August 2014 - dovecot

Manage Sieve Security?
by Chris 18 Aug '14

18 Aug '14

Dear All, can I expose Dovecot's Manage Sieve port to the internet or should I restrict access (e.g. by IP address or VPN)? -- Christian

2 1

virtual plugin in HG unaware of namespaces
by Thomas Leuxner 17 Aug '14

17 Aug '14

The latest changes to the virtual plugin seem to have a negative effect on name space rules: $ cat dovecot-virtual * Public/* flagged While flagged messages inside the mailbox still show up, messages flagged in 'Public' are not picked up anymore. Regards Thomas

1 1

INBOX subfolders not showing up
by Matthias Sitte 16 Aug '14

16 Aug '14

Hi, I have a problem with INBOX subfolders and subscriptions which I can't solve... Maybe somebody has seen this, too... I can create regular subfolders (not in INBOX) and (un-)subscribe to them with Thunderbird. If I create subfolders in the INBOX with TB this seems to work now in v31 (just found this out), but with v24.6 neither INBOX subfolder creation nor subscriptions worked. When I modified the `subscriptions' file manually on the server, the folders would show up in TB, though. Maybe this was a TB bug, but quite similarly INBOX subfolders don't show up on iPhones (iOS up-to-date), but all other subfolders do. Any ideas what's going on? Best, Matthias ====================================================================== # dovecot -n # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.6 ext4 hostname = familie-sitte.org log_path = /var/log/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/srv/mail/%d/%n/Maildir:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)familie-sitte.org protocols = " imap sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl_cert = </etc/dovecot/ssl/mail_cert.pem ssl_cipher_list = SSDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+RC4:EDH+aRSA:EECDH:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = </etc/dovecot/ssl/mail_key.pem userdb { args = uid=vmail gid=vmail home=/srv/mail/%d/%n driver = static } protocol lda { mail_plugins = " quota sieve" } protocol imap { mail_plugins = " imap_quota quota" }

3 4

Server dovecot: auth: Warning: sql: Ignoring changed iterate_quer
by Joseph Malloy 16 Aug '14

16 Aug '14

Hello, I am having an issue with Dovecot. I am using Roundcube to access my mailboxes, which I have set up using ViMbAdmin. However when I go to the Roundcube, I get login Failed. So looking in the mail.log I can see the following: Aug 15 13:20:09 Server dovecot: auth: Warning: sql: Ignoring changed iterate_query in /etc/dovecot/dovecot-sql.conf.ext, because userdb sql not used. (If this is intentional, set userdb_warning_disable=yes) Aug 15 13:20:11 Server dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<joe(a)anoblequest.co.uk>, method=PLAIN, rip=62.49.15.89, lip=192.168.0.90, TLS, session=<su7WCqoALAA+MQ9Z> I am most greatful for the support Joe :)

2 1

namspace management
by A. Schulze 15 Aug '14

15 Aug '14

Hello, since some weeks I'm playing with namespaces. But I still did nod found a solution for all faces of different problems. Current issue: Public namespace. I have users inbox as follow: mail_home = /data/mail/%Ln/ mail_location = maildir:~/Maildir:INDEX=~/.dovecot.index namespace { inbox = yes separator = / prefix = INBOX/ } Public namespace: namespace { location = maildir:/data/mail_public/Maildir/:INDEXPVT=~/.dovecot.index.public/ prefix = PUBLIC/ separator = / type = public } that way only one subscription file is possible. Any use could subscribe/unsubscribe any folder and that match all users. If I add "subscription=no" the parent namespace' subscription is used. In fact there is no parent namespace an no subscription management is possible at all. On the other side I tried to change the PUBLIC namespace prefix to "INBOX/PUBLIC" but now the namespace is *below* the inbox. That's also not what I want. How do other users organise the namespaces INBOX, PUBLIC, SHARED and VIRTUAL (via virtual plugin) ? Thanks Andreas

