May 2014 - dovecot - dovecot.org

[Dovecot] Dovecot ontop of glusterfs issue.
by Eliezer Croitoru 23 May '14

23 May '14

Hey, I am testing Glusterfs as a storage backend for dovecot as a LDA and imap server. I have seen similar lines in the logs to these: May 21 10:46:01 mailgw dovecot: imap(eliezer(a)ngtech.co.il): Warning: Created dotlock file's timestamp is different than current time (1400658105 vs 1400658361): /home/vmail/ngtech.co.il/eliezer/Maildir/.Mailing_lists.ceph_users/dovecot-uidlist May 21 10:46:01 mailgw dovecot: imap(eliezer(a)ngtech.co.il): Error: Transaction log /home/vmail/ngtech.co.il/eliezer/Maildir/dovecot.index.log: duplicate transaction log sequence (2713) The volume is mounted only by one server with ubutntu 14.04. I have seen threads and posts about similar issue with nfs. I want to try to debug the issue but note that with the same settings of the server nfs worked fine but slower. dovecot -n output: http://pastebin.centos.org/9626/ The glusterfs is a replicated volume constructed of two bricks which is mounted only on one dovecot server. All three servers are using the same ntp pool and are synced. Any direction is better then the state I am now. Thanks, Eliezer

4 6

[Dovecot] director with same director / backend servers
by Will Yardley 23 May '14

23 May '14

I know this has been covered somewhat, but I'm still not totally clear. I'm trying to setup a 3 node cluster with 3 directors and 3 backend systems. This post (from 2012) suggests that proxy_maybe should work with director: http://www.dovecot.org/list/dovecot/2012-December/069806.html However, these two posts (from 2013) seem to say that it will not: http://dovecot.org/pipermail/dovecot/2013-November/093776.html http://dovecot.org/pipermail/dovecot/2013-November/093809.html When I try to just set =proxy_maybe=y in my LDAP config's pass_attrs, and not have an explicit 'director' listener for pop3-login / imap-login, it complains about lack of a host. May 22 14:28:08 XXXX dovecot: pop3-login: Error: proxy: host not given: user=<XXXXXXX>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Guessing the answer is "no", but is there any way (with v 2.x) to have one regular "listener" for imap / pop3, and one "director" listener for each as well, using the same instance of Dovecot? Has anyone gotten this to work successfully? I'm using LDAP, and do not want to explicitly specify a host for each username, I just want director to balance users across the 3 hosts. Obviously, I can just create two instances, but not only does this make the config more convoluted (especially following the convention of having the config files broken out into a bunch of files), but means I have to modify the default init script to really do it cleanly (something we were doing on the older iteration of this system that I had really been hoping to avoid). I'm assuming it's not possible to simply have the listeners for 'foo-login' execute something different depending on the port? I tried a couple different ways of configuring this, but it didn't seem to work. Dovecot is version 2.0.9 from RHEL 6. w

1 0

[Dovecot] Dovecot pam
by Tommy Berglund 22 May '14

22 May '14

Hello! How can I disable passdb { driver = pam } in /etc/dovecot/conf.d/auth-system.conf.ext from file /etc/dovecot/local.conf. I have postfix and dovecot set up to only use virtual users. I'd rather do all the configuration in local.conf if possible. My doveconf-n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-24-generic x86_64 Ubuntu 14.04 LTS auth_failure_delay = 5 secs auth_mechanisms = plain login cram-md5 listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " mail_home = /var/vmail/%d/%n mail_location = mdbox:~/ managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = scheme=cram-md5 /etc/dovecot/passwd driver = passwd-file } plugin { sieve = /vmail/%d/%n/.dovecot.sieve sieve_dir = /vmail/%d/%n/sieve sieve_global_path = /vmail/dovecot/sieve/default.sieve } protocols = imap lmtp sieve service auth { executable = /usr/lib/dovecot/auth unix_listener /var/spool/postfix/private/auth-client { group = postfix mode = 0660 user = postfix } user = root } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { driver = passwd } userdb { args = /etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = sieve postmaster_address = postmaster@localhost } Best regards

2 2

[Dovecot] When the subject portion of an e-mail contains a control character, dovecot.sieve terminates unexpectatedly.
by Atsuko Tanaka 22 May '14

