April 2016 - dovecot - dovecot.org

How to make quota_status policy to apply to postfix virtual aliases as well?
by Hamy 04 Apr '16

04 Apr '16

HelloI am setting up a postfix+dovecot setup and using quota-status service to reject mails for full mailboxes on smtp session, according to this: https://sys4.de/en/blog/2013/04/08/postfix-dovecot-mailbox-quota/ This is working fine and without any apparent issues. however, Postfix doesn't seem to consult the policy when you're using virtual alias addresses. a virtual alias, is the one that you usually define with virtual_alias_maps . what happens is that Postfix only verifies there is a corresponding value for the given email address and blindly accept it. And it seems smtpd_recipient_restrictions , only applies to the original email address and postfix does not consult that after applying virtual alias. Does any one have any idea how to solve this? is there a setting that i'm missing? or is there a better way to setup email aliases that solve this issue? Best Regards,

1 0

1 last error
by Jason Pruim 03 Apr '16

03 Apr '16

Hey Everyone, I’m down to 1 last error that I know I created on my own but I can’t figure out how to fix it… Here is the error that I’m getting: Apr 3 04:29:37 ip-172-31-24-2 postfix/qmgr[20458]: EFE01423E2: from=<me(a)spike.net>, size=359, nrcpt=1 (queue active) Apr 3 04:29:37 ip-172-31-24-2 dovecot: lda(beth(a)primelashdiva.info): Fatal: setresgid(89(postfix),89(postfix),97(dovecot)) failed with euid=97(dovecot): Operation not permitted Apr 3 04:29:37 ip-172-31-24-2 postfix/pipe[20745]: EFE01423E2: to=<beth(a)primelashdiva.info>, relay=dovecot, delay=22, delays=22/0.01/0/0.01, dsn=4.3.0, status=deferred (temporary failure) So I figure that I messed up the permissions on /etc/dovecot/conf.d I tried to fix it even by setting it way open: drwxrwxrwx 2 dovecot dovecot 4096 Mar 30 00:56 conf.d And it still doesn’t work! doveconf -n: $ doveconf -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 4.1.17-22.30.amzn1.x86_64 x86_64 ext4 auth_mechanisms = plain login first_valid_uid = 89 hostname = mail.primelashdiva.info mail_location = maildir:/var/vmail/%d/%n/Maildir mail_privileged_group = dovecot mbox_write_locks = fcntl namespace inbox { inbox = yes location = prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } postmaster_address = postmaster(a)primelashdiva.info protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = dovecot mode = 0666 user = dovecot } user = dovecot } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = no ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem ssl_protocols = !SSLv2 !SSLv3 userdb { args = uid=postfix gid=postfix home=/var/mail/vhosts/%d/%n driver = static } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = } [ec2-user@ip-172-31-24-2 dovecot]$ It might be too late for me to concentrate enough to figure it, but my googling isn’t bringing up any info… Any pointers? Thanks Everyone! Jason Pruim pruimj(a)gmail.com 352.234.3175

3 3

Problem with GSSAPI
by Luca Bertoncello 03 Apr '16

03 Apr '16

Hi list! I'm really puzzled... I have a Mailserver with Dovecot 2.2.9 (installed from Ubuntu 14.04-Repositories) and it works well with LDAP-Authentication agains the Active Directory. Now I want to use GSSAPI to allow the clients (with Thunderbird 38.7.1) to read E-Mails without giving a password. I configured Dovecot using these HowTos: http://mindref.blogspot.de/2011/02/dovecot-kerberos.html http://wiki.dovecot.org/Authentication/Kerberos But it does not work... In mail.log I can just see: Apr 3 09:52:26 mail dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 3 09:52:26 mail dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 3 09:52:26 mail dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so Apr 3 09:52:26 mail dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 3 09:52:26 mail dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libauthdb_ldap.so Apr 3 09:52:26 mail dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Apr 3 09:52:26 mail dovecot: auth: Debug: auth client connected (pid=2300) Apr 3 09:52:26 mail dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.50.54, lip=192.168.50.3, session=<x8Sq5I8vsADAqDI2> and Thunderbird says that the Ticket was not accepted and I have to check if I'm logged into the Kerberos/GSSAPI subsystem. I checked with tcpdump and I see that Thunderbird does NOT send at all any request. Could someone help me? Thanks a lot! Luca Bertoncello (lucabert(a)lucabert.de)

