December 2013 - dovecot

[Dovecot] BUG: Authentication client sent unknown handshake command
by Emmanuel Dreyfus 04 Dec '13

04 Dec '13

Hi After upgrading the kernel, everything is fine, except dovecot authentication. I get this trange thing (data after REQUEST? changed just in case it contains anything sensitive): Nov 29 16:56:01 volanges dovecot: auth: Error: BUG: Authentication client sent unknown handshake command: REQUEST?6970356762?616?6?235264ef69dbd1665538af54d12fdaea?session_pid=453?req... Nov 29 16:56:01 volanges dovecot: imap: Error: Authentication server didn't send valid SPID as expected: MECH PLAIN plaintext Nov 29 16:56:01 volanges dovecot: imap: Error: Disconnected from auth server, aborting (client-pid=161 client-id=1) Nov 29 16:56:01 volanges dovecot: imap-login: Internal login failure (pid=161 id=1) (internal failure, 1 successful auths): user=<jdoe>, method=PLAIN, rip=192.0.2.251, lip=192.0.2.10, mpid=453, TLS, TLSv1 with cipher AES128-SHA (128/128 bits) Reverting to the previous kernel fixed the problem, but I have not been able to spot what the problem was. Any idea? -- Emmanuel Dreyfus manu(a)netbsd.org

3 5

[Dovecot] Ubuntu packages and broken link in docs
by Alan McGinlay - SICS 04 Dec '13

04 Dec '13

Hi, Two things: 1. Does anyone know of a good PPA with updated packages of Dovecot for Ubuntu? "For the latest Dovecot for latest Ubuntu LTS see Xiaoka APT Repository. (Outdated. Could someone provide a ppa for latest stable Dovecot, please?)" 2. On the http://wiki2.dovecot.org/PrebuiltBinaries#Ubuntu page there is a link to a supposedly outdated PPA, the ppa page now redirects to an ad for the guys services so should probably be removed. /Alan

2 1

[Dovecot] Different settings for SSL/non-SSL protocols
by Алексей Прокопчук 04 Dec '13

04 Dec '13

Good time of the day! It is possible to setup dovecot with different requirements for SSL and non-SSL protocols? What would I like to do: pop3/imap non-SSL = allowed plain text authentication. pop3/imap with SSL = allowed plain text authentication with required valid SSL certificates. I need to allow access from any IP address for first group of users, which have valid SSL certificates. And allow access from only local IP addresses for second group of users which doesn't have SSL certificates at all. I tried to setup dovecot for such task. SSL and non-SSL pop3/imap works together fine, but without require valid SSL certificates. If I set auth_ssl_require_client_cert = yes, non-SSL pop3/imap refuses authentication without valid SSL certificate. I tried to use different sections for protocol pop3 {} and protocol pop3s {} (and imap/imaps) but this seems doesn't work. Is there any way to solve this? Thanks for attention, with best regards, Alexey Prokopchuk (AP8686-RIPE)

1 2

[Dovecot] Complete migration from Cyrus on remote server
by Alan McGinlay - SICS 04 Dec '13

04 Dec '13

Hi All! I am working on a complete migration from an old solaris machine running Cyrus IMAP v2.3.14 and wish to migrate all users to a new ubuntu vm running Dovecot 2.0.19. What I have so far is a fully functional dovecot installation with LDAP / Dovecot SASL auth using Maildir++. My plan is to use Perdition IMAP proxy on a third host and migrate users a few at a time (see attached picture of my whiteboard). The proxy is in place and already used by webmail clients to connect to the old server, shortly I will change the dns to point smtp.domain.com and imap.domain.com etc to the proxy instead of the old server but I haven't finished testing yet. Once that is done it is a simple matter of changing the proxy configuration per user to make them hit the new server instead. The problem I am having with this is that I am using Imapsync (http://imapsync.lamiral.info) to perform the initial synchronization (i have scripted it to maintain sync every 10 minutes with the addtion of "--maxage 1" option) using the following command line options: /usr/local/bin/imapsync --noreleasecheck --useheader ALL --delete2 --expunge2 --tmpdir /var/vmail/cache --subscribe --subscribed --tls1 --tls2 --usecache --nofoldersizes --nocheckmessageexists --host1 oldserver.domain.com --authuser1 adminuser --user1 testuser(a)domain.com --authmech1 PLAIN --password1 <HIDDEN> --host2 newserver.domain.com --authuser2 adminuser --user2 testuser(a)domain.com --authmech2 PLAIN --password2 <HIDDEN> All email is copied over and stored in dovecot as you would expect. Then I switch the user to the new server on the imapproxy and restart the client (thunderbird or whatever). This is where all email headers are downloaded again as if they were new! There are *Many* users here who would complain intensely if this happened and I was really wanting the migration to be as invisible as possible. Is there a way to do what I have described without the clients redownloading headers / full messages? I have been working on this for some time now but have hit a roadblock and don't know where to turn, any help would be really appreciated! Notes: * The proxy is not used during imapsync. * Some users have 20 years worth of mail running into 10's of GB * I have looked at dsync but the docs state that the mailbox should not be accessed during sync, this is not possible for me (it doesn't say why this is the case however)

