August 2013 - dovecot

[Dovecot] OT: z-Push
by Christian Rößner 04 Sep '13

04 Sep '13

Hi, just a short question: I have installed and configured z-Push to use BackendIMAP. On my iPhone I have created an account and I can see my mails. Also sending works. So far so good. Now the question: When I create a new folder i.e. Test under the root (/), then I get an error. And after resyncing the folder has been created not under /, but under /0/Test. Also I can not remove that folder over ActiveSync. Does somebody have z-Push fully working with Dovecot or is z-Push designed for Cyrus and only some features are working with Dovecot? So at the moment folder create/move/delete does not work here with z-Push-2.0.3 and Dovecot 2.1.9 Thanks in advance -Christian Rößner --- Bachelor of Science Informatik Erlenwiese 14, 36304 Alsfeld T: +49 6631 78823400, F: +49 6631 78823409, M: +49 176 93118939 USt-IdNr.: DE225643613, http://www.roessner-network-solutions.com

4 4

Re: [Dovecot] Logging passwords on auth failure/dealing with botnets
by Joseph Tam 03 Sep '13

03 Sep '13

Michael Smith writes: > We're already running fail2ban, but it doesn't seem that effective > against botnets, when they only do one attempt per IP. Yeah, distributed BFDs are tough to block unless you can characterize the clients well. > That leaves us back to getting dovecot to log the tried password for > unknown users. Another tactic might be to hook in a authentication script: http://wiki2.dovecot.org/AuthDatabase/CheckPassword You can run this as an external plugin and won't have to muck into the dovecot innards. From here, you can log attempts, keep track of bad IPs, or take action if you spot a username/password combination that merits instant blacklisting. Joseph Tam <jtam.home(a)gmail.com>

5 10

[Dovecot] sync re-copies emails assigning new UIDs
by Anand Kumria 03 Sep '13

03 Sep '13

Hi, I have been (attempting) to transition a company from in-house dovecot 1.x to a hosted dovecot 2.2 setup. I am running the doveadm sync command, and for the four mailboxes have been blocked -- sync'ing seem to be copying the same mails, over and over (note, initially I was using doveadm backup but my reading has indicated that 'doveadm sync' is better) Example: # date && doveadm -v -o imapc_user=kaye(a)example.com -o imapc_password=*pass* -o imapc_host=imap.example.com -o imapc_port=993 -o imapc_ssl=imaps -o imap c_ssl_dir=/etc/ssl -o imapc_feature=rfc822.size -o imapc_ssl_verify=no sync -1 -R -u kaye(a)example.com imapc: Sat Aug 3 09:05:37 UTC 2013 [...] dsync(kaye(a)example.com): Info: copy from INBOX: box=INBOX, uid=5306, msgid=<FB3A2E1C62B148F8B057476BDCBB4A9B@THENORMANS>, size=13544 dsync(kaye(a)example.com): Info: copy from INBOX: box=INBOX, uid=5307, msgid=<006b01ce8dad$b8864930$2992db90$(a)com.au>, size=10163563 [...] dsync(kaye(a)example.com): Info: copy from INBOX: box=INBOX, uid=5311, msgid=< cm.083930.bijjdjk.jdkimlhij.r(a)createsend5.com>, size=46658 [...] # date && doveadm -v -o imapc_user=kaye(a)example.com -o imapc_password=*pass* -o imapc_host=imap.example.com -o imapc_port=993 -o imapc_ssl=imaps -o imapc_ssl_dir=/etc/ssl -o imapc_feature=rfc822.size -o imapc_ssl_verify=no sync -1 -R -u kaye(a)example.com imapc: Sat Aug 3 10:01:48 UTC 2013 [...] dsync(kaye(a)kamdha.com): Info: copy from INBOX: box=INBOX, uid=5324, msgid=<FB3A2E1C62B148F8B057476BDCBB4A9B@THENORMANS>, size=13544 dsync(kaye(a)kamdha.com): Info: copy from INBOX: box=INBOX, uid=5325, msgid=<006b01ce8dad$b8864930$2992db90$(a)com.au>, size=10163563 [...] dsync(kaye(a)kamdha.com): Info: copy from INBOX: box=INBOX, uid=5329, msgid=< cm.083930.bijjdjk.jdkimlhij.r(a)createsend5.com>, size=46658 [...] The exact same number of emails (some in the INBOX, some in the Sent folder) are transferred each time. In this case, I've firewalled the origin - so their entire mail system is stopped whilst I do the transfer just in case modifications of IMAP flags or additional delivieres might have been the problem. I am using Dovecot v2.2.4; is this normal expected behaviour? If so, what is the best way to ensure that a migration is done without data loss. If this isn't expected, has anyone else seen this kind of error before? Thanks, Anand

