June 2016 - dovecot - dovecot.org

exempt local auth-client UNIX socket from failed login penalty // add to login_trusted_networks ?
by Steffen Kaiser 29 Jun '16

29 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm using Dovecot v2.2 with unix_listener auth-client { } to verify passwords for a different service. However, it looks like that auth_failure_delay effects all connects going through that socket. I mean: connect /var/run/dovecot2.2/auth-client attempt bad auth 2s penalty NO disconnect ==> Note, it's another connection almost immediately following each connect /var/run/dovecot2.2/auth-client attempt good auth 2s penalty OK disconnect Can I disable auth_failure_delay for local UNIX sockets? How do I add it to login_trusted_networks? - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEVAwUBV20MbHz1H7kL/d9rAQKm1AgAiVjjSimUTapEbhqHwZzfQWLzcJlkfm2W z5smziGbVELYb0/COPd84GK6wyUF7+3iRZOuVPhLRdljhB72PWRe+hHX3KgMWHr2 1o5WLkX+0cGEwSXMvJ2w3ee/zmxYxva2WI+PjSzkgvvhxGMtnIxO7mMglEV5zbbq ZxJcC1Ba4T9qpUhRIw3EQ5VPRs4cnLBz3Im4IDGLduWAGJYf/Rrxh+x+k3IqMtzb v92ErjgQtz5bN+bgEtQ8C33UehoZeZ93eA3V8o/OiwZPtWyneWL6Yqwxni4LjtLI R4wuu0N6Ea/BbA/fsElquRer0bXH2Zkt5mckJpDG6Rbe/IO5WYXq0A== =axyE -----END PGP SIGNATURE-----

2 2

dsync unstable? (other strange detail)
by Heiko Schlittermann 29 Jun '16

29 Jun '16

Hi, I'm trying to migrate from Cyrus (remote side) to Dovecot 2.2.24 (local). On the local side the destinations folders, and indexes are empty. The command I'm using is doveadm \ -o mail_plugins= \ -o imapc_master_user=<cyrus-user> \ -o imapc_password=<cyrus-password> \ -o imapc_host=<cyrus-ip> \ \ -o imapc_ssl_verify=no \ -o imapc_ssl=imaps \ -o imapc_port=993 \ backup -f -u "heiko" -R imapc: \ || { rc=$? echo "EXIT: $rc" >&2 exit $rc } On successive runs of the above command I get: dsync(heiko): Warning: Deleting mailbox 'Serververwaltung.Mailinglisten Anforderung': UID=16 GUID= is missing locally EXIT: 75 dsync(heiko): Warning: Deleting mailbox 'Serververwaltung.Mailman': UID=2 GUID= is missing locally EXIT: 75 dsync(heiko): Warning: Deleting mailbox 'Serververwaltung.Servermeldungen': UID=514 GUID= is missing locally EXIT: 75 dsync(heiko): Warning: Deleting mailbox 'Serververwaltung.Servermeldungen.AIDE': UID=188292 GUID= is missing locally EXIT: 75 dsync(heiko): Warning: Deleting mailbox 'Serververwaltung.Servermeldungen.AIDE.AIDE - 2012': UID=9343 GUID= is missing locally EXIT: 75 Any idea where to look next? Is 'doveadm backup' the wrong tool for such migration? (I'd say with about 2.2.9 I had similar problems, but at least it didn't stop at every subfolder.) Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE - ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

2 6

FTS search used / useful on an IMAP proxy?
by Luca Lesinigo 29 Jun '16

29 Jun '16

We are preparing an IMAP proxy based on dovecot-2.2.22, basic proxy functionality is already working and I’m trying to understand if having the FTS service configured on the dovecot *proxy* would be of any use. I do suspect it would be useless, I guess dovecot in imap proxy mode just forwards any command to the backend and does not bother to do anything about it, but I’m failing to find a definitive answer in the documentation. If I am guessing correctly, an fts service would only be useful if configured and working on the actual backend. Can anyone clarify my doubts? thank you, -- Luca Lesinigo

