January 2015 - dovecot

[PATCH] Make Delivered-To optional
by Nagy, Attila 13 Jan '15

13 Jan '15

Hi, I've read at least one e-mail on this list about making delivered-to in lmtpd optional, but now I need this too, so I made a patch. The default remains as is now (enabled). Rationale: I would like to dsync users and I have catchall POP mailboxes (meaning: a single mailbox gets the mails for a lot of e-mail addresses). If I deliver the e-mails to Dovecot's lmtpd as the original RCPT TO, the Delivered-To header can be used for the POP client to sort the messages on their side to the correct mailbox, but because Dovecot sees this as a new user, it adds it to the replicator.db. Now imagine a single mailbox with thousands of e-mail addresses, this will make thousands of entries in replicator.db, all of which Dovecot would like to replicate independently... If I deliver to the mailbox uid, Dovecot dsync will work right (only one user will be added, no matter how many different e-mail addresses end up in this mailbox), but the Delivered-To will contain the uid, so the user can't use that to sort the messages into their final destination on their side. So the solution here is that I disable the addition of Delivered-To header in Dovecot (because it doesn't know what is the original address) and add it in an upper layer, so during the lmtp transaction, the message will already contain the right value. Currently Dovecot adds another Delivered-To line, which confuses the clients. Please add this feature to Dovecot. Thanks,