4 7

[Dovecot] file descriptor errors
by Christian Rößner 04 Dec '13

04 Dec '13

Hi, I use dovecot 2.2.9 on Gentoo Linux and I get lots of these erors in my log file: Dec 4 08:53:37 mx dovecot: auth: Error: close failed in file object destructor: Dec 4 08:53:37 mx dovecot: auth: Error: IOError: [Errno 9] Bad file descriptor What could cause these error messages? My mailboxes are stored on an ext4 filesystem: /dev/vdb1 on /srv/mail type ext4 (rw,noatime) doveconf -n: # OS: Linux 3.11.2-hardened x86_64 Gentoo Base System release 2.2 ext4 auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_access_groups = mail mail_attachment_dir = /srv/mail/copymail/attachments mail_gid = mail mail_location = maildir:/srv/mail/virtual/%d/%n mail_plugins = quota acl zlib mail_log notify mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk-E-Mail { auto = subscribe special_use = \Junk } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. } passdb { args = /usr/local/sbin/ispcp-decrypt.py driver = checkpassword } plugin { acl = vfile acl_shared_dict = file:/srv/mail/virtual/shared-mailboxes.db quota = dict:User quota::file:/srv/mail/virtual/%d/%n/dovecot-quota quota_rule = *:storage=300M:messages=20000 quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } postmaster_address = postmaster(a)deltaweb.de protocols = imap pop3 lmtp sieve service auth-worker { extra_groups = ssl-cert unix_listener auth-worker { mode = 0600 user = vmail } user = vmail } service auth { extra_groups = ssl-cert unix_listener /var/spool/postfix.relay/private/auth { group = postfix mode = 0660 user = postfix } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0660 user = vmail } user = vmail } service config { unix_listener config { mode = 0600 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = ::1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl_cert = </etc/ssl/certs/mx_deltaweb_de.crt ssl_key = </etc/ssl/private/mx_deltaweb_de.key userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota acl zlib mail_log notify sieve } protocol lda { mail_plugins = quota acl zlib mail_log notify sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = quota acl zlib mail_log notify imap_quota imap_acl imap_zlib } Thanks in advance -Christian Rößner -- Bachelor of Science Informatik Erlenwiese 14, 36304 Alsfeld T: +49 6631 78823400, F: +49 6631 78823409, M: +49 176 93118939 USt-IdNr.: DE225643613, http://www.roessner-network-solutions.com

1 0

[Dovecot] Possible managesieve bug.
by Pedro R. Benito da Rocha 04 Dec '13

04 Dec '13

Hi, I'm migrating from from 1.1 to 2.2. Currently I am doing test to ensure I'm doing it right. On the old server the managesieve config says: sieve = /correo/%d/%u/dovecot.sieve sieve_dir = /correo/%d/%u/Sieve and is working fine. But the same config on the new server is not working. I have activated verbose logging and this is the result: Dec 3 09:59:41 imap-01 dovecot: managesieve-login: Login: user=<xxxx(a)ubu.es>, method=LOGIN, rip=10.145.4.65, lip=10.145.4.45, mpid=29855, session=<T7hfhJ3s+QAKkQRB> Dec 3 09:59:41 imap-01 dovecot: managesieve(xxxx(a)ubu.es): Error: sieve-storage: Performing readlink() on active sieve symlink '/correo/ubu.es/xxxx(a)ubu.es/dovecot.sieve' failed: Permission denied Dec 3 09:59:41 imap-01 dovecot: managesieve(xxxx(a)ubu.es): Error: sieve-storage: Failed to stat active sieve script symlink (/correo/ubu.es/xxxx(a)ubu.es/dovecot.sieve) Permission denied. Dec 3 09:59:41 imap-01 dovecot: managesieve(xxxx(a)ubu.es): Disconnected: Logged out bytes=120/331 Dec 3 09:59:51 imap-01 dovecot: managesieve-login: Login: user=<pedro(a)ubu.es>, method=LOGIN, rip=10.145.4.65, lip=10.145.4.45, mpid=29858, session=<6bDthJ3s+wAKkQRB> Dec 3 09:59:51 imap-01 dovecot: managesieve(xxxx(a)ubu.es): Error: sieve-storage: Performing readlink() on active sieve symlink '/correo/ubu.es/xxxx(a)ubu.es/dovecot.sieve' failed: Permission denied Dec 3 09:59:51 imap-01 dovecot: managesieve(xxxx(a)ubu.es): Disconnected: Logged out bytes=44/199 Permissions are ok. I modified the permissions using 0777 but the error message is the same. I have made other tests to see if I can find the problem, and I made it work if I delete "%d" from config, this way: sieve = /correo/%u/dovecot.sieve sieve_dir = /correo/%u/Sieve I have copied all filters preserving permissions, and with the same file permissions is working. If I add the '%d' to the path error comes again. Can anyone tell me if this is the normal behavior or is a bug? Thanks, Pedro -- ------------------------------------------------------------------------ Pedro R. Benito da Rocha - Servicio de Informatica - Area de Sistemas Universidad de Burgos (España) E-mail: pedro(a)ubu.es Tel: +34 947258845 ------------------------------------------------------------------------