3 2

Disabling passdb pam in local.conf
by Patrick Ben Koetter 28 Jun '16

28 Jun '16

Greetings, I'm trying to create a configuration that leaves every config file deployed by an install process or paket management software untouched. The goal is to put every configuration required into /etc/dovecot/local.conf. I've come quite far, but I fail to disable pam as passdb service in local.conf. What I get if I run doveconf -n is this section: passdb { driver = pam } It is in there, because 10-auth.conf includes it: !include auth-system.conf.ext These actions are not an option at the moment: - modify /etc/dovecot/conf.d/10-auth.conf and comment/remove the !include-statement - create an /etc/dovecot/dovecot.conf which would contain all options required and would not include any other *.conf files Reading http://wiki2.dovecot.org/ConfigFile I see ways to include external files, but nothing to exclude a file in local.conf. Knowing Timo I would expect there is a way to acchieve what I want. I just don't seem to find it. What am I missing? Regards, p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

8 20

Suggestion: Split login_trusted_networks
by Peter Mogensen 28 Jun '16

28 Jun '16

Hi, For the upcoming 2.3 development, I'd like to re-suggest this: It seems the use of login_trusted_networks is overloaded. Example: * It's used for indicating which hosts you trust to provide XCLIENT remote IP's. (like a proxy) * It's used for indicating from which hosts you trust logins enough to disable auth penalty. (like in a webmail) Often these two uses cases have a different set of hosts. So you can't have one set of hosts which you trust for XCLIENT and another set of hosts you trust for not being the origin of brute force attacks. /Peter

2 2

Where Dovecot stores subscribtions for shared folder
by Miloslav Hůla 27 Jun '16

27 Jun '16

Hi, could please someone hint me, where Dovecot stores subscribtions for shared folder? Our configuration: namespace { disabled = no hidden = no ignore_on_failure = no inbox = no list = children location = maildir:/vmail/user/%%n/Maildir:INDEXPVT=/vmail/user/%n/Maildir/Shared/%%n prefix = user.%%n. separator = . subscriptions = yes type = shared } When I subscribe to 'user.test', I'll get ~Maildir/Shared/test/.INBOX/dovecot.index.pvt.log in it. When I unsubscribe from 'user.test', file stays there and its hash is the same. Kind regards, Milo

2 1

doveadm purge -A includes users with gid outside of limits and then reports error
by Michal Hlavinka 27 Jun '16

27 Jun '16

Hi, one our user reported that when he runs "doveadm purge -A" it goes through users that don't have gid in the first_valid_gid-last_valid_git range and it reports error. For example: doveadm(dovenull): Error: user dovenull: Mail access for users with GID 996 not permitted (see first_valid_gid in config file, gid from userdb lookup). doveadm(dovenull): Error: User init failed auth/userdb-passwd.c : passwd_iterate_want_pw(...) has checks for UID range, but does not have checks for GID range. Is there any reason for this? We've added those checks (see attached patch) and all seems fine. Cheers, Michal Hlavinka

1 0

Mailboxes on NFS or iSCSI
by Miloslav Hůla 27 Jun '16

27 Jun '16

Hello, we are running Dovecot (2.2.13-12~deb8u1) on Debian stable. Configured with Mailbox++, IMAP, POP3, LMTPD, Managesieved, ACL. Mailboxes are on local 1.2TB RAID, it's about 5310 accounts. We are slowly getting out of space and we are considering to move Mailboxes onto Netapp disk array with two independent network connections. Are there some pitfalls? Not sure we should use NTP or iSCSI mounts (both open implementations are not so shiny). Thanks for sharing any experiences. Kind regards, Milo

3 3

fts_solr crashs
by M. Koehler 27 Jun '16

27 Jun '16

Hi, I´ve set up in dovecot 2.2.24-1~auto+49 (from dovecot repo) fts_solr and fts_tika - jetti8 (from Debian Jessie) and latest tika-server running on a seperate machine. But if I want to rescan all messages for reindexing for instance all attachments with "doveadm -v index -u user(a)domain.tld INBOX" with 3137 mail in the INBOX it counts and then by 2900 mails the doveadm crashes with the following error message: doveadm(user(a)domain.tld): Info: INBOX: Caching mails seq=1..3137 2900/3137doveadm(user(a)domain.tld): Error: fts_solr: Indexing failed: 500 Java heap space java.lang.OutOfMemoryError: Java heap space doveadm(user(a)domain.tld): Panic: file http-client-request.c: line 769 (http_client_request_send_payload): assertion failed: (ret == 0) doveadm(user(a)domain.tld): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x8dc1e) [0x7f269375ec1e] -> /usr/lib/dovecot/libdovecot.so.0(+0x8dc98) [0x7f269375ec98] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f26936fd02e] -> /usr/lib/dovecot/libdovecot.so.0(http_client_request_send_payload+0xc8) [0x7f2693716b88] -> /usr/lib/dovecot/modules/lib21_fts_solr_plugin.so(solr_connection_post_more+0x49) [0x7f2691c538b9] -> /usr/lib/dovecot/modules/lib21_fts_solr_plugin.so(+0x361e) [0x7f2691c4f61e] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x9a17) [0x7f2692ad5a17] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x9e20) [0x7f2692ad5e20] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(fts_build_mail+0x999) [0x7f2692ad6809] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x1056e) [0x7f2692adc56e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_precache+0x29) [0x7f2693a1f7b9] -> doveadm(+0x2e947) [0x7f26943be947] -> doveadm(+0x28daf) [0x7f26943b8daf] -> doveadm(+0x2989d) [0x7f26943b989d] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x278) [0x7f26943ba788] -> doveadm(doveadm_cmd_run_ver2+0x560) [0x7f26943c8c70] -> doveadm(doveadm_cmd_try_run_ver2+0x37) [0x7f26943c8cc7] -> doveadm(main+0x1df) [0x7f26943aa33f] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f2693347b45] -> doveadm(+0x1a716) [0x7f26943aa716] I don´t see any shortages on the seperate solr machine. What could I do? How do I get more details to locate the problem?! Thanks a lot and regards, Michael

