December 2014 - dovecot

Re: Required SSL with exceptions
by dovecot＠outputservices.com 09 Dec '14

09 Dec '14

On 12/08/14 23:50, SATOH Fumiyasu wrote: > Hi, > > At Mon, 08 Dec 2014 16:01:43 -0600, > List wrote: >> Essentially we would like to host IMAP with SSL enforced for any connections coming from anywhere except the subnet where our other mail servers reside. The idea is to not install a local instance of dovecot on the webmail/carddav/caldav servers to reduce the number of instances that need to be managed. Is it possible to have two imap listeners, where ssl is enforced on one port, and not on another? > > Use login_trusted_networks parameter. > What is the syntax for login_trusted_networks? The docs and WIKI do not show it.

2 1

Dovecot Pre-Login Scripting
by Jeremy Hayden 09 Dec '14

09 Dec '14

Hello, We are in the process of migrating users from one system that is currently not hosted by our company, to our dovecot 2.2.10 installation. We are planning on doing the dovecot dsync command for copying users mail over to the new installation, but the one snag we are running into is ensuring we are able to get the users credentials stored in our system. We are migrating the email from a Gmail ISP account to our installation as they are discontinuing their support next year. The setup is a multistep process we are hoping to accomplish. When a connection is started to our cluster, it will first check the database to see if the credentials match, if not it will verify against Gmail's servers. If the Gmail test is successful, it would pass the credentials to a script to store them for future login attempts. Once the authentication is verified and stored locally, we would run a post-login script to run dsync to copy the mail down to the new system. The problem we are running into is efficiently and appropriately hooking into the dovecot authentication process. We are unable to find anything regarding PreLogin Scripting to contrast the PostLoginScripting we are currently using, and the only other thing we are currently seeing as a possible option is running a custom authentication socket or password imap-login to a script. This seems like it would be a resource nightmare depending on the server load and are hoping for a more elegant option to be unveiled. Any other options or suggestions are welcome. We are also wondering, if we have to go with the custom authentication setup, if there are any examples out there to base our scripts off in setting it up. Thank you, Jeremy

1 0

Required SSL with exceptions
by List 09 Dec '14

09 Dec '14

I have a Dovecot cluster which is on separate machines from my webmail/caldav/cardav cluster, and I currently have the system setup with ssl = required. Unfortunately the caldav/cardav server I am running doesn't support STARTTLS so I was wondering if there is a way to still enforce ssl for every connection with the exception of a certain subnet, or if there is a better way to accomplish this without install a local install of Dovecot on each of my caldav/cardav servers.

3 4

Using dovecot with existing mbox hieararchy - possible?
by Chris Green 08 Dec '14

08 Dec '14

I currently use mutt to read my E-Mail on a machine which runs a postfix server to receive mail by SMTP. Mail is actually delivered to the final mbox mailboxes by a custom filtering script writtin in Python. Will dovecot happily serve mail from the existing hierarchy (obviously if I configure it right) so that I can connect using IMAP to my server machine to read mail? The mbox files are all under ~/Mail with several levels of directories in some trees. Does dovecot need any sort of notification from postfix (or my Python script) to indicate that new mail has been delivered or does it just re-scan the mbox files at intervals to see changes? -- Chris Green

