September 2013 - dovecot

[Dovecot] Dovecot replies with default SSL certificate instead of the vhost's
by Shadi Habbal 16 Sep '13

16 Sep '13

Hello, I'm using dovecot v2.0.21. According to http://wiki2.dovecot.org/SSL/DovecotConfiguration,dovecot 2.x supports different SSL certificate for different virtual hosts by using "local_name" directive, but I can't get it to work. When testing the certificate using "openssl s_client -connect domain.com:pop3s" I get the default certificate instead of domain.com's.----------------------------------------------------------------------------Here is the my dovecot.conf:# 2.0.21: /etc/dovecot/dovecot.conf# OS: Linux 2.6.32-358.6.2.el6.x86_64 x86_64 CentOS release 6.4 (Final) auth_master_user_separator = *auth_mechanisms = PLAIN LOGINdict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf}first_valid_uid = 2000last_valid_uid = 2000listen = *log_path = /var/log/dovecot.logmail_gid = 2000mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/mail_plugins = quotamail_uid = 2000managesieve_notify_capability = mailtomanagesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihavenamespace { inbox = yes location = prefix = separator = / type = private}namespace { list = children location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared}passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql}passdb { args = /etc/dovecot/dovecot-master-users-password driver = passwd-file master = yes}plugin { acl = vfile acl_shared_dict = proxy::acl auth_socket_path = /var/run/dovecot/auth-master autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk quota = dict:user::proxy::quotadict quota_rule = *:storage=1G quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = /%Lh/sieve/dovecot.sieve sieve_dir = /%Lh/sieve sieve_global_dir = /var/vmail/sieve sieve_global_path = /var/vmail/sieve/dovecot.sieve}protocols = pop3 imap sieveservice auth { unix_listener /var/spool/postfix/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail }}service dict { unix_listener dict { group = vmail mode = 0660 user = vmail }}service imap-login { process_limit = 500 service_count = 1}service pop3-login { service_count = 1}service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail }}ssl = requiredssl_cert = </etc/pki/tls/certs/iRedMail_CA.pemssl_key = </etc/pki/tls/private/iRedMail.keyuserdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql}verbose_ssl = yesprotocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/sieve.log mail_plugins = quota sieve autocreate postmaster_address = root}protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota autocreate}protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv}local_name nourcc.com { ssl_ca = </etc/ssl/comodo.ca.crt ssl_cert = </etc/pki/tls/certs/nourcc.com.pem ssl_key = </etc/pki/tls/private/nourcc.com.key}local_name rockmetal-ae.com { ssl_ca = </etc/ssl/comodo.ca.crt ssl_cert = </etc/pki/tls/certs/rockmetal-ae.com.pem ssl_key = </etc/pki/tls/private/rockmetal-ae.com.key}local_name alliance-sir.com { ssl_ca = </etc/ssl/comodo.ca.crt ssl_cert = </etc/pki/tls/certs/alliance-sir.com.pem ssl_key = </etc/pki/tls/private/alliance-sir.com.key}----------------------------------------------------------------------------Here are my certs permissions, just in case:[root@epm certs]# ll /etc/ssl/comodo.ca.crt-rw-r--r-- 1 root root 6668 Sep 14 21:51 /etc/ssl/comodo.ca.crt[root@epm certs]# ll /etc/pki/tls/certs/nourcc.com.pem-rw-r--r-- 1 root root 1801 Sep 10 00:00 /etc/pki/tls/certs/nourcc.com.pem[root@epm certs]# ll /etc/pki/tls/private/nourcc.com.key-rw------- 1 root root 1708 Sep 15 19:37 /etc/pki/tls/private/nourcc.com.key----------------------------------------------------------------------------Here is my openssl test output:$ openssl s_client -connect nourcc.com:pop3sCONNECTED(00000003)depth=0 C = SY, O = epm.nourcc.com, OU = IT, CN = epm.nourcc.com, emailAddress = root(a)epm.nourcc.comverify error:num=18:self signed certificateverify return:1depth=0 C = SY, O = epm.nourcc.com, OU = IT, CN = epm.nourcc.com, emailAddress = root(a)epm.nourcc.comverify return:1.......................... blah blah blah ......................... so I'm not sure, is there a certain way for doing it that I overlooked? Thanks.

