILTIN_GENPARAMS:key size too small but when DH generator fails, ssl-params hangs forever in io_loop_run: __epoll_wait_nocancel() io_loop_handler_run(..) at ioloop-epoll.c:176 io_loop_run(..) at ioloop.c:406 master_service_run(..) at master-service.c:566 main(..) at main.c:156 Getting system in FIPS mode can be a little tricky, but DH_generator simulated failure can do the trick. Just change ssl-params/ssl-params-openssl.c:generate_dh_paramaters:39 - if (dh == NULL) { + if (1 || dh == NULL) { and when you run ssl-params (with no ssl-parameters.dat), it hangs. Let me know if you need more information. Regards, Michal Hlavinka

2 3

[Dovecot] backup maildir mailbox bugs
by Anand Kumria 04 Nov '13

04 Nov '13

Hi, Using dovecot v2.2.5.5, I get the following: $ doveadm -v backup -R -u user(a)example.com maildir:/home/rsync/ example.com/user/Maildir/ [...] dsync(user(a)example.com): Panic: file dsync-mailbox-export.c: line 228 (export_save_change_get): assertion failed: (change->type == DSYNC_MAIL_CHANGE_TYPE_FLAG_CHANGE) dsync(user(a)example.com): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x59e6a) [0x7f91ad185e6a] -> /usr/lib/dovecot/libdovecot.so.0(default_fatal_handler+0x2a) [0x7f91ad185f2a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f91ad144b89] -> doveadm [user(a)example.com Printing Quotes send:mailbox recv:mailbox](dsync_mailbox_export_init+0x8b8) [0x434028] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox](dsync_brain_sync_mailbox_open+0x233) [0x42ba83] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox](dsync_brain_slave_recv_mailbox+0x125) [0x42c615] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox](dsync_brain_run+0x369) [0x42a929] -> doveadm [user(a)example.comPrinting Quotes send:mailbox recv:mailbox]() [0x42881b] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox]() [0x411ad7] -> doveadm [user(a)example.com Printing Quotes send:mailbox recv:mailbox](doveadm_mail_try_run+0x260) [0x4127a0] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox](main+0x3f0) [0x4116c0] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed) [0x7f91acd8e76d] -> doveadm [user(a)example.com Printing Quotes send:mailbox recv:mailbox]() [0x4118bd] Other lines emitted were Info lines indicating what message was being processed. Unfortunately this appears to stop the backup dead in it's tracks. Suggestions on how to proceed? I was (originally) doing this as an IMAP to IMAP copy, and when that failed I managed to get the raw Maildir. Now I appear stuck with that too. Regards, Anand -- “Don’t be sad because it’s over. Smile because it happened.” – Dr. Seuss

2 4

Re: [Dovecot] Doveadm with a 2nd Instance
by Chris Lasater 03 Nov '13

03 Nov '13

While testing some more I found out something else. I have an alias set for doveadm so it was running with sudo and that ended up being part of the issue. If doveadm is run as a regular user then the problem goes away [user@server ~]$ doveadm -i Director log find Debug: /home/user/apps/logs/director/director_debug.log Info: /home/user/apps/logs/director/director_info.log Warning: /home/user/apps/logs/director/director.log Error: /home/user/apps/logs/director/director.log Fatal: /home/user/apps/logs/director/director.log [user@server ~]$ sudo doveadm -i Director log find Debug: /home/user/apps/logs/dovecot_debug.log Info: /home/user/apps/logs/dovecot_info.log Warning: /home/user/apps/logs/dovecot.log Error: /home/user/apps/logs/dovecot.log Fatal: /home/user/apps/logs/dovecot.log Also if I run "sudo doveadm stop" to stop the main instance, I now have the ability to use the -i Director using sudo. Unfortunately this makes it difficult to manage two instances. Does anyone have an idea of getting this to work with sudo? Chris

2 2

[Dovecot] Encryption solution for messages at rest
by Douglas Mortensen 03 Nov '13

03 Nov '13

Hi, We have clients with various security & compliance requirements. Although not required, it would be ideal to have messages encrypted at rest. We already use SSL/TLS to secure the transmission of most email. However, it would be nice to have them encrypted sitting on our server. Is anyone doing this? I think that ideally, rather than full-disk encryption, we should use an encryption that encrypts the actual email messages as they sit on our file system. This way even if we ever had our server breached by an attacker, they wouldn't be able to do anything with the messages. However, this would also mean that if the attacker can't decrypt the files, than dovecot and postfix still would need to. This means that the encryption key would need to be available to the dovecot deamon. We'd either need to have it in a file that is restricted to access only by dovecot (less secure), or use an encryption passphrase for the certificate which would have to be typed in manually each time that dovecot starts or restarts (more secure, but also more work and possibility of disruption because the server can't restart gracefully without a human being having to be present [although I don't think we have issues with unexpected restarts anyway]). Is anyone doing anything like this with dovecot? Thanks!! - Doug Mortensen Network Consultant Impala Networks Inc CCNA, MCSA, Security+, A+ Linux+, Network+, Server+ A.A.S. Information Technology . www.impalanetworks.com P: (505) 327-7300 F: (505) 327-7545

6 6

[Dovecot] DH parameter length too small?
by Jörg Lübbert 02 Nov '13

02 Nov '13

Hello, from my understanding, using 1024bit DH parameters results in a not sufficiently secure key exchange for DH(E). Therefore I think it would be advisable to have parameters of at least 2048bit . In fact, I would see a great benefit in chosing parameter length arbitrarily. I also do not see the benefit of parameter regeneration. What were the design goals here? Thanks, Jörg Lübbert

2 1