July 2014 - dovecot - dovecot.org

[Dovecot] TLS/SSL for Win8 & Outlook
by Sebastian Goodrick 02 Jul '14

02 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello I recently upgraded to dovecot 2.1.7 (as supplied with Debian Weezy). All clients work as expected except for Outlook (2013 &2010) on Win8 with a SSL/TLS connection. (Thunderbird on Win8 and Outlook 2013 on Win 7 works fine. On my previous dovecot version 1.2.13 all clients worked.) As far as I understand, one difference is the support for TLS1.2 and SSL3. And on the client side Win8 is now connecting through the Microsoft Unified Security Protocol Provider. My logs show these issues: Dovecot: May 06 21:05:43 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [78.42.x.x] May 06 21:05:43 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [78.42.x.x] May 06 21:05:43 imap-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [78.42.x.x] May 06 21:05:43 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=78.42.x.x, lip=144.76.x.x, TLS handshaking: Disconnect Outlook 2013 (contains German, translation in []): IMAP: 12:30:02 [db] Mit 'mail.xxx.de' wird eine Verbindung an Port 143 hergestellt. [A connection to port 143 is established with 'mail.xxx.de'] [snip] IMAP: 12:30:02 [rx] * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Welcome at mail.xxx.de [snip] IMAP: 12:30:02 [rx] hmpc OK Pre-login capabilities listed, post-login capabilities have more.IMAP: 12:30:02 [tx] ekum STARTTLS IMAP: 12:30:02 [db] OnNotify: asOld = 5, asNew = 5, ae = 3 IMAP: 12:30:02 [rx] ekum OK Begin TLS negotiation now. IMAP: 12:30:02 [db] Mit 'Microsoft Unified Security Protocol Provider' wird eine sichere Verbindung ausgehandelt. [A secure connection is negotiated with 'Microsoft Unified Security Protocol Provider'] IMAP: 12:30:02 [db] OnNotify: asOld = 5, asNew = 6, ae = 2 IMAP: 12:30:03 [db] Die Verbindung mit 'mail.xxx.de' wurde geschlossen. [Connection to 'mail.xxx.de' has been closed.] IMAP: 12:30:03 [db] OnNotify: asOld = 6, asNew = 0, ae = 5 IMAP: 12:30:03 [db] ERROR: "Es kann keine sichere Verbindung mit dem Server hergestellt werden.", hr=2148322330 [Can't establish a secure connection with the server.] My settings for ssl_protocols and ssl_cipher_list are empty. Since it works with most clients, I assume no broken certificates or my dovecot configuration. The connection fails at the TLS/SSL handshake. Has anyone seen this behaviour, too? Is there a setting (for ssl_protocols and ssl_cipher_list) to support Outlook on Win8? Thanks, Sebastian -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlNqhkwACgkQR7+YB0QzbnqEFQCdHBPPpFB/pqgZ9FR81h/vcGy5 hkoAn2iuq+AUwQCN3yEtGIWuPAfpm2bs =WrvL -----END PGP SIGNATURE-----

6 29

Re: number of users
by Jonathan Tripathy 02 Jul '14

02 Jul '14

On 2014-07-02 15:04, Reindl Harald wrote: > Am 02.07.2014 16:01, schrieb ihab: >> i using roundcube with dovecot, i have a question if there is >> possible to >> know the number of users that using the mail system (in other word >> the >> online users) > > no - how do you imagine that? > > * roundcube is a web-application > * HTTP is stateless > * so there are no permanent connections It is possible as Roundcube does have its own session management, which you could maybe hook into.

