June 2014 - dovecot - dovecot.org

Problems with dsync and global acls
by Michał Węgrzynek 12 Jun '14

12 Jun '14

Hi all! I have 2 servers running dsync tcp replication between them. After setting global ACLs to * user=admin lrwstipekxa on both hosts, I get the following errors during replication for every folder: dsync-local(mwegrzynek): Error: Mailbox Trash: Failed to set attribute vendor/vendor.dovecot/pvt/acl/user=admin: Invalid right '' This error first manifested in version 2.2.13, there were no such errors in 2.2.9 (stock Ubuntu 14.04) version. Am I doing something wrong? My configuration: # 2.2.13.3 (6dab0352ccb3+): /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-29-generic x86_64 Ubuntu 14.04 LTS ext4 auth_cache_size = 10 M auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/krb5.keytab auth_master_user_separator = * auth_mechanisms = plain login gssapi auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@() auth_username_format = %Ln auth_verbose = yes default_client_limit = 10000 default_process_limit = 1000 default_vsz_limit = 2 G doveadm_port = 12345 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_rcpt_check_quota = yes lmtp_save_to_detail_mailbox = yes mail_gid = vmail mail_home = /var/mail/users/%u mail_location = mdbox:/var/mail/users/%u/mdbox mail_plugins = acl quota virtual zlib listescape fts fts_squat notify replication mail_prefetch_count = 20 mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate mdbox_preallocate_space = yes namespace dzielone { list = children location = mdbox:%%h/mdbox:INDEXPVT=~/shared/%%u prefix = Dzielone/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } namespace publiczne { list = children location = mdbox:/var/mail/public:INDEXPVT=~/public prefix = Publiczne/ separator = / subscriptions = no type = public } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.passdb.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/var/mail/config/shared-mailboxes fts = squat fts_squat = partial=4 full=10 mail_replica = tcps:xxx.yyy.zzz quota = dict:User quota::file:%h/dovecot-quota sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } pop3_uidl_format = %v.%u protocols = imap pop3 lmtp sieve quota_full_tempfail = yes replication_dsync_parameters = -d -l 60 -n inbox -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail user = vmail } } service doveadm { inet_listener { port = 12345 ssl = yes } process_limit = 10 } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl_ca = </etc/ssl/certs/xxx.pem ssl_cert = </etc/ssl/certs/default.pem ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_client_ca_file = /etc/ssl/certs/xxx.pem ssl_key = </etc/ssl/private/default.key userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.userdb.ext driver = ldap } protocol lmtp { mail_plugins = acl quota virtual zlib listescape fts fts_squat notify replication sieve } protocol lda { mail_plugins = acl quota virtual zlib listescape fts fts_squat notify replication sieve } protocol imap { mail_plugins = acl quota virtual zlib listescape fts fts_squat notify replication imap_acl imap_zlib imap_quota } Thanks in advance for your help, -- *Michał Węgrzynek*

1 0

Converting mailboxes from one Maildir format to another
by Patrick C 12 Jun '14

12 Jun '14

I am currently running dovecot 2.0.9 on a CentOS 6 server with the following layout for mailboxes: mail_location = maildir:~/Maildir I would like to change the layout to this format to match the output of other software packages such as offlineimap, mbsync, etc: mail_location = maildir:~/Maildir:LAYOUT=fs:INBOX=~/Maildir/INBOX Is there a way to convert the mailbox layout for all mail accounts currently on the server? I was looking at dsync, but there aren't any Maildir <--> Maildir examples. I was also looking at potentially writing a script to manually rename directories/move files around to match the new format, but wasn't sure whether that would mess with UIDs or other dovecot internals. pat patrickc81(a)gmail.com

2 1

Maildir index
by Eduardo Ramos 11 Jun '14

11 Jun '14

Hi all! I store my maildir mailboxes in a ocfs2 volume. By default, my indexes are stored with the inbox. If I change now to a local disk, could I have trouble? That's my production server. Thanks!