2 2

[PATCH 0/7] Fixes for lib-mail message-address
by Pali Rohár 03 Apr '16

03 Apr '16

Hello, I borrowed dovecot parser for email addresses and going to use it in new perl module as replacement for Email::Address. During implementation and testing I found bugs in dovecot parser & generator. So I'm sending my patches together with tests. Pali Rohár (7): lib-mail: message_address_write: Fix generating empty group list lib-mail: message_address_write: Fix generating group list with empty name lib-mail: parse_addr_spec: Like in rfc822_skip_comment() check if last_comment is not NULL lib-mail: parse_addr_spec: Email address without local-part is invalid lib-mail: parse_mailbox: Set display name instead mailbox when parsing failed lib-mail: message_address_write: Quote and escape strings if needed lib-mail: Update tests for message address src/lib-mail/message-address.c | 99 +++++++++++++++++++++++++++++++---- src/lib-mail/test-message-address.c | 11 +++- 2 files changed, 98 insertions(+), 12 deletions(-) -- 1.7.9.5

2 2

Dovecot rest api
by use experience 03 Apr '16

03 Apr '16

Team, Need more information on dovecot rest api. Any detailed information about list of dovecot rest apis other than http://www.dovecot.fi/dovecot-launches-a-gmail-api-compatible-rest-api-to-e… will really helpful.

3 2

Found 4 bugs in latest SquirrelMail related to IMAP and SMTP STARTTLS, Dovecot capabilities
by Tobias 03 Apr '16

03 Apr '16

This is a cross-post from the squirrelmail-devel list. It may be of interest if you want to run SquirrelMail and connect to Dovecot (and Postfix, possibly other servers) on a remote host using STARTTLS. BR Tobias -------- Forwarded Message -------- Subject: [SM-DEVEL] 4 bugs, IMAP and SMTP STARTTLS, Dovecot capabilities Date: Sun, 3 Apr 2016 04:27:56 +0200 From: Tobias <lists.zxinn(a)otaking.se> Reply-To: Squirrelmail Developers Mailing List <squirrelmail-devel(a)lists.sourceforge.net> To: squirrelmail-devel(a)lists.sourceforge.net Hello! I've looked for and have not seen any similar issues reported related to STARTTLS. Sourceforge wouldn't let me create an account or else I could have submitted bug reports directly. I'm using SquirrelMail 1.4.23 installed from latest FreeBSD Ports, together with PHP 5.6. I'm attempting to connect using STARTTLS to Dovecot 2.2.22 and Postfix 3.1.0. I've verified the code is not fixed for any of these four issues in the latest 1.5.2 SVN. Issue 2 is not as much of a problem in 1.5.2 as it is in 1.4.23 when using 'login' authentication. I connect to the IMAP and SMTP servers using their IP, but need to override the 'peer_name' to validate the certificate properly. New in PHP 5.6 is also that verify_peer defaults to TRUE, which means I need to either be able to set the peer_name, or disable verify_peer. I've found three issues in functions/imap_general.php, related to STARTTLS and Dovecot IMAP server, as well as one STARTTLS issue in class/deliver/Deliver_SMTP.class.php, class class Deliver_SMTP, function initStream. Issue 1: Stream options ($imap_stream_options) are not used with STARTTLS ($use_imap_tls = 2) in function sqimap_create_stream. The stream options are only used for $use_imap_tls = 1. How to fix: Add something like this: // set context options to allow for SSL option overrides @stream_context_set_option($imap_stream,$stream_options); Before trying to initiate the TLS session here: functions/imap_general.php :: function sqimap_create_stream 826: // start crypto on connection. suppress function errors. 827: if (@stream_socket_enable_crypto($imap_stream,true,STREAM_CRYPTO_METHOD_TLS_CLIENT)) { Issue 2: IMAP capabilities are only read once in function sqimap_create_stream (and subsequently used in sqimap_login to determine certain login options), however the capability list for Dovecot is not the same before and after STARTTLS. From Dovecot, before STARTTLS (telnet <local-ip> 143): * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready. From Dovecot, after successful STARTTLS (openssl s_client -starttls imap -connect <local-ip>:143): <SSL session info> --- . OK Pre-login capabilities listed, post-login capabilities have more. a capability * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN a OK Pre-login capabilities listed, post-login capabilities have more. How to fix: Issue "capability" command after successful STARTTLS to re-read the capabilities. Either as part of function sqimap_create_stream, or after call to sqimap_create_stream and before login options are checked in function sqimap_login. SquirrelMail 1.4.23 uses the return value with capabilities from function sqimap_create_stream to determine if 'login' is a viable option. Dovecot reports LOGINDISABLED prior to STARTTLS. (1.5.2 does not have this check for 'login'.) Issue 3: Multi-line response from the server to the AUTHENTICATE PLAIN (and likely cram/digest md5, possibly even login) are not accepted. The IMAP protocol allows the server to prefix responses which are incomplete with "*", and Dovecot uses this to report capabilities after successful login, but this is not handled by SquirrelMail's sqimap_login function. SquirrelMail reports: Unknown error: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE QUOTA The full output from Dovecot is: * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE QUOTA A003 OK Logged in How to fix: Check if '*' is the first token in a response, and read another line from the stream. Possibly something similar to this: while (substr($read,0,1) == '*') { // OK so far.. $read = sqimap_fgets($imap_stream); } Issue 4: Identical to issue 1 but for SMTP. $use_smtp_tls = 2 and STARTTLS in class/deliver/Deliver_SMTP.class.php, class class Deliver_SMTP, function initStream, does not honor stream options. BR Tobias ----- squirrelmail-devel mailing list Posting guidelines:http://squirrelmail.org/postingguidelines List address:squirrelmail-devel@lists.sourceforge.net List archives:http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options):https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