22 May '14

Hello. We have currently set dovecot.sieve to insert the text "[SPAM]" at the beginning of an e-mail's subject when it's X-Spam-Score is above 80%. After we set our system as stated the following errors occur: 1) When an e-mail's subject contains control characters like [Ctrl+V|^V], dovecot.sieve terminates with an error and an e-mail is not able to be sent. When a MIME encoded Subject like [ＴＥＳＴ^VＭＡＩＬ] is sent we're not able to edit the subject and dovecot ends with an error. This is a sample of the data that was used in testing. Subject: =?ISO-2022-JP?B?GyRCI1QjRSNTI1QbKEIWGyRCI00jQSNJI0wbKEI=?= X-Spam-Score: 100.00% ↓ Subject: =?ISO-2022-JP?B?GyRCI1QjRSNTI1QbKEIWGyRCI00jQSNJI0wbKEI=?= X-Spam-Score: 100.00% This is the log generated by the data above. ---------------------------------------------------------------------- sieve: info: started log at May 02 10:46:22. main script: line 14: error: addheader action: specified value `[SPAM] ＴＥＳＴ?・・' is invalid. ---------------------------------------------------------------------- Aside from [Ctrl + V] the following control charcters also cause errors: backspace Ctrl + A Ctrl + C Ctrl + [ Ctrl + X Ctrl + Y 2) When an e-mail's subject line contains a "\0" character, everything following the null character is deleted. When a MIME encoded Subject is sent, for example "ＴＥＳＴ\0ＭＡＩＬ", the subject becomes "[SPAM]ＴＥＳＴ", the characters after the NULL character are deleted and dovecot.sieve ends normally. This is a sample of the data that we collected. Subject: =?ISO-2022-JP?B?GyRCI1QjRSNTI1QbKEIAGyRCI00jQSNJI0wbKEI=?= X-Spam-Score: 100.00% ↓ Subject: [SPAM] =?utf-8?b?77y077yl77yz77y0?= X-Spam-Score: 100.00% -Environment ・OS CentOS release 6.5 (Final) x86_64 ・Software Version dovecot-2.2.12 dovecot-2.2-pigeonhole-0.4.2 ・Results from the "dovecot -n" command. ---------------------------------------------------------------------- # 2.2.12: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.5.1.el6.x86_64 x86_64 CentOS release 6.5 (Final) disable_plaintext_auth = no lock_method = dotlock mail_fsync = always mail_gid = vmail mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = quota mail_temp_dir = /var/tmp mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave spamtest spamtestplus editheader mbox_write_locks = dotlock mmap_disable = yes passdb { driver = passwd } plugin { quota = maildir:User quota sieve = ~/Maildir/dovecot.sieve sieve_dir = ~/Maildir/sieve sieve_editheader_max_header_size = 1k sieve_editheader_protected = X-Verified sieve_extensions = +editheader +spamtest +spamtestplus sieve_max_actions = 250 sieve_max_redirects = 100 sieve_spamtest_max_value = 100.00 sieve_spamtest_status_header = X-Spam-Score: ([[:digit:]]+\.[[:digit:]]+)% sieve_spamtest_status_type = score sieve_user_log = /var/log/dovecot.sieve/%d/%u.log } postmaster_address = postmaster(a)example.jp protocols = pop3 imap service auth { unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } ssl_ca = </etc/pki/tls/certs/CA.crt ssl_cert = </etc/pki/tls/certs/example.jp.crt ssl_key = </etc/pki/tls/private/example.jp.key submission_host = 127.0.0.1:20025 userdb { args = /etc/dovecot/ldap/userdb.conf.ext driver = ldap } protocol lda { mail_plugins = quota sieve } protocol imap { mail_plugins = quota imap_quota passdb { args = /etc/dovecot/ldap/passdb.conf.ext driver = ldap } } protocol pop3 { passdb { args = /etc/dovecot/ldap/passdb.conf.ext driver = ldap } } ---------------------------------------------------------------------- -Contents of the "dovecot.sieve" file user/Maildir/dovecot.sieve ---------------------------------------------------------------------- require "fileinto"; require "mailbox"; require "envelope"; require "variables"; require "editheader"; require "spamtestplus"; require "relational"; require "enotify"; require "comparator-i;ascii-numeric"; if spamtest :percent :value "ge" :comparator "i;ascii-numeric" "80" { if exists "subject" { deleteheader :matches "subject" "*"; addheader "Subject" "[SPAM] ${1}"; } else { addheader "Subject" "[SPAM]"; } } ---------------------------------------------------------------------- Please reply. Thank you. -- ---------------------------------------- Atsuko Tanaka DesigNET Inc. e-mail：tanaka(a)designet.co.jp ----------------------------------------