3 4

(Again) Some trouble with dovecot 2.1(.7) and SASL
by admin 15 Aug '14

15 Aug '14

The parentheses in the subject are due to referral to this discussion on the mailing list: http://dovecot.org/list/dovecot/2012-February/063851.html At first I thought I found the problem, but then realized this was 2012 and the suggested patch already is applied in dovecot. I also have segault messages in my kernel log; not too many, but it was enough to dig for it: > Wed Jun 25 08:29:05 2014 auth[17590]: segfault at 10 ip 00007f02ad5e8e56 sp 00007fff932f9250 error 4 in auth[7f02ad5d3000+40000] > Mon Jun 30 16:11:41 2014 auth[12501]: segfault at 10 ip 00007fc6a1fefe56 sp 00007fff276e6ea0 error 4 in auth[7fc6a1fda000+40000] > Sat Jul 5 13:11:32 2014 auth[15603]: segfault at 10 ip 00007f6447a6be56 sp 00007fff09c48020 error 4 in auth[7f6447a56000+40000] > Tue Jul 8 05:08:21 2014 auth[30071]: segfault at 10 ip 00007ff22656ae56 sp 00007fff26b017f0 error 4 in auth[7ff226555000+40000] > Mon Jul 21 14:25:28 2014 auth[30918]: segfault at 10 ip 00007fe1fc817e56 sp 00007fff7e654f20 error 4 in auth[7fe1fc802000+40000] <--- > Wed Aug 13 18:56:31 2014 auth[27593]: segfault at 10 ip 00007ffbf8ce8e56 sp 00007fffe0157f70 error 4 in auth[7ffbf8cd3000+40000] > Wed Aug 13 18:57:59 2014 auth[24264]: segfault at 10 ip 00007f2df31bde56 sp 00007fff094263c0 error 4 in auth[7f2df31a8000+40000] The last 2 entries are a result of me being able to reproduce the problem, the 3rd last is the only one I was able to track down (due to log rotation) I tracked the problem down to a contact form of a website of one of my customers. whenever used, the segfault gets triggered. Nevertheless, the message always gets delivered. So we are talking about the marked line; the corresponding log entries from mail.info: > Jul 21 14:25:29 mail postfix/smtpd[27590]: connect from unknown[<webserver ip>] > Jul 21 14:25:29 mail dovecot: auth: Fatal: master: service(auth): child 30918 killed with signal 11 (core dumps disabled) > Jul 21 14:25:29 mail postfix/smtpd[27590]: warning: unknown[<webserver ip>]: SASL DIGEST-MD5 authentication failed: Connection lost to authentication server > Jul 21 14:25:29 mail dovecot: auth-worker(27595): mysql(127.0.0.1): Connected to database mail > Jul 21 14:25:29 mail postfix/smtpd[27590]: D4D8E44752: client=unknown[<webserver ip>], sasl_method=CRAM-MD5, sasl_username=<existing account and working account> > Jul 21 14:25:29 mail postfix/cleanup[27598]: D4D8E44752: message-id=<id(a)doma.in> > Jul 21 14:25:29 mail postfix/qmgr[13349]: D4D8E44752: from=<server(a)doma.in>, size=2680, nrcpt=1 (queue active) > Jul 21 14:25:29 mail postfix/smtpd[27590]: disconnect from unknown[<webserver ip>] > Jul 21 14:25:29 mail dovecot: lmtp(27600): Connect from local > Jul 21 14:25:30 mail postfix/lmtp[27599]: D4D8E44752: to=<info(a)doma.in>, orig_to=<contact(a)doma.in>, relay=<mailserver fqdn>[private/dovecot-lmtp], delay=0.19, delays=0.07/0.04/0.04/0.04, dsn=2.0.0, status=sent (250 2.0.0 <info(a)doma.in> MrY+OdkizVPQawAAMrkmwA Saved) > Jul 21 14:25:30 mail postfix/qmgr[13349]: D4D8E44752: removed > Jul 21 14:25:30 mail dovecot: lmtp(27600, info(a)doma.in) MrY+OdkizVPQawAAMrkmwA: msgid=<id(a)doma.in>: saved mail to INBOX > Jul 21 14:25:30 mail dovecot: lmtp(27600): Disconnect from local: Client quit (in reset) contact(a)doma.in is a virtual address which gets forwarded to info(a)doma.in (/etc/postfix/virtual). The used CMS is PyroCMS (v2.2.3) - the version is not up2date, but nevertheless the CMS might be the one to blame, a service should not segfault. Some packages are to be updated, as well as the CMS; but I am willing to wait to provide information, which leads to the problem, as I cannot switch between different versions on my productive system for the sake of gaining debug information. I hope that someone has any kind of clue and is willing to resolve that issue with me, asking me for the necessary information to do so. Thanks in advance!

