July 2013 - dovecot - dovecot.org

[Dovecot] Non-blocking file_dotlock_open() in quota-maildir question
by do1＠yandex.ru 10 Jul '13

10 Jul '13

Hello, Is it safe to change lines in plugins/quota/quota-maildir.c::maildirsize_write() from fd = file_dotlock_open_group(.., DOTLOCK_CREATE_FLAG_NONBLOCK, ..); to fd = file_dotlock_open_group(.., 0, ..); ? Rationale is: exim+cpanel frequently leave stale maldirsize.lock, but when quota plugin try to dotlock maildirsize, it do this with NONBLOCK flag and just once, so first lock fails with EAGAIN and second may never happen. (When last mail is over quota this also prevent user from further receiving any mail because quota remain exceeded, forver. This is annoing problem.) I wonder if it is possible to do easy fix problem by removing NONBLOCK flag, but as I don't understand why this NONBLOCK flag is used in the first place I decided to ask developers in the list for approval. If removing NONBLOCK flag is not possible I will just call file_dotlock_open_group() twice if first one return -1 with EAGAIN. Best regards, Don.

2 1

[Dovecot] Mailbox statistics (sdbox / indexes) (+ wiki2 frontpage notes)
by Jeroen Massar 10 Jul '13

10 Jul '13

Hi, I used to, with a simple script, loop over the filenames in a Maildir, grab the From from the contents of the file and grab the flags (especially "READ" and "REPLIED") from the filename, but after moving to sdbox these flags are hidden in the index file. Is there anyway to get these out of there programmatically without having to resort to using an imap-client or is that the way to go? (I am effectively counting who has sent the most mail to a mailbox and how many of the the messages have been and have not been replied to; thus another answer would be: "I got a stats program for mailboxes") Greets, Jeroen PS: just reverted the wiki2 Frontpage, apparently even bots know who the author of the IMAP protocol is (leading me to believe that that check does not work): http://wiki2.dovecot.org/FrontPage?action=info I could not find a "revert" button thus copied&pasta'd the previous edition in there. PS2: there seems to be a master.wiki2.dovecot.org and a wiki2.dovecot.org; logging in on the one does not log in on the other, and accounts on the one are different from the other, and it seems cookies go missing also somewhere, hence why an IP is logged and not my account (which I used to have, now was missing and thus I recreated, but needed to do that on both boxes)

3 2

[Dovecot] [PATCH] login-common: Add support for ECDH/ECDHE cipher suites
by David Hicks 10 Jul '13

