February 2014 - dovecot

Re: [Dovecot] Logging authentication failures when Dovecot's auth service used to authenticate postfix smtpd
by MV 28 Feb '14

28 Feb '14

> in case of SASL postfix is talking via a unix socket so there is no connection IP dovecot knows about I don't not where Dovecot get the client IP from, but having auth socket in place, below is a redacted extract from my logs. As you can see Dovecot does know the client's IP. Dovecot config: auth_verbose = yes auth_debug = no # Dovecot log after submission/smtpd AUTH successful <nothing> # Dovecot log after submission/smtpd AUTH failure ... auth: Info: passwd-file(joe(a)example.com,46.z.z.z): Password mismatch Dovecot config: auth_verbose = yes auth_debug = yes # Dovecot log after submission/smtpd AUTH successful ... auth: Debug: client in: AUTH 1 PLAIN service=smtp nologin lip=212.x.x.x rip=46.z.z.z secured resp=<hidden> ... auth: Debug: passwd-file(joe(a)example.com,46.z.z.z): lookup: user=joe(a)example.com file=/etc/dovecot/virtual_users ... auth: Debug: client passdb out: OK 1 user=joe(a)example.com # Dovecot log after submission/smtpd AUTH failure ... auth: Debug: client in: AUTH 2 PLAIN service=smtp nologin lip=212.x.x.x rip=46.z.z.z secured resp=<hidden> ... auth: Info: plain(?,46.z.z.z): invalid input ... auth: Debug: client passdb out: FAIL 2 And regardless of Docecot config, postfix always logs the same stuff # Postfix log after submission/smtpd AUTH successful (QUIT after AUTH without sending RCPT TO) ... postfix/smtpd[5678]: connect from host.client.foo.tld[46.z.z.z] ... postfix/smtpd[5678]: disconnect from host.client.foo.tld[46.z.z.z] # Postfix log after submission/smtpd AUTH failure ... postfix/smtpd[1234]: connect from host.client.foo.tld[46.z.z.z] ... postfix/smtpd[1234]: warning: host.client.foo.tld[46.z.z.z]: SASL PLAIN authentication failed: ... postfix/smtpd[1234]: disconnect from host.client.foo.tld[46.z.z.z]

1 0

[Dovecot] Logging authentication failures when Dovecot's auth service used to authenticate postfix smtpd
by MV 28 Feb '14

28 Feb '14

Hello, tl;dr: Is there a way to get dovecot's auth to log failed smtp authentications without having to switch on "auth_verbose"? postfix version 2.11.0 and dovecot version 2.2.12 I'm currently migrating my postfix+courier to postfix+dovecot and so far it's working as expected. Except for logging smtp login failures. Despite Postfix logging successful authentications (see sample below), it doesn't log failed smtp logins. Feb 25 22:28:53 mailer2 postfix/submission[20274]: C981B20198: client=A-B-C-D.*****.net[A.B.C.D]:63107, sasl_method=PLAIN, sasl_username=joe(a)example.net And since my postfix setup authenticates virtual users through Dovecot's auth, I thought maybe dovecot could report smtp login failures the same way it reports imap and pop3 login failures. Below is a sample extracted from "info_log_path" after several imap and pop3 login failures. (Obviously the IP 255.... is made up and irrelevant for this mater). # begin extract "/var/log/dovecot-info.log" 2014-02-27 21:14:26 auth: Info: passwd-file(joe(a)example.net,255.255.255.255,<Y0lbzmnzfwAuQV80>): Password mismatch 2014-02-27 21:16:46 auth: Info: passwd-file(foobar,255.255.255.255,<Y0lbzmnzfwAuQV80>): unknown user 2014-02-27 21:52:00 auth: Info: passwd-file(foo(a)example.net,255.255.255.255,<0Su6VGrzGwAuQV80>): unknown user 2014-02-27 21:53:35 auth: Info: plain(?,255.255.255.255,<0Su6VGrzGwAuQV80>): Empty username 2014-02-27 21:53:55 auth: Info: plain(?,255.255.255.255,<0Su6VGrzGwAuQV80>): Username character disallowed by auth_username_chars: 0x5c (username: \0) 2014-02-27 22:08:05 auth: Info: plain(?,255.255.255.255): invalid input 2014-02-27 22:09:36 auth: Info: passwd-file(joe(a)example.net,255.255.255.255): Password mismatch 2014-02-27 22:09:53 auth: Info: login(?,255.255.255.255): Empty username # end extract I've tried adding "-L -o info_log_path=/var/log/dovecot-info.log" to the both auth and auth-worker services but that yield nothing. ----------------------%<-------------------------------- auth_mechanisms = plain login auth_verbose = yes base_dir = /var/run/dovecot/ info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/virtual_users driver = passwd-file } userdb { args = username_format=%u /etc/dovecot/virtual_users default_fields = uid=vmail gid=vmail driver = passwd-file override_fields = home=/home/vmail/%d/%u result_failure = return-fail result_internalfail = return-fail } service auth-worker { executable = auth -w -L -o info_log_path=/var/log/dovecot-info.log } service auth { executable = auth -L -o info_log_path=/var/log/dovecot-info.log unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix user = postfix mode = 0660 } } service lmtp { executable = lmtp -L -o info_log_path=/var/log/dovecot-info.log unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix user = postfix mode = 0660 } } ---------------------->%-------------------------------- The relevant postfix config is ... smtpd_sasl_type = dovecot smtpd_sasl_path = private/dovecot-auth virtual_transport = lmtp:unix:private/dovecot-lmtp

