November 2014 - dovecot

Re: Dovecot-lda permission errors or maybe authentication errors?
by Alexander Dalloz 06 Nov '14

06 Nov '14

Am 06.11.2014 um 09:01 schrieb Steffen Kaiser: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Wed, 5 Nov 2014, Alexander Dalloz wrote: > > Dear Alexander, > >> Run "sestatus" and you'll see. >> >> Run "grep -i AVC /var/log/audit/audit.log" to identify SELinux caused >> denials. > > because I saw this type of question quite too often, I added this info > to the Wiki2 (to be revised by Timo): > http://master.wiki2.dovecot.org/WhyDoesItNotWork > > I copy'n'pasted your sentences, if you don't mind. > > Kind regards, > > - -- Steffen Kaiser Hello Steffen, sure I am fine with that. Even better it would be to have a recipe for a custom SELinux policy to not be mislead switching off SELinux at all. Such a custom policy is necessary when storing mail in the user's homedir because files created there get a wrong SELinux context for that usecase by default. An general overview about this topic can be found on http://wiki.centos.org/HowTos/SELinux Kind regards Alexander

1 0

Can I take mail from Maildir mailbox and deliver it as new?
by James Pryor 06 Nov '14

06 Nov '14

Hello list, I have a need for someone to point me in the right direction. Our old email system (system A) had an account that acted as a mailing list accumulator/archiver. This account was a member of every list and mail would be sent to it's address. The strange part is that email was not delivered to system A because there was a . (dot) forward alias to another machine (system B) that runs sendmail. System B's sendmail then slurped up the incoming mail and processed it in some fashion which I do not care about. On our new mail server (system C (OS is RHEL6.5, dovecot-2.0.9-7.el6_5.1.x86_64, postfix-2.6.6-6.el6_5.x86_64)), I performed a bulk Linux account and mailbox migration from system A to system C using postfix/dovecot/imapsync. But I forgot to put the alias in place on system C to send all incoming that special account's mail on system B. So mail started to get delivered to local user ar_list on system C. So now I have a Maildir format mailbox on system C that has mail in it and I want to be able to manipulate and/or re-send those emails as new mail to system B. Once it is received by sendmail on system B, then I don't care about it any more. Is there a way to take mail sitting on disk in a mailbox and deliver it as if it was new mail to some other machine? Thanks, James -bash-4.1$ ls -l total 566 drwx------ 2 ar_list users 2048 Aug 7 21:29 cur -rw------- 1 ar_list users 12556 Oct 8 17:09 dovecot.index -rw------- 1 ar_list users 378880 Oct 9 14:41 dovecot.index.cache -rw------- 1 ar_list users 2580 Oct 9 14:41 dovecot.index.log -rw------- 1 ar_list users 65549 Oct 9 14:41 dovecot-uidlist -rw------- 1 ar_list users 8 Aug 7 19:38 dovecot-uidvalidity -r--r--r-- 1 ar_list users 0 Aug 7 19:38 dovecot-uidvalidity.53e40ddc drwx------ 2 ar_list users 100352 Oct 9 14:41 new drwx------ 2 ar_list users 2048 Oct 9 14:41 tmp -bash-4.1$ ls new/ | wc -l 1020 -bash-4.1$ ls cur | wc -l 25

3 3

Re: Dovecot-lda permission errors or maybe authentication errors?
by Robert Kryger 06 Nov '14

06 Nov '14

Alexander, You are absolutely right - I apologize for my confusion regarding SElinux. In fact, when I turn off SElinux in /etc/selinux/config (setting SELINUX=disabled, instead of =enforcing) then dovecot-lda starts working. Thanks for the advice - I have been fighting with this for several weeks without making headway! Robert

1 0

gssapi considered as PLAIN?
by Harry Schmalzbauer 05 Nov '14

05 Nov '14

Hello, as soon as I set "disable_plaintext_auth = yes", AUTH=GSSAPI vanishes from capabilities. ([CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] vs [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED]) Why? I'm wondering especially because at http://wiki2.dovecot.org/Authentication/Mechanisms, GSSAPI is correctly listed under “Non-plaintext authentication“. Thanks, -Harry