2 1

Multiple Passdb's - Order
by Jean-Louis Dupond 15 Aug '14

15 Aug '14

Hi, Today I upgraded my dovecot to a newer version (2.2.9 debian wheezy-backports) At that moment I also reconfigured the whole thing a bit nicer. Now I stumbled on the following issue. In my configuration I use 2 backends (LDAP & passwd-file). passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } userdb { args = uid=vmail gid=vmail home=/var/vmail/%d/%n driver = static } Now this worked fine before. But if I tested it, LDAP logins worked, and passwd-file logins failed. Failed log (user is only in the passwd-file): Aug 01 21:31:55 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Aug 01 21:31:55 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so Aug 01 21:31:55 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_pgsql.so Aug 01 21:31:55 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_sqlite.so Aug 01 21:31:55 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Aug 01 21:31:55 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libauthdb_ldap.so Aug 01 21:31:55 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Aug 01 21:31:55 auth: Debug: passwd-file /etc/dovecot/users: Read 10 users in 0 secs Aug 01 21:31:55 auth: Debug: auth client connected (pid=5516) Aug 01 21:31:55 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=c34kcZb/uwBbtKLu lip=xxx rip=xxxx lport=993 rport=52411 Aug 01 21:31:55 auth: Debug: client passdb out: CONT 1 Aug 01 21:31:55 auth: Debug: client in: CONT 1 xxxxx (previous base64 data may contain sensitive data) Aug 01 21:31:55 auth: Debug: cache(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): miss Aug 01 21:31:55 auth: Debug: ldap(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): pass search: base=uid=info(a)xxx.com,ou=mail,dc=dupie,dc=be scope=subtree filter=(&(objectClass=posixAccount)(uid=info(a)xxx.com)) fields=uid,userPassword Aug 01 21:31:55 auth: Debug: cache(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): miss Aug 01 21:31:55 auth: Debug: cache(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): miss Aug 01 21:31:55 auth: Debug: passwd-file(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): lookup: user=info(a)xxx.com file=/etc/dovecot/users Aug 01 21:31:57 auth: Debug: client passdb out: FAIL 1 user=info(a)xxx.com temp Aug 01 21:31:57 auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=c34kcZb/uwBbtKLu lip=xxx rip=xxx lport=993 rport=52411 resp=xxx (previous base64 data may contain sensitive data) Aug 01 21:32:01 auth: Debug: cache(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): miss Aug 01 21:32:01 auth: Debug: ldap(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): pass search: base=uid=info(a)xxx.com,ou=mail,dc=dupie,dc=be scope=subtree filter=(&(objectClass=posixAccount)(uid=info(a)xxx.com)) fields=uid,userPassword Aug 01 21:32:01 auth: Debug: cache(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): miss Aug 01 21:32:01 auth: Debug: cache(info(a)xxx.com,xxx,<c34kcZb/uwBbtKLu>): hit: {CRAM-MD5}19192922..... Aug 01 21:32:03 auth: Debug: client passdb out: FAIL 2 user=info(a)xxx.com temp As you see it returned a FAIL, but the password was retrieved from the users file (see the cache hit). Now I changed the order of the passdb's in my config, to make passwd-file come first, and then LDAP. And what happend now, it started working ... Logs: Aug 01 21:30:23 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Aug 01 21:30:23 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so Aug 01 21:30:23 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_pgsql.so Aug 01 21:30:23 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_sqlite.so Aug 01 21:30:23 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Aug 01 21:30:23 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libauthdb_ldap.so Aug 01 21:30:23 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Aug 01 21:30:23 auth: Debug: passwd-file /etc/dovecot/users: Read 10 users in 0 secs Aug 01 21:30:23 auth: Debug: auth client connected (pid=5459) Aug 01 21:30:24 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=TTm6a5b/swBbtKLu lip=xxx rip=xxx lport=993 rport=52403 Aug 01 21:30:24 auth: Debug: client passdb out: CONT 1 Aug 01 21:30:24 auth: Debug: client in: CONT 1 xxxx (previous base64 data may contain sensitive data) Aug 01 21:30:24 auth: Debug: cache(info(a)xxx.com,xxx,<TTm6a5b/swBbtKLu>): miss Aug 01 21:30:24 auth: Debug: passwd-file(info(a)xxx.com,xxx,<TTm6a5b/swBbtKLu>): lookup: user=info(a)xxx.com file=/etc/dovecot/users Aug 01 21:30:24 auth: Debug: client passdb out: OK 1 user=info(a)xxx.com Aug 01 21:30:24 auth: Debug: master in: REQUEST 1973682177 5459 1 9976303da4c6eb55a008b0cae6ab12a1 session_pid=5462 request_auth_token Aug 01 21:30:24 auth: Debug: master userdb out: USER 1973682177 info(a)xxx.com uid=1001 gid=1001 home=/var/vmail/xxx.com/info auth_token=31afcf6ff0c5ed5150beb96ad3718cff452badae The only thing I changed here was the order the passdb backends. It works fine now, but it not clear to me why the order is so important. Could somebody explain this? Or is this some bug? Thanks Jean-Louis

