July 2013 - dovecot - dovecot.org

[Dovecot] Dovecot v2.2.4 (ebbe00999da8) doveadm crash
by e-frog 01 Aug '13

01 Aug '13

Hello, Current Dovecot v2.2 HG crashes using the following command: $ doveadm mailbox status -A -t unseen 'virtual/unread' Please see backtrace below and dovecot -n output attached. Thanks, e-frog gdb /usr/bin/doveadm 24023 GNU gdb (GDB) 7.5.91.20130417-cvs-ubuntu Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i686-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/bin/doveadm...Reading symbols from /usr/lib/debug/usr/bin/doveadm...done. done. Attaching to program: /usr/bin/doveadm, process 24023 warning: unable to open /proc file '/proc/24023/status' warning: unable to open /proc file '/proc/24023/status' ptrace: No such process. [New LWP 24023] warning: Can't read pathname for load map: Input/output error. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1". Core was generated by `doveadm mailbox status -A -t unseen virtual/unread'. Program terminated with signal 11, Segmentation fault. #0 i_stream_next_line (stream=0x0) at istream.c:382 382 istream.c: No such file or directory. (gdb) bt full #0 i_stream_next_line (stream=0x0) at istream.c:382 _stream = <optimized out> pos = <optimized out> #1 0xb754656b in auth_master_user_list_next (ctx=0xb91bfbd8) at auth-master.c:689 line = <optimized out> #2 0xb7634a0b in mail_storage_service_all_next (ctx=0xb91c4ba8, username_r=username_r@entry=0xbf8e6630) at mail-storage-service.c:1260 __FUNCTION__ = "mail_storage_service_all_next" #3 0xb7752d46 in doveadm_mail_cmd_get_next_user (ctx=0xb91be478, username_r=0xbf8e6630) at doveadm-mail.c:416 No locals. #4 0xb7753e95 in doveadm_mail_all_users (wildcard_user=0x0, argv=0xb91ba1ec, ctx=0xb91be478) at doveadm-mail.c:368 ret = <optimized out> input = {module = 0x0, service = 0xb77918f3 "doveadm", username = 0xb91bf8a0 "test1(a)local.lan", session_id = 0x0, local_ip = {family = 0, u = { ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = { s_addr = 0}}}, remote_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, local_port = 0, remote_port = 0, userdb_fields = 0x0, flags_override_add = (unknown: 0), flags_override_remove = (unknown: 0), no_userdb_lookup = 0} user_idx = 0 user = 0xb91bf8a0 "test1(a)local.lan" error = 0x10 <Address 0x10 out of bounds> #5 doveadm_mail_cmd (argv=0xb91ba1ec, argc=-1189371412, cmd=0xbf8e668c) at doveadm-mail.c:523 ctx = 0xb91be478 getopt_args = <optimized out> ret = <optimized out> c = <optimized out> wildcard_user = 0x0 error = <optimized out> #6 doveadm_mail_try_run (cmd_name=cmd_name@entry=0xb91ba200 "mailbox", argc=5, argc@entry=6, argv=argv@entry=0xb91ba1dc) at doveadm-mail.c:608 cmd = 0xbf8e668c #7 0xb7752903 in main (argc=6, argv=0xb91ba1dc) at doveadm.c:398 cmd_name = 0xb91ba200 "mailbox" i = <optimized out> quick_init = false c = <optimized out> (gdb)

2 4

[Dovecot] SSL warning messages
by Anand Kumria 01 Aug '13

01 Aug '13

Hi, I've had the following appear in my logfile, and am just wondering what the warning means? dovecot: managesieve-login: Warning: SSL alert: where=0x4008, ret=256: warning close notify [a.b.c.d] dovecot: imap-login: Warning: SSL alert: where=0x4004, ret=256: warning close notify [w.x.y.z] Should I be worrying about these kinds of messages? Dovecot 2.2.4 on Ubuntu 12.04 LTS if it is important. Thanks, Anand