4 5

[Dovecot] Sieve fileinto extension and redirect action
by FUSTE Emmanuel 21 May '14

21 May '14

Hello, Is there any way to limit the use of the "redirect" action (local user only or silent ignore) as provisioned by the RFC in the Pigeonhole implementation ? The only way I found for the moment is to completely disable the fileinto extension which hardly beat the users experience. "redirect" is forbidden by my organization policy. Regards, Emmanuel.

3 3

[Dovecot] LMTP hostname ignoring ENV variables
by G H 21 May '14

21 May '14

I am having an issue with LMTP appending the local hostname to received mail from Postfix. I either want to append localhost, a custom string, or nothing at all. Looking through the source code, I believe I should be able to set "export DOVECOT_HOSTNAME" and "export DOVECOT_HOSTDOMAIN" in my initscript to override the hostname set in lmtp/commands.c, client_get_added_headers() I'm using Centos 5; my hostname is mailtest1.atest.qq -- it is not defined in /etc/hosts. The added header is below: Received: from mail.mailorxyz.de by mailtest1.atest.qq (Dovecot) with LMTP id sreUK1+sfFOseQAAPYI4hw for <admin(a)mailorxyz.de>; Wed, 21 May 2014 13:39:03 +0000 Received: by mail.mailorxyz.de (Postfix, from userid 97) id CC743116AB5; Wed, 21 May 2014 13:39:03 +0000 (UTC) I have the following defined in /etc/init.d/dovecot: export DOVECOT_HOSTDOMAIN=dovecot.mailorxyz.de export DOVECOT_HOSTNAME=dovecot.mailorxyz.de Am I missing something or did I misunderstand the source code? Thanks.