1 0

Still muddling through with broken auth...
by Jason Pruim 03 Apr '16

03 Apr '16

Hey Everyone, I’m still muddling through my first install… Followed the tutorials on workaround.org <http://workaround.org/> which were very helpful! but don’t include much info if things don’t work 100%… and so far I haven’t been able to pin down where the error is. When I try: telnet localhost 143 this is what shows up in the maillot: Apr 2 21:06:57 ip-172-31-24-2 dovecot: auth: Fatal: Unknown database driver 'sql' Apr 2 21:06:57 ip-172-31-24-2 dovecot: master: Error: service(auth): command startup failed, throttling for 2 secs Apr 2 21:06:57 ip-172-31-24-2 dovecot: imap-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<+lw34IYvVgB/AAAB> With the failed driver for the database, I tried mysql and sql both of which produce the same error… I have a few other issues but I think those are related farther upstream… Not being able to sign into round cube for webmail, because of it being unable to connect to the storage container… But I think that’s a round cube issue… I want to get postfix and dovecot playing nicely before I worry too much about things like webmail access… Here is my postconf -n: [ec2-user@ip-172-31-24-2 dovecot]$ postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 html_directory = no inet_interfaces = localhost inet_protocols = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop unknown_local_recipient_reject_code = 550 virtual_mailbox_domains = hash:/etc/postfix/virtual_mailbox_domains virtual_mailbox_maps = hash:/etc/postfix/virtual_mailbox_users virtual_transport = dovecot [ec2-user@ip-172-31-24-2 dovecot]$ What else can I provide? Thanks! Jason Pruim pruimj(a)gmail.com 352.234.3175

