November 2014 - dovecot

Re: authentication issues with ipad / mac email client
by Rajesh M. 04 Nov '14

04 Nov '14

hi i am using dovecot version2.2.7 provided by qmailtoaster - 64 bit on centos 6.5 64 bit system - 16 gb ram with a hex core processor. i was using qmail pop3 on a 32 bit system for the past over 7 years and had absolutely no issues. with dovecot pop3 i have started receiving a variety of problems mac machines and ipads -- port 110 does not work at all. i have to use port 995 only. i have allowed plain text auth. thunderbird works perfectly -- both imap and pop3 with port 110 and port 995 outlook 2010 also works but incase of one customer the mail download is very slow. i have a windows servers with mailenable mail server and the same customer could download perfectly from those windows servers. i am using the default "service pop3" settings Do i need to increase the memory settings / for pop3 login similar to imap login which i am missing out like what is configured for imap. (pl see config file below) My mail server is busy with around 4000 mailboxes and transacting over 200k emails per day. atleast around 250 simultaneous pop3 connections during peak hours. # dovecot -a | grep pop3_uidl_format pop3_uidl_format = %08Xu%08Xv [root@ns1 spamassassin]# dovecot -n # 2.2.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.29.2.el6.x86_64 x86_64 CentOS release 6.5 (Final) auth_cache_negative_ttl = 0 auth_cache_size = 32 M auth_cache_ttl = 30 mins auth_mechanisms = plain login digest-md5 cram-md5 default_login_user = vpopmail disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 log_path = /var/log/dovecot.log login_greeting = ready. mail_max_userip_connections = 50 mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = . type = private } passdb { args = cache_key=%u webmail=127.0.0.1 driver = vpopmail } plugin { quota = maildir:ignore=Trash quota_rule = ?:storage=0 } protocols = imap pop3 service imap-login { client_limit = 256 process_limit = 400 process_min_avail = 4 service_count = 0 vsz_limit = 384 M } ssl_cert = </var/qmail/control/servercert.pem ssl_dh_parameters_length = 2048 ssl_key = </var/qmail/control/servercert.pem userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = " quota imap_quota" } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_lock_session = no pop3_no_flag_updates = yes } i am really puzzled because dovecot was highly recommended by all. thanks for all your help rajesh ----- Original Message ----- From: Daniel Parthey [mailto:pada@posteo.de] To: 24x7server@24x7server.net,dovecot@dovecot.org Sent: Sat, 01 Nov 2014 09:34:53 +0100 Subject: Re: authentication issues with ipad / mac email client Hi, please post * output of "doveconf -n" * error log messages from dovecot for failed vs. succeeded login Regards Daniel

1 0

Re: Example records for SQL AUTH
by deoren 04 Nov '14

04 Nov '14

On 11/3/2014 4:29 PM, Jorge Bastos wrote: > Hi, > > > > Where can I get examples for the records for the "users" table? If I understand your question properly and you're looking for examples of creating new virtual users, then this guide covers that: https://www.linode.com/docs/email/email-with-postfix-dovecot-and-mysql You would have to adjust to fit your chosen schema of course as theirs is a much simpler setup that excludes the uid, gid, and home values. > > For SHA512-CRYPT, I tried: > > > > replace into users values ('a(a)a.com','a.com',ENCRYPT('b', CONCAT('$6$', > SUBSTRING(SHA(RAND()), -16))),'',0,0,'true'); > > > > schema is: > > CREATE TABLE `users` ( > > `username` varchar(255) NOT NULL, > > `domain` varchar(255) NOT NULL, > > `password` varchar(255) NOT NULL, > > `home` varchar(255) NOT NULL, > > `uid` int(11) NOT NULL, > > `gid` int(11) NOT NULL, > > `active` enum('true','false') NOT NULL DEFAULT 'true', > > PRIMARY KEY (`username`) > > ) ENGINE=InnoDB DEFAULT CHARSET=utf8 > > > > Password_query: > > password_query = select username, domain,password from users where > username='%u' and domain='%d' and active='true' What does your auth-sql-conf.ext file look like? With as much information as you already have in your database schema you may want to look at using the Prefetch userdb. http://wiki2.dovecot.org/UserDatabase/Prefetch P.S. Apologies for the duplication. I forgot to reply to the list with my last response.