1 1

[Dovecot] Auth error in log
by Per-Henrik Lundblom 03 Sep '13

03 Sep '13

Hi, I have a setup with Dovecot handling a few virtual domains delivering mails to both local Unix account mailboxes and seperate mailboxes for virtual users defined in a MySQL database. A quick overview of the configuration shows two passdb definitions: auth default { mechanisms = plain login passdb pam { args = dovecot } passdb sql { args = /etc/dovecot/dovecot-sql.conf } userdb passwd { args = mail=maildir:~/Maildir blocking=yes } userdb static { args = uid=vmail gid=mail home=/var/spool/vmail/%d/%n allow_all_users=yes } user = root socket listen { master { path = /var/run/dovecot/auth-master mode = 0600 user = vmail group = mail } client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } !include_try /etc/dovecot/auth.d/*.auth } When a virtual user defined in the MySQL database tries to log in using IMAP or SMTP I always get auth failures logged in the system logs. Entries are like this: Aug 21 06:25:36 roadrunner dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=luser(a)mydomain.com rhost=85.224.xx.xx I assume these failures comes form the fact that PAM doesn't recognize the virtual users and Dovecot continues to the SQL passdb entry. As a result I get a _lot_ of auth failures in the logs. I have tried to come up with a way where the auth failures from PAM arent't logged if the the SQL authenication is successful. Is this possible or are there any other recommended ways to handle this? /PH -- Per-Henrik Lundblom email: ph(a)whatever.nu phone: +46 733 207126 webpage: www.whatever.nu

2 3

[Dovecot] local AND virtual mail locations ?
by Pierre-Philipp Braun 02 Sep '13

02 Sep '13

Hi, I would like to use Dovecot not only for virtual mboxes, but also for local users. In other words, I would like to use different "mail_location"s depending on "passdb" "passwd-file" versus "passwd". I need that as the smtp daemon I am using (david parsons' postoffice smtp server) serves both but is only able to process messages through procmail on local users. Here are the two mail_locations I would like to use: mail_location: mbox:~/mail/:INBOX=/var/mail/%u mail_location: mbox:/var/spool/virtual/%d/%n.imap:INBOX=/var/spool/virtual/%d/%n depending on those passdb stanzas, respectively: passdb passwd-file { args = username_format=%n /etc/virtual/%d/passwd } passdb passwd { } Any help would be appreciated. Here's my Dovecot version and current working configuration for virtual users only: # dovecot -n dovecot -n # 1.2.17: /usr/local/etc/dovecot.conf # OS: FreeBSD 8.3-RELEASE amd64 ufs protocols: imap ssl: no disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login first_valid_uid: 6 first_valid_gid: 6 mail_location: mbox:/var/spool/virtual/%d/%n.imap:INBOX=/var/spool/virtual/%d/%n imap_client_workarounds: tb-extra-mailbox-sep auth default: user: mail passdb: driver: passwd-file args: username_format=%n /etc/virtual/%d/passwd userdb: driver: static args: uid=6 gid=6 I find that first_valid_uid and first_valid_gid don't look pretty but it seems mandatory for the standard 'mail' user and group ownerships to work on the virtual mbox files and folders. I created the user while the group already existed. If you have any advices on that too, I would be pleased. Thanks Pierre-Philipp

3 7

[Dovecot] Getting back into Dovecot 2.2.5
by Kai Hendry 02 Sep '13

02 Sep '13

Hi there, I'm prompted to get into running my own mail server again with Gmail going bad. However I found /usr/share/doc/dovecot/example-config/conf.d/ a little scary, since I like to have my configs as minimalistic as possible, e.g. http://dabase.com/blog/Minimal_squid3_proxy_configuration/ So far I have: https://github.com/Webconverger/sg.webconverger.com/blob/master/dovecot/dov… I was kinda hoping for a Maildir, but this doesn't work: mail_location = maildir:~/Maildir:LAYOUT=fs:INBOX=/var/mail/%u I do realise /var/mail/%u is a mbox, but I was wondering if there could be some clever conversion. I was surprised something like INBOX=/var/mail/%u wasn't the default btw. Also surprised dovecot seems to choke on single line syntax like `passdb { driver = pam }` :-) Next thing I'm confused about is the `namespace inbox {` stuff. Is it really needed? I was expecting Dovecot to create the folders once I defined them, but mutt couldn't see them until I created them myself. The mail server is just for myself and a few colleagues. We will probably use mutt as our MUA and Apple Mail on IOS when we are out & about. I next plan to integrate dspam, and work out how to sort mails into folders like I previously effectively had with Gmail's labels. I was confused to which mechanism I should be using to sort mail into folders with rules. Sieve? Back to Procmail? Pigeonhole? I'm looking to avoid complexity here. On the topic of search, can I get away with not running a Solr server? Since I shudder at the thought of running Tomcat. http://wiki2.dovecot.org/Plugins/FTS Kiitos paljon for any pointers!