3 11

Dovecot with LDAP/AD has problem with uid/gid
by Luca Bertoncello 02 Apr '16

02 Apr '16

Hi list! I have a Server connected to an AD and I need to configure Dovecot to authenticate the users against the AD (with password and GSSAPI). Now I'm trying to connect Dovecot to the AD with password. The authentication works, but I always got this error: Apr 2 13:03:49 mail dovecot: pop3-login: Login: user=<lucabert>, method=PLAIN, rip=192.168.50.1, lip=192.168.50.3, mpid=3508, session=<ZWJDc34vDgDAqDIB> Apr 2 13:03:49 mail dovecot: pop3(lucabert): Error: stat(/var/spool/mail/lucabert/tmp) failed: Permission denied (euid=10001(lucabert) egid=10000(domain users) missing +x perm: /var/spool/mail/lucabert, dir owned by 1005:8 mode=0700) Apr 2 13:03:49 mail dovecot: pop3(lucabert): Error: Couldn't open INBOX: Internal error occurred. Refer to server log for more information. [2016-04-02 13:03:49] My configuration: # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-83-generic x86_64 Ubuntu 14.04.4 LTS nfs auth_gssapi_hostname = mail.cch.intra auth_mechanisms = plain login cram-md5 gssapi auth_use_winbind = yes auth_username_chars = disable_plaintext_auth = no login_greeting = mail.cch.intra ready. mail_fsync = always mail_gid = 8 mail_location = maildir:/var/spool/mail/%Ln mail_nfs_index = yes mail_uid = 1005 mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = " imap pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = uid=1005 gid=8 euid=1005 } userdb { args = uid=1005 gid=8 home=/var/spool/mail/%n allow_all_users=yes driver = passwd-file override_fields = uid=1005 gid=8 euid=1005 } auth-ldap.conf.ext: passdb { driver = ldap # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext # Default fields can be used to specify defaults that LDAP may override #default_fields = home=/home/virtual/%u override_fields = uid=1005 gid=8 euid=1005 } and in my /etc/dovecot/dovecot-ldap.conf.ext I have: user_attrs = \ =uid=1005, \ =gid=8, \ =quota_rule=*:bytes=%{ldap:quotaBytes}, \ =home=/var/spool/mail/%{ldap:sAMAccountName}, \ =mail=maildir:/var/spool/mail/%{ldap:sAMAccountName}/Maildir But it seems that all these settings for uid/gid will be ignored/overwritten... Of course the Mailboxes have user 1005 and group 8. Can someone help me? Thanks Luca Bertoncello (lucabert(a)lucabert.de)

1 1

Save UID & metadata of mail in mysql table
by use experience 02 Apr '16

02 Apr '16

Team, I would like to save UID and metadata of mail in mysql table. I am trying to achieve this using dovecot plugin mail-filter. Also would like to do in the process of mail store (using Dovecot LDA). How can I get UID & metadata through script.

2 3

SIS deduplication fails to create intermediate directories and funny permissions
by Jesus Cea 01 Apr '16

01 Apr '16

I have configured my system to use SIS, sharing the same same storage for all users, and offline deduplication. I have this in my "root" cron: """ 53 1 * * * /usr/local/bin/doveadm purge -A 16 * * * * /usr/local/bin/doveadm sis deduplicate /home/dovecot/buzones/attachments /home/dovecot/buzones/attachments/queue """ Yes, it is launched as "root" but I would expect doveadm drop privileges as soon as possible. This is working great, but from time to time I get this error message: """ Your "cron" job on babylon5 /usr/local/bin/doveadm sis deduplicate /home/dovecot/buzones/attachments /home/dovecot/buzones/attachments/queue produced the following output: Error: mkdir(/home/dovecot/buzones/attachments/dc/62/hashes) failed: No such file or directory """ Looks like doveadm is trying to create the "hashes" directory but the parent "62" doesn't exits yet. If I create that directory by hand and set permissions correctly, everything (seems to) work. Talking about this, I see something strange wit the permissions. All files and directories in SIS are created with "dovemail" user and group EXCEPT the "hashes" directory inside the newly created directory. That is: When I get the error message, I have this: """ drwx------ 7 dovemail dovemail 7 Apr 1 13:28 . drwx------ 237 dovemail dovemail 237 Mar 24 20:09 .. drwx------ 3 dovemail dovemail 3 Feb 29 02:30 1d drwx------ 3 dovemail dovemail 3 Mar 9 01:53 7f drwx------ 3 dovemail dovemail 3 Feb 29 02:30 88 drwx------ 3 dovemail dovemail 3 Feb 29 02:30 8d """ I create the missing directory by hand and change permissions. Now I have: """ drwx------ 7 dovemail dovemail 7 Apr 1 13:28 . drwx------ 237 dovemail dovemail 237 Mar 24 20:09 .. drwx------ 3 dovemail dovemail 3 Feb 29 02:30 1d drwx------ 3 dovemail dovemail 3 Apr 1 13:30 62 drwx------ 3 dovemail dovemail 3 Mar 9 01:53 7f drwx------ 3 dovemail dovemail 3 Feb 29 02:30 88 drwx------ 3 dovemail dovemail 3 Feb 29 02:30 8d """ I run the deduplicator again (as root) and it creates a "hashes" directory inside the "62" directory... with user/group root/root. """ drwx------ 2 root root 2 Apr 1 13:30 hashes """ -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

1 0