December 2014 - dovecot

disabling certain ciphers
by Will Yardley 02 Dec '14

02 Dec '14

Can you use both ssl_protocols *and* ssl_cipher_list in the same config (in a way that's sane)? ssl_protocols (>= 2.1) and ssl_cipher_list co-exist, or are they mutually exclusive? I have a Dovecot 2.2.13 system, and I tried setting: I also tried things like ssl_cipher_list = HIGH or ssl_cipher_list = HIGH:!MEDIUM:!LOW however, doing this seems to make v3 still work unless I explicitly do !SSLv3 in ssl_cipher_list in addition to disabling it in $ssl_protocols. This is different from Apache, which has similar parameters, but where disabling the protocol takes precedence. If I just do: ssl_protocols = !SSLv2 !SSLv3 I still get some ciphers that show up as "weak", e.g., | SSLv3: | ciphers: | TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong | TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong | TLS_DHE_RSA_WITH_DES_CBC_SHA - weak [....] | TLS_RSA_WITH_DES_CBC_SHA - weak Is there a way to exclude these ciphers, while still keeping my config easy to parse and avoiding duplicative or deprecated configs? The behavior is also pretty strange; if I have something like one of the following, with or without $ssl_protocols set to exclude SSLv2 and SSLv3: ssl_cipher_list = HIGH:!MEDIUM:!LOW:!SSLv3 ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:+HIGH:!MEDIUM TLS v1.0 and v1.1 get disabled as well. I also can't seem to explicitly enable TLS 1.0 or 1.1 in $ssl_cipher_list. w

3 12

Adding extra fields from an external source
by Ian Allison 02 Dec '14

02 Dec '14

Hi, I have an existing (Open)LDAP which I'm using with dovecot and I would like to implement quotas. I have global quotas working, but I would like per user quotas similar to what is described in the wiki (http://wiki2.dovecot.org/Quota/Configuration#LDAP) My problem is that there is no obvious attribute in the schemas shipped in the RHEL/Centos 6 to hold the quota string. Is it possible to get User database extra fields from an external source? e.g. flat file or MySQL table. I would like to pull everything else from LDAP but just fill out quota_rule from a different source. I realize I could expand my LDAP but I'm wary of just importing some random schema. I've had mixed results doing that in the past (the qmail schema (http://www.zytrax.com/books/ldap/ape/qmail.html) was incompatible with my existing structure, and at the moment I'm using a hacked version of the linux quota project's LDAP schema (http://sourceforge.net/projects/linuxquota/) - I'd rather have something a bit more official). If there is a recommended schema that you guys use which is stable and works well I would like to give that a try. -Thanks, Ian.

3 3

SORT capability
by absolutely_free＠libero.it 01 Dec '14

01 Dec '14

Hi, why I don't see SORT capability on my dovecot server? # telnet localhost 143 Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready. 1 capability * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5 1 OK Capability completed. a logout * BYE Logging out a OK Logout completed. Connection closed by foreign host. I am using # dovecot --version 2.0.9 default CentOS rpm package. Thank you

3 2

Re: Dovecot Director and Dovecot proxy
by anon_user＠openmailbox.org 01 Dec '14

01 Dec '14

On 2014-12-01 19:56, anon_user(a)openmailbox.org wrote: >> Il 01/12/2014 17:11, rub zorghy ha scritto: >> Why Dovecot Director server isn't used to perform this without Dovecot >> proxy ? Thus, the load balancer (F5 Big-IP) can distribute requests >> based >> on IMAP protocol to Dovecot Director cluster. >> I think that the slide is just one example of a scenario ,very >> complex. In real world, >> unless you do not have to segment users (some users use Exchange, >> others use Dovecot, but all user use imap.corporate.com, the proxy, > for login) you don't need a Proxy in front of Director. > > Load balancer is only for HA. > > Ciao Hello, So, dovecot director can work without dovecot proxy ? Thanks.

1 0

Dovecot 2.2.15, Panic: file mbox-sync.c: line 152 (mbox_sync_read_next_mail): assertion failed:
by Mark Sapiro 01 Dec '14

01 Dec '14

The log messages are attached. The core dump is at <https://www.dropbox.com/s/9i80ms7xkyxoqj7/core.26450?dl=0> The server is $ uname -a Linux sbh16.songbird.com 2.6.18-8.1.14.el5 #1 SMP Thu Sep 27 18:58:54 EDT 2007 i686 i686 i386 GNU/Linux -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 2

