November 2015 - dovecot

Re: ssl-params: slow startup (patch for consideration)
by Joseph Tam 05 Nov '15

05 Nov '15

A. Schulze writes: > precomputing ssl-params is also possible without patching but it's a > little bit tricky > ... > Long version in german: https://andreasschulze.de/dovecot/ssl-params Nice. (You should probably point out to ensure ssl_parameters_regenerate is zero, otherwise all this work will get wiped out!) Joseph Tam <jtam.home(a)gmail.com>

2 1

Fw: new message
by Doug Wierenga 05 Nov '15

05 Nov '15

Hello! New message, please read <http://battersandco.com/meeting.php?e> Doug Wierenga

1 0

Fw: new message
by terry＠dop.com 05 Nov '15

05 Nov '15

Hello! New message, please read <http://profi2w.com.br/forget.php?80> terry(a)dop.com

1 0

ldap and proxy/proxy_maybe
by jjhoffart 04 Nov '15

04 Nov '15

Hello, I am trying to setup dovecot director and am receiving a lot of "Aborted login (proxy dest auth failed)" and "error proxying loops to itself" messages in the dovecot log. I don't fully understand the dovecot-ldap.conf file config? could someone please let me know if the following is correct. If so what could be causing the errors mentioned above, if not what needs to be corrected? hosts = 127.0.0.1:389 ldap_version = 3 auth_bind = yes dn = cn=vmail,dc=something,dc=somewhere dnpass = hi89Dfnptc55jRWG9oLQJUfWOH0CgV base = o=domains,dc=campus,dc=local scope = subtree deref = never # Below two are required by command 'doveadm mailbox ...' iterate_attrs = mail=user iterate_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)) user_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls%Lc)(|(mail=%u)(&(enabledService=shadowaddress)(shadowAddress=%u)))) user_attrs = mail=user,homeDirectory=home,=mail=maildir:~/Maildir/,mailQuota=quota_rule=*:bytes=%$ # Used for dn lookup pass_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls%Lc)(|(mail=%u)(&(enabledService=shadowaddress)(shadowAddress=%u)))) pass_attrs = mail=user,userPassword=password,someAttribute=proxy,hostName=host default_pass_scheme = CRYPT

1 0

ssl-params: slow startup (patch for consideration)
by Joseph Tam 04 Nov '15

04 Nov '15

Based on the recent found weaknesses in DH key exchange, http://weakdh.org/ I increased ssl_dh_parameters_length to 2048 bits, and found waited for 5+ minutes for dovecot to come back online after a restart. Unless you got a fast machine, the initialization of DH parameters can exceed your patience. Regeneration may not be a problem (if ssl_parameters_regenerate=0 or if Dovecot uses old parameters until regeneration finishes), but for cold starts, the server can be tied up for a few minutes creating DH parameters while clients queue up. I ran "openssl dhparam 2048" and got wildly varying run times of 1m45s, 11m56s, 0.4s, 2m19s, 3h23s. Most of the time was spent testing primality of candidate p *and* (p-1)/2 -- so called "safe prime". If you're unlucky, this can take a long time. However, it appears "safe" primes are not what they're cracked up to be -- they offer some guarantees, but are not safer than non-safe primes. Creating DH parameters without requiring primality of (p-1)/2 (i.e. what "openssl dhparam -dsaparam" does) results in much lower run-time bounds. I cribbed some OpenSSL code to create this (untested) patch. -------------------------------------------------------------------------------- --- iostream-openssl-params.c~ Tue Nov 3 16:08:38 2015 +++ iostream-openssl-params.c Tue Nov 3 15:43:39 2015 @@ -6,5 +6,2 @@ -/* 2 or 5. Haven't seen their difference explained anywhere, but 2 is the - default.. */ -#define DH_GENERATOR 2 @@ -14,2 +11,3 @@ DH *dh; + DSA *dsa; unsigned char *p; @@ -17,3 +15,13 @@ - dh = DH_generate_parameters(bitsize, DH_GENERATOR, NULL, NULL); + dsa = DSA_generate_parameters(bitsize, NULL, 0, NULL, NULL, NULL, NULL); + if (dsa == NULL) { + *error_r = t_strdup_printf( + "DSA_generate_parameters(bits=%d) failed: %s", + bitsize, openssl_iostream_error()); + return -1; + } + + dh = DSA_dup_DH(dsa); + DSA_free(dsa); + if (dh == NULL) { @@ -20,4 +28,4 @@ *error_r = t_strdup_printf( - "DH_generate_parameters(bits=%d, gen=%d) failed: %s", - bitsize, DH_GENERATOR, openssl_iostream_error()); + "DSA_dup_DH() failed: %s", + openssl_iostream_error()); return -1; -------------------------------------------------------------------------------- The other way to prevent long startup times is to pre-compute the DH parameter using "openssl dhparam -out dh2048.pem 2048". I can contribute a patch to do this (read file, convert it into ssl-parameters.dat, then set/behave like ssl_parameters_regenerate=0), but I couldn't figure out the best place to do this. ssl_params_if_unchanged()? Joseph Tam <jtam.home(a)gmail.com>

