April 2015 - dovecot - dovecot.org

can't create folders under shared mailbox's INBOX
by luke.bigum＠lmax.com 08 Apr '15

08 Apr '15

Hello, I have a namespace / ACL problem with shared mailboxes that I can't figure out. I have a local user tam(a)crm.yb.lmax that shares it's INBOX and all other folders with on LDAP group. Members of that group can't create a folder under the shared local user's INBOX: [08-Apr-2015 11:43:05 +0000]: [9501] S: * MYRIGHTS tam(a)crm.yb.lmax lrwstipekxcd [08-Apr-2015 11:43:05 +0000]: [9501] S: A0004 OK Myrights completed. [08-Apr-2015 11:43:05 +0000]: [9501] C: A0005 CREATE tam(a)crm.yb.lmax/Templates [08-Apr-2015 11:43:05 +0000]: [9501] S: A0005 NO [NOPERM] Permission denied I *can* create a folder underneath another folder of the same shared user that already exists: [08-Apr-2015 11:43:47 +0000]: [99CE] S: * MYRIGHTS tam(a)crm.yb.lmax/Drafts lrwstipekxcd [08-Apr-2015 11:43:47 +0000]: [99CE] S: A0004 OK Myrights completed. [08-Apr-2015 11:43:47 +0000]: [99CE] C: A0005 CREATE tam(a)crm.yb.lmax/Drafts/Test [08-Apr-2015 11:43:47 +0000]: [99CE] S: A0005 OK Create completed. Creating the subfolder as the local user itself works fine: [08-Apr-2015 11:35:35 +0000]: [4E9C] C: A0005 CREATE INBOX/Templates [08-Apr-2015 11:35:35 +0000]: [4E9C] S: A0005 OK Create completed. However the local user creates INBOX/Templates, whereas the ldap user is creating under tam(a)crm.yb.lmax/Templates. Is this an artifact of how we've set up namespaces below? Thanks, -Luke [root@localhost dovecot]# doveconf -n # 2.2.15: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.6 (3e924b1b6c5c+) # OS: Linux 2.6.32-358.11.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) auth_master_user_separator = * default_login_user = vmail disable_plaintext_auth = no doveadm_password = secret doveadm_port = 12345 first_valid_gid = 490 first_valid_uid = 490 imapc_ssl_verify = no listen = * mail_access_groups = vmail mail_location = mdbox:~/mdbox/ mail_plugins = " zlib acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl mdbox_preallocate_space = yes mdbox_rotate_size = 10 M namespace { hidden = no ignore_on_failure = no inbox = no list = yes location = mdbox:/srv/mail/%%d/%%n/mdbox prefix = %%u/ separator = / subscriptions = yes type = shared } namespace personal { hidden = yes inbox = yes location = mailbox LMAX-Sent { auto = subscribe } mailbox Sent { auto = subscribe special_use = \Sent } prefix = INBOX/ separator = / subscriptions = yes type = private } passdb { args = scheme=SSHA512 /etc/dovecot/local-users.passdb driver = passwd-file } passdb { args = scheme=SSHA512 /etc/dovecot/master-users.passdb driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap skip = authenticated } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes.db sieve = ~/%d/%n/.dovecot.sieve sieve_dir = ~/%d/%n/sieve sieve_extensions = +notify +imapflags +vacation-seconds sieve_vacation_min_period = 10s zlib_save = gz zlib_save_level = 6 } protocols = imap lmtp sieve replication_dsync_parameters = -d -l 30 -U service auth { unix_listener auth-userdb { group = vmail user = vmail } } service config { unix_listener config { user = vmail } } service imap-login { process_limit = 500 process_min_avail = 2 user = vmail } service imap-postlogin { executable = script-login /etc/dovecot/ldap_groups.sh user = vmail } service imap { executable = imap imap-postlogin } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </etc/pki/tls/certs/localhost.crt ssl_client_ca_file = /etc/pki/tls/certs/ca-bundle.crt ssl_key = </etc/pki/tls/private/localhost.key userdb { args = /etc/dovecot/local-users.userdb driver = passwd-file } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes verbose_ssl = yes protocol lmtp { mail_plugins = " sieve" } protocol imap { mail_plugins = " zlib acl imap_acl" } --- LMAX Exchange, Yellow Building, 1A Nicholas Road, London W11 4AN http://www.LMAX.com/ --- #1 Fastest Growing Tech Company in UK - Sunday Times Tech Track 100 (2014) Awards 2015 Best FX Trading Venue - ECN/MTF - WSL Institutional Trading Awards 2014 Best Margin Sector Platform - Profit & Loss Readers' Choice Awards 2014 Best FX Trading Venue - ECN/MTF - WSL Institutional Trading Awards 2014 Best Infrastructure/Technology Initiative - WSL Institutional Trading Awards 2013 #15 Fastest Growing Tech Company in UK - Sunday Times Tech Track 100 2013 Best Overall Testing Project - The European Software Testing Awards 2013 Best Margin Sector Platform - Profit & Loss Readers' Choice Awards 2013 Best FX Trading Platform - ECN/MTF - WSL Institutional Trading Awards 2013 Best Executing Venue - Forex Magnates Awards 2011 Best Trading System - Financial Sector Technology Awards 2011 Innovative Programming Framework - Oracle Duke's Choice Awards --- FX and CFDs are leveraged products that can result in losses exceeding your deposit. They are not suitable for everyone so please ensure you fully understand the risks involved. This message and its attachments are confidential, may not be disclosed or used by any person other than the addressee and are intended only for the named recipient(s). This message is not intended for any recipient(s) who based on their nationality, place of business, domicile or for any other reason, is/are subject to local laws or regulations which prohibit the provision of such products and services. This message is subject to the terms at http://www.lmax.com/pdf/general-disclaimers.pdf however if you cannot access these, please notify us by replying to this email and we will send you the terms. If you are not the intended recipient, please notify the sender immediately and delete any copies of this message. LMAX Exchange is the trading name of LMAX Limited. LMAX Limited operates a multilateral trading facility. LMAX Limited is authorised and regulated by the Financial Conduct Authority (firm registration number 509778) and is a company registered in England and Wales (number 6505809). LMAX Hong Kong Limited is a wholly-owned subsidiary of LMAX Limited. LMAX Hong Kong is licensed by the Securities and Futures Commission in Hong Kong to conduct Type 3 (leveraged foreign exchange trading) regulated activity with CE Number BDV088.

