May 2014 - dovecot - dovecot.org

[Dovecot] / vs. </
by Boris 19 May '14

19 May '14

The default configuration file for Dovecot in Debian uses: ssl_cert = </path/to/cert I checked my current configuration and I use: ssl_cert =/path/to/cert What is the difference? (pipe?) And is the former better somehow?

3 6

[Dovecot] imapc Proxy to IMAPS Exchangeserver?
by Ralf Hildebrandt 19 May '14

19 May '14

I'm trying to adapt http://wiki2.dovecot.org/HowTo/ImapcProxy to our Exchange Server, which has LOGINDISABLED on Port 143, and I offering LOGIN on Port 993. How do I go about this? Simply changing imapc_port to: imapc_port = 993 doesnt work: Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready. . LOGIN hildeb password . NO [UNAVAILABLE] Temporary authentication failure. [mproxy:2014-05-16 09:33:23] . LOGOUT * BYE Logging out . OK Logout completed. Connection closed by foreign host. Logs: May 16 11:33:04 mproxy dovecot: master: Dovecot v2.2.9 starting up (core dumps disabled) May 16 11:33:21 mproxy dovecot: auth: Error: imapc(exchange-imap.charite.de:143): Command '2 LOGIN "hildeb" "password"' failed with BAD: 2 Command received in Invalid state. May 16 11:33:21 mproxy dovecot: auth: Error: imap(hildeb,::1,<bjeUGoH53AAAAAAAAAAAAAAAAAAAAAAB>): Disconnected from server May 16 11:33:21 mproxy dovecot: auth: Error: imapc(exchange-imap.charite.de:143): Authentication failed: Command received in Invalid state. May 16 11:33:26 mproxy dovecot: imap-login: Aborted login (auth failed, 1 attempts in 8 secs): user=<hildeb>, method=PLAIN, rip=::1, lip=::1, secured, session=<bjeUGoH53AAAAAAAAAAAAAAAAAAAAAAB> But why is it still using port 143? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

3 5

[Dovecot] logging of failed SASL usernames
by Reindl Harald 19 May '14

19 May '14

as far as i understand postfix has no way to know the username of such failed logins like below, IMHO dovecot internally does because it verifies against the sql-userdatabase is there a way that dovecot logs the username? after ask the users to change their passwords for safety caused by Heartbleed it was easy to write a tool find forgotten devices in case of IMAP/POP3 but especially Apple clients force to enter the new password seperated for incoming and outgoing server and don't tell the user if things don't work so there is really a need support them and fuzzy logic based on the last successful IMAP/POP3 login from a IP and failed send attempts from the same IP shortly after receive mail leaves a bad taste of only a guess May 18 11:19:09 mail postfix/smtpd[5173]: warning: unknown[177.139.182.86]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 May 18 11:19:15 mail postfix/smtpd[5173]: warning: unknown[177.139.182.86]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

2 2

[Dovecot] Configuration of dovecot 2.0.19 to authenticate users via LDAP
by Danylo Esterman 19 May '14