5 10

[Dovecot] Can't download emails with large file attachment
by prabin 16 Sep '13

16 Sep '13

Hi, I am using CentOS 5.9 with postfix+dovecot v1.0.7 I have problem in downloading emails with attachment of more than 3MB via my email client. (Thunderbird, Outlook, etc) I can send emails out with more than 3MB without any problem, whereas i can't download emails. Following are the errors i found on maillog *dovecot: pop3-login: SSL_write() syscall failed: Bad file descriptor** **dovecot: impa-login: SSL_write() syscall failed: Bad file descriptor* After this the email client stops downloading emails. What could be the problem ? Please help me fix this . Thank You * **dovecot version: dovecot-1.0.7-8.el5_9.1** **openssl version: openssl-0.9.8e-26.el5_9.1** **CentOS 5.9* dovecot: POP3(support1): Disconnected top=0/0, retr=1/0, del=0/17, size=57279820 *Sep 16 17:25:56 mail dovecot: pop3-login: SSL_write() syscall failed: Bad file descriptor [110.44.xx.xx]* dovecot -n # 1.0.7: /etc/dovecot.conf log_timestamp: %Y-%m-%d %H:%M:%S listen(default): 61.xx.xx.XX:143 listen(imap): 61.xx.xx.XX:143 listen(pop3): 61.xx.xx.XX:110 ssl_listen(default): 61.xx.xx.XX:993 ssl_listen(imap): 61.xx.xx.XX:993 ssl_listen(pop3): 61.xx.xx.XX:995 ssl_cert_file: /etc/pki/tls/certs/dovecot.pem ssl_key_file: /etc/pki/tls/private/dovecot.pem ssl_cipher_list: ALL:!LOW verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_process_per_connection: no login_process_size: 512 mail_location: maildir:~/Maildir mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib64/dovecot/imap mail_plugin_dir(imap): /usr/lib64/dovecot/imap mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3 auth default: mechanisms: plain login verbose: yes debug: yes debug_passwords: yes passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix

1 0

[Dovecot] Change mail_location for one user?
by Scott Galambos 16 Sep '13

16 Sep '13

Hello, I'm running the latest version of dovecot on Linux with mbox mailboxes. Everything works fine. So in my dovecot config I have mail_location = mbox:~/mail:INBOX=/var/mail/%u I would like to now change the mail_location for one user in an attempt to slowly migrate to Maildir format. I'm confused how to do this. I'm running shadow passwords: $: doveconf -n passdb passdb { driver = shadow } Testing any given user gives: $: dovecot user sarah field value uid 1478 gid 116 home /home/sarah mail mbox:~/mail:INBOX=/var/mail/sarah system_groups_user sarah What would I have to do to make only sarah's mail_location ~/Maildir now? My userdb is: $: doveconf -n userdb userdb { driver = passwd } I tried following the wiki's but its confusing. Thanks for any help or tips.