1 0

Re: Maildir permissions on creation?
by Von Random 13 Jan '15

13 Jan '15

Yes, and it is not my use case, sadly. ACLs are meant for imap, not filesystem access and mail_access_groups is also useless for some reason. It just does not change anything. Probably because I don't use mail_location and variables when I provide path for home. (It's stored as is in a database on mailbox creation.) 26.12.2014, 12:07, "Tobi" <tobster(a)brain-force.ch>: > Have you checked the dovecot wiki for 'filepermissions in shared mailboxes' ? > Explains how dovecot set ACL when creating mailboxes > > Am 26. Dezember 2014 09:37:37 MEZ, schrieb Von Random <von(a)vdrandom.org>: >> Err, my bad, of course 0640 on files in case of setgid on directories. >> >> 26.12.2014, 11:36, "Von Random" <von(a)vdrandom.org>: >>> The main reason is that I don't want to provide backup user with >> unnecessary write permissions within maildirs and mail user within >> backup logs dir. I was talking about mail_user:mail_group 0750 on dirs >> and 0640 on files. (Or, possibly, mail_user:backup_group 2750 and >> 2640.) >>> 26.12.2014, 11:19, "Tobi" <tobster(a)brain-force.ch>: >>>> Whats the reason you do not want to use default dovecot user. Your >> idea would assume that at least the group must have write access. For >> me a no-go on mailboxes. >>>> Am 24. Dezember 2014 13:21:15 MEZ, schrieb Von Random >> <von(a)vdrandom.org>: >>>>> Hello. >>>>> >>>>> In my configuration dovecot reads home from mysql and uses no >> variables >>>>> within it. It uses Maildir++ storage with virtual users. I also >> happen >>>>> to use LMTP. >>>>> >>>>> I want to use a backup solution that does not involve running >> itself as >>>>> root. Neither do I want to run it as dovecot's mail user. >>>>> >>>>> And there lies the problem: dovecot creates maildirs with 0700 and >>>>> files within them inherit that set of permissions. And there seems >> to >>>>> be no sane way to control it. I think I've figured out what to >> patch in >>>>> order to change that default, but if possible, I'd like to avoid >> doing >>>>> that. >>>>> >>>>> tl;dr: is it possible to change the default set of permissions for >> new >>>>> maildirs created by dovecot? >>>> - -- >>>> Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail >> gesendet. >>>>>> -----BEGIN PGP SIGNATURE----- >>>>>> Version: APG v1.1.1 >>>>>> >>>>>> iQI7BAEBCgAlBQJUnRoiHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK >>>>>> CRA1HOYlqGik5L9iD/9FIE2JzWfB7fWJEbI3vVg+ar4LRGwW1xNIf8ahlytPbsmH >>>>>> D9dFP3kWpJH6TO41AksNjz/FxHcUqSrlsKYTFUsDZCyb9Zyxd8Jv+dH04FwUzw+y >>>>>> kq+ayoylnTN7Q8mQnqkUpWEuYd5ohWbbUUSguwzN8Zd1T4jCFR9/Lvu0cweE6meu >>>>>> mBGwvXBbfBP4El+mAM2lKnoMXQpMycS6aX7FwQ/fBaoWSkzg/2az69UtqG6LLF67 >>>>>> ZhJkbn17cpT3y/l/2nV5urdcFVh8RoSXNuYyMN4r7IDKQ6BPsneD+839LS9X/gP/ >>>>>> QMuo5nO5xdx4q1bT9gtv1zz5eKAJ1f3R2oPZyxdpiV5PruSY3J3kvu0cF0aJvQF6 >>>>>> +s0iDsoDBcueB6JEUnYAarteWvBvxRnqb8ytju1xbIEkKLZtaS8Gf2cpZ8eA+Ha/ >>>>>> D0zkYfq7bt+Ra7BY6Qh7XMfiN5z9eWe5RqOmVLZRLf9N75U6wWa+fmXpvlqEtGNV >>>>>> pKsgif/ivCHiA24+JSJ1PBRjwO36Tu4MsSlT2WnkvyFBQzFzg9T00fl+uTXzgNEz >>>>>> SBta2wmXk9XVJ9mPzfNrAaAA3+T6H90Sj1CbRt7NZx30UdwYoIL5XXEtnG0p1XdS >>>>>> moe91H2UE+NT+jgj7emAOLxJf86vIwiHCqI0Zl/7wVNJEnKBXJP5WIHcdEDEHg== >>>>>> =Tl/z >>>>>> -----END PGP SIGNATURE----- > > - -- > Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet. > -----BEGIN PGP SIGNATURE----- > Version: APG v1.1.1 > > iQI7BAEBCgAlBQJUnSVbHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK > CRA1HOYlqGik5GvTEACYhFfqS5hK4rAoHCzDd5vFwCLIE/ESheJhREbpewE4k7Nq > BGR1hKygYeAnj3w1CB9R4sgRBOTHSpRuIzk1ZMId5UuQOBxy8ukRzA5xiAoP22lw > AxB6Ek7e7VLz0998GmoN7uw1t5tczR1SkHscs0XfuBCBJrvo79DHYs7CP18oDTic > m5NVJS0MZzJGWPSDGwN6WPwRbLZMTZHc79h+WTmYz9Fzet2As71npvP0PiLd4hQP > xMlgUXCF1vXTUPUGf/NtQfy/xjaww4sEMqOxpigjLLMmnz+OFPo9Mar0uWvNBCgq > 3rTUqAUaMcLS8ANyvqzPXXba67dl+rNYuK33tWom+H17JzNf1rdYKxtc7IVQgm/E > RfYhIejH9yQR0/8CHw+ySF3mJdiQsZHMKL4PwXhRzp9OuOU8RZts1bve8pJEHGSr > ZQjqjiNB/DyE0s9uNh94U58mwGT8FKHQPR52EPF2WyNlyet1aYUCNQlXm2Qe+3FI > k4D4eJpRfWIHS5x7NALuwrki+/OqFvDphzKCTmhIC2Qa8UnKvxaS9VccW2Z5D9R9 > PHoOb2pgm5bIOUtsWUCykDiTwh5IA0jReoGPRlXmFK/tuhHawdrbfUlQ/YrVAX8w > p+FhchB5e5LNnBOjIXDB9c+viuobF3qo3uoOqjAwGTkEqIdwsiswCUPfjZJD+A== > =XfBH > -----END PGP SIGNATURE-----

2 1

pigeonhole: upgrade 0.4.3 -> 0.4.6 broke script storage
by Petar Bogdanovic 12 Jan '15

