February 2014 - dovecot

[Dovecot] AUTH_USER variable has invalid value in checkpassword Script
by dovecot.pkoch＠dfgh.net 25 Feb '14

25 Feb '14

Dear dovecot experts: We are using client certificates to authenthicate against a Dovecot server. Our certificates contain a x500UniqueIdentifier. I'm absolutely sure that the value of the x500UniqueIdentifier was stored into the AUTH_USER when I tested my setup last year. This has somehow changed and now AUTH_USER always contains the username. This has fatal consequences as now every owner of a valid certificate can logon as any user. Here are some more details of our setup: We are using a checkpassword-Script that does the following: 1. Read Username and Password from file descriptor 3 2. If (AUTH_CERT=="valid") and (AUTH_USER==Username) then user is authenticated 3 If (AUTH_CERT=="valid") and (AUTH_USER<>Username) then authentication is rejected (User a tries to logon as User B) 4 If (AUTH_CERT<>"valid) we calculate the current OATH value for Usernames TOTP-token and compare that with the provided password. The last step is the reason why we are using a checkpassword script. Our smartphone users cannot use a smartcard but enter a password that was created by an OTP generator, so programming my own checkpassword script was my only option. AUTH_USER contains the username even if the x500UniqueIdentifier from the users certificate does not, so step 2 happens when step 3 should happen. I did the initial testing with Dovecot 2.2.6. At that time we were using both port 143 and 993. We now use Dovecot 2.2.7 and port 993 only. This should not make a difference but I will recompile 2.2.6 right after sending this posting. Kind regards and thank you very much for this wonderful IMAP server Peter Koch current dovecot.conf: --------------------------------------------------------- # Dovecot configuration file default_process_limit = 2048 protocols = imap listen = * base_dir = /var/dovecot/ mail_location = maildir:/mail/%u:LAYOUT=fs ssl_cert = </etc/ssl/certs/imap.crt ssl_key = </etc/ssl/private/imap.key ssl_ca = </etc/ssl/certs/imap-ca.crt ssl_verify_client_cert = yes ssl_cert_username_field = x500UniqueIdentifier service imap-login { inet_listener imap { port = 0 } } service auth { client_limit = 4096 } service anvil { client_limit = 5000 } passdb { driver = checkpassword args = /usr/dovecot/bin/checkpassword } userdb { driver = passwd override_fields = home=/mail/%u } protocol imap { mail_max_userip_connections = 1000 }

1 0

[Dovecot] A question regarding doveadm replicator status
by XarHs 25 Feb '14

25 Feb '14

Hello, I am using Dovecot version 2.2.10. I am quite familiar with ssh replication and I managed to set it up correctly. The only problem I see is that when i run the command: doveadm replicator status I get a wrong "Total number of known users" which is a) is different between the two (2) replicated dovecot servers, i.e. in mail1 I get a total of 21 users and in mail2 I get a total of 20 users (it should be the same, correct?) b) is not matching the total number of users I have in each server (mail1, mail2) which I am also getting when counting the total users with "doveadm" service enabled. (the command doveadm user '*' | wc lists a total of 16 users for both mail1, mail2 servers, which is also the total number of users that exist indeed in the LDAP structure with the doveadm service enabled. Is there any way to reset the value of "Total number of known users"? Do I have to delete a file in /var/run/dovecot or something in order to do it? The only way I tried (not successfully though) to reset it is by executing the command: for i in `doveadm user '*'` ;do doveadm replicator remove $i ; done which does empties all existing users (16), but leaves me with Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 5 in mail1 server and Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 4 in mail2 server, i.e. the value is 5 (21-16) for mail1 and 4 (20-16) for mail2 server. After seeing that I tried to restart dovecot service, which again ended in the following numbers: Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 21 in mail1 server and Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 20 in mail2 server thus their values augmented back to +16, meaning dovecot read succesfully my 16 users. I have not found a way to successfully reset the "Total number of known users" numbers back to the valid 16 users, which is also returned by running the command: doveadm user '*' | wc Why do I have those differences? How is the "Total number of known users" being calculated? What should I do to effectively reset to to the normal value (which in my case is 16)? Thanks in advance.

