April 2015 - dovecot - dovecot.org

Authentication with Samba using Kerberos fails
by Justin Clacherty 08 Apr '15

08 Apr '15

Hi, I've been having some problems getting GSSAPI authentication going against a samba (4.2) server and am hoping someone can point me in the right direction. I've searched through Google and haven't managed to find a solution yet. I followed the config instructions at http://wiki2.dovecot.org/Authentication/Kerberos and run through the testing. Testing from the server with telnet does as expected i.e. I get the "+" after I try "a authenticate GSSAPI". However, when I go to test from Thunderbird on while logged in on a Windows PC joined to the domain authentication fails and I see the following in mail.log (I'm running Ubuntu 14.04.2 LTS). Apr 8 11:49:18 server dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 8 11:49:18 server dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 8 11:49:18 server dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so Apr 8 11:49:18 server dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Apr 8 11:49:18 server dovecot: auth: Debug: auth client connected (pid=17667) Apr 8 11:49:18 server dovecot: auth: Debug: client in: AUTH#0111#011GSSAPI#011service=imap#011secured#011session=e8xMvSwTQgDAqCpl#011lip=192.168.1.1#011rip=192.168.1.101#011lport=143#011rport=49986 Apr 8 11:49:18 server dovecot: auth: Debug: gssapi(?,192.168.42.101,<e8xMvSwTQgDAqCpl>): Obtaining credentials for imap(a)server.corp.mydomain.com Apr 8 11:49:18 server dovecot: auth: Debug: client passdb out: CONT#0111#011 Apr 8 11:49:18 server dovecot: auth: Debug: client in: CONT<hidden> Apr 8 11:49:18 server dovecot: auth: Debug: gssapi(me(a)corp.mydomain.com,192.168.1.101,<e8xMvSwTQgDAqCpl>): security context state completed. Apr 8 11:49:18 server dovecot: auth: Debug: client passdb out: CONT#0111#011YIGVBgkqhkiG9xIBAgICAG+BhTCBgqADAgEFoQMCAQ+idjB0oAMCAReibQRrkGiOLsky4fbzWGzpxgW4mjmpjvNsiCqH8MnsUKviP9v1oVLPXSVkqFzFUiCLAd130ldnf742o/inz9Dx6e0aETwDKnnZu9OUD2nCGg/f5zA20IXGWR1zXVJi3hEB8nmrLgaENhyX0JMiE6g= Apr 8 11:49:18 server dovecot: auth: Debug: client in: CONT<hidden> Apr 8 11:49:18 server dovecot: auth: Debug: gssapi(me(a)corp.mydomain.com,192.168.1.101,<e8xMvSwTQgDAqCpl>): Negotiated security layer Apr 8 11:49:18 server dovecot: auth: Debug: client passdb out: CONT#0111#011BQQF/wAMAAAAAAAAIvajggH////ubQhCZGfeuWGZQ7w= Apr 8 11:49:18 server dovecot: auth: Debug: client in: CONT<hidden> Apr 8 11:49:18 server dovecot: auth: Panic: file auth-request.c: line 716 (auth_request_is_disabled_master_user): assertion failed: (request->requested_login_user != NULL) Apr 8 11:49:18 server dovecot: auth: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x5e271) [0x7f524a7da271] -> /usr/lib/dovecot/libdovecot.so.0(+0x5e34e) [0x7f524a7da34e] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f524a795a9e] -> dovecot/auth(+0x15162) [0x7f524ac7e162] -> dovecot/auth(auth_request_lookup_credentials+0x22) [0x7f524ac7f8d2] -> /usr/lib/dovecot/modules/auth/libmech_gssapi.so(+0x20d4) [0x7f52499450d4] -> dovecot/auth(auth_request_handler_auth_continue+0xd1) [0x7f524ac81391] -> dovecot/auth(+0x1052a) [0x7f524ac7952a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x27) [0x7f524a7ea247] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xd7) [0x7f524a7eafd7] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f524a7e9de8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f524a79ac93] -> dovecot/auth(main+0x38c) [0x7f524ac7750c] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f5249d8dec5] -> dovecot/auth(+0xe6d9) [0x7f524ac776d9] Apr 8 11:49:18 server dovecot: auth: Fatal: master: service(auth): child 17668 killed with signal 6 (core dumps disabled) Apr 8 11:49:18 server dovecot: imap-login: Warning: Auth connection closed with 1 pending requests (max 0 secs, pid=17667, EOF) Apr 8 11:49:19 server dovecot: imap-login: Disconnected (auth process communication failure): user=<>, method=GSSAPI, rip=192.168.1.101, lip=192.168.1.1, TLS, session=<e8xMvSwTQgDAqCpl> Relevant parts of my config: auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_debug = yes auth_debug_passwords = no auth_default_realm = CORP.MYDOMAIN.COM auth_failure_delay = 2 secs auth_gssapi_hostname = server.corp.mydomain.com auth_krb5_keytab = /etc/dovecot/krb5.keytab auth_master_user_separator = auth_mechanisms = gssapi auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = yes auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 userdb { args = uid=dovecot gid=dovecot home=/var/vmail/%u default_fields = driver = static override_fields = } Any help greatly appreciated. Cheers, Justin.