1 0

SSL Client authentication with trustcenter-certificate
by dovecot.pkoch＠dfgh.net 04 Nov '14

04 Nov '14

Dear reader, we are using dovecot 2.2.7 and like it very much. Authentication is done via a checkpassword program that does two things: 1) check wether the client has connected via SSL using a client certificate 2) check wether the client is using a one time password generator Most of our users are using certificates that we have created ourself. These certificates contain a x500uniqueidentifier. But some users are using certificates from a german trust center and these certificates do not contain a x500uniqueIdentifier nor something similar. I would like to map these certificates to user accounts and my first idea was to do so from my checkpassword programm. But how do I find out the client-certificate from within a checkpassword script. I tried to add an additional entry to auth_request_var_expand_static_tab and fill in that environment variable in auth_request_get_var_expand_table_full() (both in src/auth/auth-request.c). But where do I find the SSL-context from which I can extract the client certificate? Kind regards Peter Koch

1 0

Example records for SQL AUTH
by Jorge Bastos 04 Nov '14

04 Nov '14

Hi, Where can I get examples for the records for the "users" table? For SHA512-CRYPT, I tried: replace into users values ('a(a)a.com','a.com',ENCRYPT('b', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))),'',0,0,'true'); schema is: CREATE TABLE `users` ( `username` varchar(255) NOT NULL, `domain` varchar(255) NOT NULL, `password` varchar(255) NOT NULL, `home` varchar(255) NOT NULL, `uid` int(11) NOT NULL, `gid` int(11) NOT NULL, `active` enum('true','false') NOT NULL DEFAULT 'true', PRIMARY KEY (`username`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 Password_query: password_query = select username, domain,password from users where username='%u' and domain='%d' and active='true' What could I be missing? but logs says user is not found in userdb: Nov 3 22:17:24 fastmail dovecot: auth: Error: sql(a(a)a.com,127.0.0.1,<JIsTtvsGZwB/AAAB>): user not found from userdb Nov 3 22:17:24 fastmail dovecot: pop3: Error: Authenticated user not found from userdb, auth lookup id=3938844673 (client-pid=10240 client-id=1) Nov 3 22:17:24 fastmail dovecot: pop3-login: Internal login failure (pid=10240 id=1) (internal failure, 1 successful auths): user=<a(a)a.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=10247, secured, session=<JIsTtvsGZwB/AAAB>

1 0

Postlogin script in v1
by List 03 Nov '14

03 Nov '14

Does dovecot-1.0.7-7.el5 support postlogin scripting?

2 1

Released Pigeonhole v0.4.6 for Dovecot v2.2.15.
by Stephan Bosch 02 Nov '14

02 Nov '14

Hello Dovecot users, Version 0.4.5 introduced one new 'feature', but it caused build problems. This release fixes that. If you've successfully installed 0.4.5, you do not need to upgrade. Changelog v0.4.6: - After make distclean, the distributed tarball would fail to recompile. This causes problems for some distribution builds. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.6.tar… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.6.tar… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Released Pigeonhole v0.4.5 for Dovecot v2.2.15.
by Stephan Bosch 02 Nov '14

02 Nov '14

Hello Dovecot users, Unfortunately, Pigeonhole v0.4.4 had a rather big issue with error handling and the execution of the implicit keep. This problem presented itself for example when users exceeded their quota. This did not result in the proper rejection message. This is why I quickly release a new version. Changelog v0.4.5: + Added a Pigeonhole version banner to doveconf output. This way, future bug reports will also include Pigeonhole version information. - Fixed handling of implicit keep. Last version erroneously reported that implicit keep succeeded after an earlier failure, while it in fact had failed. Particularly occurred for mailbox quota errors. - Fixed segfault occurring on SunOS systems when there is no active script. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.5.tar… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.5.tar… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

