November 2013 - dovecot

[Dovecot] backup maildir mailbox bugs
by Anand Kumria 04 Nov '13

04 Nov '13

Hi, Using dovecot v2.2.5.5, I get the following: $ doveadm -v backup -R -u user(a)example.com maildir:/home/rsync/ example.com/user/Maildir/ [...] dsync(user(a)example.com): Panic: file dsync-mailbox-export.c: line 228 (export_save_change_get): assertion failed: (change->type == DSYNC_MAIL_CHANGE_TYPE_FLAG_CHANGE) dsync(user(a)example.com): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x59e6a) [0x7f91ad185e6a] -> /usr/lib/dovecot/libdovecot.so.0(default_fatal_handler+0x2a) [0x7f91ad185f2a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f91ad144b89] -> doveadm [user(a)example.com Printing Quotes send:mailbox recv:mailbox](dsync_mailbox_export_init+0x8b8) [0x434028] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox](dsync_brain_sync_mailbox_open+0x233) [0x42ba83] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox](dsync_brain_slave_recv_mailbox+0x125) [0x42c615] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox](dsync_brain_run+0x369) [0x42a929] -> doveadm [user(a)example.comPrinting Quotes send:mailbox recv:mailbox]() [0x42881b] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox]() [0x411ad7] -> doveadm [user(a)example.com Printing Quotes send:mailbox recv:mailbox](doveadm_mail_try_run+0x260) [0x4127a0] -> doveadm [ user(a)example.com Printing Quotes send:mailbox recv:mailbox](main+0x3f0) [0x4116c0] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed) [0x7f91acd8e76d] -> doveadm [user(a)example.com Printing Quotes send:mailbox recv:mailbox]() [0x4118bd] Other lines emitted were Info lines indicating what message was being processed. Unfortunately this appears to stop the backup dead in it's tracks. Suggestions on how to proceed? I was (originally) doing this as an IMAP to IMAP copy, and when that failed I managed to get the raw Maildir. Now I appear stuck with that too. Regards, Anand -- “Don’t be sad because it’s over. Smile because it happened.” – Dr. Seuss

2 4

[Dovecot] v2.2.7 released
by Timo Sirainen 04 Nov '13

04 Nov '13

http://dovecot.org/releases/2.2/dovecot-2.2.7.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.7.tar.gz.sig * Some usage of passdb checkpassword could have been exploitable by local users. You may need to modify your setup to keep it working. See http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security + auth: Added ability to truncate values logged by auth_verbose_passwords (see 10-logging.conf comment) + mdbox: Added "mdbox_deleted" storage, which can be used to access messages with refcount=0. For example: doveadm import mdbox_deleted:~/mdbox "" mailbox inbox subject oops + ssl-params: Added ssl_dh_parameters_length setting. - master process was doing a hostname.domain lookup for each created process, which may have caused a lot of unnecessary DNS lookups. - dsync: Syncing over 100 messages at once caused problems in some situations, causing messages to get new UIDs. - fts-solr: Different Solr hosts for different users didn't work.

4 4

[Dovecot] Shared mailbox help needed
by Alex Ferrara 04 Nov '13

04 Nov '13

Hi everyone, I am in the middle of a migration from Cyrus 2.4 to Dovecot 2.1.7, and I have everything mostly working. I set up Dovecot to authenticate against Active Directory (Samba4) using PAM and SSSD, and have also used the fantastic cyrus2dovecot perl script to do a test migration of all our mail, and that is now working flawlessly. I have the issue of shared IMAP accounts to deal with, and I am a little stuck. I see that Dovecot is very flexible, and I think I am getting stuck in this flexibility. I thought that if I explain what I am trying to achieve, someone might point me in the right direction. In the Cyrus regime, we have several imap accounts that are shared with a group of people. These groups are actual unix groups that actual unix users are a member of. If we want a person to access a mailbox, we add them to the group and then at next login, it pops up in Thunderbird automatically. SSSD does, from what I can tell, a decent job of binding to AD and mapping AD users to unix users, but since not all of the users have an NIS uid in AD, I decided to use a static mapping. This might have been the wrong decision, I am not sure. userdb { driver = static args = uid=900 gid=900 home=/mnt/mail/%u allow_all_users=yes } It probably isn't important at this stage, but the mail spool is stored on an NFS server and the indexes are stored locally. Thanks in advance, Alex Ferrara Director Receptive IT Solutions