19 May '14

I am trying to get dovecot 2.0.19 authenticate users via LDAP (OpenLDAP 2.4.28) and using Wireshark to debug the process. It looks like the basic configuration of dovecot is fine, but it doesn't pull it off to send the right request to the LDAP server. First of all, this is how my LDAP-entries look: # ht dn: dc=ht objectClass: top objectClass: dcObject objectClass: organization o: ip dc: ht # admin, ht dn: cn=admin,dc=ht objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9cFY1b0ZZVUhack1aRTVvaUg1T3c2cytVWHV4aUNvaHI= # people, ht dn: ou=people,dc=ht objectClass: organizationalUnit objectClass: top ou: people # groups, ht dn: ou=groups,dc=ht objectClass: organizationalUnit objectClass: top ou: groups # ipusers, groups, ht dn: cn=ipusers,ou=groups,dc=ht gidNumber: 500 cn: ipusers objectClass: posixGroup objectClass: top # Max Mustermann, people, ht dn: cn=Max Mustermann,ou=people,dc=ht cn: Max Mustermann givenName: Max gidNumber: 500 homeDirectory: /home/users/mmustormann sn: Mustermann objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1000 uid: mmustermann userPassword:: e01ENX1ETUYxdWNEeHRxZ3h3NW5pYVhjbVlRPT0= loginShell: /bin/bash mail: mustorm(a)test.com Now, I use the following configuration for dovecot (/etc/dovecot/dovecot-ldap.conf.ext) hosts = 10.1.2.1 dn = cn=admin,dc=ht dnpass = a auth_bind = yes auth_bind_userdn = uid=%u,ou=people,dc=ht ldap_version = 3 scope = subtree base = ou=people,dc=ht user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid user_filter = (&(objectClass=posixAccount)(uid=%u)) pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=posixAccount)(uid=%u)) This is what I see in Wireshark: http://i.stack.imgur.com/ICzDe.png Dovecot cannot authenticate itself for some reason... If i change the configuration as follows: auth_bind = no #auth_bind_userdn = uid=%u,ou=people,dc=ht Then I get following picture: http://i.stack.imgur.com/tb5vo.png It doesn't pick up the setting base = ou=people,dc=ht. But what is more crucial is that even looking at the whole tree "<ROOT>" wholeSubTree it can't find the required entry. I am really desperate and don't know how to make it work. Can somebody please give me a clue how to solve this problem?

2 1

[Dovecot] Signal 11 with dovecot-lda
by Jim Dishaw 19 May '14

19 May '14

dovecot version: 2.2.13 NetBSD 5.1 on an amd64 architecture Based on the log file, I think this problem first manifested itself when I upgrade from 2.2.9 to 2.2.12. I tried to go back to 2.2.9, but I would have had to rollback some of the other dependencies. I built 2.2.13 and the problem still exists. Mail gets successfully delivered, but the sender get a non-delivery message. I've hacked a temporary workaround to prevent the non-delivery from being sent by having the bounce service run discard instead of bounce. Logfile excerpt: May 18 04:37:07 chaos postfix/smtp[27935]: 39F8B2134F: to=<XXXX(a)YYYY.ZZZ>, relay=127.0.0.1[127.0.0.1]:10024, delay=21, delays=1.9/0.13/0.69/18, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0538621350) May 18 04:37:07 chaos postfix/qmgr[19537]: 39F8B2134F: removed May 18 04:37:07 chaos dovecot: lda(XXXX(a)YYYY.ZZZ): msgid=<MAILSM200e8021240fd744d9d8094cd0c3e82dfc2@MAILSM200>: saved mail to INBOX May 18 04:37:07 chaos postfix/pipe[12775]: 0538621350: to=<XXXX(a)YYYY.ZZZ>, relay=dovecot, delay=0.54, delays=0.07/0.3/0/0.18, dsn=5.3.0, status=bounced (Command died with signal 11: "/usr/pkg/libexec/dovecot/dovecot-lda") May 18 04:37:07 chaos postfix/cleanup[2233]: 88C0221353: message-id=<20140518043707.88C0221353(a)chaos.dishaw.org> May 18 04:37:07 chaos postfix/bounce[18857]: 0538621350: sender non-delivery notification: 88C0221353 May 18 04:37:07 chaos postfix/qmgr[19537]: 88C0221353: from=<>, size=14448, nrcpt=1 (queue active) May 18 04:37:07 chaos postfix/qmgr[19537]: 0538621350: removed May 18 04:37:08 chaos postfix/smtp[20299]: 88C0221353: to=<AAAA(a)BBBB.CCC>,relay=site.careerbuilder.com[208.82.4.130]:25, delay=0.89, delays=0.03/0.03/0.25/0.58, dsn=2.6.0, status=sent (250 2.6.0 message received) May 18 04:37:08 chaos postfix/qmgr[19537]: 88C0221353: removed Backtrace: #0 0x00007f7ffc907270 in ?? () #1 0x00007f7ffd778498 in lib_signals_deinit () from /usr/pkg/lib/dovecot/libdovecot.so.0 #2 0x00007f7ffd725739 in master_service_deinit () from /usr/pkg/lib/dovecot/libdovecot.so.0 #3 0x0000000000403021 in main ()