1 0

Safe to downgrade 2.2 to 2.1?
by Florian Tischler 11 Jun '14

11 Jun '14

Hi, is it safe to downgrade Dovecot 2.2 to 2.1 (in my case 2.2.13 to 2.1.17 with mdbox format) or will there be troubles with index files and backup/restore is recommended? Unfortunately with 2.2+ it is not to be possible to use acl + lazy_expunge together anymore, so downgrading is the only option for me... @Timo, please fix acl + lazy_expunge in 2.2 if you find some time. Florian -- Florian Tischler System Administrator *Johann Radon Institute for Computational and Applied Mathematics (RICAM) http://www.ricam.oeaw.ac.at/

1 0

Change index location problem
by igord 11 Jun '14

11 Jun '14

Hi All, I was unable to change location of Dovecot indexes. Currently they are under /var/vmail/%d/%u, but I want to change them to /media/ephemeral0/%u I've changed conf line in /etc/dovecot/dovecot.conf: mail_location = maildir:/var/vmail/%d/%u:INDEX=/media/ephemeral0/%u and setup permissions of /media/ephemeral0 to dovecot:dovecot, tried also vmail:mail (which is default user for e-mails) and also tried with 777 on all dirs, but Dovecot is keeping creating indexes on the old location. I tried moving them from old to new location, but Dovecot recreates them on the old location. Details: # dovecot --version 2.0.9 # doveconf -a | grep location mail_location = maildir:/var/vmail/%d/%u:INDEX=/media/ephemeral0/%u Has anyone experienced something similar, any solution for this? Thanks in advance! -- View this message in context: http://dovecot.2317879.n4.nabble.com/Change-index-location-problem-tp48468.… Sent from the Dovecot mailing list archive at Nabble.com.

2 4

Re: Subject tag [Dovecot] is gone
by Professa Dementia 11 Jun '14

11 Jun '14

On 6/9/2014 7:26 PM, Timo Sirainen wrote: > The main reason is DKIM, which is starting to be a real problem. I have not used DKIM much. My mail server and client mostly deal with SPF. I have a filter that colorizes messages that have no SPF or a missing DKIM or bad DKIM signature. I *have* noticed that a lot of messages from the list get marked in such manner, but it never really bothered me and I never thought about it much. Now I understand why that happens (the [Dovecot] identifier in the subject). When trying to solve a problem, the first thing is to correctly identify the problem. You cannot solve a problem if you do not even know what it is. The underlying problem is to identify and classify emails as ones you want and ones you do not want. This is not easy and involves reading a person's mind. A person may, depending on their mood, classify the same email differently at different times, which complicates things. DKIM assumes that you can, in many cases, classify emails this way based on authenticating the *domain* of the sender. This has some serious flaws in that it does not address this issue, even though it purports to. One way to classify an email as "wanted" is if it comes from someone you know and want to communicate with. Signing based on a domain does nothing to address this. If my girlfriend is judy(a)yahoo.com, I want to receive her emails. That does not means I want to receive all emails from the yahoo.com domain. I do not want someone else to impersonate her. If later, we break up and I no longer want to receive her emails, DKIM does nothing to help with that, either. That could be OK if such functionality is beyond its scope. DKIM erroneously bundles sender authentication with message validation. I want to know that it really was judy(a)yahoo.com that sent me the message and not someone trying to impersonate her. However, as a separate function, I would like to know that the message I received is not the one she sent. These functions should not be integrated. As it is now, if the signature does not verify, I do not know why. Was the sender spoofed? Was some part of the message modified in some way? And just for the record, I believe that the subject line should conceptually be treated as part of the message, along with the date. DKIM is too strict. If I want to present a legal document (email) in court, I may want to prove that the document I present to the court is exactly as it was when it was sent to me. However, this is not a common occurrence. The real world is messy and imperfect and often, changes to emails are innocuous and legitimate. Mailing lists are an example of this. A mailing list or anti-virus scanner *should* be able to add a footer or add a mailing list identifier to the subject line, as long as those changes can be marked as later additions that the original sender is not accountable for. An email program should make it clear to the recipient which parts are not accountable to the original sender. I am not proposing a new standard, simply pointing out that breaking an established protocol (by removing the [Dovecot] subject identifier) because of a flawed anti-spam system is not in people's best interest. Can a spammer spoof messages from the list? Sure. Has it happened? Not that I am aware of. Is it a problem? Not so far. So why, then, make people go through all this trouble of setting up new filters and rules, mail routing, software upgrades, etc, just to appease a standard that is clearly broken? Dem