1 0

sdbox and IMAP folders
by Jeff Larsen 08 Dec '14

08 Dec '14

We have just migrated from cyrus-imap to dovecot 2.2.9 on Ubuntu. By default, all our user's manually created folders appear at the same folder level as INBOX (i.e., they are next to INBOX, and not inside INBOX in a typical tree view of the folders). But on Dovecot, users are able to create new folders either parallel to INBOX or as subfolders within INBOX, which I think is going to lead to confusion for our users, especially when working from the limited UI of a smartphone client where folder hierarchy is not as easy to visualize. With cyrus, this behavior depended on the client setting for "IMAP server directory" as it is called in Thunderbird. If the setting was given the value "INBOX", then all folders were parallel to INBOX and you could not create any folder that would appear in the tree inside INBOX. With the setting empty, then all folders appeared as subfolders of INBOX. It was all or nothing. When the mail accounts were migrated to dovecot, the existing top-level user folders were created in dovecot at the same level as INBOX. We did nothing intentional to get this result. We just used cyrus2dovecot to export to maildir, then doveadm sync to convert to the final sdbox. With dovecot, when "IMAP server directory" is empty, we get the original folder tree with all folders parallel to inbox, but users are also able to create subfolders inside INBOX . We are using sdbox storage and the folder heirarchy as seen in the client tree (parallel folders and subfolders) is also reflected in the server's local file system. If we change the "IMAP server directory" setting on the client while using dovecot, then all the folders that were previously at the same level as INBOX become inaccessible, so that's not a viable option. So, my question is this: Can I replicate the cyrus behavior where INBOX subfolders are an all-or-nothing option? Or are we stuck with users (having questionable file management skills in the first place) getting lost between INBOX subfolders and top-level folders. Thanks, Jeff root:~# doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-40-generic x86_64 Ubuntu 14.04.1 LTS auth_mechanisms = plain login auth_verbose = yes listen = * mail_location = sdbox:%h:LAYOUT=fs:ALT=/var/alt-vmail/%n mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { quota = dict:%n::file:%h/dovecot-quota quota_grace = 10%% quota_rule = *:storage=100M quota_rule2 = Trash:storage=+20M sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0666 } } service imap-login { inet_listener imap { address = localhost port = 143 } inet_listener imaps { port = 0 } } service managesieve-login { inet_listener sieve { address = localhost port = 4190 } } ssl = required ssl_cert = </etc/ssl/certs/mail.XXXX.com.crt ssl_key = </etc/ssl/private/mail.XXXX.com.key userdb { args = username_format=%n /etc/dovecot/qec-quota-override default_fields = uid=vmail gid=vmail home=/var/vmail/%n driver = passwd-file } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = uid=vmail gid=vmail home=/var/vmail/%n driver = ldap } protocol lda { mail_plugins = " quota sieve" } protocol imap { mail_plugins = " quota imap_quota" }

1 0

Missing hits when performing full-text searches
by Frerich Raabe 08 Dec '14

08 Dec '14

Hi, we're running Dovecot 2.1.7 together with Solr for efficient fulltext search. A couple of days ago we reinstalled our Solr server on a new machine. After adjusting our Dovecot setup to use the new server, it took a few days to notice that something seems fishy about our full-text search: expected hits wouldn't be shown among the search results. For instance, one of the folders (a shared, read-only folder which is basically a mailinglist archive) with about 210k messages has a plaintext mail with the text 'Amman'. However, logging into the IMAP server and issueing a . SEARCH TEXT Amman In the folder doesn't yield any hits. It seems that this happens for older mails only -- trying other keywords, we did notice hits in recent mails but not in older ones. Some caching related to the old Solr server causing issues? Debugging this further, I noticed that the above IMAP command shows this in the Solr log files: INFO: [] webapp=/solr path=/select params={fl=uid,score&sort=uid+asc&q=(hdr:"Amman"+OR+body:"Amman")&fq=%2Bbox:b68ece09e22fb9502d34010017227a26+%2Buser:""&rows=209392} hits=0 status=0 QTime=229 And indeed, something like $ curl 'http://indexer:8080/solr/select?fl=uid,score&sort=uid+asc&q=(hdr:"Amman"+OR+body:"Amman")&fq=%2Bbox:b68ece09e22fb9502d34010017227a26+%2Buser:""&rows=209392' Yields no results. However, I noticed that if I remove the 'fq=' part from the query then I get a bunch of hits. Alas, I don't know whether those are to be expected or not. Does anybody have an idea what might cause this, or what the meaning of that 'box' checksum is? -- Frerich Raabe - raabe(a)froglogic.com www.froglogic.com - Multi-Platform GUI Testing