2 2

[Dovecot] disconnecting (disconnected by server)
by Patrick Westenberg 03 Dec '13

03 Dec '13

Hi all, I just recognized a lot of log entries like this on my proxy: Dec 03 13:50:54 imap-login: Info: proxy(mail(a)example.com): disconnecting 1.2.3.4 (Disconnected by server): user=<mail(a)example.com>, method=PLAIN, rip=1.2.3.4, lip=2.4.6.8, TLS, session=<qk02v6DsJwBTlUQX> There are no similar entries on the backends. What does this mean? Something I have to worry about? Regards Patrick # 2.2.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.2 auth_mechanisms = plain login default_process_limit = 150 director_mail_servers = 172.17.1.2 172.17.1.1 director_servers = 172.17.1.3 172.17.1.4 director_user_expire = 5 mins lmtp_proxy = yes log_path = /var/log/dovecot.log managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { address = 172.17.1.3 port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director } service lmtp { inet_listener lmtp { address = 172.17.1.3 port = 24 } } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl_cert = </etc/ssl/certs/wildcard.example.com.crt ssl_key = </etc/ssl/private/wildcard.example.com.key protocol !smtp { passdb { args = proxy=y nopassword=y starttls=any-cert driver = static } } protocol smtp { passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } } protocol lmtp { auth_socket_path = director-userdb } # 2.2.2: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.1 auth_mechanisms = plain login disable_plaintext_auth = no dotlock_use_excl = no hostname = mb01.example.com listen = 172.17.1.1 log_path = /var/log/dovecot.log login_trusted_networks = 172.17.1.3 172.17.1.4 mail_fsync = always mail_gid = vmail mail_home = /var/mail/%d/%n mail_location = maildir:~/Maildir mail_plugins = quota mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spamverdacht { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User quota::file:%h/Maildir/dovecot-quota quota_rule2 = INBOX.Trash:ignore quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_after = /usr/local/etc/dovecot/sieve/sieve_after.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)example.com protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { mode = 0666 user = vmail } } service lmtp { inet_listener lmtp { address = 172.17.1.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-warning { executable = script /usr/local/etc/dovecot/quota_warning.sh unix_listener quota-warning { user = vmail } user = root } ssl_cert = </etc/ssl/certs/mb01.example.com.crt ssl_key = </etc/ssl/private/mb01.example.com.key submission_host = mf01.wk-serv.net userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 30 mail_plugins = quota imap_quota }

2 5

[Dovecot] Error in imap_address_arg_append
by Potapov Sergey 03 Dec '13

03 Dec '13

Hi Function imap_envelope_parse return incorrect result for addresses with groups due to error in imap_address_arg_append because of with ", " is added after group name and before first mailbox. Patch for dovecot v2.1 in attach.

2 1

[Dovecot] Gettings mails recently moved to a folder
by Florian Lindner 03 Dec '13

03 Dec '13

Hello, some spam training tools learn the same message over and over again. Since I want to use a daily cronjob to train messages and I do not want to have the same messages trained multiple times, I need to way to get new messages in a folder. Is there a (consolish) way to get a list of messages that were recently moved to a folder? dovecot does not modify mtime, according to RFC 3501. Thanks, Florian

5 9

[Dovecot] imap-login hangs after receiving revoked SSL certificate
by Алексей Прокопчук 03 Dec '13

03 Dec '13

Good time of the day! My English is not very good, excuse me if I said something wrong. I use dovecot-2.1.16 on Gentoo Linux amd64. I need to setup dovecot (imap and pop3) for SSL and non-SSL connection simultaneously. For SSL connections client must submit a valid SSL certificate. Now SSL part of dovecot.conf looks like this: ----------------- ssl = yes ssl_cert = </etc/ssl/dovecot/dovecot.pem ssl_key = </etc/ssl/dovecot/dovecot.pem ssl_ca = </etc/ssl/ca/ca.pem ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes protocol !smtp { auth_ssl_require_client_cert = yes } ----------------- All works fine with valid certificates. But if I submit revoked certificate, dovecot doesn't send error or success messages to mail client, process 'imap-login' eats 100% CPU and completely hangs. Only SIGKILL can terminate it. When dovecot receives revoked certificate, following messages appears in the log: ------------------ Dec 2 13:50:26 mail dovecot: imap-login: Invalid certificate: certificate revoked: /O=AP inc./OU=Admins/CN=Alexey Prokopchuk/UID=alexpro Dec 2 13:50:26 mail dovecot: imap-login: Invalid certificate: Different CRL scope: /CN=AP inc. root certification authority/O=AP inc./C=UA Dec 2 13:50:39 mail last message repeated 17950 times ------------------- If I'm not mistaken, in case of revoked certificate submission, dovecot must simply answer "SSL error" or "permission denied" to client and close connection, but according to log, it tries to check certificate again and again and do it in infinite loop. I can't understand for now - I misconfigured something or it's a bug? Thanks for attention, with best regards, Alexey Prokopchuk (AP8686-RIPE)

2 3