2 2

[Dovecot] Dovecot2 vs. AD, "Inactivity during authentication"
by Jeroen Scheerder 28 Feb '14

28 Feb '14

Hi, I'm trying to setup Dovecot2 for o IMAP client access o LDA for postfix mail delivery (with SIEVE) ... on a FreeBSD host. The FreeBSD server has no users (by intention), so I've set up a virtual mail domain, using LDAP lookups in Postfix. So far so good. Mail delivers into the proper mailbox. But I'm stuck getting Dovecot to authenticate. User- and passwd DB's are set up for LDAP lookups to AD, using an authenticated bind (the AD server offers no anonymous binds, yet). I've enabled all the debugging I can find, but my logs have little information to offer. Any help in getting me a step further would be much appreciated. In particular, I'd like to learn how do diagnose these userdb/passdb issues properly. Here's what I see in the logs: Feb 27 12:25:49 <mail.info> ponyboy dovecot: imap-login: Disconnected: Inactivity during authentication (disconnected while authenticating, waited 172 secs): user=<>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<r/ERi2HzQAB/AAAB> Feb 27 12:26:42 <mail.err> ponyboy dovecot: auth: Error: PLAIN(js,127.0.0.1,<r/ERi2HzQAB/AAAB>): Request 74099.1 timed out after 225 secs, state=1 This logging is related to the folloging IMAP session: ponyboy% telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login js suppressed * OK Waiting for authentication process to respond.. * BYE Disconnected for inactivity during authentication. Connection closed by foreign host. Here's my config: $ dovecot -n # 2.2.10: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-RELEASE amd64 ufs auth_debug = yes auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes first_valid_gid = 1000 first_valid_uid = 1000 imap_client_workarounds = delay-newmail last_valid_gid = 1000 last_valid_uid = 1000 mail_gid = 1000 mail_location = maildir:/var/mail/on2it/%Ln mail_uid = 1000 maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/on2it-ldap-users.cfg driver = ldap } protocols = imap service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } } shutdown_clients = no ssl = no userdb { args = /usr/local/etc/dovecot/on2it-ldap-users-userdb.cfg driver = ldap } valid_chroot_dirs = /var/mail/on2it $ cat /usr/local/etc/dovecot/on2it-ldap-users.cfg hosts = dc2.office.on2it.net ldap_version = 3 base = dc=office,dc=on2it,dc=net scope=subtree auth_bind = yes dn = [suppressed] dnpass = [suppressed] pass_attrs = sAMAccountName=user user_attrs = \ =home=/var/mail/on2it/%{ldap:sAMAccountName}, \ =mail=maildir:/var/mail/on2it/%{ldap:sAMAccountName} user_filter = (&(ObjectClass=person)(sAMAccountName=%u)) pass_filter = (&(ObjectClass=person)(sAMAccountName=%u)) iterate_attrs = sAMAccountName=user iterate_filter = (objectClass=person) $ ls -l /usr/local/etc/dovecot/on2it-ldap-users-userdb.cfg lrwxr-xr-x 1 root wheel 20 Feb 27 12:07 /usr/local/etc/dovecot/on2it-ldap-users-userdb.cfg -> on2it-ldap-users.cfg

3 5

Re: [Dovecot] Error "Initializing mail storage ..." after upgrading to 2.2.10
by Joseph Tam 28 Feb '14

28 Feb '14

G?tz Reinicke writes: > mail_location = mbox:~/:INBOX=/var/mail/%u > ... > Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, > list=yes, subscriptions=yes > location=mbox:~/:INBOX=/var/mail/rechnungseingang-animationsinstitut > Feb 27 17:02:11 imap(rechnungseingang-animationsinstitut): Error: user > rechnungseingang-animationsinstitut: Initialization failed: Namespace > '': Home directory not set for user. Can't expand ~/ for mail root dir > in: ~/:INBOX=/var/mail/rechnungseingang-animationsinstitut Hmm, I don't have a trialing '/' in my mail_location, so maybe you can try leaving it off too just to check. mbox:~:INBOX=/var/mail/%u Also, is your home directory well defined in your userdb? Check output of doveadm user rechnungseingang-animationsinstitut Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] Quota-Status issue
by Cyberonic Turbo 27 Feb '14

