November 2014 - dovecot

Unknown scheme SSHA256.HEX.b64
by grundy 02 Dec '14

02 Dec '14

I'm getting a very strange error and I'm completely mystified by it. Thank you so much for taking a look! I recently migrated some users from another dovecot server to my own, and the previous admin had the passwords in their database using the SSHA256 scheme in HEX format. All the password hashes are in my database (MySQL) with a {SSHA256.HEX} prefix, and I thought at first that they were working fine, but then I checked my logs and am seeing this: localhost dovecot: auth: Error: password(***(a)***.***): Unknown scheme SSHA256.HEX.b64 (I have replaced the email address with asterisks) I am completely flabbergasted, as I can't imagine how "SSHA256.HEX.b64" is even coming in to existence as a string. I have triple checked the database and that combination appears nowhere in it. Does anybody have any idea how that is happening? Thanks again. -- View this message in context: http://dovecot.2317879.n4.nabble.com/Unknown-scheme-SSHA256-HEX-b64-tp50803… Sent from the Dovecot mailing list archive at Nabble.com.

2 1

Dovecot 2.2.15, Panic: file mbox-sync.c: line 152 (mbox_sync_read_next_mail): assertion failed:
by Mark Sapiro 01 Dec '14

01 Dec '14

The log messages are attached. The core dump is at <https://www.dropbox.com/s/9i80ms7xkyxoqj7/core.26450?dl=0> The server is $ uname -a Linux sbh16.songbird.com 2.6.18-8.1.14.el5 #1 SMP Thu Sep 27 18:58:54 EDT 2007 i686 i686 i386 GNU/Linux -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 2

v2.2.15 - make check - Conditional jump or move depends on uninitialised value
by AMM 01 Dec '14

01 Dec '14

Hello, I am currently using Dovecot 2.2.10 on Fedora 16 - 64 bit system I had made v2.2.10 Fedora 16 rpm file using spec file from ATrpms. http://dl.atrpms.net/all/dovecot.spec It has been working well from 6 months or so. Today I tried to make v2.2.15 rpm using same spec file. But "make check" is giving following error: fatal_printf_format_fix .............................................. : ok 0 / 190 tests failed ==8834== Conditional jump or move depends on uninitialised value(s) ==8834== at 0x4F7FE99: __strspn_sse42 (in /lib64/libc-2.14.90.so) ==8834== by 0x10FCF1: test_ds_recurse (test-data-stack.c:123) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== There are more similar errors after that and then rpmbuild aborts. I already saw that someone reported same error recently: http://dovecot.org/pipermail/dovecot/2014-October/098452.html But I do not know what is the right solution / patch? Can I disable "make check" safely? Its a production server so would not take any risk. Can anyone please tell what should I do? Thanks in advance. AMM

2 4

Unable to see virtual users
by Randall Gellens 01 Dec '14

01 Dec '14

I have a new Dovecot v2.2.9 installation and am having trouble getting virtual users recognized. Also, the example configuration listed on the Wiki generates config errors. Note that I haven't tried running dovecot yet, I wanted to verify that the config looked good first. First, my configuration. I'm trying to use /etc/dovecot/users as my combined userdb and passdb file, with all users having a UID/GID of vmail, and a home directory of /local/mnt/home/<user> ---------- $ sudo doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-39-generic x86_64 Ubuntu 14.04.1 LTS ext4 auth_verbose = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = mdbox:/local/mnt/mail/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%n /etc/dovecot/users driver = passwd-file } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = randy(a)qti.qualcomm.com protocols = " imap sieve pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = username_format=%n /etc/dovecot/users default_fields = uid=vmail gid=vmail home=/local/mnt/home/%n driver = passwd-file } userdb { driver = passwd } ---------- Next, my /etc/dovecot/users file: $ cat /etc/dovecot/users fred:x test:{SSHA}amehbJZYxKWuIbywINVNWxKcPrWi27a+ poptest2:x poptest3:x ---------- If I ask dovecot what it knows about user 'test' it says the user doesn't exist: $ sudo doveadm user test field valueuserdb lookup: user test doesn't exist ---------- If I ask about a user in /etc/passwd, it finds it: $ sudo doveadm user nobody field value uid 65534 gid 65534 home /nonexistent mail mdbox:/local/mnt/mail/nobody system_groups_user nobody ---------- As an aside, when I copied the sample config entries from http://wiki2.dovecot.org/UserDatabase it got config errors: userdb { driver = passwd-file args = username_format=%n /etc/dovecot/users default_fields = uid=vmail gid=vmail override_fields = skip = never result_failure = continue result_internalfail = continue result_success = return-ok } The 'skip', 'result_failure', etc. entries all generated config errors as being unknown. Since these were just explicitly setting config variables to their default values, I deleted them. It does seem odd that the config sample from the Wiki generated errors though. -- Randall Gellens Opinions are personal; facts are suspect; I speak for myself only -------------- Randomly selected tag: --------------- The difference between stupidity and genius is that genius has its limits. --Albert Einstein