1 0

Search Public Folder
by Bobber 08 Apr '15

08 Apr '15

I'm trying to use doveadm fetch to search a folder that is public for all users. The command runs but the output is empty. There are no error messages. Is there anything different to do in order to search public folders? -- *Bob Wooldridge*

1 0

Search Public Folder
by Bob Wooldridge 08 Apr '15

08 Apr '15

I'm trying to use doveadm fetch to search a folder that is public for all users. The command runs but the output is empty. There are no error messages. Is there anything different to do in order to search public folders? -- Bob Wooldridge EDM Incorporated http://www.edm-inc.com

1 0

Deleting empty folders
by Samuel Williams 07 Apr '15

07 Apr '15

So, along with the problem of lots of folders ending in 1 1 1 1, I'd like to have a strategy to delete these. I was trying to understand if it is possible to use http://linux.die.net/man/1/doveadm-expunge to delete empty folders, but without also deleting messages? Is this possible and if so what is the syntax? Kind regards, Samuel

5 10

What to read about interactions
by Andrew Sullivan 07 Apr '15

07 Apr '15

Hi, TL;DR: I am having a hard time synthesizing the information I need out of the website/wiki documentation, and google isn't turning up what I need, so I'm looking for advice on what I should read next to understand the way aliases, dovecot's lmtp, and pigeonhole work together. Details below. I've been using dovecot happily for some years, but in a recent migration of my mail server I set up something that I think will be slightly easier to maintain. I now have a single (in my case postgres) database backing all user names and so on, with postfix relying on dovecot auth for user validation and delivery. I have the usual anti-spam machinery in there, and have started using the (for me new) pigeonhole implementation of sieve. (My old mail system was built around the earlier dovecot implementation, and while I've patched it over time it's really pretty creaky.) On the whole, this all seems very nice, but I'm having a hard time understanding the details of what interacts with what other bits when. In particular, my mail system is known by several different names, and I thought it'd be much handier to have everything land in one real mailbox, since I could sort the inbound mail into different mailboxes without a lot of trouble using seive. This has turned out to be slightly trickier than I thought it ought to be (procmail is in some ways easier), and I've come to the conclusion that I don't have a strong foundation in exactly how this is supposed to work. Apart from reading the code (which would probably at this point be hard enough for me so as to make it impossible), are there things I ought to read to understand this better? I've read the seive RFCs, but while that gives me a clue about what ought to happen protocol-wise, it isn't helping me at all to understand the interaction among the different subsystems so that I can see clearly how different parts of the delivery chain are interacting. I'm sure there's some crucial bit of, "Everyone knows that," that I've overlooked, and I thought it would be better to ask for the FM than just to read randomly until I stumbled on it. Thanks, A -- Andrew Sullivan ajs(a)crankycanuck.ca