1 0

ACL syntax for setting specified folders within Maildir/ read-only for owner
by kepa 08 Apr '15

08 Apr '15

Hi, I have dovecot (2.2.16, see dovecot -n at end) installed to /opt on CentOS 6 for access on a local network. I would like to create an archival mail account which will reduce the primary account file size and still make older emails easily accessible. How can I set specified folders in this Maildir read-only with ACL? For example, I included this in the dovecot-acl file to specify protected folders in the archives@ Maildir but it did not work: "Email 2013/*" user=archives lrs "Email 2014/*" user=archives lrs Also tried this on folders without spaces with no success (the folders were still delete-able by the user via the Thunderbird client). Each "Email..." folder has several child folders that should also be read-only. BTW, what is the maximum size for a Maildir that Dovecot can comfortably handle? Thanks! Kepa dovecot -n: # 2.2.16: /opt/dovecot/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-504.12.2.el6.x86_64 x86_64 CentOS release 6.6 (Final) mail_location = maildir:~/Maildir mail_plugins = acl namespace inbox { inbox = yes location = [mailbox info ...] plugin { acl = vfile:/opt/dovecot/etc/dovecot/dovecot-acl } protocols = imap service imap-login { inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } protocol imap { mail_plugins = acl imap_acl

2 1

Users can't use Dovecot IMAP
by John Lewis 08 Apr '15

08 Apr '15

Every time a user logs into Dovcot's IMAP service PAM closes the session immediately after it opens. I would like a user to have a session open long enough to read some emails. dictator@drakeclasher:~$ sudo dovecot -n # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.14-0.bpo.1-amd64 x86_64 Debian 7.8 mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = failure_show_msg=yes %s driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap lmtp" ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { driver = passwd } userdb { args = mail driver = pam } Apr 6 21:57:29 drakeclasher su[2346]: pam_unix(su:session): session opened for user mailtest by dictator(uid=0) Apr 6 21:59:55 drakeclasher su[2346]: pam_unix(su:session): session closed for user mailtest dictator@drakeclasher:~$ groups mailtest mailtest : Domain Users mail users

2 2

Dovecot keeps creating info files in mail directory instead of home
by Jeffrey 'jf' Lim 08 Apr '15

08 Apr '15

I've been trying to troubleshoot this for a while now, and I'm really at a loss. My userdb is set up correctly to return home, and mail, and a test with 'doveadm user' verifies this: # doveadm user user@domain field value uid 1000 gid 1000 home /var/domain/user mail maildir:/var/mail/user@domain I've reloaded, restarted, stopped and started dovecot again - and even deleted the info files in the mail directory just to be sure - but each and every time I log in with imap, dovecot recreates the files again (dovecot.index.log, dovecot-uidlist, etc.) in the mail directory instead of home. I've even made sure just in case that the home directory is accessible to all, and chmod 777, but nothing gets created there. And I dont get any errors at all in the logs. I'm on the latest version (2.2.16). -jf -- He who settles on the idea of the intelligent man as a static entity only shows himself to be a fool. Mensan / Full-Stack Technical Polymath / System Administrator 12 years over the entire web stack: Performance, Sysadmin, Ruby and Frontend