2 1

dovecot-lda can't create /var/mail dotlocks on debian
by John Clements 03 Nov '15

03 Nov '15

I've been using dovecot+postfix happily for many years, and I'm now configuring it for a new machine. However, I'm running into an old problem again, and thinking that there must be a better solution. The problem is that dovecot-lda is unable to create dotlock files in the /var/mail directory. Dovecot version: 1:2.2.13-12~deb8u1 (I'm guessing this is upstream version 2.2.13) OS: Debian Jessie Currently, my mail directory has these permissions: clements@desmond:~$ ls -ld /var/mail drwxrwsr-x 2 root mail 4096 Nov 2 22:07 /var/mail clements@desmond:~$ ls -l /var/mail total 8 -rw------- 1 clements mail 1382 Nov 2 21:59 clements -rw------- 1 granitemon mail 530 Nov 2 22:07 granitemon I've added mail_privileged_group = mail to allow creation of the dotlock files. When I configure postfix to deliver using dovecot-lda, I get logs that look like this: Nov 3 11:12:20 desmond dovecot: lda(granitemon): Error: setegid(privileged) failed: Operation not permitted Nov 3 11:12:20 desmond dovecot: lda(granitemon): msgid=< 20151103181306.A4B5B5FF32(a)desmond.XXXDOMAIN.org>: save failed to INBOX: BUG: Unknown internal error In order to isolate the error, I took postfix out of the equation, and called dovecot-lda directly: clements@desmond:/tmp$ cat bogusmail From: clements(a)XXXDOMAIN.org To: granitemon@localhost Date: November 3 2015 Subject: graaaah this is the body clements@desmond:/tmp$ /usr/lib/dovecot/dovecot-lda -e -d clements < bogusmail BUG: Unknown internal error clements@desmond:/tmp$ In response to this, mail.log now contains this similar error: Nov 3 11:34:57 desmond dovecot: lda(clements): msgid=unspecified: save failed to INBOX: BUG: Unknown internal error Nov 3 11:34:57 desmond dovecot: lda(clements): Error: setegid(privileged) failed: Operation not permitted I've tried a number of "random internet search" solutions, including - changing perms on mail files from 660 to 600 - enabling 'mail_access_groups=mail' in 10-mail.conf - adding individual users to the mail group. I guess I'm pretty confident that if dovecot is writing "BUG: Unknown internal error" in the logs, that this is is actually a bug in dovecot. OBresearch: I read through the release notes of 2.2.14 -- 2.2.19 to see if a relevant-looking bug had been fixed, but nothing jumped out at me. OBresearch: searching the dovecot mailing list, I found one *extremely* relevant thread called "Re: [Dovecot] started with dovecot sieve <http://dovecot.markmail.org/message/kgd34wberxuvmrsa?q=setegid>", but there didn't seem to be a solution contained in the thread. Final note: this doesn't appear to be confined to debian jessie: I took a look at my existing installation, and I see that in fact I just went ahead and made /var/mail world-writeable, which seems... sub-optimal. I'm sure I could do that here, too, but I'd certainly rather not. Thanks in advance, and let me know if I've left out relevant crucial information. Best, John Clements

