February 2014 - dovecot

[Dovecot] Upgrading from 1.2.x -> 2.2.x in one step possible
by Götz Reinicke - IT Koordinator 26 Feb '14

26 Feb '14

Hi, after some off-ML discussions to and some reconsiderations, we might do the "big jump" from our current 1.2.17 to the atrpms 2.2. From googling and reading the dovecot upgrade wiki I don't see any (big) pitfalls. Basically we use the default config options, mbox, pop3s/imaps on RH EL 5. So "just" run the upgrade-config script, fingers crossed and thats it? Ii it possible to do such a big step form 1.2 to 2.2? Thanks for comments and suggestions . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 82 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

3 2

[Dovecot] Removing Mount Points
by Jeff Geiger 26 Feb '14

26 Feb '14

Dovecot version 2.1.7 If a dovecot mount point (drive) dies, and the data is restored into the same path that's no longer a mount point (subfolder), dovecot complains about a missing mount point. Is it safe to do a `doveadm mount remove {path}` to fix the error since it's no longer a legit mount point? Example: We were storing indexes on an SSD drive mounted at /mnt/ssd. That drive died. I was able to put everything back into the /mnt/ssd folder (no longer mounted, just a folder). Everything seems to be working as expected. But, when I just went to dsync an account from another server to this one, I got the following error: dsync(sales(a)foo.com): Error: Couldn't create index dir /mnt/ssd/indexes/6/a/ sales(a)foo.com/mailboxes: Can't create mailbox root dir /mnt/ssd/indexes/6/a/ sales(a)foo.com/mailboxes: Mountpoint /mnt/ssd isn't mounted. Mount it or remove it with doveadm mount remove Would doing a `doveadm mount remove /mnt/ssd` fix my issue, or cause some type of catastrophe? Thanks, Jeff Geiger jeff.geiger(a)firespring.com

2 1

[Dovecot] Auto-response
by Si L 26 Feb '14

26 Feb '14

Dear Sir, Thank-you for your message. I shall not be reading Yahoo Mail for quite some time. You should presume that your message remains unloved and unread. ** If you know who I am (in other words you are not a Bulk Emailer), then you already know how to contact me either on my _normal_ EMail address, or on the telephone. Yours faithfully.

1 0

Re: [Dovecot] AUTH_USER variable has invalid value in checkpassword Script
by dovecot.pkoch＠dfgh.net 26 Feb '14

26 Feb '14

answering my own questions: > This has somehow changed and now AUTH_USER always > contains the username. This has fatal consequences as no > every owner of a valid certificate can logon as any user. I now use auth_ssl_username_from_cert = yes and this temporarily fixes my problem. Now if user A authenticates with his certificate and claims to be user B he will be logged on as user A. With ssl_username_from_cert = no (default) he was logged in as User B. > I'm absolutely sure that the value of the x500UniqueIdentifier > was stored into the AUTH_USER when I tested my setup > last year. If one looks at the source code, in particular routine env_put_auth_vars() in src/auth/db-checkpassword.c and routine auth_request_get_var_expand_table() in src/auth/auth-request.c it is clear, that this has never worked. The environemnt variable AUTH_USER always contais the username (in all Dovecot versions). It dows NOT contain the Dovecot auth_user-variable. Comparing AUTH_USER with the username makes no sense in a checkpassword-script So here's my next question: How do I find out the original username from within a chackpassword script after it has been replaced by the x500UniqueIdentifier value from a client certificate? Why is request->requested_login_user == NULL in env_put_auth_vars(). request->user contains the x500UniqueIdentifier value from the clients certificate so the original username was replaced and therefore should have been moved into request->requested_login_user. Kind regards Peter Koch

1 0

[Dovecot] Oldies but Goldies - Dovecot 1.2 and Sieve
by Götz Reinicke - IT Koordinator 25 Feb '14

25 Feb '14

Hi, we still run dovecot 1.2.17 and upgrading is not planed for some time. But I'm asked to install a sieve system to be used with SOGo soon. What do I have to install / configure? Is installing/configuring the dovecot-sieve-0.1.19 and dovecot-managesieve-0.11.13 enough? We still use mostly the default settings for imaps/pop3s. And of course configure SOGo. Thanks for any feedback. Regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 82 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