2 1

Re: [Dovecot] Per-user Sieve script location question
by Selcuk Yazar 21 May '14

21 May '14

Hi Again, we have one domain, i suppose we don't have any problem with %n parameter. our mail server has mapped LUN Storage disk , we have some empty space problems, so i think it's better keep user things in storage for backup etc. we have totally 40K users(most of students) but i think at most 50 of them use this filter, autorespond etc. :) thank you for your reply. Selçuk On Wed, May 21, 2014 at 3:15 PM, Steffen Kaiser < skdovecot(a)smail.inf.fh-brs.de> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Wed, 21 May 2014, Selcuk Yazar wrote: > > Hi Selcuk, > > > i changed my 90-sieve.conf >> >> to >> >> sieve = /var/sieve-scripts/%u.sieve >> sieve_dir = /home/vmail/domains/sieve/%n/.sieve >> > > Yeah, looks good. However, do you host multiple domains? In your config > you differ domains: > > mail_location = mbox:/home/vmail/domains/%d/%u > > with sieve = /var/sieve-scripts/%u.sieve , too, but > with sieve_dir = /home/vmail/domains/sieve/%n/.sieve you do not. > > http://wiki2.dovecot.org/Variables > %u user full username (e.g. user@domain) > %n username user part in user@domain, same as %u if there's no domain > %d domain domain part in user@domain, empty if user with no domain > > I suppose, you should use: > > sieve_dir = /home/vmail/domains/sieve/%u/.sieve > > otherwise info(a)example.org and info@localhost share the same Sieve dir. > > BTW: Because you have an unique directory per user now anyway, why not use > is that as home directory? I'm not sure, what other things use the home > for. E.g. use > > mail_home = /home/vmail/domains/home/%d/%u > > and keep the home-relative paths for Sieve: ~/... > > > On Wed, May 21, 2014 at 12:10 PM, Steffen Kaiser < >> skdovecot(a)smail.inf.fh-brs.de> wrote: >> >> -----BEGIN PGP SIGNED MESSAGE----- >>> Hash: SHA1 >>> >>> On Wed, 21 May 2014, Selcuk Yazar wrote: >>> >>> my dovecot conf is >>> >>>> >>>> doveconf -n >>>> # 2.0.9: /etc/dovecot/dovecot.conf >>>> >>>> [...] >>> >>> mail_location = mbox:/home/vmail/domains/%d/%u >>>> >>>> [...] >>> >>> userdb { >>>> args = /etc/dovecot/conf.d/dovecot-ldap.conf.ext >>>> driver = ldap >>>> } >>>> >>>> you're right we have mail_location , >>>> >>>> should i add mail_home value >>>> >>>> >>> That depends on if your LDAP configuration contains a (for the mailserver >>> usable) home for the individual user. >>> >>> mail_home = /home/vmail/domains/%d/%u >>> >>>> >>>> >>> The value shows that you did not followed my advice from the last >>> response: "Read the link above about why not store Sieve files below an >>> user's mail location." maybe because you missed it because you toppost. >>> >>> to 10-mail.conf file ? >>> >>>> >>>> >>> never use the same dir for mail location and user's home. >>> >>> >>> On Wed, May 21, 2014 at 11:43 AM, Steffen Kaiser < >>> >>>> skdovecot(a)smail.inf.fh-brs.de> wrote: >>>> >>>> -----BEGIN PGP SIGNED MESSAGE----- >>>> >>>>> >>>>> >>>> On Wed, 21 May 2014, Selcuk Yazar wrote: >>> >>>> >>>>> our users stored OpenLdap and users home folder like below: >>>>> >>>>> >>>>>> >>>>>> without seeing your current doveconf -n output and the ldap >>>>> configuration >>>>> file, I would guess that your users have no home directory: >>>>> http://wiki2.dovecot.org/VirtualUsers/Home >>>>> >>>>> >>>>> >>>>> /home/vmail/domains/domainname.edu.tr/username/... >>>>> >>>>>> >>>>>> now when i used default settings for dovecot sieve >>>>>> >>>>>> sieve = ~/.dovecot.sieve >>>>>> sieve_dir = ~/sieve >>>>>> >>>>>> sieve script write and work globaly and stored, >>>>>> /home/vmail/domains/sieve >>>>>> >>>>>> i looked up Dovecot docs for per user but i don't understand clearly >>>>>> >>>>>> can i replace sieve parameters like >>>>>> >>>>>> sieve = /home/vmail/domains/..................edu.tr/%n/.dovecot. >>>>>> sieve >>>>>> sieve_dir = /home/vmail/domains/.........................edu.tr/%n/. >>>>>> sieve >>>>>> >>>>>> for per user scirpt. >>>>>> >>>>>> >>>>>> Read the link above about why not store Sieve files below an user's >>>>> mail >>>>> location. >>>>> >>>>> >>>> - -- Steffen Kaiser >>> -----BEGIN PGP SIGNATURE----- >>> Version: GnuPG v1.4.11 (GNU/Linux) >>> >>> iQEVAwUBU3xtn3z1H7kL/d9rAQIu1wf/XMXuEC1O1PQssoU1uHfTM5jOHpH1KHis >>> yUL1z2/WV8c7engx+CNtGPxnRewC1UFKBZcHaAyXHNxQM+jsYf+NkUo4PDlKkzfi >>> /JIn+SGOlwZKJUYarnAJbt0CdZG7f8auvMLsoovR8iNitSAdyH5AkRt9i25YFndW >>> Nm0lYO1CPJzKp3CVhDS0Lxs6sSD21xsMvuauzMmS4ZpYhXXEdOf4jqNkIYdJbSHz >>> nBHx8sjlJaKNKO3OWs1S5T7DxlRz+VYGw1IZ1BUgpBBD3LxDIOwTLG7NNjWRG2lB >>> nTB+WK02fvh0T+oJORVuKmgoXG5WKvZjFOa4oVqdbbzM6V4ZJSx9Sw== >>> =bLQp >>> -----END PGP SIGNATURE----- >>> >>> >> >> >> >> > - -- Steffen Kaiser > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.11 (GNU/Linux) > > iQEVAwUBU3yY9Hz1H7kL/d9rAQIIpwf/bfNNbI3zCEuJs3xYq5Nl+Td2QGX0uUzk > 8PA4taMNrq00W3jBtTi8J4/ZlqT+l15r5nDr6O/VSgffymi9l0JmRMRIfUyzfjBy > IThSQTrbjx9t+gCJa15Q2JISYEhXC0WYDpseEZle5vFyIKxWT01FYH5cJe45n9ci > LcY3QmCdrQ4JYuYPiECfOx5rFw7dvZBnS4YDLg/A/O3dUzx7BV6V+cSepAecpoom > 4U5udqoWRF1pDgKywn0elB0WorEbgnyOHLSrd5uPOuQuP9aW2bcWJGSpr1/j5tQk > tOYd/czhNhpPEKbzH/MJyn6mbhu4F3DGMAfuD9tweIAD25A41HgVpQ== > =6w4r > -----END PGP SIGNATURE----- > -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