1 1

[Dovecot] tests with metadata module
by Mihai Badici 25 Feb '14

25 Feb '14

--Repost after subscription as list member --- I made some tests with metadata support in dovecot 2.2.10. Previously I had dovecot 2.2.4 with external metadata plugin who work well. I use dovecot with roundcube and roundcube plugins from kolab project . First, the feature activation was tricky and rather undocumented. I spent about half hour googling, after that I set: imap_metadata = yes and mail_attribute_dict = file:%h/shared_metadata I think you cold put those lines in the 20-imap.conf example file commented; that way will be easy for us to activate. Because I changed the location of shared_metadata, all folders was unannotated . I went in folder manager in roundcube and set folder "calendar" as calendar type and so on. That worked and i have: cat shared_metadata: shared/c4268a04da44bb527c5b0000193e0904/vendor/kolab/folder-type event shared/cd5792367fc9cd5196170000193e0904/vendor/kolab/folder-type event shared/33f55d2e8912195209290000193e0904/vendor/kolab/folder-type event shared/32f55d2e8912195209290000193e0904/vendor/kolab/folder-type contact However, it looks like the metadata is not properly read after. Calendar and Contacts folders don't appear in roundcube. I have this crash in dovecot's log: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x67d81) [0xb7625d81] -> /usr/lib/dovecot/libdovecot.so.0(+0x67e11) [0xb7625e11] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0xb75d6af9] -> dovecot/imap() [0x805d3b2] -> dovecot/imap() [0x805d5bc] -> dovecot/imap() [0x805d6c9] -> dovecot/imap(client_handle_input+0x56) [0x805d836] -> dovecot/imap(client_input+0x72) [0x805dcc2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x38) [0xb7638d98] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x10e) [0xb7639d6e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x48) [0xb7638818] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x28) [0xb75dcb68] -> dovecot/imap(main+0x284) [0x8050f34] -> /lib/libc.so.6(__libc_start_main+0xf5) [0xb743f5a5] -> dovecot/imap() [0x80510a5] Dec 26 09:28:49 imap(mihai.badici): Fatal: master: service(imap): child 4919 killed with signal 6 (core dumps disabled) I logged imap sessions in roundcube and I have: A0003 GETMETADATA "*" (/private/vendor/kolab/folder-type /shared/vendor/kolab/folder-type) On a similar server with the "old" metadata plugin, I have here listed all folders with coresponding annotations. How I can debug further? This is a test server so I can stress it. -- Mihai Bădici http://mihai.badici.ro -----------------------------------------

3 6

[Dovecot] Detail improvement: %c variable
by Hadmut Danisch 25 Feb '14

25 Feb '14

Hi, although dovecot is great and almost exactly solving my problems and fitting my requirements, there is an odd detail that causes me problems: The %c variable. (See http://wiki2.dovecot.org/Variables ) I'm managing an IMAP server for an association, which is connected to an LDAP server. Users can connect in three ways: IMAPS from the internet, IMAP from local acccounts, and IMAP through a Web->IMAP interface, which is protected through additional one-time-passwords. The web gateway is intended to be used from untrusted computers as well, so the IMAP password entered through the Web site must not be the same as the password used on IMAPS. I have solved this problem by using %s%c as part of the LDAP user_filter. When people connect over IMAPS, this becomes imapsecured (%s=imap, %c=secured), while an unencrypted connect becomes imap (%s=imap, %c=) Unfortunately, this works only, if the web interface and the IMAP server are located on different (virtual) machines. But if the web gateway and dovecot are no the /same/ machine, this does not work anymore, since %c becomes "secured" on localhost, even if unencrypted. It causes a lot of trouble and headache. Please add a configuration variable to configure, whether %c should become "secured" for unencrypted traffic on the loopback device (localhost). regards Hadmut

5 9

[Dovecot] realtime backup with LDA?
by Francesco 25 Feb '14

25 Feb '14

Hello everyone, i was reading the dovecot-lda documentation as i'm using LDA as a delivery agent on my current mailserver configuration. I was curious to know if there are some options for having a message to be delivered to a "twin mailbox" upon delivery. this twin mailbox would work as a backup archive for recovering emails in case the user accidentally deletes them. so if i have a user which is alice i would create a second mailbox named backup_alice or whatever respecting a predictable schema and then every mail delivered to alice would also be delivered to backup_alice. do you know if this can be done? have any example? i was also planning to use shared folders + ACLS to have backup_alice accessible as a read only mailbox directly from the alice imap account. thanks in advance Francesco

6 20

[Dovecot] Dovecot hooks
by rhklinux 25 Feb '14

25 Feb '14

Hello people, I am absolute newbie in the world of Dovecot. Before I start learning configuration and plugin writing I want to ensure that what I am trying to do can be done using Dovecot. I want to have a IMAP proxy setup with a module (written by me) that scans email data for some specific content. Any help appriciated. -- View this message in context: http://dovecot.2317879.n4.nabble.com/Dovecot-hooks-tp46887.html Sent from the Dovecot mailing list archive at Nabble.com.