3 3

Authentication with Samba using Kerberos fails
by Justin Clacherty 08 Apr '15

08 Apr '15

Hi, I've been having some problems getting GSSAPI authentication going against a samba (4.2) server and am hoping someone can point me in the right direction. I've searched through Google and haven't managed to find a solution yet. I followed the config instructions at http://wiki2.dovecot.org/Authentication/Kerberos and run through the testing. Testing from the server with telnet does as expected i.e. I get the "+" after I try "a authenticate GSSAPI". However, when I go to test from Thunderbird on while logged in on a Windows PC joined to the domain authentication fails and I see the following in mail.log (I'm running Ubuntu 14.04.2 LTS). Apr 8 11:49:18 server dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 8 11:49:18 server dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 8 11:49:18 server dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so Apr 8 11:49:18 server dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Apr 8 11:49:18 server dovecot: auth: Debug: auth client connected (pid=17667) Apr 8 11:49:18 server dovecot: auth: Debug: client in: AUTH#0111#011GSSAPI#011service=imap#011secured#011session=e8xMvSwTQgDAqCpl#011lip=192.168.1.1#011rip=192.168.1.101#011lport=143#011rport=49986 Apr 8 11:49:18 server dovecot: auth: Debug: gssapi(?,192.168.42.101,<e8xMvSwTQgDAqCpl>): Obtaining credentials for imap(a)server.corp.mydomain.com Apr 8 11:49:18 server dovecot: auth: Debug: client passdb out: CONT#0111#011 Apr 8 11:49:18 server dovecot: auth: Debug: client in: CONT<hidden> Apr 8 11:49:18 server dovecot: auth: Debug: gssapi(me(a)corp.mydomain.com,192.168.1.101,<e8xMvSwTQgDAqCpl>): security context state completed. Apr 8 11:49:18 server dovecot: auth: Debug: client passdb out: CONT#0111#011YIGVBgkqhkiG9xIBAgICAG+BhTCBgqADAgEFoQMCAQ+idjB0oAMCAReibQRrkGiOLsky4fbzWGzpxgW4mjmpjvNsiCqH8MnsUKviP9v1oVLPXSVkqFzFUiCLAd130ldnf742o/inz9Dx6e0aETwDKnnZu9OUD2nCGg/f5zA20IXGWR1zXVJi3hEB8nmrLgaENhyX0JMiE6g= Apr 8 11:49:18 server dovecot: auth: Debug: client in: CONT<hidden> Apr 8 11:49:18 server dovecot: auth: Debug: gssapi(me(a)corp.mydomain.com,192.168.1.101,<e8xMvSwTQgDAqCpl>): Negotiated security layer Apr 8 11:49:18 server dovecot: auth: Debug: client passdb out: CONT#0111#011BQQF/wAMAAAAAAAAIvajggH////ubQhCZGfeuWGZQ7w= Apr 8 11:49:18 server dovecot: auth: Debug: client in: CONT<hidden> Apr 8 11:49:18 server dovecot: auth: Panic: file auth-request.c: line 716 (auth_request_is_disabled_master_user): assertion failed: (request->requested_login_user != NULL) Apr 8 11:49:18 server dovecot: auth: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x5e271) [0x7f524a7da271] -> /usr/lib/dovecot/libdovecot.so.0(+0x5e34e) [0x7f524a7da34e] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f524a795a9e] -> dovecot/auth(+0x15162) [0x7f524ac7e162] -> dovecot/auth(auth_request_lookup_credentials+0x22) [0x7f524ac7f8d2] -> /usr/lib/dovecot/modules/auth/libmech_gssapi.so(+0x20d4) [0x7f52499450d4] -> dovecot/auth(auth_request_handler_auth_continue+0xd1) [0x7f524ac81391] -> dovecot/auth(+0x1052a) [0x7f524ac7952a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x27) [0x7f524a7ea247] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xd7) [0x7f524a7eafd7] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f524a7e9de8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f524a79ac93] -> dovecot/auth(main+0x38c) [0x7f524ac7750c] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f5249d8dec5] -> dovecot/auth(+0xe6d9) [0x7f524ac776d9] Apr 8 11:49:18 server dovecot: auth: Fatal: master: service(auth): child 17668 killed with signal 6 (core dumps disabled) Apr 8 11:49:18 server dovecot: imap-login: Warning: Auth connection closed with 1 pending requests (max 0 secs, pid=17667, EOF) Apr 8 11:49:19 server dovecot: imap-login: Disconnected (auth process communication failure): user=<>, method=GSSAPI, rip=192.168.1.101, lip=192.168.1.1, TLS, session=<e8xMvSwTQgDAqCpl> Relevant parts of my config: auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_debug = yes auth_debug_passwords = no auth_default_realm = CORP.MYDOMAIN.COM auth_failure_delay = 2 secs auth_gssapi_hostname = server.corp.mydomain.com auth_krb5_keytab = /etc/dovecot/krb5.keytab auth_master_user_separator = auth_mechanisms = gssapi auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = yes auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 userdb { args = uid=dovecot gid=dovecot home=/var/vmail/%u default_fields = driver = static override_fields = } Any help greatly appreciated. Cheers, Justin.