Panic: from mbox-sync.c; doveadm zlib-plugin
by Timothe Litt 01 Dec '14

01 Dec '14

Upgraded to dovecot 2.2.15 (built from sources on Fedora linux), saw intermittent panics: From dovecot:imap Error: Next message unexpectedly corrupted in mbox file /home/xxxx/mail/Junk E-mail at 1202197 Panic: file mbox-sync.c: line 152 (mbox_sync_read_next_mail): assertion failed: (sync_ctx->input->v_offset != mail_ctx->mail.from_offset || sync_ctx->input->eof) Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0 [0x274ecf] -> /usr/local/lib/dovecot/libdovecot.so.0 [0x274f4d] -> /usr/local/lib/dovecot/libdovecot.so.0 [0x27446b] -> /usr/local/lib/dovecot/libdovecot-storage.so.0 [0x16633e] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mbox_sync+0x6b6) [0x168146] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mbox_storage_sync_init+0x81) [0x169391] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x40) [0x186270] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x3d) [0x18715d] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x74) [0x1b6c44] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x5f) [0x1895bf] -> dovecot/imap(imap_status_get+0x7a) [0x806396a] -> dovecot/imap(cmd_status+0x128) [0x80588a8] -> dovecot/imap(command_exec+0x33) [0x805c8e3] -> dovecot/imap [0x805b63f] -> dovecot/imap [0x805b6c3] -> dovecot/imap(client_handl Fatal: master: service(imap): child 25461 killed with signal 6 (core dumps disabled) They are on hiatus, but thought I should report this anyway. If I get a reproducer, I'll see if I can get core dumps. The user involved had several procmail processes hung waiting for the lockfile on this mbox. Killing sendmail & dovecot, the procmails & restarting sendmail & dovecot is all that I did after the errors. It is possible that the last message delivered prior to the errors was truncated ("note the input-eof" in the trace), but this shouldn't result in a panic. I'd expect a warning, then the message truncated to whatever is there, and operations proceeding... Also, it appears that make install doesn't remove the doveadm zlib plugin, which it seems was obsoleted by http://www.dovecot.org/list/dovecot-cvs/2012-October/021796.html. This results in: doveadm log find doveadm(root): Error: Module is for different ABI version 2.1.12 (we have 2.2.ABIv15(2.2.15)): /usr/local/lib/dovecot/doveadm/lib10_doveadm_zlib_plugin.so Removing /usr/local/lib/dovecot/doveadm/lib10_doveadm_zlib_plugin.* fixes this. However, it would be better if make install either removed these from an old installation in an upgrade, renamed the files, or advised the installer to do so. FWIW: # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.22.14-72.fc6 i686 Fedora Core release 6 (Zod) first_valid_gid = 4000 first_valid_uid = 4000 hostname = smtp.example.net login_greeting = Dovecot ready. Unauthorized access is prohibited. mail_access_groups = mail mail_location = mbox:~/mail:INBOX=/var/mail/%n mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox "Train As Forgotten" { auto = subscribe } mailbox "Train As Ham" { auto = subscribe } mailbox "Train As Spam" { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { driver = pam } service imap-login { inet_listener imap { address = imap.v4.example.net imap.v6.example.net port = 143 } inet_listener imaps { address = imap.v4.example.net imap.v6.example.net port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { address = pop.v4.example.net pop.v6.example.net port = 110 } inet_listener pop3s { address = pop.v4.example.net pop.v6.example.net port = 995 ssl = yes } } ssl_ca = </etc/pki/tls/certs/example_net_ca-cert-crl.pem ssl_cert = </etc/pki/tls/certs/servers-example-net.pem ssl_key = </etc/pki/tls/private/servers-example-net.pmk userdb { driver = passwd } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags mail_plugins = } protocol pop3 { mail_plugins = pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } -- Timothe Litt ACM Distinguished Engineer -------------------------- This communication may not represent the ACM or my employer's views, if any, on the matters discussed.

1 0

v2.2.15 - make check - Conditional jump or move depends on uninitialised value
by AMM 01 Dec '14

01 Dec '14

Hello, I am currently using Dovecot 2.2.10 on Fedora 16 - 64 bit system I had made v2.2.10 Fedora 16 rpm file using spec file from ATrpms. http://dl.atrpms.net/all/dovecot.spec It has been working well from 6 months or so. Today I tried to make v2.2.15 rpm using same spec file. But "make check" is giving following error: fatal_printf_format_fix .............................................. : ok 0 / 190 tests failed ==8834== Conditional jump or move depends on uninitialised value(s) ==8834== at 0x4F7FE99: __strspn_sse42 (in /lib64/libc-2.14.90.so) ==8834== by 0x10FCF1: test_ds_recurse (test-data-stack.c:123) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== by 0x10FCC9: test_ds_recurse (test-data-stack.c:119) ==8834== There are more similar errors after that and then rpmbuild aborts. I already saw that someone reported same error recently: http://dovecot.org/pipermail/dovecot/2014-October/098452.html But I do not know what is the right solution / patch? Can I disable "make check" safely? Its a production server so would not take any risk. Can anyone please tell what should I do? Thanks in advance. AMM