1 0

Re: [Dovecot] Doveadm with a 2nd Instance
by Chris Lasater 03 Nov '13

03 Nov '13

While testing some more I found out something else. I have an alias set for doveadm so it was running with sudo and that ended up being part of the issue. If doveadm is run as a regular user then the problem goes away [user@server ~]$ doveadm -i Director log find Debug: /home/user/apps/logs/director/director_debug.log Info: /home/user/apps/logs/director/director_info.log Warning: /home/user/apps/logs/director/director.log Error: /home/user/apps/logs/director/director.log Fatal: /home/user/apps/logs/director/director.log [user@server ~]$ sudo doveadm -i Director log find Debug: /home/user/apps/logs/dovecot_debug.log Info: /home/user/apps/logs/dovecot_info.log Warning: /home/user/apps/logs/dovecot.log Error: /home/user/apps/logs/dovecot.log Fatal: /home/user/apps/logs/dovecot.log Also if I run "sudo doveadm stop" to stop the main instance, I now have the ability to use the -i Director using sudo. Unfortunately this makes it difficult to manage two instances. Does anyone have an idea of getting this to work with sudo? Chris

2 2

[Dovecot] Encryption solution for messages at rest
by Douglas Mortensen 03 Nov '13

03 Nov '13

Hi, We have clients with various security & compliance requirements. Although not required, it would be ideal to have messages encrypted at rest. We already use SSL/TLS to secure the transmission of most email. However, it would be nice to have them encrypted sitting on our server. Is anyone doing this? I think that ideally, rather than full-disk encryption, we should use an encryption that encrypts the actual email messages as they sit on our file system. This way even if we ever had our server breached by an attacker, they wouldn't be able to do anything with the messages. However, this would also mean that if the attacker can't decrypt the files, than dovecot and postfix still would need to. This means that the encryption key would need to be available to the dovecot deamon. We'd either need to have it in a file that is restricted to access only by dovecot (less secure), or use an encryption passphrase for the certificate which would have to be typed in manually each time that dovecot starts or restarts (more secure, but also more work and possibility of disruption because the server can't restart gracefully without a human being having to be present [although I don't think we have issues with unexpected restarts anyway]). Is anyone doing anything like this with dovecot? Thanks!! - Doug Mortensen Network Consultant Impala Networks Inc CCNA, MCSA, Security+, A+ Linux+, Network+, Server+ A.A.S. Information Technology . www.impalanetworks.com P: (505) 327-7300 F: (505) 327-7545

6 6

[Dovecot] Assertion error in Dovecot 2.2.6
by Mark Sapiro 03 Nov '13

03 Nov '13

Background. A while back I upgraded my phone to one currently using Android 4.1.2 and K9 mail 4.409. This phone/MUA combination seems at times to go crazy making IMAP connections. At first, I had mail_max_userip_connections = 30 (my largest imap account has 19 folders). The issue I had at that time was multiple errors like Oct 14 17:45:16 sbh16 dovecot: imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=30): user=<xxx>, method=PLAIN, rip=xx.xx.xx.xx, lip=xx.xx.xx.xx, TLS, session=<c63x5bzowQBi0uQR> I then set mail_max_userip_connections = 50 This greatly reduced but didn't completely eliminate these messages, but then I would see multiple Oct 31 16:13:40 sbh16 dovecot: master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped and Oct 31 16:13:40 sbh16 dovecot: imap-login: Disconnected: Connection queue full (no auth attempts in 4 secs): user=<>, rip=xx.xx.xx.xx, lip=xx.xx.xx.xx, TLS handshaking, session=<s26xmRHqVQBi0uQR> followed finally by Oct 31 16:13:40 sbh16 dovecot: imap-login: Panic: file client-common.c: line 190 (client_destroy): assertion failed: (!client->authenticating) Oct 31 16:13:40 sbh16 dovecot: auth: Warning: auth client 19669 disconnected with 1 pending requests: EOF Oct 31 16:13:40 sbh16 dovecot: imap-login: Fatal: master: service(imap-login): child 19669 killed with signal 6 (core not dumped - add -D parameter to service imap-login { executable } I then set default_process_limit = 200, and things seem to have settled down, but I thought the panic should be reported. Possibly this is relevant - the above only seem to occur when the phone is connecting via wifi and possibly only when the phone has just switched from the phone data network to wifi. Current doveconf -n # 2.2.6: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.18-8.1.14.el5 i686 CentOS release 5 (Final) auth_mechanisms = plain apop login auth_worker_max_count = 5 default_process_limit = 200 mail_location = mbox:~/Mail:INBOX=/var/spool/mail/%u mail_privileged_group = mail mbox_write_locks = fcntl dotlock namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot.passwd driver = passwd-file } passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } ssl_cert = </etc/httpd/conf/ssl/combined.crt ssl_key = </etc/httpd/conf/ssl/www.grizz.org.key userdb { driver = passwd } protocol imap { mail_max_userip_connections = 50 } -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 1