2 2

[Dovecot] Why are ACLs for non-existent mailboxes accepted?
by Boris 25 Feb '14

25 Feb '14

Dovecot 2.2.9-1 accepts SETACL commands that share mailboxes to non-existent mailboxes. There is no error message. Is this intended behavior? I think it's bad because clients present a success message when indeed the intent of the user failed. Typos are hard to catch.

4 6

[Dovecot] dsync, a zero-way synchronisation tool?
by Fabiano Sidler 24 Feb '14

24 Feb '14

Hi folks! I have set up dsync replication with SSH according to http://wiki2.dovecot.org/Replication with the exception of having system users and calling doveadm dsync-server directly from authorized_keys, because the wrapper script posted on the above site is needless (at least in 2.2.10). However, while the two instances connect well to each other, no synchronisation is performed at all, the mailboxes happily remain untouched. I've then temporarily replaced SSH with socat and captured the traffic. Any hints what goes wrong? Unfortunately there are no logs to provide... Greetings, Fabiano

1 1

[Dovecot] Dovecot stopped with "master: Fatal: kevent(): Invalid argument"
by Michael Galapchuk 24 Feb '14

24 Feb '14

Hi, after more than 20 days uptime, Dovecot stopped with the following logged in /var/log/messages: - master: Fatal: kevent(): Invalid argument dovecot -n: # 2.2.10: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.2-RELEASE-p3 amd64 auth_default_realm = xxx.com.ua auth_mechanisms = plain login default_client_limit = 3000 dict { quotadict = mysql:/usr/local/etc/dovecot/dovecot-dict-quota.conf } disable_plaintext_auth = no doveadm_password = xxx doveadm_port = xxx first_valid_gid = 6 first_valid_uid = 26 listen = 10.xx.xx.xx 10.xx.xx.xx login_log_format_elements = user=<%u> method=%m rip=%r %c mail_location = mdbox:~/mdbox mail_plugins = quota mail_log notify replication mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mdbox_rotate_interval = 2 weeks mdbox_rotate_size = 25 M passdb { args = /usr/local/etc/dovecot/dovecot-mysql.conf driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcp:xxx.xxx.com.ua quota = dict:user::proxy::quotadict quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=85%% quota-warning 85 %u replication_full_sync_interval = 12 hours sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 lmtp sieve service aggregator { fifo_listener replication-notify-fifo { user = mailnull } unix_listener replication-notify { user = mailnull } } service dict { unix_listener dict { group = mail mode = 0600 user = mailnull } } service doveadm { inet_listener { port = xxx } } service imap-login { client_limit = 3000 process_min_avail = 8 service_count = 0 vsz_limit = 256 M } service lmtp { executable = lmtp -L group = mail process_min_avail = 5 unix_listener lmtp { mode = 0666 } user = mailnull } service managesieve-login { process_min_avail = 2 service_count = 1 } service managesieve { process_limit = 128 } service pop3-login { process_limit = 1024 process_min_avail = 8 service_count = 1 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh group = mail unix_listener quota-warning { group = mail mode = 0600 user = mailnull } user = mailnull } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = mailnull } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /usr/local/etc/dovecot/dovecot-mysql.conf driver = sql } valid_chroot_dirs = /var/mail verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags mail_plugins = quota mail_log notify replication imap_quota } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes pop3_fast_size_lookups = yes pop3_no_flag_updates = yes pop3_uidl_format = %08Xu%08Xv } protocol lda { info_log_path = /var/log/dovecot/lda.log log_path = /var/log/dovecot/lda_error.log postmaster_address = postmaster(a)xxx.com.ua quota_full_tempfail = no sendmail_path = /usr/local/sbin/exim } protocol lmtp { info_log_path = /var/log/dovecot/deliver.log log_path = /var/log/dovecot/error_lmtp.log postmaster_address = postmaster(a)xxx.com.ua quota_full_tempfail = no sendmail_path = /usr/local/sbin/exim } Best regards, Mike

1 0

[Dovecot] dsync: possible cosmetic bug
by Andrei Dobrotsvetov 23 Feb '14

23 Feb '14

Hello Everyone, I use dovecot2-2.2.10, FreeBSD 9.2-RELEASE. Replication was set up according to: http://wiki2.dovecot.org/Replication, dsync wrapper script is used. It seems that all is worked as desired, but i see the following into log file: doveadm: Error: dsync-remote(XXX@YYY): Info: save: box=INBOX, ... There were no such log records when i tried replication without wrapper script. Best regards, Andrei

2 1