1 0

Re: [Dovecot] Per-user Sieve script location question
by Selcuk Yazar 21 May '14

21 May '14

Hi, Steffen i changed my 90-sieve.conf to sieve = /var/sieve-scripts/%u.sieve sieve_dir = /home/vmail/domains/sieve/%n/.sieve and it works. thank you. On Wed, May 21, 2014 at 12:10 PM, Steffen Kaiser < skdovecot(a)smail.inf.fh-brs.de> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Wed, 21 May 2014, Selcuk Yazar wrote: > > my dovecot conf is >> >> doveconf -n >> # 2.0.9: /etc/dovecot/dovecot.conf >> > [...] > >> mail_location = mbox:/home/vmail/domains/%d/%u >> > [...] > >> userdb { >> args = /etc/dovecot/conf.d/dovecot-ldap.conf.ext >> driver = ldap >> } >> >> you're right we have mail_location , >> >> should i add mail_home value >> > > That depends on if your LDAP configuration contains a (for the mailserver > usable) home for the individual user. > > mail_home = /home/vmail/domains/%d/%u >> > > The value shows that you did not followed my advice from the last > response: "Read the link above about why not store Sieve files below an > user's mail location." maybe because you missed it because you toppost. > > to 10-mail.conf file ? >> > > never use the same dir for mail location and user's home. > > > On Wed, May 21, 2014 at 11:43 AM, Steffen Kaiser < >> skdovecot(a)smail.inf.fh-brs.de> wrote: >> >> -----BEGIN PGP SIGNED MESSAGE----- >>> >> > On Wed, 21 May 2014, Selcuk Yazar wrote: >>> >>> our users stored OpenLdap and users home folder like below: >>> >>>> >>>> >>> without seeing your current doveconf -n output and the ldap configuration >>> file, I would guess that your users have no home directory: >>> http://wiki2.dovecot.org/VirtualUsers/Home >>> >>> >>> >>> /home/vmail/domains/domainname.edu.tr/username/... >>>> >>>> now when i used default settings for dovecot sieve >>>> >>>> sieve = ~/.dovecot.sieve >>>> sieve_dir = ~/sieve >>>> >>>> sieve script write and work globaly and stored, >>>> /home/vmail/domains/sieve >>>> >>>> i looked up Dovecot docs for per user but i don't understand clearly >>>> >>>> can i replace sieve parameters like >>>> >>>> sieve = /home/vmail/domains/..................edu.tr/%n/.dovecot.sieve >>>> sieve_dir = /home/vmail/domains/.........................edu.tr/%n/. >>>> sieve >>>> >>>> for per user scirpt. >>>> >>>> >>> Read the link above about why not store Sieve files below an user's mail >>> location. >>> >> > - -- Steffen Kaiser > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.11 (GNU/Linux) > > iQEVAwUBU3xtn3z1H7kL/d9rAQIu1wf/XMXuEC1O1PQssoU1uHfTM5jOHpH1KHis > yUL1z2/WV8c7engx+CNtGPxnRewC1UFKBZcHaAyXHNxQM+jsYf+NkUo4PDlKkzfi > /JIn+SGOlwZKJUYarnAJbt0CdZG7f8auvMLsoovR8iNitSAdyH5AkRt9i25YFndW > Nm0lYO1CPJzKp3CVhDS0Lxs6sSD21xsMvuauzMmS4ZpYhXXEdOf4jqNkIYdJbSHz > nBHx8sjlJaKNKO3OWs1S5T7DxlRz+VYGw1IZ1BUgpBBD3LxDIOwTLG7NNjWRG2lB > nTB+WK02fvh0T+oJORVuKmgoXG5WKvZjFOa4oVqdbbzM6V4ZJSx9Sw== > =bLQp > -----END PGP SIGNATURE----- > -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