2 2

fts_solr not working
by Jeff Gamsby 27 Jun '16

27 Jun '16

I am running ISPConfig 3 on Debian and have managed to install the dovecot-solr and dovecot-fts plugins. I have solr running undet tomcat at http://localhost:8880 but the indexing is not working. I am using Dovecot 2.17 I do not understand namespaces and why fts_solr needs them, I just want to index the entire users Maildir. I am trying to index a users mailbox but am getting the following error: (changed user name) doveadm fts rescan -u user(a)user.com inbox doveadm(user(a)user.com): Error: Namespace prefix not found: inbox running that in debig mode gives: doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/lib20_fts_plugin.so doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/lib21_fts_solr_plugin.so doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_zlib_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_zlib_plugin.so: undefined symbol: i_stream_create_deflate (this is usually intentional, so just ignore this message) doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so doveadm(user(a)user.com): Debug: Added userdb setting: mail=maildir:/var/vmail/user.com/user/Maildir doveadm(user(a)user.com): Debug: Added userdb setting: plugin/quota_rule=*:storage=0B doveadm(user(a)user.com): Debug: Added userdb setting: plugin/sieve=/var/vmail/user.com/user/.sieve doveadm(user(a)user.com): Debug: Effective uid=5000, gid=5000, home=/var/vmail/user.com/user doveadm(user(a)user.com): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/vmail/user.com/user/Maildir doveadm(user(a)user.com): Debug: maildir++: root=/var/vmail/user.com/user/Maildir, index=, control=, inbox=/var/vmail/user.com/user/Maildir, alt= doveadm(user(a)user.com): Debug: fts: No fts setting - plugin disabled doveadm(user(a)user.com): Error: Namespace prefix not found: inbox in conf.d/10-mail.conf I have this namespace defined: namespace inbox { # Namespace type: private, shared or public #type = private # Hierarchy separator to use. You should use the same separator for all # namespaces or some clients get confused. '/' is usually a good one. # The default however depends on the underlying mail storage format. #separator = # Prefix required to access this namespace. This needs to be different for # all namespaces. For example "Public/". #prefix = # Physical location of the mailbox. This is in same format as # mail_location, which is also the default for it. #location = # There can be only one INBOX, and this setting defines which namespace # has it. inbox = yes # If namespace is hidden, it's not advertised to clients via NAMESPACE # extension. You'll most likely also want to set list=no. This is mostly # useful when converting from another server with different namespaces which # you want to deprecate but still keep working. For example you can create # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/". #hidden = no protocol imap { plugin { fts = solr fts_solr = break-imap-search url=http://localhost:8880/solr/ } } protocol pop3 { plugin { fts = solr fts_solr = break-imap-search url=http://localhost:8880/solr/ } # Show the mailboxes under this namespace with LIST command. This makes the # namespace visible for clients that don't support NAMESPACE extension. # "children" value lists child mailboxes, but hides the namespace prefix. #list = yes # Namespace handles its own subscriptions. If set to "no", the parent # namespace handles them (empty prefix should always have this as "yes") #subscriptions = yes } I had to put this in dovecot.conf in order for the plugin to be enabled: mail_plugins = fts fts_solr solr is reachable at localhost:8880/solr and appears to be working. Please help, any suggestions are welcome Thanks

4 5