1 0

[Dovecot] lazy_expunge and shared folders
by Florian 02 Jul '14

02 Jul '14

Hi, since migration to Dovecot 2.2 I have troubles with lazy_expunge as soon as a user shares a folder. The user the folder is shared to cannot login anymore, dovecot logs Fatal: lazy_expunge: Unknown namespace: '.EXPUNGED/' - When no folder is shared lazy_expunge is working fine, deleted mails are moved to the expunged namespace and can be recovered without any problems. - Sharing folders works as long as I disable lazy_expunge. I have used the config (with minor changes) with dovecot 2.0 for years without any problem. Switching to dovecot 2.2.10 (atrps repository) or 2.2.12 (dovecot enterprise repo) lazy_expunge and acl do not work together anymore. Is it a bug, a known limitation or is something wrong with my config? Any hints are welcome. Thanks in advance, Florian dovecot -n # 2.2.12.12 (03196f188677): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-042stab085.20 x86_64 CentOS release 6.5 (Final) auth_cache_negative_ttl = 10 mins auth_cache_size = 10 M auth_cache_ttl = 2 hours auth_failure_delay = 10 secs auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_gid = 105 first_valid_uid = 105 hostname = ... imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_idle_notify_interval = 10 mins last_valid_uid = 105 listen = ... lmtp_save_to_detail_mailbox = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_gid = vimap mail_home = /var/imap/spool/%1n/%n mail_location = mdbox:~/mdbox mail_plugins = " fts fts_lucene acl" mail_temp_dir = /var/imap/tmp mail_uid = vimap managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl mdbox_rotate_interval = 1 days namespace { list = children location = mdbox:/var/imap/spool/%%1n/%%n/mdbox:INDEXPVT=/var/imap/spool/%1n/%n/mdbox/shared/%%u prefix = User/%%u/ separator = / subscriptions = no type = shared } namespace expunged { hidden = yes list = no location = mdbox:/var/imap/spool/%1n/%n/mdbox:MAILBOXDIR=expunged prefix = .EXPUNGED/ separator = / subscriptions = no type = private } namespace inbox { inbox = yes location = mdbox:/var/imap/spool/%1n/%n/mdbox mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Learn { auto = subscribe } mailbox Learn/Ham { auto = subscribe } mailbox Learn/Spam { auto = subscribe } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/All { special_use = \All } mailbox virtual/Flagged { special_use = \Flagged } prefix = separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = /etc/dovecot/extra-users driver = passwd-file } plugin { acl = vfile:/var/imap/global-acls:cache_secs=300 acl_shared_dict = file:/var/imap/shared-mailboxes/shared-mailboxes fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. lazy_expunge = .EXPUNGED/ lazy_expunge_only_last_instance = yes recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_max_actions = 32 sieve_max_redirects = 4 sieve_max_script_size = 1M } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh postmaster_address = postmaster@... protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vimap mode = 0600 user = vimap } user = $default_internal_user } service imap-login { process_min_avail = 4 service_count = 0 } service imap { process_limit = 1024 vsz_limit = 256 M } service lmtp { inet_listener lmtp { address = ... port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } service_count = 1 vsz_limit = 64 M } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } process_min_avail = 4 service_count = 0 } service pop3 { process_limit = 512 } ssl_cert = </etc/dovecot/ssl/... ssl_key = </etc/dovecot/ssl/... userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } userdb { args = uid=vimap gid=vimap home=/var/imap/spool/%1n/%n driver = static } protocol lda { mail_plugins = " fts fts_lucene acl sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene acl imap_acl" } protocol lmtp { mail_plugins = " fts fts_lucene acl sieve" } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 } protocol pop3 { mail_max_userip_connections = 20 }

4 4

Imaptest script testing
by kaustubh 02 Jul '14

02 Jul '14

http://www.imapwiki.org/ImapTest/ <http://www.imapwiki.org/ImapTest/> I am doing imap testing using imaptest scripts. But, i am unable to append message. APPEND INBOX "15-Jun-2015 05:30:05 -0700" "From:abc@gmail.com" "Subject: test. HI this is msg". This command i am using in my testing script. Command executed properly. But, it is not appending mail which is i entered into command. Imaptest appending his own mail into mailbox. please tell me whether i am doing it wrong way. How to append msg i entered into command using imaptest ?? -- View this message in context: http://dovecot.2317879.n4.nabble.com/Imaptest-script-testing-tp48607.html Sent from the Dovecot mailing list archive at Nabble.com.

2 1

Direct groups of users to pairs of backend mailstores?
by Murray Trainer 01 Jul '14

01 Jul '14

Hi All, We are using Dovecot in a Director setup with two director proxies, six backend mailstores, mailbox storage in NFS, and user accounts stored in LDAP. Currently we have five NFS filesystems on EMC VNX storage which are all mounted on each of the six backend mailstores. At the moment all users could be directed to any of the six mailstores. We have a group of users with very large mailboxes we want to put on separate cheaper Backblaze NFS storage. Because this will be less reliable than our VNX storage we want to be able to direct this group of users to a new pair of backend mailstores that only have the Backblaze NFS mounts. This would isolate the rest of the users isolation from problems with the Backblaze NFS servers. I have read the Dovecot documentation which indicates it is possible to direct users always to a single backend server. Can Dovecot direct users to a pair or more of backend mailstores - ie a subset or another set of mailstores. If not it would be a great enhancement which would allow more scalability, flexibility and redundancy. Thanks Murray