2 5

Cannot use dovecot with vpopmail and sendmail
by Matthias Fechner 15 Aug '14

15 Aug '14

Hi, I setup a configuration that will use sendmail with dovecot as imap/pop3 service and vpopmail as backend to handle virtual users and store email there. For this I created a dovecot.m4 as described in the wiki, it looks like: ######################*****############## ### DOVECOT Mailer specification ### ##################*****################## Mdovecot, P=/usr/local/libexec/dovecot/dovecot-lda, F=l59DFMPhnu, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP, M=51200000, U=vpopmail:vchkpw, T=DNS/RFC822/X-Unix, A=/usr/local/libexec/dovecot/dovecot-lda -d $u Then I added to my .mc file: MAILER(dovecot) I added to my mailertable: dovecot.fechner.net dovecot:dovecot I create one entry in the virtusertable to catch a email and forward it to dovecot (all other email have to handled by another imap server till dovecot is running fine): dovecot(a)fechner.net idefix(a)dovecot.fechner.net I created a domain and a user in vpopmail to catch idefix(a)dovecot.fechner.net. If I execute: doveadm auth test idefix(a)dovecot.fechner.net Password: passdb: idefix(a)dovecot.fechner.net auth succeeded extra fields: user=idefix(a)dovecot.fechner.net So I think the first part is fine. But if I try to sent an email to dovecot(a)fechner.net I get the error message: Aug 14 21:48:34 anny dovecot: lda(idefix(a)dovecot.fechner.net): Fatal: setuid(89(vpopmail) from userdb lookup) failed with euid=1002(idefix): Operation not permitted (This binary should probably be called with process user set to 89(vpopmail) instead of 1002(idefix)) Aug 14 21:48:34 anny sendmail[94303]: s7EJXgma087740: to=<dovecot(a)fechner.net>, ctladdr=<idefix(a)anny.lostinspace.de> (1002/0), delay=00:14:52, xdelay=00:00:00, mailer=dovecot, pri=120389, relay=dovecot, dsn=4.0.0, stat=Deferred: dovecot mailer (/usr/local/libexec/dovecot/dovecot-lda) exited with EX_TEMPFAIL It seems to be a problem with dovecot-lda but I have no idea what is wrong. The user is set in the .m4 file and permission/group/user is set in the auth socket correctly. The output of doveconf -n is: # 2.2.13: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-STABLE amd64 zfs auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes first_valid_uid = 10 mail_debug = yes mail_location = maildir:/usr/local/vpopmail/domains/%d/%n/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = cache_key=%u%r%l webmail=127.0.0.1 driver = vpopmail } service auth-worker { unix_listener auth-worker { group = vchkpw user = vpopmail } } service auth { unix_listener auth-userdb { group = vchkpw mode = 0666 user = vpopmail } user = vpopmail } service imap-login { inet_listener imap { port = 22143 } inet_listener imaps { port = 22993 } } service pop3-login { inet_listener pop3 { port = 22110 } inet_listener pop3s { port = 22995 } } userdb { args = quota_template=quota_rule=*:backend=%q driver = vpopmail } Thanks for any ideas who this could be fixed. Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