2 7

[dovceot-2.2.19] doveadm fts expand constantly gives Segfault
by Marcin Mirosław 03 Nov '15

03 Nov '15

Hi! When I issue: doveadm fts expand -A body xxx I'm always getting Segfault. I can't find descrption of this command in manual, is it possible to add some information to manual? # gdb -q doveadm Reading symbols from doveadm...Reading symbols from /usr/lib64/debug//usr/bin/doveadm.debug...done. done. (gdb) set args fts expand -A body XXX (gdb) run Starting program: /usr/bin/doveadm fts expand -A body XXX Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error warning: File "/lib64/libthread_db-1.0.so" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load". To enable execution of this file add add-auto-load-safe-path /lib64/libthread_db-1.0.so line to your configuration file "/root/.gdbinit". To completely disable this security protection add set auto-load safe-path / line to your configuration file "/root/.gdbinit". For more information about this security protection see the "Auto-loading safe path" section in the GDB manual. E.g., run from the shell: info "(gdb)Auto-loading safe path" warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff65a61af in fts_user_get_search_tokenizer (user=<optimized out>) at fts-user.c:248 248 fts-user.c: No such file or directory. (gdb) bt #0 0x00007ffff65a61af in fts_user_get_search_tokenizer (user=<optimized out>) at fts-user.c:248 #1 0x00007ffff65a2f8a in fts_search_arg_expand (backend=0x555555802f10, argp=0x7fffffffdf10, pool=0x5555557e56e0) at fts-search-args.c:108 #2 fts_search_args_expand_tree (backend=backend@entry=0x555555802f10, pool=0x5555557e56e0, argp=argp@entry=0x7fffffffdf10) at fts-search-args.c:171 #3 0x00007ffff65a31a5 in fts_search_args_expand (backend=backend@entry=0x555555802f10, args=0x5555557e5700) at fts-search-args.c:199 #4 0x00007ffff2118b2e in cmd_fts_expand_run (ctx=0x5555557e2f10, user=<optimized out>) at doveadm-fts.c:127 #5 0x000055555557a945 in doveadm_mail_next_user (ctx=0x5555557e2f10, input=<optimized out>, error_r=0x7fffffffe028) at doveadm-mail.c:384 #6 0x000055555557bf53 in doveadm_mail_all_users (wildcard_user=0x0, argv=<optimized out>, ctx=0x5555557e2f10) at doveadm-mail.c:452 #7 doveadm_mail_cmd (argv=<optimized out>, argc=<optimized out>, cmd=<optimized out>) at doveadm-mail.c:621 #8 doveadm_mail_try_run (cmd_name=<optimized out>, argc=4, argv=0x5555557ce3a0) at doveadm-mail.c:710 #9 0x000055555556ba6a in main (argc=5, argv=0x5555557ce398) at doveadm.c:345 (gdb) mail_plugins = acl fts fts_lucene listescape quota notify mail_log stats zlib protocol lmtp { mail_plugins = acl fts fts_lucene listescape quota notify mail_log stats zlib sieve } protocol lda { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 25 mail_plugins = acl fts fts_lucene listescape quota notify mail_log stats zlib antispam imap_acl imap_quota imap_stats imap_zlib last_login } protocol pop3 { mail_plugins = acl fts fts_lucene listescape quota notify mail_log stats zlib last_login } Thanks, Marcin

1 0

[dovceot-2.2.19] doveadm fetch with fts_squat returns random results
by Marcin Mirosław 03 Nov '15