5 4

replication with plugin won´t work
by Florian Schaal 11 Jun '14

11 Jun '14

Hi all, i try to setup a master-master replication with dovecot / dsync. I´m using virtual-users. When I call doveadm sync -A remote:vmail@server2 new mails are copied to the second server, but new messages from server 2 not on Server 1. To fix this i run doveadm sync -A remote:vmail@server on the 2nd server But I want that it works with dovecot / dsync (see my config at the end - identical on bot servers, only mail_replica is different). I added some services regarding http://wiki2.dovecot.org/Replication If i send a local mail on one server it will not be replicated to the other server until i run doveadm sync. Maybe i just missed some steps in my setup? doveadm user '*' displays the right users on both servers. === docecot.conf === # 2.2.13 (7b25994a8cb7): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-042stab076.8 x86_64 Debian 7.5 auth_mechanisms = plain login ntlm disable_plaintext_auth = no dsync_remote_cmd = ssh -p 4711 -l%{login} %{host} doveadm dsync -u%u listen = *,[::] log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_plugins = " notify replication" mail_privileged_group = vmail passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_replica = remote:vmail@server2 quota = dict:user::file:/var/vmail/%d/%n/.quotausage replication_full_sync_interval = 1 hours sieve = /var/vmail/%d/%n/.sieve } protocols = imap pop3 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service config { unix_listener config { user = vmail } } service doveadm { user = vmail } service imap-login { client_limit = 1000 process_limit = 500 } service replicator { process_min_avail = 1 } ssl_cert = </etc/postfix/smtpd.cert ssl_key = </etc/postfix/smtpd.key userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota } === docecot.conf === regards Florian

1 0

[Dovecot] Can't get authentication for masterusers on Mac OS X Server 10.6.8
by Gilles Celli 11 Jun '14

11 Jun '14

Hi dovecot masters, This is my first post here, since I desperately need some advices from the dovecot community. I've tried to get an answer on the Apple Forums but til now no luck....here we go: I've tried to sync our users emails (Mac OS X Server 10.6.8 Snow Leopard with dovecot 1.1.20-apple0.5) via imapsync to our new server by using the masterusers authentication method on the old 10.6.8 server... The main problem on OS X Server 10.6.8 is that dovecot 1.1.20 uses the OD (OpenDirectory) driver (well I think), so that when following the directions of Master users/password from this page I can't login with the http://wiki1.dovecot.org/Authentication/MasterUsers I couldn't find anything on the OD driver directive....the dovecot 1.1.20-apple build doesn't even have the shadow driver built in (see below the dovecot --build-options), so that passdb shadow {} won't work anyway I always get NO Authentication failed, when trying the following: >telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK Dovecot ready. 1 login user1*mailadmin PASSWORD 1 NO Authentication failed. I've tried also to add a Post-login scripting like described here, but no luck either: http://www.stefanux.de/wiki/doku.php/server/dovecot Does someone know how to fix my migration issue ? Any help is greatly appreciated. Gilles Here's my dovecot : >dovecotd --build-options Build options: ioloop=kqueue notify=kqueue ipv6 openssl Mail storages: maildir mbox dbox cydir raw SQL drivers: Passdb: checkpassword od pam passwd passwd-file Userdb: od passwd passwd-file prefetch static Here's my dovecot -n output: >dovecotd -n # 1.1.20apple0.5: /private/etc/dovecot/dovecot.conf Warning: fd limit 256 is lower than what Dovecot can use under full load (more than 306). Either grow the limit or change login_max_processes_count and max_mail_processes settings # OS: Darwin 10.8.0 i386 hfs base_dir: /var/run/dovecot syslog_facility: local6 protocols: pop3 imap pop3s imaps ssl_ca_file: /etc/certificates/Default.DB14D82BF89A0DDCE123137BC94AEA0C94DDD838.chain.pem ssl_cert_file: /etc/certificates/Default.DB14D82BF89A0DDCE123137BC94AEA0C94DDD838.cert.pem ssl_key_file: /etc/certificates/Default.DB14D82BF89A0DDCE123137BC94AEA0C94DDD838.key.pem ssl_cipher_list: ALL:!LOW:!SSLv2:!aNULL:!ADH:!eNULL disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_user: _dovecot login_process_per_connection: no max_mail_processes: 50 mail_max_userip_connections(default): 20 mail_max_userip_connections(imap): 20 mail_max_userip_connections(pop3): 10 verbose_proctitle: yes first_valid_uid: 6 first_valid_gid: 6 mail_access_groups: mail mail_location: maildir:/var/spool/imap/dovecot/mail/%u mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_process_sharing: full mail_max_connections(default): 10 mail_max_connections(imap): 10 mail_max_connections(pop3): 5 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 lda: postmaster_address: postmaster(a)example.com hostname: mymailserver.example.com mail_plugins: quota quota_full_tempfail: yes sendmail_path: /usr/sbin/sendmail auth_socket_path: /var/run/dovecot/auth-master log_path: /var/log/mailaccess.log info_log_path: /var/log/mailaccess.log auth default: mechanisms: plain login gssapi apop cram-md5 master_user_separator: * verbose: yes passdb: driver: passwd-file args: /etc/dovecot/passwd.masterusers pass: yes master: yes passdb: driver: od userdb: driver: od args: partition=/etc/dovecot/partition_map.conf enforce_quotas=no socket: type: listen master: path: /var/run/dovecot/auth-master mode: 384 user: _dovecot group: mail plugin: quota_warning: storage=100%% /usr/libexec/dovecot/quota-exceeded.sh quota_warning2: storage=90%% /usr/libexec/dovecot/quota-warning.sh quota: maildir:User quota sieve: /var/spool/imap/dovecot/sieve-scripts/%u/dovecot.sieve