10 Jul '13

# HG changeset patch # User David Hicks <david(a)hicks.id.au> # Date 1373085976 -36000 # Sat Jul 06 14:46:16 2013 +1000 # Node ID ccd83f38e4b484ae18f69ea08631eefcaf6a4a4e # Parent 1fbac590b9d4dc05d81247515477bfe6192c262c login-common: Add support for ECDH/ECDHE cipher suites ECDH temporary key parameter selection must be performed during OpenSSL context initialisation before ECDH and ECDHE cipher suites can be used. OpenSSL >= 1.0.2 automatically handles ECDH temporary key parameter selection. For OpenSSL < 1.0.2 we must manually specify a named elliptic curve that Dovecot will use to generate an ephemeral key pair. By default we try to use the same named curve as that used in the server's private EC key file. If this attempt fails, a fall back curve of NIST P-384 (secp384r1) is used instead. RFC 6460 states that NIST P-384 MUST be used for cipher suites that include AES-256. For cipher suites that include AES-128, RFC 6460 states that NIST P-256 MUST be used. No matter which curve is used as a fall back option, Dovecot will be non-compliant. The reason for selecting NIST P-384 as a fall back curve is to ensure that the non-compliance is in the form of providing too great a level of security for AES-128 cipher suites rather than too little security for AES-256 cipher suites. diff -r 1fbac590b9d4 -r ccd83f38e4b4 src/login-common/ssl-proxy-openssl.c --- a/src/login-common/ssl-proxy-openssl.c Fri Jun 28 19:48:37 2013 +0300 +++ b/src/login-common/ssl-proxy-openssl.c Sat Jul 06 14:46:16 2013 +1000 @@ -119,6 +119,10 @@ const struct master_service_ssl_settings *ssl_set); static void ssl_server_context_deinit(struct ssl_server_context **_ctx); +static void ssl_proxy_ctx_set_crypto_params(SSL_CTX *ssl_ctx, + const struct master_service_ssl_settings *set); +static int ssl_proxy_ctx_get_pkey_ec_curve_name(const struct master_service_ssl_settings *set); + static unsigned int ssl_server_context_hash(const struct ssl_server_context *ctx) { unsigned int i, g, h = 0; @@ -993,11 +997,58 @@ store = SSL_CTX_get_cert_store(ssl_ctx); load_ca(store, set->ssl_ca, load_xnames ? &xnames : NULL); } + ssl_proxy_ctx_set_crypto_params(ssl_ctx, set); SSL_CTX_set_info_callback(ssl_ctx, ssl_info_callback); + return xnames; +} + +static void +ssl_proxy_ctx_set_crypto_params(SSL_CTX *ssl_ctx, + const struct master_service_ssl_settings *set) +{ +#if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10002000L + EC_KEY *ecdh; + int nid; + const char *curve_name; +#endif if (SSL_CTX_need_tmp_RSA(ssl_ctx)) SSL_CTX_set_tmp_rsa_callback(ssl_ctx, ssl_gen_rsa_key); SSL_CTX_set_tmp_dh_callback(ssl_ctx, ssl_tmp_dh_callback); - return xnames; +#if !defined(OPENSSL_NO_ECDH) + /* In the non-recommended situation where ECDH cipher suites are being + used instead of ECDHE, do not reuse the same ECDH key pair for + different sessions. This option improves forward secrecy. */ + SSL_CTX_set_options(ssl_ctx, SSL_OP_SINGLE_ECDH_USE); +#endif +#if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10002000L + /* OpenSSL >= 1.0.2 automatically handles ECDH temporary key parameter + selection. */ + SSL_CTX_set_ecdh_auto(ssl_ctx, 1); +#elif !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L + /* For OpenSSL < 1.0.2, ECDH temporary key parameter selection must be + performed manually. Attempt to select the same curve as that used + in the server's private EC key file. Otherwise fall back to the + NIST P-384 (secp384r1) curve to be compliant with RFC 6460 when + AES-256 TLS cipher suites are in use. This fall back option does + however make Dovecot non-compliant with RFC 6460 which requires + curve NIST P-256 (prime256v1) be used when AES-128 TLS cipher + suites are in use. At least the non-compliance is in the form of + providing too much security rather than too little. */ + nid = ssl_proxy_ctx_get_pkey_ec_curve_name(set); + ecdh = EC_KEY_new_by_curve_name(nid); + if (ecdh == NULL) { + /* Fall back option */ + nid = NID_secp384r1; + ecdh = EC_KEY_new_by_curve_name(nid); + } + if ((curve_name = OBJ_nid2sn(nid)) != NULL) + i_debug("SSL: elliptic curve %s will be used for ECDH and" + " ECDHE key exchanges", curve_name); + if (ecdh != NULL) { + SSL_CTX_set_tmp_ecdh(ssl_ctx, ecdh); + EC_KEY_free(ecdh); + } +#endif } static void @@ -1084,6 +1135,28 @@ } static int +ssl_proxy_ctx_get_pkey_ec_curve_name(const struct master_service_ssl_settings *set) +{ + int nid = 0; +#if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10002000L + EVP_PKEY *pkey; + const char *password; + EC_KEY *eckey; + EC_GROUP *ecgrp; + + password = *set->ssl_key_password != '\0' ? set->ssl_key_password : + getenv(MASTER_SSL_KEY_PASSWORD_ENV); + pkey = ssl_proxy_load_key(set->ssl_key, password); + if (pkey != NULL && + (eckey = EVP_PKEY_get1_EC_KEY(pkey)) != NULL && + (ecgrp = EC_KEY_get0_group(eckey)) != NULL) + nid = EC_GROUP_get_curve_name(ecgrp); + EVP_PKEY_free(pkey); +#endif + return nid; +} + +static int ssl_proxy_ctx_use_certificate_chain(SSL_CTX *ctx, const char *cert) { /* mostly just copy&pasted from SSL_CTX_use_certificate_chain_file() */ @@ -1209,7 +1282,6 @@ #endif ssl_proxy_ctx_use_key(ctx->ctx, ssl_set); - SSL_CTX_set_info_callback(ctx->ctx, ssl_info_callback); if (ctx->verify_client_cert) ssl_proxy_ctx_verify_client(ctx->ctx, xnames);

2 1

[Dovecot] dovecot.index disappeared
by Metro Domain Admin 10 Jul '13

10 Jul '13

Hello, One of my users just mysteriously lost all files from his inbox. I have "mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename" but couldn't find any evidence of accidental file or folder deletion. I logged in to find that ~user/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index and its backup were tiny, only 552 bytes, when the folder had thousands of messages. Other folders were left intact. We are running 2.1.15 (mdbox) on Ubuntu 12.10 using ext4. The system was rebooted about 10 days before and the full INBOX was definitely seen since the reboot. I'm just looking for ideas about what might have happened. Thanks, Tony