2 1

currupt folder structure --> INBOX 1 1 1 1 1
by Thorben Hemmler 07 Apr '15

07 Apr '15

Hi all! I´ve got a problem with some (not all) of my mailboxes. If you see, some folders got strange names. 41943652 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:42 INBOX 1 42205306 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:46 INBOX 1 1 42336882 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:48 INBOX 1 1 1 42337295 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:49 INBOX 1 1 1 1 42598861 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:51 INBOX 1 1 1 1 1 42730114 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:54 INBOX 1 1 1 1 1 1 42730261 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:57 INBOX 1 1 1 1 1 1 1 42730276 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:57 INBOX 1 1 1 1 1 1 1 1 42730291 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:58 INBOX 1 1 1 1 1 1 1 1 1 42730306 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 10:59 INBOX 1 1 1 1 1 1 1 1 1 1 42730321 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:00 INBOX 1 1 1 1 1 1 1 1 1 1 1 42730336 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:01 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 42730351 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:02 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 1 42730366 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:03 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 1 1 42730381 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:04 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 42730400 4.0K drwx------ 3 vmail vmail 4.0K Mar 25 11:05 INBOX 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 and so on..... Any ideas what I´m doing wrong? Thanks in advance. Best regards, Thorben

1 0

Using dovecot to serve an email archive
by Ramón Casares 06 Apr '15

06 Apr '15

I have a collection of old email messages, archived as follows: 1) One file per message. 2) Messages (=files) distributed in a hierarchy of dirs under mailarch. 3) Each file (=message) uses the name <seconds>.R<sha1>.mail Here <seconds> is the date of the message, expressed as the number of seconds from 1-1-1970 00:00 in 10 digits, and <sha1> is the SHA-1 hash of the message contents, expressed in hexadecimal, [0-9a-f]. The advantages of this file naming scheme are: 1) All important metadata are in the file name. 2) You can verify the integrity of each message using only its own data and metadata. 3) Each file name is unique. 4) It is compatible with maildir (qmail) unique names (uniq). 5) If a dir is sorted alphabetically, then it is ordered chronologically. 6) The extension .mail can be used to call an appropriate message reader. >From time to time I add new messages and dirs to the archive, but some dirs are closed forever, so it would be nice to tar.gz'ip them. Now I am looking for an IMAP server that can serve this collection in a read-only (ro) manner. That is, the server should not write the mailarch dir at all. I am exploring two possibilities: 1) using hard links. 2) using FUSE to set a rw layer on top of the ro archive layer. But I am new to dovecot, so perhaps there is an easier way to achieve what I want, and therefore I would appreciate very much your advice.

2 2

Sieve/ManageSieve documentation on Wiki2
by Robert Blayzor 06 Apr '15

06 Apr '15

Is it possible the Sieve/ManageSieve documentation on the Wiki can be cleaned up? It's incredibly confusing now. Some of the Sieve configuration information says certain options are deprecated, but then the example on how to configure it uses the deprecated options rather than what they *should* be now. More confusion is the sieve plugin configuration listing those same deprecated options, yet when you pull the document on how to configure ManageSieve, it (again) uses deprecated configuration information? http://wiki2.dovecot.org/Pigeonhole/ManageSieve/Configuration Or am I missing something? -- Robert inoc.net!rblayzor http://inoc.net/

2 1

IMAP logging / rawlog
by G H 06 Apr '15

06 Apr '15

I am trying to monitor with Nagios that my phones are consistently checking into dovecot via IMAP. I used to be able to parse syslog for imap-login messages. I have since updated my phones, the phoness email client (k9-mail) and dovecot. Now the imap-login messages are few and far between. However, I can clearly see via tcpdump that some traffic is happening when I click refresh on k9. I enabled "rawlog" support in dovecot, but it doesn't seem to write to disc frequently enough. 1) Does anyone have a better suggestion for how to monitor that my phone is checking in regularly? 2) Is there a flush-to-disk capability for rawlog in dovecot? 3) Also, when you have imap_zlib plugin enabled, the rawlog logs the raw compressed data instead of the decompressed IMAP commands. Is this an oversight? (FYI: k9 is calling SELECT "INBOX" on refresh) Thanks, G H

2 1

Question About Dovadm syntax
by Kenneth Ulrich 06 Apr '15

06 Apr '15

Hello All, I just have a quick question about doveadm commands. 1. Is there a command that we can use to count emails for a particular end user? 2. If an end user needed to copy/move emails from one account to another, is there a command? Also, I've searched Google results, numerous Ubuntu, CentOS, Fedora forums, Doveadm forums, and read the DoveCot/DoveADM man pages numerous times and either I am over looking, or I am not understanding. Thus why I am asking here.

2 1