2 1

Re: [Dovecot] Maildir permissions and Solr re-indexing
by Joseph Tam 01 Aug '13

01 Aug '13

Michael Welsh Duggan writes: > All the files in my Maildir are owned by md5i:mail (I am md5i), and have > 660 permissions. All directories have the same user:group permissions, > and 770 with the setguid bit set. (That last may not be necessary, but > ... > > doveadm(md5i): Error: fchown(/home/md5i/Maildir/.mail.test/dovecot.index.log.newlock, group=8(mail)) failed: Operation not permitted (egid=1000(md5i), group based on /home/md5i/Maildir/.mail.test - see http://wiki2.dovecot.org/Errors/ChgrpNoPerm) > > After this, each directory has a dovecot.index.log with md5i:md5i 600 > permissions. I think the cause is clear enough: you (user=md5i/uid=1000) are not part of group mail (gid=8), so the dovecot user process doing things on your behalf cannot create index files that are anlogous to the mailbox it's indexing. You can either 1) add "md5i" to group mail 2) remove g+w permission on your mail files (making group membership irrelevant) 3) fiddle with "mail_privileged_group = mail", but I'm a little hazy on all the ramifications of this. I don't know your particular circumstances, so I don't know which is best. If (big if) nothing on your system (particularly the MTA) requires access to your mail spool files by running as group=mail, probably 2) is your best option. Joseph Tam <jtam.home(a)gmail.com>

2 1

[Dovecot] LMTP: userdb lookup - user-filter with variables
by Burckhard Schmidt 31 Jul '13

31 Jul '13

I tried to use dovcots lmtp instead of dovecot-lda. postfix has in master.cf ... dovecot-lda -f ... -d ${user} to separate the user part from user(a)hostname.domain. So lookup of "user" succeeds in userdb (LDAP) done by dovecot-lda. I have always local addresses like to=<user(a)hostname.domain> postfix/lmtp[6579]: [ID 197553 mail.info] B3CDA66A16: to=<h0094slk(a)mailstore4.hu-berlin.de> With lmtp the userpart must be separated also. I tried user_filter (LDAP) with %n, %Ln, %8n without success: userdb lookup: user(a)hostname.domain doesn't exist) dovecot-2.1.17 I used "doveadm user h0094slk" and "doveadm user h0094slk(a)mailstore4.hu-berlin.de" for my tests. userdb { driver = ldap args = /usr/dovecot/etc/ldapuser.conf } and ldapuser.conf with ... user_filter = (&(uid=%n) (objectClass=cmsAccount)) user_attrs = homeDirectory=home I modified user_filter like uid=%Ln or uid=%8u success for doveadm user h0094slk (because nothing to split) userdb: h0094slk home : /home/p0094/h0094slk but no success for doveadm user h0094slk(a)mailstore4.hu-berlin.de userdb lookup: user h0094slk(a)mailstore4.hu-berlin.de doesn't exist It looks for me like user_filter do not use variables at this point? What I'm missing? -- Mit freundlichen Grüßen --- Burckhard Schmidt Abteilung Systemsoftware und Kommunikation ZE Computer- und Medienservice der Humboldt-Universität zu Berlin Postanschrift: Unter den Linden 6, 10099 Berlin Standort: Rudower Chaussee 26; 12489 Berlin Tel.: +49-30-2093-70058 Fax: +49-30-2093-2959 Mail: bschmidt(a)cms.hu-berlin.de

1 1

Re: [Dovecot] LDA vs. LMTP
by Joseph Tam 31 Jul '13

31 Jul '13

Martin Burgraf writes: > > I don't know why you would consider a background process inferior to a > > run-on-demand executable. > > Well, the background process is hogging CPU and RAM while it basically > does nothing. "Hogging" CPU and memory is putting it strongly, as it is basically suspended while blocked on waiting for a connection, and if left for a long time in an idle state, might be swapped out to disk and not consuming (real) memory, or consuming real memory that isn't in use otherwise. As I stated before, the resource usage is small compared with all the other stuff going on, so if you don't have a busy mail server, I don't think you should sweat the difference. The benefits of LMTP should increase with load, as having LMTP resident will save you the overhead of repeatedly loading/unloading LDA, and I'm sure the CPU and memory usage of servicing that overhead will be non-trivial. If you have oodles of memory, then it's no problem keeping a LMTP resident. If you don't have enough memory and are VM disk thrashing, you'll have other problems and LDA/LMTP is the least of your worries. > And when it's running as root there is always the danger > of privilege escalation. LDA only runs when it's needed and since it > uses only user rights it shoudbe more harmless. I didn't contest the privilege separation aspect, as it a necessary design trade-off that one daemon doing things for all user will need overriding access. However, if this is a concern, you can virtualize all your users. LMTP can theoretically be subverted, but at least won't be as root. (I'm assuming LMTP stays as root, and not spawning off user processes to do the real work.) Joseph Tam <jtam.home(a)gmail.com>

3 2

Re: [Dovecot] dovecot-lda not logging if dovecot runs under daemontools
by Jost Krieger 30 Jul '13