2 1

[Dovecot] Right way to share some global mailboxes
by Dieter Knopf 09 Jul '13

09 Jul '13

Hello, i'm using Dovecot since a long time but now I need to share folders for global mail adresses like info@ and support@ between all users. What is the right way to share this mailboxes between many users (everyone with own read flag). My config for location is: mail_location = maildir:/home/vmail/%d/%n:INDEX=/home/vmail-indexes/%d/%n And now i have a folder like /home/vmail/bar.com/foo for sharing... Thanks!

3 3

Re: [Dovecot] Anyone know dovecot?
by Reindl Harald 09 Jul '13

09 Jul '13

Am 09.07.2013 13:52, schrieb Tom Horsley: > I keep getting this sort of garbage cluttering my logs: > > dovecot: master: Warning: /ada/denmark is no longer mounted. See http://wiki2.dovecot.org/Mountpoints: 1 Time(s) > > I have indeed seen the wiki page mentioned, and even > tried what it says, but nothing seems to "stick". > Any time a filesystem gets mounted, I apparently > also have to invoke doveadm yet again to make > it ignore the new dadgum filesystem. (The wildcards > mentioned in that web page seem only to apply to > existing filesystems, not new mounts). > > Is there a way to just make it stop forever? no, i asked on the dovecot list why this happens since dovecot 2.0 and upstream believes it is a good idea to assume that every random mounted FS could be relevant for email because it *may* be referred in a config-include instead throw only a fatal error if this is the case and something can not be accessed

1 0

[Dovecot] (no subject)
by Dotan Cohen 08 Jul '13

08 Jul '13

On an Ubuntu Server 12.04 system with Dovecot 2.0.19 I am having some trouble with the Dovecot passwords. I am finding this in the logs when I unsuccessfully try to log in: Jul 07 08:13:25 auth-worker: Debug: pam(user(a)someDomain.com,212. 179.241.14): lookup service=dovecot Jul 07 08:13:25 auth-worker: Debug: pam(user(a)someDomain.com,212.179.241.14): #1/1 style=1 msg=Password: Jul 07 08:13:27 auth-worker: Info: pam(user(a)someDomain.com,212.179.241.14): pam_authenticate() failed: Authentication failure (password mismatch?) (given password: 12345) Jul 07 08:13:29 auth: Debug: client out: FAIL 2 user=user(a)someDomain.com Jul 07 08:13:29 pop3-login: Info: Disconnected (auth failed, 2 attempts): user=<user(a)someDomain.com>, method=PLAIN, rip=212.179.241.14, lip=10.138.11.251 This is not the real password, but an example to show that I think that there is an issue: $ /usr/bin/doveadm pw -u user(a)someDomain.com -s DIGEST-MD5 Enter new password: # Here I have typed "12345" Retype new password: # Here I have typed "12345" {DIGEST-MD5}f4e442b0dec5009eaa8b9b4104923edc $ printf "12345" | md5sum 827ccb0eea8a706c4c34a16891f84e7b - $ Shouldn't that password match the md5sum check? Also, might I have the file formats wrong? $ cat passwd user@someDomain.com::5000:5000::/var/mail/vhosts/someDomain.com/user $ cat shadow user@someDomain.com:{DIGEST-MD5}f4e442b0dec5009eaa8b9b4104923edc $ Note that testing in Telnet fails the password as well, both when specifying the user without a domain and with a domain: $ telnet mail.someDomain.com 143 Trying x.x.x.x... Connected to mail.someDomain.com. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. a login user 12345 a NO [AUTHENTICATIONFAILED] Authentication failed. e logout * BYE Logging out e OK Logout completed. Connection closed by foreign host. $ telnet mail.someDomain.com 143 Trying x.x.x.x... Connected to mail.someDomain.com. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. a login user(a)someDomain.com 12345 a NO [AUTHENTICATIONFAILED] Authentication failed. * BAD Error in IMAP command received by server. e logout * BYE Logging out e OK Logout completed. Connection closed by foreign host. Thanks! -- Dotan Cohen http://gibberish.co.il http://what-is-what.com

2 2

[Dovecot] DOVECOT 2.2.4 = 501 5.5.4 Unsupported options in LMTP
by Dmitry 06 Jul '13