4 4

Sa-learn-pipe.sh script modification
by Pierre Barre 01 Nov '14

01 Nov '14

Hello, I've seen on this wiki page: http://wiki2.dovecot.org/Plugins/Antispam A script called "sa-learn-pipe.sh". I've tested it but it slow things down because dovecot wait for the script termination. So, I've made a modification. Now, the task is running in the background and dovecot move the mail without waiting for the script termination: #!/bin/bash echo /usr/bin/sa-learn $* /tmp/sendmail-msg-$$.txt echo "$$-start ($*)" >> /tmp/sa-learn-pipe.log #echo $* > /tmp/sendmail-parms.txt cat<&0 >> /tmp/sendmail-msg-$$.txt /usr/bin/sa-learn $* /tmp/sendmail-msg-$$.txt && rm -f /tmp/sendmail-msg-$$.txt & echo "$$-end" >> /tmp/sa-learn-pipe.log exit 0 I want know if this can cause any problem ? Thanks. -- Best regards, Pierre Barre.

1 0

Corrupted SSL parameters file in state_dir with HG 267bca7a62fb
by Thomas Leuxner 01 Nov '14

01 Nov '14

Hi, with the latest HG 267bca7a62fb the following error started to appear in the logs: Oct 31 09:39:07 nihlus dovecot: master: Dovecot v2.2.15 (267bca7a62fb) starting up for imap, lmtp [...] Oct 31 10:10:52 nihlus dovecot: lmtp(20876): Error: Corrupted SSL parameters file in state_dir: ssl-parameters.dat - disabling SSL 360 Oct 31 10:10:52 nihlus dovecot: lmtp(20876): Error: Couldn't initialize SSL parameters, disabling SSL Oct 31 10:10:52 nihlus dovecot: lmtp(20876): Connect from local This most likely has been introduced with a commit after the previous build installed (aa5dde56424f). I did not find options to disable SSL for LMTP either, as in my setup I'm using a UNIX socket. Regards Thomas

4 4

authentication issues with ipad / mac email client
by Rajesh M. 01 Nov '14

01 Nov '14

hi we are using using qmail toaster with dovecot pop3 and imap client outlook and thunderbird works fine in case of several ipad / mac email clients imap works fine but pop3 logins are not working with 110 port my dovecot config file is given below could somebody help please # Settings for 'stock' qmail-toaster disable_plaintext_auth = no default_login_user = vpopmail mail_max_userip_connections = 50 service imap-login { service_count = 0 client_limit = 256 process_min_avail = 4 vsz_limit = 384M process_limit = 400 } auth_cache_size = 32M auth_cache_ttl = 1800 auth_cache_negative_ttl = 0 auth_mechanisms = plain login digest-md5 cram-md5 auth_username_format = %Lu first_valid_uid = 89 first_valid_gid = 89 log_path = /var/log/dovecot.log login_greeting = ready. mail_plugins = $mail_plugins quota plugin/quota = maildir protocols = imap pop3 ssl_cert = </var/qmail/control/servercert.pem ssl_key = </var/qmail/control/servercert.pem # the following will likely be the default at some point ssl_dh_parameters_length = 2048 namespace { inbox = yes location = prefix = # prefix = INBOX. # Use 'prefix = INBOX.' for Courier-IMAP compatible transparent migration. # This forces all client apps to create subfolders underneath/within # the inbox instead of adjacent to it. It's not necessary to be that way. # FWIW, shubes thinks this setting is annoying/rediculous/retarded. # As a practical example, having no prefix allows mobile users to select # which folders get synchronized. Otherwise their whole mailbox is # synchronized, and they have no way to choose which folders they want sync'd. separator = . type = private } passdb { args = cache_key=%u webmail=127.0.0.1 driver = vpopmail } protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = $mail_plugins imap_quota } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_lock_session = no # pop3_uidl_format = UID%u-%v pop3_no_flag_updates=yes } userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } plugin { quota = maildir:ignore=Trash quota_rule = ?:storage=0 } thank you very much, rajesh

3 2