5 7

[Dovecot] Unable to use dovecot-antispam plugin
by Xavier Claude 14 Sep '13

14 Sep '13

Hello everybody, I'm trying to use the Dovecot antispam on Debian Wheezy (dovecot version 2.1.7), but it's not working, each time I put a mail in the "Spam" folder, it is send in its original folder. What bother me the most is that I don't see anything in the log. Here is my dovecot config related to the antispam plugin : plugin { antispam_allow_append_to_spam = yes antispam_backend = dspam antispam_debug_target = syslog antispam_dspam_args = --user;%Lu;--deliver=spam,innocent;--source=error;--signature=%%s antispam_dspam_binary = /usr/bin/dspam antispam_dspam_notspam = --class=innocent antispam_dspam_result_header = X-DSPAM-Result antispam_dspam_spam = --class=spam antispam_signature = X-DSPAM-Signature antispam_signature_missing = error antispam_spam = SPAM;Spam antispam_trash = trash;Trash;Deleted Items; Deleted Messages sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocol imap { mail_plugins = " antispam" } And in the log, the only thing I see is the plugin initialization : Jul 27 13:18:05 twoflowers imap: antispam: plugin initialising (2.0-notgit) Jul 27 13:18:05 twoflowers imap: antispam: "SPAM" is exact match spam folder Jul 27 13:18:05 twoflowers imap: antispam: "Spam" is exact match spam folder Jul 27 13:18:05 twoflowers imap: antispam: no unsure folders Jul 27 13:18:05 twoflowers imap: antispam: "trash" is exact match trash folder Jul 27 13:18:05 twoflowers imap: antispam: "Trash" is exact match trash folder Jul 27 13:18:05 twoflowers imap: antispam: "Deleted Items" is exact match trash folder Jul 27 13:18:05 twoflowers imap: antispam: " Deleted Messages" is exact match trash folder Jul 27 13:18:05 twoflowers imap: antispam: allowing APPEND to spam folders Jul 27 13:18:05 twoflowers imap: antispam: dspam binary set to /usr/bin/dspam Jul 27 13:18:05 twoflowers imap: antispam: dspam result set to X-DSPAM-Result Jul 27 13:18:05 twoflowers imap: antispam: dspam extra arg --user Jul 27 13:18:05 twoflowers imap: antispam: dspam extra arg xavier Jul 27 13:18:05 twoflowers imap: antispam: dspam extra arg --deliver=spam,innocent Jul 27 13:18:05 twoflowers imap: antispam: dspam extra arg --source=error Jul 27 13:18:05 twoflowers imap: antispam: dspam extra arg --signature=%s Jul 27 13:18:05 twoflowers imap: antispam: signature header line is "X-DSPAM-Signature" Thank you for your help. -- Xavier Claude claude.xavier(a)gmail.com

2 5

[Dovecot] mailbox virtual/All
by Kai Hendry 14 Sep '13

14 Sep '13

Anyone using "mailbox virtual/All" ? Can't get it to work. At best I get an empty folder showing in mutt. Wondering if someone can share their complete working config with me please? This is my conf http://ix.io/838 Thanks!

1 0

[Dovecot] Temporarily disable mail delivery when using Dovecot's LDA
by Avinash Sultanpur 14 Sep '13

14 Sep '13

Hi, How can I disable mail delivery to a user or a mailbox temporarily. Is there something in the lines of qmail where you set a sticky bit on the home directory and mail delivery is deferred? Thanks, Avinash.