1 0

Search Public Folder
by Bobber 07 Apr '15

07 Apr '15

I'm trying to use doveadm fetch to search a folder that is public for all users. The command runs but the output is empty. There are no error messages. Is there anything different to do in order to search public folders? -- *Bob Wooldridge*

1 0

Search Public Folder
by Bob Wooldridge 07 Apr '15

07 Apr '15

I'm trying to use doveadm fetch to search a folder that is public for all users. The command runs but the output is empty. There are no error messages. Is there anything different to do in order to search public folders? -- Bob Wooldridge EDM Incorporated http://www.edm-inc.com

1 0

Deleting empty folders
by Samuel Williams 07 Apr '15

07 Apr '15

So, along with the problem of lots of folders ending in 1 1 1 1, I'd like to have a strategy to delete these. I was trying to understand if it is possible to use http://linux.die.net/man/1/doveadm-expunge to delete empty folders, but without also deleting messages? Is this possible and if so what is the syntax? Kind regards, Samuel

5 10

What to read about interactions
by Andrew Sullivan 07 Apr '15

07 Apr '15

Hi, TL;DR: I am having a hard time synthesizing the information I need out of the website/wiki documentation, and google isn't turning up what I need, so I'm looking for advice on what I should read next to understand the way aliases, dovecot's lmtp, and pigeonhole work together. Details below. I've been using dovecot happily for some years, but in a recent migration of my mail server I set up something that I think will be slightly easier to maintain. I now have a single (in my case postgres) database backing all user names and so on, with postfix relying on dovecot auth for user validation and delivery. I have the usual anti-spam machinery in there, and have started using the (for me new) pigeonhole implementation of sieve. (My old mail system was built around the earlier dovecot implementation, and while I've patched it over time it's really pretty creaky.) On the whole, this all seems very nice, but I'm having a hard time understanding the details of what interacts with what other bits when. In particular, my mail system is known by several different names, and I thought it'd be much handier to have everything land in one real mailbox, since I could sort the inbound mail into different mailboxes without a lot of trouble using seive. This has turned out to be slightly trickier than I thought it ought to be (procmail is in some ways easier), and I've come to the conclusion that I don't have a strong foundation in exactly how this is supposed to work. Apart from reading the code (which would probably at this point be hard enough for me so as to make it impossible), are there things I ought to read to understand this better? I've read the seive RFCs, but while that gives me a clue about what ought to happen protocol-wise, it isn't helping me at all to understand the interaction among the different subsystems so that I can see clearly how different parts of the delivery chain are interacting. I'm sure there's some crucial bit of, "Everyone knows that," that I've overlooked, and I thought it would be better to ask for the FM than just to read randomly until I stumbled on it. Thanks, A -- Andrew Sullivan ajs(a)crankycanuck.ca

2 1

currupt folder structure --> INBOX 1 1 1 1 1
by Thorben Hemmler 07 Apr '15

07 Apr '15

Hi all! I´ve got a problem with some (not all) of my mailboxes. If you see, some folders got strange names. 41943652 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:42 INBOX 1 42205306 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:46 INBOX 1 1 42336882 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:48 INBOX 1 1 1 42337295 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:49 INBOX 1 1 1 1 42598861 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:51 INBOX 1 1 1 1 1 42730114 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:54 INBOX 1 1 1 1 1 1 42730261 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:57 INBOX 1 1 1 1 1 1 1 42730276 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:57 INBOX 1 1 1 1 1 1 1 1 42730291 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:58 INBOX 1 1 1 1 1 1 1 1 1 42730306 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:59 INBOX 1 1 1 1 1 1 1 1 1 1 42730321 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:00 INBOX 1 1 1 1 1 1 1 1 1 1 1 42730336 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:01 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 42730351 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:02 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 1 42730366 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:03 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 1 1 42730381 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:04 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 42730400 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:05 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 and so on..... Any ideas what I´m doing wrong? Thanks in advance. Best regards, Thorben

1 0