3 6

Working with Active Directory on Windows Server 2012 R2
by Aaron Jenkins 30 Nov '14

30 Nov '14

Hi all, I’m having issues getting Dovecot to work with AD on 2012 R2 in a test environment. Background: AD is running on dc1.ad.automaton.uk<http://dc1.ad.automaton.uk>, the domain is ad.automaton.uk<http://ad.automaton.uk>. The DNS server is running on ad.automaton.uk<http://ad.automaton.uk> and the automaton.uk<http://automaton.uk> DNS is set up correctly in the test environment in that everything resolves to the correct IP address and I can authenticate with whichever LDAP clients (ldapsearch, ApacheDS, sssd). It refuses to bind on Dovecot for some reason. aaron@mail:/var/log$ uname -a Linux mail.ad.automaton.uk 3.16.0-23-generic #31-Ubuntu SMP Tue Oct 21 17:56:17 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux aaron@mail:/var/log$ dovecot --version 2.2.9 aaron@mail:/var/log$ dpkg -l | grep dovecot ii dovecot-core 1:2.2.9-1ubuntu5 amd64 secure POP3/IMAP server - core files ii dovecot-gssapi 1:2.2.9-1ubuntu5 amd64 secure POP3/IMAP server - GSSAPI support ii dovecot-imapd 1:2.2.9-1ubuntu5 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-ldap 1:2.2.9-1ubuntu5 amd64 secure POP3/IMAP server - LDAP support aaron@mail:/var/log/$ cat dovecot-debug.log … Nov 19 09:22:23 auth: Debug: auth client connected (pid=10345) Nov 19 09:22:23 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=pkJxdDkISwAK0zcd lip=10.211.55.33 rip=10.211.55.29lport=993 rport=56395 Nov 19 09:22:23 auth: Debug: client passdb out: CONT 1 Nov 19 09:22:23 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Nov 19 09:22:29 auth: Debug: client passdb out: FAIL 1 user=aaron.jenkins temp Nov 19 09:22:29 auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=pkJxdDkISwAK0zcd lip=10.211.55.33 rip=10.211.55.29lport=993 rport=56395 resp= (previous base64 data may contain sensitive data) Nov 19 09:22:39 auth: Debug: client passdb out: FAIL 2 user=aaron.jenkins temp Nov 19 09:22:40 auth: Debug: client in: AUTH 3 PLAIN service=imap secured session=pkJxdDkISwAK0zcd lip=10.211.55.33 rip=10.211.55.29lport=993 rport=56395 Nov 19 09:22:44 auth: Debug: client passdb out: CONT 3 Nov 19 09:22:44 auth: Debug: client in: CONT 3 (previous base64 data may contain sensitive data) Nov 19 09:22:50 auth: Debug: client passdb out: FAIL 3 user=aaron.jenkins temp Nov 19 09:22:50 auth: Debug: client in: AUTH 4 PLAIN service=imap secured session=pkJxdDkISwAK0zcd lip=10.211.55.33 rip=10.211.55.29lport=993 rport=56395 resp= (previous base64 data may contain sensitive data) Nov 19 09:22:56 auth: Debug: client passdb out: FAIL 4 user=aaron.jenkins temp (I’ve removed the base64 as it might contain passwords I actually use, if it’s important I’ll re-run it with a different password unredacted) Do you guys have any ideas on how to get it working with 2012 R2? I know the LDAP is quite funky but I suspect that’s why it doesn’t work. Also, attached is my sssd config as it’s working fine in case it might provide any insights.