3 7

ntlm_auth seems ok, initial auth failure with dovecot2 (and winbind 4.1.13)
by Harry Schmalzbauer 05 Nov '14

05 Nov '14

Hello, I've read quite often that there are problems with ntlm_auth helper (last one here http://www.dovecot.org/list/dovecot/2014-June/096561.html) But haven't found any confirmation, neither it's working for anybody else nor that it's known taht this issue needs debuging. Like for ohers, my authentication tests from the commandline with ntlm_auth exactly give expected results. But initial authentication (with Outlook) fail at first, but after entering the user's password, nevertheless succeeds with mech=NTLM. See the attached ntlm-log.txt Can't exactly tell when this regression occured, one year ago nobody had to enter his password, it worked like intended with Outlook (which still is version 2010). Any idea how to debug? It could be also a regression in samba, both highly appreciated applications were upgraded at the same time… Thanks, -Harry

1 0

doveadm index message-decoder assertion failed
by cs+dovecot＠ctzen.com 05 Nov '14

05 Nov '14

Hi, I've setup FTS using lucene and it should be working, the lucene index is updated when mail arrives. I also managed to reindex my INBOX: doveadm index -u foo -q INBOX However, when I try to index an Archives folder: doveadm index -u foo -q Archives, the index-work crashed with this log message: dovecot: indexer-worker(foo): Panic: file message-decoder.c: line 363 (message_decode_body): assertion failed: (ctx->translation_size <= sizeof(ctx->translation_buf)) dovecot: indexer: Error: Indexer worker disconnected, discarding 1 requests for foo dovecot: indexer-worker(foo): Fatal: master: service(indexer-worker): child 28730 killed with signal 6 (core dumps disabled) The Archives folder has 22317 messages. Please help. dovecot --version 2.2.15 dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-STABLE i386 auth_username_format = %Ln first_valid_gid = 1000 first_valid_uid = 1000 login_trusted_networks = xxx.xxx.xxx.x/24 mail_location = maildir:~/Maildir mail_plugins = " fts fts_lucene" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { antispam_backend = spool2dir antispam_spam = Junk antispam_spool2dir_notspam = /var/spool/dovecot-antispam/queue/ham-%%020lu-%u-%%05lu antispam_spool2dir_spam = /var/spool/dovecot-antispam/queue/spam-%%020lu-%u-%%05lu antispam_trash = Trash fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. } protocols = imap lmtp sieve service imap-login { inet_listener imap { address = xxx.xxx.xxx.x } inet_listener imaps { address = xxx.xx.xx.xx } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = xxx.xx.xx.xx xxx.xxx.xx.x port = 4190 } } ssl_cert = </var/ssl/crts/mail.crt ssl_key = </var/ssl/keys/ssl-npp.key userdb { driver = passwd } protocol lmtp { mail_plugins = " fts fts_lucene sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene antispam" }

2 2

calling post-login script with doveadm
by Héctor Moreno Blanco 05 Nov '14

05 Nov '14

Hello everyone, I'm trying to execute some commands with doveadm but I need some information loaded in a post-login script before running these commands. Is possible to run the post-login script while executing doveadm? I've found how to do something similar with -o key=value to override settings, but I want to change a namespace location, as done in the post-login script: ... export USERDB_KEYS="$USERDB_KEYS namespace/archivo/location" exec env "NAMESPACE/ARCHIVO/LOCATION=$location" "$@" ... Thank you very much in advanced. Kind regards. Héctor Moreno P Please consider the environment before printing this e-mail. ______________________ This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it. ______________________ Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informacion clasificada por su emisor como confidencial en el marco de su Sistema de Gestion de Seguridad de la Informacion siendo para uso exclusivo del destinatario, quedando prohibida su divulgacion copia o distribucion a terceros sin la autorizacion expresa del remitente. Si Vd. ha recibido este mensaje erroneamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboracion. ______________________