3 4

[Dovecot] Auto-blocking faulty login attempts
by Jos Chrispijn 01 Sep '13

01 Sep '13

Dear group, How can I block login attempts to dovecot after trying 5 times in error? -- Best regards, Jos Chrispijn --- Artificial intelligence is no match for natural stupidity

3 2

[Dovecot] Dovecot and Postfix Authentication
by Christopher Trom 31 Aug '13

31 Aug '13

I am a student and am trying to get a mail server setup for a project. I have all of the Postfix configuration taken care of, but I am confused by the way that authentication works with Dovecot in the mix. As a user of the system, am I supposed to authenticate myself to Postfix, Dovecot, both individually, or both together? My Postfix users are stored in a PostgreSQL database, should Dovecot also be connected to this db? Some basic pointers on how this setup ought to look is all that I'm hoping for. Thank you, Christopher

2 1

Re: [Dovecot] Bizarre permissions problem
by Joseph Tam 31 Aug '13

31 Aug '13

Bill Oliver writes: > There's *one* user I can't get it to work on without a > workaround. The user is "newuser" and the uid is 1111 (actual name and > number changed to protect the innocent). The error I get in my maillog > is: > > The error I get in may maillog is: > Aug 29 16:02:11 localbox dovecot: imap(newuser): Error: chown(/home/newuser/mail/.imap/INBOX, -1, 12(mail)) failed: Operation not permitted (egid=1111(newuser), group based on /var/mail/newuser) > Aug 29 16:02:11 localbox dovecot: imap(newuser): Error: mkdir(/home/newuser/mail/.imap/INBOX) failed: Operation not permitted > Aug 29 16:02:11 localbox dovecot: imap(newuser): Error: chown(/home/newuser/mail/.imap/INBOX, -1, 12(mail)) failed: Operation not permitted (egid=1111(newuser), group based on /var/mail/newuser) > Aug 29 16:02:11 localbox dovecot: imap(newuser): Error: mkdir(/home/newuser/mail/.imap/INBOX) failed: Operation not permitted > Aug 29 16:02:11 localbox dovecot: imap(newuser): Error: chown(/home/newuser/mail/.imap/INBOX, -1, 12(mail)) failed: Operation not permitted (egid=1111(newuser), group based on /var/mail/newuser) > Aug 29 16:02:11 localbox dovecot: imap(newuser): Error: mkdir(/home/newuser/mail/.imap/INBOX) failed: Operation not permitted > > Now, it looks to me like dovecot is saying that the user newuser can't > get to the /home/newuser/mail/.imap directory because it doesn't have > permission. However, the user newuser has all the permissions it needs: > > $ ls -la /home/newuser/mail > > total 20 > drwxrw---- 3 newuser newuser 4096 Aug 29 15:01 . > drwxrw---- 6 newuser newuser 4096 Aug 29 12:16 .. > drwxrwx--- 2 newuser newuser 4096 Aug 29 16:05 .imap > -rw-rw---- 1 newuser newuser 499 Aug 13 07:56 saved-messages > -rw-rw---- 1 newuser newuser 1756 Aug 16 11:15 sent-mail The output of doveconf -n would have been useful, especially as it relates to your mail_location value, but I can make a pretty good guess at what is happening. Dovecot is trying to create indices with analogous permissions to your mailbox files. Your user's INBOX (/var/mail/newuser) has permission user:group:mode = 1111:12:0660 *but* newuser is not in group "mail" (GID 12), hence it cannot do the required chown operations. (Notice the mode of .imap/: the group write is on so the chmod worked.) Your INBOX ended up this way because some LDA's auto-create new INBOX's with these permissions (to allow access to other part of the mail sysyem that are set-gid "mail"). Options: 1) chmod g-rwx /var/mail/newuser - assumes you have no other parts of your mailsystem that needs access to all user INBOX by assuming group "mail". - dovecot is smart enough to figure out group membersip is irrelevant is groups access is nil. 2) chgrp newuser /var/mail/newuser 3) To avoid future problems: make sure new mailboxes are created with workable permissions. There are also dovecot configs that loosen up some group access, but you'll have to investigate that yourself. Joseph Tam <tam(a)math.ubc.ca>

1 0

[Dovecot] kqueue bug?
by Timo Sirainen 31 Aug '13

31 Aug '13

Apparently Dovecot with kqueue ioloop enabled causes random crashes in FreeBSD 9.1. Anyone else noticed something like that? I'm wondering if Dovecot's kqueue code has a bug somewhere (I can't find it) or could it be that FreeBSD itself has a bug? Anyway it seems to be returning events for filters that have already been removed.

4 3