1 0

Trying Dovecot Replication with dsync
by Minhas Listas 14 Aug '14

14 Aug '14

Hi, I have a failover cluster for mail server with: Ubuntu12.04 + DRBD (for block replication) + Ext4 filesystem + Dovecot-2.0.19-2 with Mdbox It works fine with ~50k accounts. My cluster design: http://adminlinux.com.br/cluster_design.txt I plan to test Dovecot Replication with dsync to build an active/active cluster with load balancing. Can anyone direct me to some literature? A tutorial for example. I'm installing a cluster (for tests) with Ubuntu 14.04 + Ext4 filesystem (without Drbd) + Dovecot-2.2.9-1ubuntu2.1. My conf is in: http://adminlinux.com.br/replication-doveconf.txt I'm following this doc http://wiki2.dovecot.org/Replication but I'm getting some errors: 1) Aug 14 15:39:34 ceph1 dovecot: imap(account=domaintest.com): Error: open(/var/run/dovecot/replication-notify-fifo) failed: Permission denied What is the correct perms for /var/run/dovecot/replication-notify-fifo ? Currently: # ll /var/run/dovecot/replication-notify-fifo prw------- 1 root root 0 Aug 14 15:57 /var/run/dovecot/replication-notify-fifo| 2) Aug 14 16:02:34 ceph1 dovecot: dsync-server(account=domaintest.com): Error: Couldn't create lock */var/lib/imap/account=domaintest.com <http://domaintest.com>/*.dovecot-sync.lock: No such file or directory Aug 14 16:02:34 ceph1 dovecot: dsync-local(account=domaintest.com): Error: Couldn't create lock */var/lib/imap/account=domaintest.com <http://domaintest.com>/*.dovecot-sync.lock: No such file or directory In my production cluster, it is automatically created by dovecot when the user performs the first login: */var/lib/imap/*<account> for INDEX */var/spool/imap/*<account> for Mdbox Thanks! -- Thiago Henrique

1 0

panic: dsync and imapc
by Alex Ha 14 Aug '14

14 Aug '14

Hi Dovecot list! I try to sync from a remote imap server to my local dovecot server via the dsync tool with imapc. Here is my command: # /usr/local/dovecot/bin/dsync -c /usr/local/dovecot/etc/dovecot/dovecot.conf -D -o imapc_user= test(a)example.com -o imapc_password=pwd backup -R -u test(a)example.com imapc: Here the error message: dsync(test(a)example.com): Panic: file quota-maildir.c: line 827: unreached Please see the attached debug.txt for a full debug messages and stacktrace. System info OS: Ubuntu 14.04 Server 64 Bit Dovecot: 2.2.13 Thanks, Alex

1 0