1 0

userdb lookup not possible with only userdb prefetch
by Yves Goergen 08 Dec '14

08 Dec '14

Hello, I am setting up a new server and migrating my Dovecot 1.2.9 config to the new 2.2.9 version. There wasn't much to keep from the old version so I had to recreate the config from scratch. Now I think I'm done but I can't login to IMAP. The log says this: > dovecot: auth: Error: prefetch(box@****.de,2001:****:7765,<bzAOP5QJXwAgAQpgEAXJAZyOMB1qBXdl>): userdb lookup not possible with only userdb prefetch > dovecot: auth: Error: userdb(box@****.de,2001:****:7765,<bzAOP5QJXwAgAQpgEAXJAZyOMB1qBXdl>): user not found from userdb prefetch > dovecot: imap: Error: Authenticated user not found from userdb, auth lookup id=178651137 (client-pid=13711 client-id=1) > dovecot: imap-login: Internal login failure (pid=13711 id=1) (internal failure, 1 successful auths): user=<box(a)****.de>, method=PLAIN, rip=2001:****:7765, lip=2a01:****:2, mpid=13717, TLS, session=<bzAOP5QJXwAgAQpgEAXJAZyOMB1qBXdl> That doesn't help me a lot. Here's parts of my configuration, dumped with 'dovecot -n': > # 2.2.9: /etc/dovecot/dovecot.conf > # OS: Linux 3.13.0-40-generic x86_64 Ubuntu 14.04.1 LTS > auth_mechanisms = plain login > disable_plaintext_auth = no > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > plugin { > quota = maildir > } > protocols = imap pop3 > userdb { > driver = prefetch > } > protocol imap { > mail_max_userip_connections = 100 > mail_plugins = quota imap_quota > } What's the problem here? How can I resolve this issue? -- Yves Goergen http://unclassified.de http://dev.unclassified.de

4 4

Missing metadata on Dovecot 2.2.14, on Kolab 3.3, Centos 6.6
by Max Raafat 08 Dec '14

08 Dec '14

Hello everyone, We were trying to provision a system with Dovecot instead of another working cyrus kolab system. I am stuck with a problem with the metadata, especially when it comes to the Special Folders in Kolab 3.3, like Calenders, Tasks, etc, as well as any user created Folders. Emails work perfectly, and all the types are correct. But for example, If I try to change the type of Calenders, or create a new folder from inside roundcube and set it to type "Calenders", it stays at the default which is "mail". Therefore it causes problems, when sharing events, since they are displayed as "mail" type and not "event" type. We've tracked the problem down to the metadata not existing for special folders. A simple search only shows the default "mail" metadata, but nothing for shared folders, or special folders, etc. Here is the doveconf -n ------------------------------------------------------------------------------------------------------------- [root@m3 ~]# doveconf -n # 2.2.14: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-504.el6.x86_64 x86_64 CentOS release 6.6 (Final) imap_metadata = yes mail_attribute_dict = file:Maildir/dovecot-metadata mail_gid = 5000 mail_location = maildir:~/Maildir mail_plugins = " acl" mail_uid = 5000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { driver = shadow } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail user = vmail } } service dict { unix_listener dict { group = vmail mode = 0666 user = vmail } } service lmtp { executable = lmtp unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 ::1 port = 4190 } } service managesieve { process_limit = 1024 } ssl = required ssl_cert = </etc/ssl/m3.company.includingchain.crt ssl_key = </etc/ssl/m3.company.de.key userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = " acl sieve" } protocol lda { mail_plugins = " acl sieve" } protocol imap { mail_plugins = " acl imap_acl" } ------------------------------------------------------------------------------------------------------------ Would appreciate any help or ideas as to what I can do to fix this. Thanks Max

1 0

MD5-CRYPT/CRAM-MD5 vs SHA512-CRYPT/PLAIN
by ML mail 06 Dec '14

06 Dec '14

Hello, I am wondering which variant is more secure for user authentication and password scheme. Basically I am looking at both variants: 1) MD5-CRYPT password scheme storage with CRAM-MD5 auth mechanism 2) SHA512-CRYPT password scheme storage with PLAIN auth mechanism In my opinion the option 2) should be safer although it is using PLAIN auth mechanism. Of course I would always use STARTTLS and not allow unencrypted connection. What is your opinion? Best, ML

6 7

Size of array hosts, vhosts_count and modulo operation
by rub zorghy 05 Dec '14

05 Dec '14

Hi, Timo Sirainen wrote (May 19, 2010 1:50:34 am) : "When a connection from a newly seen user arrives, it gets assigned to a mail server according to a function: host = vhosts[ md5(username) mod vhosts_count ]" This hash function is it still used as it is without modification ? My another question sounds pretty innocent but I have doubts about vhosts_count. Taking two directors with three backend Dovecot as an example, the number of (v)hosts assigned for each host is "100" (default value of the vhost_count variable). I gather that the value for vhosts_count (to perform the modulo operation) and the size or length of the array (vhosts[]) in terms of number of elements are equal to 300. Thx so much. gdrub

1 0