1 0

[Dovecot] RFE: please add Return-Path: to sieve sent mail headers
by Maciej Uhlig 18 May '14

18 May '14

May I ask to add Return-Path: some meaningful header line to sieve sent mail headers in vacation message? Now the header line isn't generated at all and the effect is as follows: on receiving MTA: 2014-05-09T15:04:32+02:00 host/ip postfix/qmgr[2408]: 41F2F6024E: from=<>, size=900, nrcpt=1 (queue active) in received mail body: Return-Path: <> Would be nice to get: Return-Path: <user@domain> Copy of From: header line could be sufficient. Thanks. MU

11 28

[Dovecot] antispam plugin doesn't recognize spam folder
by Paul DiSciascio 18 May '14

18 May '14

After a recent upgrade to dovecot 2.2.9 (caused by an ubuntu upgrade to 14.04), the antispam plugin has stopped recognizing my spam folders as spam. I see the plugin initializes properly, but when moving a message, the mailbox_is_spam() function always returns 0. The version of dovecot-antispam that ships with ubuntu is 2.0+20130822-2build1. I also compiled the latest version in the git repository (last update 9/12/2013) and had the same results. This worked fine prior to the upgrade, with dovecot version 2.0.19 and dovecot-antispam version 2.0+20120225-2. Here are the logs from initialization: May 18 07:48:45 lebeau imap: antispam: plugin initialising (2.0-7-gabdad24) May 18 07:48:45 lebeau imap: antispam: verbose debug enabled May 18 07:48:45 lebeau imap: antispam: "SPAM" is exact match spam folder May 18 07:48:45 lebeau imap: antispam: "Spam" is exact match spam folder May 18 07:48:45 lebeau imap: antispam: "Junk" is exact match spam folder May 18 07:48:45 lebeau imap: antispam: no unsure folders May 18 07:48:45 lebeau imap: antispam: "trash" is exact match trash folder May 18 07:48:45 lebeau imap: antispam: "Trash" is exact match trash folder May 18 07:48:45 lebeau imap: antispam: "Deleted Items" is exact match trash folder May 18 07:48:45 lebeau imap: antispam: "Deleted Messages" is exact match trash folder May 18 07:48:45 lebeau imap: antispam: dspam binary set to /usr/bin/dspam May 18 07:48:45 lebeau imap: antispam: dspam extra arg --user May 18 07:48:45 lebeau imap: antispam: dspam extra arg thenut(a)bytemonkey.net May 18 07:48:45 lebeau imap: antispam: signature header line is "X-DSPAM-Signature" And then from the message move: May 18 07:50:06 lebeau imap: antispam: mailbox_is_unsure(SPAM): 0 May 18 07:50:06 lebeau imap: antispam: mailbox_is_trash(INBOX): 0 May 18 07:50:06 lebeau imap: antispam: mailbox_is_trash(SPAM): 0 May 18 07:50:06 lebeau imap: antispam: mail copy: from trash: 0, to trash: 0 May 18 07:50:06 lebeau imap: antispam: mailbox_is_spam(INBOX): 0 May 18 07:50:06 lebeau imap: antispam: mailbox_is_spam(SPAM): 0 May 18 07:50:06 lebeau imap: antispam: mailbox_is_unsure(INBOX): 0 May 18 07:50:06 lebeau imap: antispam: mail copy: src spam: 0, dst spam: 0, src unsure: 0 Clearly mailbox_is_spam(SPAM) should return 1. The other folders I have designated as spam (Junk and Spam) produce the same results. ~Paul