2 5

how to start a replication master-master correctly
by Eduardo Casarero 28 Nov '14

28 Nov '14

Hi all, I currently have one dovecot 2.2.15 working and I would like to add a second master server. If I configure the second server and enable the dsync in both servers, the sync will copy everything from A to B ? I mean, B server won't remove messages in A as it doesn't have anything in its users mailbox? The second master server will be a cold server just for contingency. Thanks

3 2

Re: Offtopic, spam+AV
by Reindl Harald 28 Nov '14

28 Nov '14

Am 28.11.2014 um 17:45 schrieb Jorge Bastos: > In my previous servers I have clamav+spamassassin configured in postfix, but > things as, scan only outgoing emails it's not possible. > > What's the best option for these two filtering now adays? besides that this is the wrong list why should it not be possible? * clamav-milter exists * spamass-milter exists * "-o receive_override_options=no_milters" exists normally you have submission (587) for authenticated mail and MX (25) for inbound mail and both can have their own receive_override_options our MX is a own server delivering already filtered messages to the mailstorage on a different vserver in the LAN via port 10025 the service 10025 is only reachable from one IP (the MX LAN interface) and has "receive_override_options=no_milters" while all other smtpd services in "master.cf" use their own milter setup adjusted for outgoing mail and both machines share a careful maintained bayes-database trained on one machine and deployed with rsync

1 0

Offtopic, spam+AV
by Jorge Bastos 28 Nov '14

28 Nov '14

Hi guys, In my previous servers I have clamav+spamassassin configured in postfix, but things as, scan only outgoing emails it's not possible. What's the best option for these two filtering now adays? Thanks in advanced,

1 0

Re: failed login message
by Rajesh M 28 Nov '14

28 Nov '14

thank you for guidance, just to recap the issue was about squirrelmail giving a wrong message : "connection dropped by imap server" instead of "invalid user or password" as advised i connected using command line on both my old and new servers, and have posted the details including the output of dovevcot -n. 1) command prompt login. i put wrong password telnet x.x.x.x 143 * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE START TLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] ready. 1 login acc(a)mydomain.com wrongpass 1 NO [AUTHENTICATIONFAILED] Authentication failed. 2) DOVECOT LOG output CURRENT SERVER Nov 28 08:48:39 imap-login: Info: Disconnected (auth failed, 1 attempts in 72 secs): user=<acc(a)mydomain.com, method=PLAIN, rip=120.62.202.70, lip=103.241.181.155, session=<4PxKs+II2QB4PspG> OLD SERVER Nov 28 09:06:08 imap-login: Info: Disconnected (auth failed, 1 attempts): user=<acc(a)mydomain.com>, method=PLAIN, rip=120.62.202.70, lip=72.35.76.156 3) DOVECOT CONFIG FILE DETAILS # dovecot -n # 2.2.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.29.2.el6.x86_64 x86_64 CentOS release 6.5 (Final) auth_cache_negative_ttl = 0 auth_cache_size = 32 M auth_cache_ttl = 30 mins auth_mechanisms = plain login digest-md5 cram-md5 default_login_user = vpopmail disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 log_path = /var/log/dovecot.log login_greeting = ready. mail_max_userip_connections = 50 mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = . type = private } passdb { args = cache_key=%u webmail=127.0.0.1 driver = vpopmail } plugin { quota = maildir:ignore=Trash quota_rule = ?:storage=0 } protocols = imap pop3 service imap-login { client_limit = 256 process_limit = 400 process_min_avail = 12 service_count = 0 vsz_limit = 384 M } service pop3-login { client_limit = 1000 process_limit = 400 process_min_avail = 12 service_count = 0 vsz_limit = 512 M } ssl_cert = </var/qmail/control/servercert.pem ssl_dh_parameters_length = 2048 ssl_key = </var/qmail/control/servercert.pem userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = " quota imap_quota" } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_lock_session = no pop3_no_flag_updates = yes } thank you for your time and patience. rajesh ----- Original Message ----- From: Gedalya [mailto:gedalya@gedalya.net] To: 24x7server@24x7server.net,dovecot@dovecot.org Sent: Tue, 25 Nov 2014 05:54:49 -0500 Subject: Re: failed login message On 11/25/2014 04:49 AM, 24x7server(a)24x7server.net wrote: > thanks for your reply > > i intentionaly put the wrong password and checked the dovecot log and the message i got was > > # tail -f /var/log/dovecot.log | grep "xxx(a)yyy.com" > Nov 25 08:47:46 imap-login: Info: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxx(a)yyy.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, > secured, session=<xObTWqYIwgB/AAAB> > > but in the squirrelmail login page instead of the message "unknown user or password incorrect" i get the message > > ERROR: Connection dropped by IMAP server. > Query: LOGOUT > > > in my old server where it is working correctly dovecot logs shows the error > > Nov 25 14:46:12 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<"xxx(a)yyy.com">, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured > > and squirrelmail gives the error : "unknown user or password incorrect" which is correct. > > is there any other place i need to check or some other config file (either squirrelmail or dovecot) that i need to modify > > could you kindly guide me > 1. Please carefully read http://dovecot.org/mailinglists.html 2. Please carefully follow the instructions at http://dovecot.org/mailinglists.html. In your case, post full details for both servers. 3. Try to manually log in to both servers using e.g. telnet in order to see any differences in the way they respond. Something like $ telnet 192.168.9.11 143 Trying 192.168.9.11... Connected to 192.168.9.11. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready. 1 login gedalya 1234 * BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client did it anyway. If anyone was listening, the password was exposed. 1 NO [PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. 2 logout * BYE Logging out 2 OK Logout completed. Connection closed by foreign host. (that's how it responds in my specific case as I disallow plaintext login) Or if you need TLS (like me): $ openssl s_client -starttls imap -quiet -connect 192.168.9.11:143 depth=2 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN = StartCom Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0 . OK Pre-login capabilities listed, post-login capabilities have more. 1 login gedalya 1234 1 NO [AUTHENTICATIONFAILED] Authentication failed. 2 logout * BYE Logging out 2 OK Logout completed.