03 Nov '15

Hi all! I've got problem with results returned by doveadm fetch. The are random and incorrect. I'll try show you: - trying to fetch emails with both: nonexistent header name and non existent value of header name: -- doveadm fetch -u user@domain uid HEADER X-Sasdasdsendasasdasdasdasaer XXtuxie |grep -c uid 0 - trying to fetch email with: non existent header name and existent value of header (value exists usually in header X-Sender) -- # doveadm fetch -u user@domain uid HEADER X-Sasdasdsendasasdasdasdasaer tuxie |grep -c uid 13743 second search: -- # doveadm fetch -u user@domain uid HEADER X-Sasdasdsendasasdasdasdasaer tuxie |grep -c uid 16639 another search with the same criteria: -- doveadm fetch -u user@domain uid HEADER X-Sasdasdsendasasdasdasdasaer tuxie |grep -c uid 20296 so the number of fetched emails is random and none of them contains such header: -- # doveadm fetch -u user@domain hdr HEADER X-Sasdasdsendasasdasdasdasaer tuxie |grep -c X-Sasdasdsendasasdasdasdasaer 0 - now I'm searching for email with existent header contained existent value: -- # doveadm fetch -u user@domain uid HEADER X-Sender tuxie |grep -c uid 50699 second search: -- # doveadm fetch -u user@domain uid HEADER X-Sender tuxie |grep -c uid 50375 It looks for me that searching is done only for value of header not for both header name with given value. Next I turn off fts_squat in config and now results are correct. If someone uses doevadm expunge with fts_squat should be carefull. I just tried fts_lucene - no problem. Regards, Marcin

1 0

Initialization Failed:
by brian 01 Nov '15

01 Nov '15

Hi dovecotters I am trying to install dovecot on a mail server I am provisioning for myself in AWS. I am following an ArsTechnica guide, and at some stage in the process the author recommends and provides instructions to configure Dovecot (http://arstechnica.com/information-technology/2014/03/taking-e-mail-back-pa…) So, now I have it installed and configured (I believe the way suggested) but when I try to connect via IMAP I am getting an error. If I try : root@ip-10-0-0-244:~# telnet mail.myactualdomain.com 143 Trying 127.0.0.1... Connected to mail.myactualdomain.com. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready. a1 LOGIN brian(a)myactualdomain.com plaintextpassword * BYE Internal error occurred. Refer to server log for more information. Connection closed by foreign host. root@ip-10-0-0-244:~# If I go to /var/log/syslog I can see the following lines: Oct 31 05:31:06 ip-10-0-0-244 dovecot: imap-login: Login: user=<brian(a)myactualdomain.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=16934, secured, session=<oCTO2V8jUwB/AAAB> Oct 31 05:31:06 ip-10-0-0-244 dovecot: imap(brian(a)myactualdomain.com): Error: user brian(a)myactualdomain.com: Initialization failed: Namespace '': Unknown setting: /var/mail/vmail/myactualdomain.com/brian/mail Oct 31 05:31:06 ip-10-0-0-244 dovecot: imap(brian(a)myactualdomain.com): Error: Invalid user settings. Refer to server log for more information. root@ip-10-0-0-244:~# dovecot --version 2.2.9 So, I don't know why it's giving me an error about : Initialization failed: Namespace '': Unknown setting: /var/mail/vmail/myactualdomain.com/brian/mail The location is there, with the permissions with I believe the correct permissions. I'm a bit stuck as to where to even go from here. Any help would be greatly appreciated. Kind Regards Brian root@ip-10-0-0-244:~# dovecot -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-48-generic x86_64 Ubuntu 14.04.2 LTS auth_mechanisms = plain login auth_verbose = yes mail_home = /var/mail/vmail/%d/%n mail_location = maildir:~/Maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=ssha512 /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = ~/.dovecot.sieve sieve_after = /var/mail/vmail/sieve-after sieve_before = /var/mail/vmail/sieve-before sieve_dir = ~/sieve } protocols = imap sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } ssl_cert = </etc/ssl/private/ssl-chain-mail-myactualdomain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_client_ca_dir = /etc/ssl/certs ssl_key = </etc/ssl/private/ssl-key-decrypted-mail-myactualdomain.key userdb { args = uid=5000 gid=5000 home=/var/mail/vmail/%d/%n driver = static } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster(a)myactualdomain.com quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 10 }

2 2