2 2

Re: [Dovecot] How to disable SSL and TLSv1.1?
by Reindl Harald 14 Sep '13

14 Sep '13

Am 13.09.2013 22:36, schrieb Darren Pilgrim: > This has kind of wandered out of the scope of the list i don't think so because having a question in public means also everyone reads it understands the real usefulness > On 9/13/2013 3:01 AM, Reindl Harald wrote: >> Am 13.09.2013 11:45, schrieb Darren Pilgrim: >>> On 9/11/2013 3:52 PM, Reindl Harald wrote: >>>> and that is why i said most widely used does not >>>> >>>> RHEL5: openssl-0.9.8e >>>> RHEL6: openssl-1.0.0 >>>> Fedora 17: openssl-1.0.0k >>>> Fedora 18: openssl-1.0.1e >>> >>> RHEL with outdated software bundled? You don't say. ;) >> >> bulls** - google for LTS > > My point is that you don't have to use the stock libraries. My *nix of choice, FreeBSD, still has 0.9.8 in the > current releases. Luckily there's 1.0.1e in ports and the framework makes it easy to switch port builds between > the base and port libraries. There are 1.0.1e packages for every Linux distro I've checked. my point is that it does not help much if you have the best of all available encryptions on your IMAP server because all the messages you receive pass the wire and since you can't disable SSL/TLSv1.0/TLS1.1 on the MTA side or if you do so you receive a lot of messages *completly unecnrypted* because the sending MTA falls back >>> Firefox and Thunderbird currently ship with TLS 1.1/1.2 support, >>> but not enabled by default >> >> so it is nut relevant > > How is TLS 1.1 and 1.2 support in one of the most popular suites of software not relevant? "but not enabled by default" is not relevant in the reality except you are the only user of your private server and even if see above what benefit do you have from TLS1.2 if the message passed the wire with SSL3 or unencrpyted at all > Sure, it's not enabled by default, but those of us working proactively can enable it taht will not go to happen for the majority of users > On by default simply means the feature has matured to the point where the cost of > supporting the general userbase is reasonably small. on by default means the ordinary users will use it off by default means the ordinary users will not use it >> as long the support for Windows XP is active and it comes to business >> you have to support it - period > > Yeah I know. Fortunately XP is EoS in less than a year. and until then it doe snot help much I will be very happy to see it and all of it creaky > legacy inanity go away. me too, and if it's only about having SSL-webhosts without a dedicated IP currently you can't use SNI in case of business websites as well as you can't disable SSL/TLS1.1/TLS1.2 as long you have potentially customers with WinXP/Outlook2003 and as long they are supported with updates you can't force a customer to upgrade >> fine but what helps 1.1 in case someone asks how to disable it - read >> the subject > > The subject line should have read TLSv1.0. Sorry for the typo. > FWIW, the body of my original email correctly said > I wanted to disable TLSv1.0, not 1.1 while it's not that hardliner attitude to at least support TLS1.1 i think i explained now well the non existing benefits in what you are doing if you think about the complete way a e-mail goes and in case you are not the only user of the server it's impossible to do so without lose customers or get a lot of complaints until you revert the settings

1 0

[Dovecot] Migrating from dovecot 2.1 to 2.2
by Micah Anderson 13 Sep '13

13 Sep '13

Due to the incompatibilities with the dsync protocol version between 2.1 and 2.2, I am unable to use dsync to move users to a new machine where we have 2.2.5 setup. This wouldn't normally be a problem, as I could just rsync the user's mdbox and dovecot would happily do the right thing. However, on the new system I've placed the indexes into a faster storage medium, where on the older system the indexes were included in their mail directory. I can rsync over the entire thing, including their old indexes, and dovecot will try to do the right thing and build new indexes, but what happens is all mail is marked as unread, and I get some old index cruft left around in the directories. How can I preserve the seen/unseen flags in such a migration? Thanks! micah