2 1

[Dovecot] dovecot auth ldap attributes - unused?
by Maciej Uhlig 21 May '14

21 May '14

Please explain the following dovecot (2.2.13) behaviour: I run dovecot in ldap auth debug mode and log file excerpt follows: 2014-05-21T08:22:01+02:00 dovecot/ip dovecot: auth: Debug: ldap(user@domain,pcip,<bdKvA+P5HQCbnmFI>): bind search: base=o=tree,dc=do,dc=ma,dc=in filter=(&(objectClass=MailAccount)(accountActive=TRUE)(mail=user@domain)) 2014-05-21T08:22:01+02:00 dovecot/ip dovecot: auth: Debug: ldap(user@domain,pcip,<bdKvA+P5HQCbnmFI>): result: mail=user@domain; mail unused 2014-05-21T08:22:01+02:00 dovecot/ip dovecot: auth: Debug: ldap(user@domain,pcip,<bdKvA+P5HQCbnmFI>): result: mail=user@domain 2014-05-21T08:22:01+02:00 dovecot/ip dovecot: auth: Debug: client passdb out: OK 24 user=user@domain 2014-05-21T08:22:01+02:00 dovecot/ip dovecot: auth: Debug: ldap(user@domain,pcip,<bdKvA+P5HQCbnmFI>): user search: base=o=tree,dc=do,dc=ma,dc=in scope=subtree filter=(&(objectClass=MailAccount)(accountActive=TRUE)(mail=user@domain)) fields=mail,quota,mailbox 2014-05-21T08:22:01+02:00 dovecot/ip dovecot: auth: Debug: ldap(user@domain,pcip,<bdKvA+P5HQCbnmFI>): result: mailbox=maildir:/mail/domain/user/mail/ quota=1G mail=user@domain; mail,mailbox,quota unused 2014-05-21T08:22:01+02:00 dovecot/ip dovecot: auth: Debug: ldap(user@domain,pcip,<bdKvA+P5HQCbnmFI>): result: mailbox=maildir:/mail/domain/user/mail/ quota=1G mail=user@domain 2014-05-21T08:22:01+02:00 dovecot/ip dovecot: auth: Debug: master userdb out: USER 3606315009 user@domain quota_rule=*:bytes=1G mail=maildir:/mail/domain/user/mail/ home=/mail/domain/user Question: why are there two ldap result log lines while the first line shows unused attributes and the second doesn't. Does the first occurence show some code being excessive somehow? Thanks. MU

2 1

[Dovecot] allow_nets + default + ldap
by Andreas Schulze 21 May '14

21 May '14

Hello, I'm playing with allow_nets function. It is really cool! In a filebased passwd backend you simply add "allow_nets=192.0.2.143/32" as mentioned in http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/AllowNets But if I use an LDAP backend it looks different. Following http://wiki2.dovecot.org/AuthDatabase/LDAP/AuthBinds and http://wiki2.dovecot.org/AuthDatabase/LDAP/Userdb#Attribute_templates_.28v2… my pass_attrs looks this: pass_attrs = =user=%{ldap:uid}, \ =allow_nets=%{ldap:allownets} Using this syntax I could add an attribute "allownets" in the ldapserver to limit access for a user. A problem occour if the attribute is not present. For example if a user should not be limited or only some but not any user should be limited. So I extend my pass_attrs with a default. pass_attrs = =user=%{ldap:uid}, \ =allow_nets=%{ldap:allownets:10.0.0.0/8} Again, that's fine. Any user was allowed to connect from my private network. But then some users connect via ipv6. I tried to extend my default to pass_attrs = =user=%{ldap:uid}, \ =allow_nets=%{ldap:allownets:10.0.0.0/8,fec0::/16} That syntax, a comma separated list, produces errors no matter if quoting using " or ' or no quoting at all. So I looked at the source (thanks, it's open!) and wrote a little patch to allow simple defaults: - ALL -> allow any address - NONE -> deny any address Now I could write pass_attrs = =user=%{ldap:uid}, =allow_nets=%{ldap:allownets:ALL} or pass_attrs = =user=%{ldap:uid}, =allow_nets=%{ldap:allownets:NONE} to allow or deny any ldap account not having an attribute allownets. Maybe there are other solutions, but that's my way... Andreas

2 3