[Dovecot] METADATA for v2.2.7
by Timo Sirainen 02 Nov '13

02 Nov '13

In case someone wants to try: http://hg.dovecot.org/dovecot-2.2/rev/0a08efeb3f40 The commit message lists the TODO. So for example if you want to enable it just for webmail (because quota limits aren’t there yet): mail_attribute_dict = file:%h/dovecot-attributes local 10.0.0.0/24 { imap_metadata = yes } Compared to the old metadata plugin, there are some improvements: - Uses lib-storage attributes internally, which means: - dsync replicates METADATA - it will be easy to add support for untagged METADATA notifications to clients when they change - SETMETADATA atomically either updates all or none of the changes Things that work in the METADATA code, but still require lib-dict changes to work properly: - Values with unlimited sizes - Values with binary data (NULs)

1 0

[Dovecot] DH parameter length too small?
by Jörg Lübbert 02 Nov '13

02 Nov '13

Hello, from my understanding, using 1024bit DH parameters results in a not sufficiently secure key exchange for DH(E). Therefore I think it would be advisable to have parameters of at least 2048bit . In fact, I would see a great benefit in chosing parameter length arbitrarily. I also do not see the benefit of parameter regeneration. What were the design goals here? Thanks, Jörg Lübbert

2 1

[Dovecot] Error: Syncing mailbox virtual failed: Virtual mailbox missing configuration file
by Mike Constabel 02 Nov '13

02 Nov '13

Hi, if I use doveadm search -u xx(a)xx.de savedbefore 15w or other search queries i got as first line: doveadm(xx(a)xx.de): Error: Syncing mailbox virtual failed: Virtual mailbox missing configuration file The virtual Mailbox has a config file: # cat /mailspool1/xx.de/xx/Maildir/virtual/Alle\ eigenen\ E-Mails/dovecot-virtual * all root@srv-mail:~# doveconf -n # 2.2.6 (81aedacbb01f): /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.2 ext4 auth_mechanisms = plain login dict { expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } lmtp_save_to_detail_mailbox = yes log_path = /var/log/dovecot/dovecot.log mail_attachment_dir = /mailspool1/attachments mail_attachment_min_size = 64 k mail_location = mdbox:/mailspool1/%d/%n/mdbox:ALT=/mailspool2/%d/%n/mdbox mail_plugins = quota mail_log notify expire trash acl zlib mailbox_alias virtual mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { list = children location = mdbox:/mailspool1/%%d/%%n/mdbox:INDEXPVT=~/mdbox/shared/%%u prefix = shared/%%u/ separator = / type = shared } namespace { list = children location = mdbox:/mailspool1/public-folders/mdbox:INDEXPVT=~/mdbox/public/public-folders prefix = public/ separator = / type = public } namespace { location = virtual:~/Maildir/virtual prefix = virtual/ separator = / } namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/All { special_use = \All } mailbox virtual/Flagged { special_use = \Flagged } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/mailspool1/shared-mailboxes.db mail_log_events = delete undelete expunge copy mailbox_create mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_new3 = Gesendete Elemente mailbox_alias_new4 = Gelöschte Elemente mailbox_alias_new5 = Junk-E-Mail mailbox_alias_old = Sent mailbox_alias_old2 = Sent mailbox_alias_old3 = Sent mailbox_alias_old4 = Trash mailbox_alias_old5 = Junk quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule = *:storage=10G quota_rule2 = Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } pop3_client_workarounds = outlook-no-nuls protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0660 } } service lmtp { inet_listener lmtp { address = 192.168.1.98 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 } service managesieve { process_limit = 1024 } ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota mail_log notify expire trash acl zlib mailbox_alias virtual sieve } protocol lda { mail_plugins = quota mail_log notify expire trash acl zlib mailbox_alias virtual sieve } protocol imap { mail_plugins = quota mail_log notify expire trash acl zlib mailbox_alias virtual imap_quota imap_acl }

2 1

[Dovecot] Pre imap-session scripting
by azurIt 02 Nov '13

02 Nov '13

Hi, is it possible to run a script right after the IMAP/POP3 session was started? I know about post-login scripting but this is probably not what i'm looking for. I need to run a script which will know PID of process running IMAP session (so it must be already started). Thank you. azur

2 1