27 Feb '14

Following this guide: http://sys4.de/en/blog/2013/04/08/postfix-dovecot-mailbox-quota/ I can't seem to get it to work, as soon as I add the smtpd_recipient_restrictions setting to postfix I can no longer send mail at all. I get the message SMTP Error (450): Failed to add recipient "postmaster(a)example.com" (4.7.1 : Recipient address rejected: Internal error occurred. Refer to server log for more information.). I googled around and found this command to test the quota-status service: printf "recipient=postmaster at example.com\nsize=1234\n\n" | nc 127.0.0.1 12340 It seems to always return the quota_status_nouser message. I'm really stumped here. What logs do I need to check for errors and does anyone have any experience with this? I'm running Dovect 2.2.10 with Postfix 2.6.6 Here's my dovecot -n result: # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.5.1.el6.x86_64 x86_64 CentOS release 6.5 (Final) auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } first_valid_uid = 2000 last_valid_uid = 2000 listen = * log_path = /var/log/dovecot.log mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = quota mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-master-users-password driver = passwd-file master = yes } plugin { acl = vfile acl_shared_dict = proxy::acl auth_socket_path = /var/run/dovecot/auth-master autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk quota = dict:user::proxy::quotadict quota_grace = 10%% quota_rule = *:storage=1G quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = /%Lh/sieve/dovecot.sieve sieve_dir = /%Lh/sieve sieve_global_dir = /var/vmail/sieve sieve_global_path = /var/vmail/sieve/dovecot.sieve } protocols = pop3 imap sieve service auth { unix_listener /var/spool/postfix/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { process_limit = 500 service_count = 1 } service pop3-login { service_count = 1 } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/pki/tls/certs/iRedMail_CA.pem ssl_key = </etc/pki/tls/private/iRedMail.key userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/sieve.log mail_plugins = quota sieve autocreate postmaster_address = root } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota autocreate } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } For my postfix/main.cf I have this relevant setting: smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, check_policy_service inet:127.0.0.1:12340, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

2 2

Re: [Dovecot] Error "Initializing mail storage ..." after upgrading to 2.2.10
by Joseph Tam 27 Feb '14

27 Feb '14

G?tz Reinicke - IT Koordinator <goetz.reinicke(a)filmakademie.de> wrote: > But on one mailbox I do get an error: > > Error: user rechnnugseingang-animationsinstitut: Initialization failed: > Initializing mail storage from mail_location setting failed > > Error: Invalid user settings. Refer to server log for more information. And the server logs says ...? Maybe the '-' is not one of the allowed characters (is there a missing 'e' at the end?) Joseph Tam <jtam.home(a)gmail.com>

2 1

[Dovecot] dsync mirror to mailstores in director setup
by Murray Trainer 27 Feb '14

27 Feb '14

Hi All, I have dsync mirror command working between a standalone dovecot server and a backend mailstore in a Dovecot Director setup. Is it safe to do the dsync directly to the backend mailstore in this setup? It doesn't seem to work via the director proxy. Thanks Murray

1 0

Re: [Dovecot] Removing Mount Points
by Jeff Geiger 26 Feb '14

26 Feb '14

That's exactly where I pulled that information from. Are you saying that my assumption is correct and I can run that without ending the world as I know it? :) Thanks! Jeff Geiger jeff.geiger(a)firespring.com On Wed, Feb 26, 2014 at 1:03 AM, Steffen Kaiser < skdovecot(a)smail.inf.fh-brs.de> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > On Tue, 25 Feb 2014, Jeff Geiger wrote: > > dsync(sales(a)foo.com): Error: Couldn't create index dir >> /mnt/ssd/indexes/6/a/ >> sales(a)foo.com/mailboxes: Can't create mailbox root dir >> /mnt/ssd/indexes/6/a/ >> sales(a)foo.com/mailboxes: Mountpoint /mnt/ssd isn't mounted. Mount it or >> remove it with doveadm mount remove >> >> Would doing a `doveadm mount remove /mnt/ssd` fix my issue, or cause some >> type of catastrophe? >> > > ;-) http://wiki2.dovecot.org/Tools/Doveadm/Mount > > - -- Steffen Kaiser > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.11 (GNU/Linux) > > iQEVAwUBUw2R3XD1/YhP6VMHAQLoRQf+LBey9f2o1+MLRSgJB+Sptp0aC746kAz6 > 8cddo6qfNGMogQ7ilfflqCpm1YA/iD29d+8/TL10616cDKZ0Tb1a4M+w8pNnImUa > ViUSBlf59QA6k9b7dshB6f191NPmFT5/lHusDZJywDcS1kal+D/lIsOPToy+Hfon > zkEslqh3Gksjj60yYrBbOBw0a2lesy7eSYunBcabTfumwFHJofWSlWuvQdxfBXKW > IMQ4yzKL1bv+UgfnJpfo6qzReV++sKS9IehGEygqEU7gCE/jhRZyZIICfXRqQAnC > 0jrboJwtfDdY7BX7LrjhaFYtQNCgNF3VqTPnHbyH+eT2KhlLkgMMMA== > =xo3d > -----END PGP SIGNATURE----- >