12 Jan '15

Hi, I ran into some troubles while upgrading pigeonhole: crane dovecot: lda(petar): Error: sieve: Failed to access user storage (temporary failure) crane dovecot: lda(petar): Error: sieve: file storage: Could not find storage root directory; path was left unconfigured and autodetection failed After reading through the changelog, I noticed that there have been some changes in the script storage location syntax but that old prefix-less paths should still work fine. My lda-configuration is very simple: # lda protocol lda { mail_plugins = sieve postmaster_address = <snip> } plugin { sieve = /data/dovecot/user/%u.sieve sieve_extensions = +editheader sieve_max_redirects = 50 } And even if I change $sieve to: sieve = file:/data/dovecot/user/%u.sieve the error messages disappear but based on the sudden unfiltered wave of mails in my INBOX that I usually store somewhere else, I guess the path still doesn't work. Any ideas? Thanks, Petar Bogdanovic

2 3

Dovecot replication over TCP/SSL, certificate error
by Jonas Plitt 12 Jan '15

12 Jan '15

Hi All, I'm running TCP-based dsync replication on two dovecot nodes. Nowdays i tried to enable SSL (TCPS). I changed mail_replica prefix from tcp:* to tcps:* and added ssl=yes to the inet_listener. Then on running *doveadm sync* i'm getting the following message: " *doveadm(example(a)example.com <example(a)example.com>): Error: Couldn't initialize SSL context: Can't load CA certs from directory /etc/ssl/certs: error:02001024:system library:fopen:File name too longdoveadm: Error: Failed to iterate through some users*" this is my config (part): *ssl_cert = </etc/ssl/certs/alpha-servers.pemssl_key = </etc/ssl/private/alpha-servers.keyssl_ca = </etc/ssl/certs/startcom-ca-bundle.pemssl_client_ca_dir = /etc/ssl/certsssl_client_ca_file = </etc/ssl/certs/startcom-ca.pemssl_protocols = !SSLv2 !SSLv3* The file startcom-ba-bundle contains the complete chain. The file startcom-ca contains only the ca certificate. Can anybody help, please? -- with kind regards, Jonas

2 2

Solaris 10 make check core dumps
by Brian Eliassen 12 Jan '15

12 Jan '15

Hello everyone, I'm doing a standard build on Solaris 10 with Dovecot 2.2.15 without anything fancy: ./configure make make check make install Configure output looks like this: *** Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : poll I/O notifys .... : none SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file shadow pam checkpassword : -bsdauth -sia -ldap -sql -vpopmail userdbs ........ : static prefetch passwd passwd-file checkpassword : -ldap -sql -vpopmail -nss SQL drivers .... : : -pgsql -mysql -sqlite Full text search : squat : -lucene -solr *** Everything works properly including the "make" until I try a "make check" at which time I receive the following failure. It would appear that something in test-http-auth is most unhappy. http auth challenges valid [0]: parse `Basic realm="WallyWorld"' ..... : ok http auth challenges valid [0]: [0]->scheme = Basic .................. : ok /bin/bash: line 1: 28057 Segmentation Fault (core dumped) ./$bin make[2]: *** [check-test] Error 1 make[2]: Leaving directory `/export/home/brian/software/dovecot-2.2.15/ src/lib-http' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/export/home/brian/software/dovecot-2.2.15/ src' make: *** [check-recursive] Error 1 This creates: -rw------- 1 root 1000 3523871 Jan 7 10:43 core Can this be safely ignored and I can proceed to "make install" or should I look somewhere else for the problem? Here is the mdb backtrace: $ mdb test-http-auth core Loading modules: [ libc.so.1 ld.so.1 ] > ::stack libc.so.1`strlen+0x50(29487, ffbffb00, ffbff43d, 0, 0, 0) libc.so.1`vsnprintf+0x70(4f2c0, 10f, 29478, ffbffaf8, 10, ff1c7078) t_noalloc_strdup_vprintf+0x3c(4f2c0, ffbffaf8, ffbffa2c, 1, 19, 0) p_strdup_vprintf+0xc(4cb90, 29478, ffbffaf8, ff1c759c, 4cc38, 4cb8c) t_strdup_printf+0x38(29478, 0, 0, 61fefeff, 80808080, 1010101) test_http_auth_challenges_valid+0x150(29000, 29400, 0, 4f250, 4cbb8, 0) test_run_funcs+0x24(4ca74, 1c00, ff1c7940, 4, ff312a00, ff13866c) test_run+0xc(4ca74, ffbffc7c, ffbffc84, 4f030, ff310140, 0) _start+0x5c(0, 0, 0, 0, 0, 0) Any help would be greatly appreciated. Brian