3 5

[Dovecot] imap-login killed with signal 11 in Dovecot 2.2.13 (feea8645c4d7)
by Thomas Leuxner 10 Jun '14

10 Jun '14

Latest 2.2.13 HG feea8645c4d7 seems to unexpectedly kill imap-login sessions: Jun 7 11:56:10 nihlus dovecot: imap(tlx(a)leuxner.net): Disconnected: Logged out in=2203 out=851225 Jun 7 11:56:10 nihlus dovecot: imap(tlx(a)leuxner.net): Disconnected: Logged out in=316 out=2417 Jun 7 11:56:10 nihlus dovecot: imap-login: Fatal: master: service(imap-login): child 60505 killed with signal 11 (core not dumped - add -D parameter to service imap-login { executable } Jun 7 11:56:10 nihlus dovecot: imap-login: Fatal: master: service(imap-login): child 60595 killed with signal 11 (core not dumped - add -D parameter to service imap-login { executable } Adding the -D parameter does not generate a core dump however...

5 7

Dovecot auth NTLM
by dovecot.lista＠palacio.cu 10 Jun '14

10 Jun '14

Hello, this is my first email to the list... i´m configuring Dovecot with NTLM authentication, at least this is what i wanted, but i´m having a few problems. 1-I made my configuration following the steps from this howto http://wiki2.dovecot.org/HowTo/ActiveDirectoryNtlm from the dovecot official site, but my dovecot´s version is 2.1.7 and the tutorial dovecot´s version is 1.1.16. But, the fact is that when i enter to the wiki1, for the version 1.x i found that all the howtos are obsoletes and the tutorial for the version 1.x is the same for the 2.x version, so this howto is not trustful.... but, there is not another one. 2-When i implement it all seems to work OK, but the communication between dovecot and the helper in "/usr/bin/ntlm_auth". I made the tests with the binary(/usr/bin/ntlm_auth) and i got the right answers from it, and i also made the test with the tool wbinfo and were successful. During the tests i was monitoring the logs of my Domain Controller (The server from where i want to authenticate) and it logged all the requests i made however when i try to authenticate with dovecot in my Domain Controller nothing is written in the logs... then i get to the conclusion that Dovecot is not communicating with the helper, and of course in dovecot´s logs appears: auth: Info: winbind(?,10.10.10.10): user not authenticated: NT_STATUS_UNSUCCESSFUL As i said, my friends, there is no any other tutorial or howto in internet, at least i did not see it. I´m asking for your help... if any of you have configured Dovecot to auth against NTLM, please tell me how. Im working on Debian Wheezy and Dovecot 2.1.7. PS:Please forgive my English i speak Spanish

1 0