06 Jul '13

Hi, Sorry for my english. My problem: *************************************************** dspam-3.9.0 (dspam-3.10.2 all the time segmentation fault) dspam.conf .................... # DeliveryHost /var/run/dovecot/lmtp # same error as IP DeliveryHost 127.0.0.33 DeliveryPort 24 DeliveryProto LMTP .................... ServerHost 192.168.1.34 ServerPort 24 ServerQueueSize 32 ServerPID /var/run/dspam/dspam.pid *************************************************** dovecot-2.2.4 10-master.conf service lmtp { # Create inet listener only if you can't use the above UNIX socket inet_listener lmtp { # Avoid making LMTP visible for the entire internet address = 127.0.0.33 port = 24 } } quota is not included *************************************************** telnet to dspam LMTP # telnet 192.168.1.34 24 Trying 192.168.1.34... Connected to 192.168.1.34. Escape character is '^]'. 220 DSPAM LMTP 3.9.0 Ready LHLO test.com 250-localhost.localdomain 250-PIPELINING 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 SIZE MAIL FROM:<test(a)test.com> 250 2.1.0 OK RCPT TO:<user(a)test.com> 250 2.1.5 OK DATA 354 Enter mail, end with "." on a line by itself 1234567 qwertyu asdfghj . 530 5.3.0 <user(a)test.com> Fatal: 501 5.5.4 Unsupported options QUIT 221 2.0.0 OK Connection closed by foreign host. *************************************************** at the same time tcpflow LMTP # tcpflow -c -i any host 127.0.0.33 127.000.000.033.00024-127.000.000.001.41663: 220 mail Dovecot ready. 127.000.000.001.41663-127.000.000.033.00024: LHLO localhost 127.000.000.001.41663-127.000.000.033.00024: 127.000.000.033.00024-127.000.000.001.41663: 250-mail 250-8BITMIME 250-ENHANCEDSTATUSCODES 250 PIPELINING 127.000.000.001.41663-127.000.000.033.00024: MAIL FROM:<test(a)test.com> SIZE=25 127.000.000.001.41663-127.000.000.033.00024: 127.000.000.033.00024-127.000.000.001.41663: 501 5.5.4 Unsupported options 127.000.000.001.41663-127.000.000.033.00024: QUIT 127.000.000.001.41663-127.000.000.033.00024: 127.000.000.033.00024-127.000.000.001.41663: 221 2.0.0 OK ^Ctcpflow[5411]: terminating *************************************************** after telnet to dovecot LMTP # telnet 127.0.0.33 24 Trying 127.0.0.33... Connected to 127.0.0.33. Escape character is '^]'. 220 mail Dovecot ready. LHLO test.com 250-mail 250-8BITMIME 250-ENHANCEDSTATUSCODES 250 PIPELINING MAIL FROM:<test(a)test.com> 250 2.1.0 OK RCPT TO:<user(a)test.com> 250 2.1.5 OK DATA 354 OK 1234567 qwertyu asdfghj . 250 2.0.0 <user(a)test.com> WVKvFEln1VEuFQAAZU03Dg Saved QUIT 221 2.0.0 OK How can I persuade dovecot to deliver the mail? And one more: telnet to dovecot LMTP # telnet 127.0.0.33 24 .................... MAIL FROM: test(a)test.com 501 5.5.4 Invalid parameters MAIL FROM: <test(a)test.com> 501 5.5.4 Invalid parameters MAIL FROM:<test(a)test.com> 250 2.1.0 OK telnet to dspam LMTP # telnet 192.168.1.34 24 .................... MAIL FROM: test(a)test.com 250 2.1.0 OK .................... # telnet 192.168.1.34 24 .................... MAIL FROM: <test(a)test.com> 250 2.1.0 OK .................... Thank you! Regards, Dmitry

2 1

[Dovecot] popup to all users ?
by Frank Bonnet 05 Jul '13

05 Jul '13

Hello I need to have a information popup will be send when my thunderbird's users connect to our server. Is there a function in Dovecot to do so ? Thank you

7 7

[Dovecot] IMAP Cannot Delete (Mailbox Doesn't exist)
by gw1500se 05 Jul '13

05 Jul '13

I am now at the next layer of the onion. I am able to retrieve mail but I cannot delete mail from my inbox. My reader says the server is responding with "mailbox does not exist." Any ideas? TIA. -- View this message in context: http://dovecot.2317879.n4.nabble.com/IMAP-Cannot-Delete-Mailbox-Doesn-t-exi… Sent from the Dovecot mailing list archive at Nabble.com.

3 5