1 0

[Dovecot] Feature Request doveadm acl command
by Thomas Leuxner 18 May '14

18 May '14

I have switched to global ACLs for public namespaces which eases their administration greately. Now while running housekeeping scripts (e.g. expunge old mails/archive mails etc.) this requires temporary overriding the global ACLs with mailbox specifix ACLs to expunge mails. The scripts would then revoke the temporary changes (delete flags) and the global ACL would take precedence again. Ideally I would want to get rid of the 'dovecot-acl' file after the scripts ran so the global ACL kicks in. There seems to be no interface command to purge 'dovecot-acl' files so this is handled by the scripts for now: [...] # Get actual path of dovecot-acl file and remove it as it is handled by global ACL acl_path=$(doveadm acl debug -u $mailbox_owner "$source_mailbox_base/$1" 2>&1 | sed -n "s/$.*$$debug_acl_mailbox_path//p") [ -f $acl_path/dovecot-acl ] && rm $acl_path/dovecot-acl It would be nice if purging a specific dovecot-acl would be handled by doveadm to avoid custom-scripting. Regards Thomas

1 0

[Dovecot] User not found when using shadow for passdb
by John J. Stimson III 17 May '14

17 May '14

I am getting "user unknown" when trying to connect to the dovecot server using IMAP. The client gets an authentication failed message and does not download mail. The host system uses shadow passwords in /etc/shadow. I would like to use the same passwords for IMAP sessions, so I have set the passdb driver to shadow. The system is Slackware, which does not use PAM. Here is the dovecot version and configuration output: # dovecot -n # 2.1.17: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.6.5 i686 Slackware 13.1.0 auth_debug_passwords = yes auth_verbose = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = blocking=no driver = shadow } service auth { unix_listener auth-userdb { user = root } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = blocking=no driver = passwd } Here are the dovecot auth_passwd_debug level log messages when the client tries to connect: May 2 09:05:07 harlie dovecot: auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth May 2 09:05:07 harlie dovecot: auth: Debug: auth client connected (pid=22181) May 2 09:05:07 harlie dovecot: auth: Debug: client in: AUTH^I1^IPLAIN^Iservice=imap^Isecured^Isession=ABCDEFGHIJKLMNOP^Ilip=96.229.223.7^Irip=10.0.0.181^Ilport=993^Irport=51898^Iresp=zxywvutsrqponmlkji== May 2 09:05:07 harlie dovecot: auth: Debug: shadow(john,10.0.0.181,<ABCDEFGHIJKLMNOP>): lookup May 2 09:05:07 harlie dovecot: auth: shadow(john,10.0.0.181,<ABCDEFGHIJKLMNOP>): unknown user May 2 09:05:09 harlie dovecot: auth: Debug: client passdb out: FAIL^I1^Iuser=john May 2 09:05:09 harlie dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<john>, method=PLAIN, rip=10.0.0.181, lip=96.229.223.7, TLS, session=<ABCDEFGHIJKLMNOP> The user john is a real account on the host machine and has entries in both /etc/passwd and /etc/shadow. Help? -- john(a)idsfa.net John Stimson http://www.idsfa.net/~john/ HMC Physics '94

1 1

[Dovecot] RFE: please add mail queue id to 'sent vacation response' log line
by Maciej Uhlig 17 May '14

17 May '14

May I ask to add receiving smtp server mail queue id to sieve 'sent vacation response' log line? Now: 2014-05-09T15:04:32+02:00 name/ip dovecot: lmtp(8164, user1@domain): YvJFLVbSbFPkHwAASpgOhg: sieve: msgid=<000301cf6b87$36be4570$a43ad050$(a)us.edu.pl> size=46850: sent vacation response to <user2@domain> Asked for something like this: 2014-05-09T15:04:32+02:00 name/ip dovecot: lmtp(8164, user1@domain): YvJFLVbSbFPkHwAASpgOhg: sieve: msgid=<000301cf6b87$36be4570$a43ad050$(a)us.edu.pl> size=46850: sent vacation response to <user2@domain> (smtp:[ip]:port): 250 2.0.0 Ok: queued as mailqueueid) <<< In case there are more than one vacation response recipients there is no way to identify who had received the response and who hadn't. Thanks. MU

5 7