4 3

Re: [Dovecot] Error - zlib & fts
by Daniel L. Miller 25 Feb '14

25 Feb '14

On 2/25/2014 10:50 AM, Daniel L. Miller wrote: > Just upgraded to a new Solr, so I did a full re-index. Saw some of > these friendly messages: > > doveadm(csmith(a)amfes.com): Error: > zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): gz trailer > has wrong CRC value at 28579617 > doveadm(csmith(a)amfes.com): Error: > read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: > Invalid argument > doveadm(csmith(a)amfes.com): Error: > read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: > Invalid argument (uid=5251) > Also some of these: doveadm(csmith(a)amfes.com): Error: zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): missing gz header at 27877205 Running 2.2.12. -- Daniel

1 0

[Dovecot] Error - zlib & fts
by Daniel L. Miller 25 Feb '14

25 Feb '14

Just upgraded to a new Solr, so I did a full re-index. Saw some of these friendly messages: doveadm(csmith(a)amfes.com): Error: zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): gz trailer has wrong CRC value at 28579617 doveadm(csmith(a)amfes.com): Error: read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: Invalid argument doveadm(csmith(a)amfes.com): Error: read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: Invalid argument (uid=5251) -- Daniel

1 0

[Dovecot] AUTH_USER variable has invalid value in checkpassword Script
by dovecot.pkoch＠dfgh.net 25 Feb '14

25 Feb '14

Dear dovecot experts: We are using client certificates to authenthicate against a Dovecot server. Our certificates contain a x500UniqueIdentifier. I'm absolutely sure that the value of the x500UniqueIdentifier was stored into the AUTH_USER when I tested my setup last year. This has somehow changed and now AUTH_USER always contains the username. This has fatal consequences as now every owner of a valid certificate can logon as any user. Here are some more details of our setup: We are using a checkpassword-Script that does the following: 1. Read Username and Password from file descriptor 3 2. If (AUTH_CERT=="valid") and (AUTH_USER==Username) then user is authenticated 3 If (AUTH_CERT=="valid") and (AUTH_USER<>Username) then authentication is rejected (User a tries to logon as User B) 4 If (AUTH_CERT<>"valid) we calculate the current OATH value for Usernames TOTP-token and compare that with the provided password. The last step is the reason why we are using a checkpassword script. Our smartphone users cannot use a smartcard but enter a password that was created by an OTP generator, so programming my own checkpassword script was my only option. AUTH_USER contains the username even if the x500UniqueIdentifier from the users certificate does not, so step 2 happens when step 3 should happen. I did the initial testing with Dovecot 2.2.6. At that time we were using both port 143 and 993. We now use Dovecot 2.2.7 and port 993 only. This should not make a difference but I will recompile 2.2.6 right after sending this posting. Kind regards and thank you very much for this wonderful IMAP server Peter Koch current dovecot.conf: --------------------------------------------------------- # Dovecot configuration file default_process_limit = 2048 protocols = imap listen = * base_dir = /var/dovecot/ mail_location = maildir:/mail/%u:LAYOUT=fs ssl_cert = </etc/ssl/certs/imap.crt ssl_key = </etc/ssl/private/imap.key ssl_ca = </etc/ssl/certs/imap-ca.crt ssl_verify_client_cert = yes ssl_cert_username_field = x500UniqueIdentifier service imap-login { inet_listener imap { port = 0 } } service auth { client_limit = 4096 } service anvil { client_limit = 5000 } passdb { driver = checkpassword args = /usr/dovecot/bin/checkpassword } userdb { driver = passwd override_fields = home=/mail/%u } protocol imap { mail_max_userip_connections = 1000 }