2 1

auth(default) :Aborted: Worker is buggy
by 刘莹莹 28 Nov '14

28 Nov '14

Hi dovecot when I modify SIEVE_DEFAULT_MAX_REDIRECTS = 25 in sieve-file:dovecot-1.2-sieve-0.1.7/src/lib-sieve/sieve-limits.h I found this problem occurs about once a week,I'm not sure if it was caused by modify SIEVE_DEFAULT_MAX_REDIRECTS = 25 , defaulte is SIEVE_DEFAULT_MAX_REDIRECTS = 4: LOG: Nov 25 11:20:12 imap-login: Info: Login: user=<any(a)rails.cn>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Nov 25 11:20:12 auth(default): Error: BUG: Worker sent reply with id 230, expected 231 Nov 25 11:20:12 auth(default): Error: worker-server(lwh(a)rails.cn,127.0.0.1): Aborted: Worker is buggy dovecot -n: namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: shared separator: / prefix: shared/%%u/ location: maildir:%Lh/%Ld/%%n/:INDEX=%Lh/%Ld/%Ln/shared/%%u list: children auth default: mechanisms: plain login default_realm: com user: txmail master_user_separator: * verbose: yes debug: yes debug_passwords: yes passdb: driver: passwd-file args: /etc/dovecot.master pass: yes master: yes passdb: driver: dict args: /etc/dovecot-memcached.conf userdb: driver: dict args: /etc/dovecot-memcached.conf socket: type: listen client: path: /var/spool/postfix/dovecot-auth mode: 438 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 438 user: txmail group: txmail plugin: quota_warning: storage=90%% %Lh/bin/dovecot-quota-warning.sh 90 %u quota_warning2: storage=95%% %Lh/bin/dovecot-quota-warning.sh 95 %u acl: vfile acl_shared_dict: file:/%Lh/%Ld/shared-mailboxes.db quota: maildir quota_rule: *:storage=10M expire: * 7 expire_dict: proxy::expire auth_socket_path: /var/run/dovecot/auth-master sieve: /opt/nsmail/data/sieve/%Ld/%Ln/.dovecot.sieve autocreate: trash autosubscribe: trash autocreate2: rubbishs autosubscribe2: rubbishs autocreate3: &XfJT0ZABkK5O9g- autosubscribe3: &XfJT0ZABkK5O9g- autocreate4: &g0l6Pw- autosubscribe4: &g0l6Pw- autocreate5: decrypt dict: expire: mysql:/etc/dovecot-expire.conf THANKS YINGYING

2 1