2 1

[Dovecot] Antispam plugin / sa-learn
by Mathieu R. 13 Sep '13

13 Sep '13

Hello, Sorry for posting on both list spamassassin and dovecot : my question is on dovecot antispam plugin, used to learn spamassassin with sa-learn. I wonder if there is a way to confirme sa-learn is correctly feeded by the antispam plugin. dovecot version : 2.1.7 spamassassin version : 3.3.2 (both packaged in debian stable, with postfix and amavis) i configured dovecot's antispam plugin this way : plugin { ... #Antispam antispam_debug_target = syslog antispam_verbose_debug = 1 antispam_backend = pipe antispam_trash = Trash antispam_spam = Junk antispam_allow_append_to_spam = no antispam_pipe_program = /srv/datadisk01/bin/sa-learn-pipe.sh antispam_pipe_program_spam_arg = --spam antispam_pipe_program_notspam_arg = --ham } refering to : http://wiki2.dovecot.org/Plugins/Antispam using that script to pipe message to sa-learn : #!/bin/sh echo /usr/bin/sa-learn $* /tmp/sendmail-msg-$$.txt ; echo "$$-start ($*)" >> /tmp/sa-learn-pipe.log ; #echo $* > /tmp/sendmail-parms.txt ; cat<&0 >> /tmp/sendmail-msg-$$.txt ; /usr/bin/sa-learn $* /tmp/sendmail-msg-$$.txt ; rm -f /tmp/sendmail-msg-$$.txt ; echo "$$-end" >> /tmp/sa-learn-pipe.log ; exit 0; here is what i got when i move a mail to Junk folder : Sep 11 18:10:10 effraie01 imap: antispam: plugin initialising (2.0-notgit) Sep 11 18:10:10 effraie01 imap: antispam: verbose debug enabled Sep 11 18:10:10 effraie01 imap: antispam: "Junk" is exact match spam folder Sep 11 18:10:10 effraie01 imap: antispam: no unsure folders Sep 11 18:10:10 effraie01 imap: antispam: "Trash" is exact match trash folder Sep 11 18:10:10 effraie01 imap: antispam: pipe backend spam argument = --spam Sep 11 18:10:10 effraie01 imap: antispam: pipe backend not-spam argument = --ham Sep 11 18:10:10 effraie01 imap: antispam: pipe backend program = /srv/datadisk01/bin/sa-learn-pipe.sh Sep 11 18:10:10 effraie01 imap: antispam: pipe backend tmpdir /tmp Sep 11 18:11:10 effraie01 imap: antispam: plugin initialising (2.0-notgit) Sep 11 18:11:10 effraie01 imap: antispam: verbose debug enabled Sep 11 18:11:10 effraie01 imap: antispam: "Junk" is exact match spam folder Sep 11 18:11:10 effraie01 imap: antispam: no unsure folders Sep 11 18:11:10 effraie01 imap: antispam: "Trash" is exact match trash folder Sep 11 18:11:10 effraie01 imap: antispam: pipe backend spam argument = --spam Sep 11 18:11:10 effraie01 imap: antispam: pipe backend not-spam argument = --ham Sep 11 18:11:10 effraie01 imap: antispam: pipe backend program = /srv/datadisk01/bin/sa-learn-pipe.sh Sep 11 18:11:10 effraie01 imap: antispam: pipe backend tmpdir /tmp Sep 11 18:12:04 effraie01 imap: antispam: mailbox_is_unsure(Junk): 0 Sep 11 18:12:04 effraie01 imap: antispam: mailbox_is_trash(INBOX): 0 Sep 11 18:12:04 effraie01 imap: antispam: mailbox_is_trash(Junk): 0 Sep 11 18:12:04 effraie01 imap: antispam: mail copy: from trash: 0, to trash: 0 Sep 11 18:12:04 effraie01 imap: antispam: mailbox_is_spam(INBOX): 0 Sep 11 18:12:04 effraie01 imap: antispam: mailbox_is_spam(Junk): 1 Sep 11 18:12:04 effraie01 imap: antispam: mailbox_is_unsure(INBOX): 0 Sep 11 18:12:04 effraie01 imap: antispam: mail copy: src spam: 0, dst spam: 1, src unsure: 0 Sep 11 18:12:04 effraie01 imap: antispam: running mailtrain backend program /srv/datadisk01/bin/sa-learn-pipe.sh Sep 11 18:12:04 effraie01 imap: antispam: running mailtrain backend program /srv/datadisk01/bin/sa-learn-pipe.sh Sep 11 18:12:04 effraie01 imap: antispam: running mailtrain backend program parameter 1 --spam and here is what i got in /tmp/sa-learn-pipe.log: 10545-start (--spam) 10545-end For me, it's working, but when i run sa-learn --backup, i just get this : v 3 db_version # this must be the first line!!! v 0 num_spam v 0 num_nonspam it's probably cause i'm using ***STANDARD-ANTI-UBE-TEST-EMAIL*** wich probably teach nothing to sa-learn, but i wonder if i can find somewher a log or something confirming sa-learn correctly get the email i pipe to it. thanks a lot in advance -- Mathieu

3 4

[Dovecot] Plugin antispam - mailtrain realtime sa-learn
by Hans Spaans 13 Sep '13

13 Sep '13

Hi, On Dovecot Wiki2[1] it is written that you need a wrapper script for sa-learn as it shouldn't support pipped input, but that is supported since SpamAssassin 2.6 at least. As far as I can see and test, the following config makes it work without a wrapper script. Can someone confirm it before the wiki is updated? plugins { antispam_backend = pipe antispam_trash = Trash antispam_spam = Junk antispam_mail_spam = --spam antispam_mail_notspam = --ham antispam_mail_sendmail = /usr/bin/sa-learn } Hans [1] http://wiki2.dovecot.org/Plugins/Antispam

2 1