2 2

Dovecot on Fedora 20 or 21
by David Mehler 10 Jan '15

10 Jan '15

Hello, Is anyone running Dovecot on either a Fedora 20 or 21 system? I'm having an issue, on a system reboot, which I admit does not happen often, Dovecot fails to start in the systemctl list, output is status failed. The issue seems to be Dovecot can not bind to the ipv6 address. Now later if I manually log in to the box and start dovecot it works just fine no problems. I've googled and seen similar issues to this. Does anyone have a solution? Thanks. Dave.

4 3

pop3 seen
by David Saez 10 Jan '15

10 Jan '15

Hi Is there a way to know if a message has been dowloaded via pop3 and not seen via imap ?

4 5

Re: dovecot on wheezy, best ssl configuration ?
by Joseph Tam 10 Jan '15

10 Jan '15

ml(a)ruggedinbox.com writes: > Our smtp server is postfix, can you please suggest a better > 'ssl_protocols' and 'ssl_cipher_list' configuration ? > We are running Debian 7 Wheezy A useful command to know is "openssl ciphers" run on the server that will tell you the ciphers available given a protocol and cipher list spec. If it comes out to empty, your client won't be able to negotiate any SSL sessions, and you'll have include more ciphers. For example, TLSv1 protocol minus any low-grade encryption or SSLv2 ciphers: $ openssl ciphers -tlsv1 'ALL:\!LOW:\!SSLv2' ADH-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:ADH-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:ADH-DES-CBC3-SHA:EXP-ADH-DES-CBC-SHA:ADH-RC4-MD5:EXP-ADH-RC4-MD5:EDH-RSA-DES-CBC3-SHA:EXP-EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC3-SHA:EXP-EDH-DSS-DES-CBC-SHA:DES-CBC3-SHA:EXP-DES-CBC-SHA:IDEA-CBC-SHA:EXP-RC2-CBC-MD5:RC4-SHA:RC4-MD5:EXP-RC4-MD5 Joseph Tam <jtam.home(a)gmail.com>

1 0

dovecot on wheezy, best ssl configuration ?
by ml＠ruggedinbox.com 10 Jan '15

10 Jan '15

Hi all, when hardening dovecot against the POODLE vulnerability, we followed the advise to disable SSL2 and SSL3 but this is giving problems with some email clients (claws-mail). ssl_protocols = !SSLv2 !SSLv3 results in the following error: dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=XXX, lip=XXX, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher, session=<2C8jBjIMmQBVGNd1> Our smtp server is postfix, can you please suggest a better 'ssl_protocols' and 'ssl_cipher_list' configuration ? We are running Debian 7 Wheezy Thank you, RuggedInbox team

4 8

auth-deny : from file to LDAP
by hummel＠pasteur.fr 09 Jan '15

09 Jan '15

Hello Timo, I want to deny access to some users. For now I'm doing it using 2 passdb's and listing users in a text file. !include auth-deny.conf.ext -> passwd-file driver !include auth-ldap.conf.ext -> ldap driver I want to do the same using only LDAP. I'm not quite sure how to do it : a) should I . change the driver of the first passdb from passwd-file to ldap . for user to be rejected, add an LDAP attribute named "foo" with a value of "yes" and map it with something like this : pass_attrs = ....,foo=deny in dovecot-ldap.conf.ext ? b) or could I use only one ldap passdb by changing the pass_filter from pass_filter = (&(objectClass=posixAccount)(uid=%u)) to something like pass_filter = (&(objectClass=posixAccount)(uid=%u)(!foo=yes)) ? Thanks -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Groupe Exploitation et Infrastructure

3 4