1 0

Managing users and home dirs
by deano-dovecot＠areyes.com 01 Jul '14

01 Jul '14

For those of you using virtual users, and SQL, how are you managing your users and their home dirs ? That is, what process do you use for adding/deleting users, creating their home dirs etc ? I suppose it's easy enough to do manually, inserting rows in the database, creating dirs, chown/chmod yada yada, but there must be a better way to do it ... If you're doing dovecot replication then it gets even more cumbersome, having to duplicate the effort in two places (and make sure it's correct). I have a nice test setup using Percona XtraDB Clustering in a 3-node cluster which works swimmingly, albeit in VMs only at the moment. A master DB node and two dovecot nodes. Dovecot replication is up and running nicely too, and I almost have all the communications going over ipsec tunnels, so it will be nice and secure. I'm thinking of something like a cronjob with two tasks, the first would periodically scan the home dirs and compare the users to what's in the database. When it finds a new userdir (plus a file labeled PASSWD) the script would add the user to the database, create the Maildir and whatever else, then delete the PASSWD file. DB replication will push that to the other nodes. The second task is scanning the user database and comparing to the home dirs - basically opposite of the first cronjob. When it finds a user in the DB that doesn't have a home dir, it would create it and whatever else is needed. This way, to add a user one would just create a PASSWD file in /var/mail/domain.com/newusername/PASSWD on either of the dovecot replication partner systems. The first cronjob task would discover the newusername dir, create the user in the DB, create the Maildir, chown/chmod etc. and delete the PASSWD file, so it's ready to go on that system. DB replication pushes the user table to the other nodes. The second task on the other dovecot system will discover a new user in the DB that doesn't have a home dir, and do its thing to create it all. So the whole create-a-new-user process becomes something like this on either dovecot system : mkdir -p /var/mail/domain.com/newusername ; echo "changeme" > /var/mail/domain.com/newusername/PASSWD A max of 5 minutes later the user is added to the database, and the home dir/Maildir/etc/etc is created on both dovecot systems. D.

2 2

i need a little advice with dovecot master user
by Francesco 01 Jul '14

01 Jul '14

Hello, As a step to migrate to a newer version of dovecot, i've been asked to configure a master user for logging in into mailboxes of a dovecot 1.2. I've followed the instructions from this page: http://wiki1.dovecot.org/Authentication/MasterUsers but appearently something is going wrong. I've turned on the auth verbose and what i get in the log is: 2014-06-30 15:25:03 auth(default): Info: passdb(administrator,127.0.0.1,master): Master user logging in as user(a)domain.tld but the output from a telnet session says: Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=LOGIN AUTH=PLAIN] server ready. a1 login user(a)domain.tld*administrator <administrator password> a1 NO [AUTHORIZATIONFAILED] Authorization failed what i noticed is that if i type a wrong password i get an AUTHENTICATIONFAILED, which, to me, sounds different from authorization. what am i doing wrong? here is the auth configuration: ____________________________________ auth_master_user_separator=* auth default { mechanisms = login plain passdb sql { args = /etc/dovecot/dovecot-sql.conf } passdb passwd-file { args = /etc/dovecot/passwd.masterusers master = yes pass = yes } userdb sql { args = /etc/dovecot/dovecot-sql.conf } userdb static { args = uid=65000 gid=65000 mail=maildir:/var/utenti/ADS/%Lu/Maildir } passdb pam { } user = root socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } ____________________________________

2 1

Error receiving mail from postfix
by Jerry 01 Jul '14

01 Jul '14

When mail is relayed to dovecot from postfix, I am getting this error message in the maillog: Jul 1 07:05:19 scorpio postfix/pipe[45488]: 3h2jQl3Xldz3FMPc: to=<user(a)domain.com>, relay=dovecot, delay=0.16, delays=0.12/0.01/0/0.03, dsn=4.3.0, status=deferred (temporary failure. Command output: lda: Error: user user(a)domain.com: Error reading configuration: Invalid settings: postmaster_address setting not given lda: Fatal: Internal error occurred. Refer to server log for more information. ) Is this a Postfix problem or a Dovecot problem? # OS: FreeBSD 10.0-RELEASE-p3 amd64 ufs auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 digest-md5 ntlm auth_verbose = yes auth_verbose_passwords = plain log_path = /var/log/dovecot mail_location = maildir:/var/mail/vmail/seibercom/gerard managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%u /usr/local/etc/dovecot/user/passwd driver = passwd-file } passdb { driver = pam } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot/user/passwd driver = passwd-file } plugin { sieve_global_path = /usr/local/etc/dovecot/sieve/default.sieve } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = username_format=%u /usr/local/etc/dovecot/user/passwd default_fields = uid=vmail gid=vmail driver = passwd-file } userdb { driver = passwd } userdb { args = username_format=%u /usr/local/etc/dovecot/user/passwd driver = passwd-file } protocol lda { mail_plugins = " sieve" } -- jerry

4 4