2 1

[Dovecot] 2 users database on same LDAP with different mail location
by Francesco 26 Feb '14

26 Feb '14

Hello, i know i know, i'm getting annoying but appearently i always come up with weird ideas and i cant seem to accomplish such a task. the scenario is that i have an LDAP server with a bunch of users. some of them are in a specific OU, and i'd like to define for all these users belonging to this OU an alternative mail location/storage. in details for all the users i'd like to use maildir storage in a directory, while for the users belonging to a specific OU i'd like to use dbox with an alternative storage attached. so i created 2 userdb like this: userdb { driver = ldap args = /etc/dovecot/dovecot-ldap-maildir.conf.ext } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap-dbox.conf.ext } and then defined these 2 args files: maildir: hosts = localhost dn = CN=ldapadmin,OU=administrators,DC=plutone,DC=local dnpass = <password> auth_bind = yes ldap_version = 3 base = DC=plutone,DC=local user_attrs = sAMAccountName=home=/var/vmail/%$ dbox: hosts = localhost dn = CN=ldapadmin,OU=administrators,DC=plutone,DC=local dnpass = <password> auth_bind = yes ldap_version = 3 base = OU=dboxusers,OU=lowpriority,DC=plutone,DC=local user_attrs = sAMAccountName=home=/var/local_dbox/%$, =mail=dbox:/var/local_dbox/%$:ALT=/var/iscsi_dbox/%$ user_filter = (&(ObjectClass=person)(mail=%u)) yet it doesn't matter how hard i try if i send an email to a user belonging to the dboxusers OU i still have the user to be addressed to the maildir storage in /var/vmail am i missing something? Thanks Francesco

4 7

[Dovecot] Dovecot upgrade 1 to 2 on Debian Squeeze : broken /var/run/dovecot
by Si L 26 Feb '14

26 Feb '14

Hi, I just upgraded from version 1 to version on Debian Squeeze using their backports. Like I expected my dovecot1 config had to be converted using doveconf and this I did. However, I see problems with files inside directory: drwxr-xr-x 4 dovenull root 4096 Feb 25 20:35 /var/run/dovecot All of them were created owned by root:root rw. I tried to changed, for example : chown postfix:dovecot /var/run/dovecot/auth-master but noticed when I restarted dovecot it reset the permissions back to root:root rw. Here's the version: # dovecot --version 2.1.7 Here's my slightly redacted conf. # grep -v ^# dovecot.conf|grep -v ^$ auth_mechanisms = plain login auth_verbose = yes dict { quotadict = mysql:/etc/dovecot/dovecot-dict-quota.conf } disable_plaintext_auth = no first_valid_uid = 106 log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/var/xx/%d/%u/ mail_plugins = quota mail_privileged_group = mail maildir_very_dirty_syncs = yes passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } plugin { quota_rule = *:storage=262144:messages=20000 quota_rule2 = Trash:storage=282144:messages=23000 } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } user = root } service imap-login { chroot = login inet_listener imap { address = 127.0.0.1 port = 3993 } inet_listener imaps { address = * port = 993 } process_limit = 256 process_min_avail = 24 service_count = 1 vsz_limit = 48 M } service pop3-login { chroot = login process_limit = 256 process_min_avail = 24 service_count = 1 vsz_limit = 48 M } ssl = required ssl_ca = </etc/ssl/certs/xxx.combined_for_dovecot.pem ssl_cert = </etc/ssl/private/xx.xx.xx.crt ssl_cipher_list = TLSv1+HIGH:!SSLv2:RC4+MEDIUM:!aNULL:!eNULL:!3DES:@STRENGTH ssl_key = </etc/ssl/private/xx.xx.xx.key ssl_verify_client_cert = yes userdb { args = uid=5000 gid=5000 home=/var/xx/%d/%u allow_all_users=yes driver = static } userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } valid_chroot_dirs = /var/xx protocol imap { mail_max_userip_connections = 96 mail_plugins = quota imap_quota } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master log_path = mail_plugins = sieve quota postmaster_address = xxxx@xxxxx } I really don't understand how I should make this work, and the after I read the docs on dovecot.org and googled I realised I was really lost getting this back up and runing :( I should be really grateful if somebody would give me some advice. Thanks, Soph'

3 6