1 1

Re: Example records for SQL AUTH
by James 05 Nov '14

05 Nov '14

On 03/11/2014 22:29, Jorge Bastos wrote: > Password_query: > > password_query = select username, domain,password from users where > username='%u' and domain='%d' and active='true' > Try "... username='%n' ..." not %u From doc/dovecot/example-config/dovecot-sql.conf # Commonly used available substitutions (see http://wiki.dovecot.org/Variables # for full list): # %u = entire user@domain # %n = user part of user@domain # %d = domain part of user@domain James.

1 0

Public mailbox confusion
by Stefan G. Weichinger 05 Nov '14

05 Nov '14

greets, I am quite sure I ask some faq here ... sorry, but I am confused by the many options and choices here. What I want to do is: I migrate lots of public folders from a MS Exchange Server ... The customer wants that there is a "Public" folder containing all these hundreds of folders, the public folder should be visible for all the dovecot-users and all the subfolders should be automatically subscribed as soon a new user logs in. What I have now: namespace { type = private separator = / prefix = inbox = yes } namespace { type = public separator = / prefix = Public/ location = maildir:/home/vmail/public:INDEXPVT=/home/vmail/public/index/%d/%u/index subscriptions = yes } As far as I see from testing this doesn't yet work that way. When I open the mailbox with eg. roundcube I see "Public" but nothing below it ... Could someone please give me a good pointer here? Thanks! Stefan

2 4

sieve replication and .dovecot.lda-dupes
by Jan Behrend 05 Nov '14

05 Nov '14

Hello list, I have a replicated dovecot with two servers. People seem to get vacation responses more often then it is specified in "days: XX", depending on which dovecot instance they receive the incoming mail. Is ".dovecot.lda-dupes" replicated? The other problem is that the vacation response is coming from the wrong address depending on which field the recipient was listed: "to:" or "cc:" Here is my test example: g9-rz has the vacation rule set up: date | mail -s test -r jbehrend(a)mpifr-bonn.mpg.de -c g9-rz(a)mpifr-bonn.mpg.de jan(a)flatpick.de and this returns this vacation response: ### snip ### Return-Path: <> Delivered-To: <jbehrend(a)mpifr-bonn.mpg.de> Received: from mail2.mpifr-bonn.mpg.de ([134.104.18.60]) by mailbox2.mpifr-bonn.mpg.de (Dovecot) with LMTP id +pgPDzm1WFSn9wAAvl5QjA for <jbehrend(a)mpifr-bonn.mpg.de>; Tue, 04 Nov 2014 12:16:13 +0100 X-Sieve: Pigeonhole Sieve 0.4.2 Message-ID: <dovecot-sieve-1415099773-541512-0(a)mailbox1.mpifr-bonn.mpg.de> Date: Tue, 04 Nov 2014 12:16:13 +0100 From: jan(a)flatpick.de To: <jbehrend(a)mpifr-bonn.mpg.de> Subject: Vacation In-Reply-To: <E1Xlc5t-0001LT-Bu(a)jb1.mpifr-bonn.mpg.de> References: <E1Xlc5t-0001LT-Bu(a)jb1.mpifr-bonn.mpg.de> Auto-Submitted: auto-replied (vacation) Precedence: bulk MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Evolution-Source: 1385020682.6450.3@jb1 Ain't here! Go away or something ... Cheers ### snip ### I would expect "g9-rz(a)mpifr-bonn.mpg.de" in the from: field. Is this correct? Cheers Jan -- MAX-PLANCK-INSTITUT fuer Radioastronomie Jan Behrend - Rechenzentrum ---------------------------------------- Auf dem Huegel 69, D-53121 Bonn Tel: +49 (228) 525 359, Fax: +49 (228) 525 229 jbehrend(a)mpifr-bonn.mpg.de http://www.mpifr-bonn.mpg.de

2 1