30 Jul '13

On Fri Jul 26 14:51:30 2013, Roberto Puzzanghera wrote: > > Hi Jost, thanks for your reply. > > Il 26.07.2013 13:11 Jost Krieger ha scritto: > >Dovecot-lda runs under qmail, so you'll find the output in qmail's > >logs. If you run, say, doveadm manually, the output will be on your > >terminal. > > I didn't explain myself very well. The qmail's log > /var/log/dovecot/current doesn't show the lda output as expected. I That's dovecot's log, not qmail's. > see onlythe output of imap and pop3. Anyway, running dovecot > manually or as daemon in the normal way (without daemontools) show > the lda output in the log. You are logging to stderr, in the delivery case that means qmail-local's output. This is somewhere in a place like /var/qmal/logs/qmail/current and looks similar to @4000000051f793e218f78c54 delivery 847552: success: lda(xxxxxxxx):_Info:_msgid=<20130730102215.ECB48809E9(a)carlos.noc.ruhr-uni-bochum.de>:_saved_mail_to_NOC-Order/did_0+0+1/ Yours Jost Krieger -- | Jost.Krieger+sig(a)ruhr-uni-bochum.de Please help stamp out spam! | | Postmaster, JAPH, resident answer machine at RUB Comp. Center | | Sincere words are not sweet, sweet words are not sincere. | | Lao Tse, Tao Te King 81 |

2 1

Re: [Dovecot] LDA vs. LMTP
by Martin Burgraf 30 Jul '13

30 Jul '13

Joseph Tam wrote: > I don't know why you would consider a background process inferior to a > run-on-demand executable. Well, the background process is hogging CPU and RAM while it basically does nothing. And when it's running as root there is always the danger of privilege escalation. LDA only runs when it's needed and since it uses only user rights it shoudbe more harmless. bye Martin

2 1

[Dovecot] LDA vs. LMTP
by Martin Burgraf 30 Jul '13

30 Jul '13

Hi there, I'm using Dovecot together with Postfix; as I understand it, there are two ways to transfer the mail from Postfix to Dovecot. 1.) by using LDA with mailbox_command = /usr/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" 2.) by using LMTP with mailbox_transport = lmtp:unix:private/dovecot-lmtp (currently using number 1) I'm interessted in the differences and the advantages/disadvantages of each of those solutions. According to http://wiki2.dovecot.org/LDA the recommended way is to use LMTP, since it's supposed to have a better performance. On the other hand, http://wiki2.dovecot.org/LMTP says, that LMTP is a backgound process, while LDA is only called when needed. I've also read, that LDA only uses the users privileges, which both means, that LDA should be better. I've also noticed, that LMTP adds an additional Recieved:-Header to the mail. Are there any other differences? Thank you M.

7 7

[Dovecot] Problem switching from Dovecot LDA to LMTP - on dovecot 2.2.4
by Michael Long 29 Jul '13

29 Jul '13

Dovecot LDA has been working fine for me but when I tried to follow the wiki and switch to LMTP I get: Recipient address rejected: User unknown in local recipient table; In postfix/main.cf I went from: mailbox_transport = dovecot-spam to mailbox_transport = lmtp:unix:private/dovecot-lmtp Added this: service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } protocol lmtp { mail_fsync = optimized postmaster_address = postmaster@domainname mail_plugins = sieve zlib } And some other pertinent parts of the config: passdb { args = /etc/dovecot/passdb driver = passwd-file } passdb { driver = pam } protocol lda { mail_fsync = optimized auth_socket_path = /var/run/dovecot/auth-master deliver_log_format = msgid=%m: %$ mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = sieve zlib postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r lda_mailbox_autocreate = yes }

1 0

[Dovecot] Maildir permissions and Solr re-indexing
by Michael Welsh Duggan 29 Jul '13

29 Jul '13

I am running a very small dovecot installation with only one user (me). I use the Solr indexer for indexing. Due to complicated reasons, I was forced to remove all the indexes and need to re-index everything. All the files in my Maildir are owned by md5i:mail (I am md5i), and have 660 permissions. All directories have the same user:group permissions, and 770 with the setguid bit set. (That last may not be necessary, but I was trying several things to get my use case to work.) Unfortunately, I can't seem to get re-indexing to work. When I do "doveadm fts rescan -A" as root, I get the following error for each of my subgroups: doveadm(md5i): Error: fchown(/home/md5i/Maildir/.mail.test/dovecot.index.log.newlock, group=8(mail)) failed: Operation not permitted (egid=1000(md5i), group based on /home/md5i/Maildir/.mail.test - see http://wiki2.dovecot.org/Errors/ChgrpNoPerm) After this, each directory has a dovecot.index.log with md5i:md5i 600 permissions. I've read the mentioned page, and played around with the ideas on it, but haven't gotten things to work. Anyone have any clue to ship my way? -- Michael Welsh Duggan (md5i(a)md5i.com)

1 1