1 0

[Dovecot] A question regarding doveadm replicator status
by XarHs 25 Feb '14

25 Feb '14

Hello, I am using Dovecot version 2.2.10. I am quite familiar with ssh replication and I managed to set it up correctly. The only problem I see is that when i run the command: doveadm replicator status I get a wrong "Total number of known users" which is a) is different between the two (2) replicated dovecot servers, i.e. in mail1 I get a total of 21 users and in mail2 I get a total of 20 users (it should be the same, correct?) b) is not matching the total number of users I have in each server (mail1, mail2) which I am also getting when counting the total users with "doveadm" service enabled. (the command doveadm user '*' | wc lists a total of 16 users for both mail1, mail2 servers, which is also the total number of users that exist indeed in the LDAP structure with the doveadm service enabled. Is there any way to reset the value of "Total number of known users"? Do I have to delete a file in /var/run/dovecot or something in order to do it? The only way I tried (not successfully though) to reset it is by executing the command: for i in `doveadm user '*'` ;do doveadm replicator remove $i ; done which does empties all existing users (16), but leaves me with Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 5 in mail1 server and Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 4 in mail2 server, i.e. the value is 5 (21-16) for mail1 and 4 (20-16) for mail2 server. After seeing that I tried to restart dovecot service, which again ended in the following numbers: Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 21 in mail1 server and Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 20 in mail2 server thus their values augmented back to +16, meaning dovecot read succesfully my 16 users. I have not found a way to successfully reset the "Total number of known users" numbers back to the valid 16 users, which is also returned by running the command: doveadm user '*' | wc Why do I have those differences? How is the "Total number of known users" being calculated? What should I do to effectively reset to to the normal value (which in my case is 16)? Thanks in advance.

1 1

[Dovecot] tests with metadata module
by Mihai Badici 25 Feb '14

25 Feb '14

--Repost after subscription as list member --- I made some tests with metadata support in dovecot 2.2.10. Previously I had dovecot 2.2.4 with external metadata plugin who work well. I use dovecot with roundcube and roundcube plugins from kolab project . First, the feature activation was tricky and rather undocumented. I spent about half hour googling, after that I set: imap_metadata = yes and mail_attribute_dict = file:%h/shared_metadata I think you cold put those lines in the 20-imap.conf example file commented; that way will be easy for us to activate. Because I changed the location of shared_metadata, all folders was unannotated . I went in folder manager in roundcube and set folder "calendar" as calendar type and so on. That worked and i have: cat shared_metadata: shared/c4268a04da44bb527c5b0000193e0904/vendor/kolab/folder-type event shared/cd5792367fc9cd5196170000193e0904/vendor/kolab/folder-type event shared/33f55d2e8912195209290000193e0904/vendor/kolab/folder-type event shared/32f55d2e8912195209290000193e0904/vendor/kolab/folder-type contact However, it looks like the metadata is not properly read after. Calendar and Contacts folders don't appear in roundcube. I have this crash in dovecot's log: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x67d81) [0xb7625d81] -> /usr/lib/dovecot/libdovecot.so.0(+0x67e11) [0xb7625e11] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0xb75d6af9] -> dovecot/imap() [0x805d3b2] -> dovecot/imap() [0x805d5bc] -> dovecot/imap() [0x805d6c9] -> dovecot/imap(client_handle_input+0x56) [0x805d836] -> dovecot/imap(client_input+0x72) [0x805dcc2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x38) [0xb7638d98] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x10e) [0xb7639d6e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x48) [0xb7638818] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x28) [0xb75dcb68] -> dovecot/imap(main+0x284) [0x8050f34] -> /lib/libc.so.6(__libc_start_main+0xf5) [0xb743f5a5] -> dovecot/imap() [0x80510a5] Dec 26 09:28:49 imap(mihai.badici): Fatal: master: service(imap): child 4919 killed with signal 6 (core dumps disabled) I logged imap sessions in roundcube and I have: A0003 GETMETADATA "*" (/private/vendor/kolab/folder-type /shared/vendor/kolab/folder-type) On a similar server with the "old" metadata plugin, I have here listed all folders with coresponding annotations. How I can debug further? This is a test server so I can stress it. -- Mihai Bădici http://mihai.badici.ro -----------------------------------------

3 6