2 4

R: Re: SORT capability
by absolutely_free＠libero.it 01 Dec '14

01 Dec '14

Here's my conf: # dovecot -n # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-71.el6.x86_64 x86_64 CentOS release 6.6 (Final) auth_mechanisms = plain login digest-md5 cram-md5 disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 mail_gid = 89 mail_location = maildir:/coraid-s2l2/domains mail_uid = 89 maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date imapflags notify mbox_write_locks = fcntl namespace { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /etc/dovecot/dovecot-sql-crypt.conf.ext driver = sql } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags sieve_max_script_size = 1M } protocols = imap pop3 lmtp sieve service imap-login { service_count = 0 } service pop3-login { service_count = 0 } ssl_cert = </etc/nginx/ssl/wildcard.crt ssl_key = </etc/nginx/ssl/wildcard.key userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = } protocol lda { mail_plugins = } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } >----Messaggio originale---- >Da: h.reindl(a)thelounge.net >Data: 01/12/2014 12.37 >A: <dovecot(a)dovecot.org> >Ogg: Re: SORT capability > > > >Am 01.12.2014 um 12:32 schrieb absolutely_free(a)libero.it: >> # dovecot -n |grep -i sort >> >> (nothing) > >i meant post the complete output >you can't grep for something not existing >but you or some config-include may set something wrong > >> Maybe to full list is only available after authentication? > >likely > >> # telnet localhost 143 >> Trying ::1... >> Connected to localhost. >> Escape character is '^]'. >> * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE >> STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready. >> a login XXXXXXXXXXX YYYYYYYYYYYYYYYY >> a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE >> SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN >> NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT >> SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS] Logged in >> >>> ----Messaggio originale---- >>> Da: h.reindl(a)thelounge.net >>> Data: 01/12/2014 12.21 >>> A: <dovecot(a)dovecot.org> >>> Ogg: Re: SORT capability >>> >>> Am 01.12.2014 um 12:19 schrieb absolutely_free(a)libero.it: >>>> why I don't see SORT capability on my dovecot server? >>>> >>>> # telnet localhost 143 >>>> Trying ::1... >>>> Connected to localhost. >>>> Escape character is '^]'. >>>> * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE >> STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready. >>>> 1 capability >>>> * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE >> STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5 >>>> 1 OK Capability completed. >>>> a logout >>>> * BYE Logging out >>>> a OK Logout completed. >>>> Connection closed by foreign host >>> >>> DUNNO >>> >>> mabye output of "dovecot -n" knows > >

1 0

R: Re: SORT capability
by absolutely_free＠libero.it 01 Dec '14

01 Dec '14

# dovecot -n |grep -i sort (nothing) Maybe to full list is only available after authentication? # telnet localhost 143 Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready. a login XXXXXXXXXXX YYYYYYYYYYYYYYYY a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS] Logged in >----Messaggio originale---- >Da: h.reindl(a)thelounge.net >Data: 01/12/2014 12.21 >A: <dovecot(a)dovecot.org> >Ogg: Re: SORT capability > > > >Am 01.12.2014 um 12:19 schrieb absolutely_free(a)libero.it: >> why I don't see SORT capability on my dovecot server? >> >> # telnet localhost 143 >> Trying ::1... >> Connected to localhost. >> Escape character is '^]'. >> * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready. >> 1 capability >> * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5 >> 1 OK Capability completed. >> a logout >> * BYE Logging out >> a OK Logout completed. >> Connection closed by foreign host > >DUNNO > >mabye output of "dovecot -n" knows > >

2 1

Unable to see virtual users
by Randall Gellens 01 Dec '14

01 Dec '14

I have a new Dovecot v2.2.9 installation and am having trouble getting virtual users recognized. Also, the example configuration listed on the Wiki generates config errors. Note that I haven't tried running dovecot yet, I wanted to verify that the config looked good first. First, my configuration. I'm trying to use /etc/dovecot/users as my combined userdb and passdb file, with all users having a UID/GID of vmail, and a home directory of /local/mnt/home/<user> ---------- $ sudo doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-39-generic x86_64 Ubuntu 14.04.1 LTS ext4 auth_verbose = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = mdbox:/local/mnt/mail/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%n /etc/dovecot/users driver = passwd-file } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = randy(a)qti.qualcomm.com protocols = " imap sieve pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = username_format=%n /etc/dovecot/users default_fields = uid=vmail gid=vmail home=/local/mnt/home/%n driver = passwd-file } userdb { driver = passwd } ---------- Next, my /etc/dovecot/users file: $ cat /etc/dovecot/users fred:x test:{SSHA}amehbJZYxKWuIbywINVNWxKcPrWi27a+ poptest2:x poptest3:x ---------- If I ask dovecot what it knows about user 'test' it says the user doesn't exist: $ sudo doveadm user test field valueuserdb lookup: user test doesn't exist ---------- If I ask about a user in /etc/passwd, it finds it: $ sudo doveadm user nobody field value uid 65534 gid 65534 home /nonexistent mail mdbox:/local/mnt/mail/nobody system_groups_user nobody ---------- As an aside, when I copied the sample config entries from http://wiki2.dovecot.org/UserDatabase it got config errors: userdb { driver = passwd-file args = username_format=%n /etc/dovecot/users default_fields = uid=vmail gid=vmail override_fields = skip = never result_failure = continue result_internalfail = continue result_success = return-ok } The 'skip', 'result_failure', etc. entries all generated config errors as being unknown. Since these were just explicitly setting config variables to their default values, I deleted them. It does seem odd that the config sample from the Wiki generated errors though. -- Randall Gellens Opinions are personal; facts are suspect; I speak for myself only -------------- Randomly selected tag: --------------- The difference between stupidity and genius is that genius has its limits. --Albert Einstein

3 6