July 2016 - dovecot - dovecot.org

New password hashing scheme as plugin
by Andreas Meyer 05 Aug '16

05 Aug '16

Hi, I want to add a new password hashing scheme as plugin and provide it for the dovecot project, so that it will be included as optional plugin in future releases. Yet the plugin compiles fine and the .so file gets created. My approach is to call the functions password_scheme_register() and password_scheme_unregister() (src/auth/password-scheme.c) inside the plugin's _init() and _deinit() functions. When a client tries to login via imap the log shows an error message: Error: Couldn't load required plugin /usr/local/lib/dovecot/lib20_newauth_plugin.so: dlopen() failed: /usr/local/lib/dovecot/lib20_newauth_plugin.so: undefined symbol: password_scheme_unregister That error obviously occurs, because the required lib is not linked into the plugin. Now my problem is to understand, whether this approach (via .so file) can be successful at all and if so, how? Do I need to link libs into it? Which would that be and how do I specify them in the Makefile.am? I assume, I don't need to link a lib, but need to use a hook to register the new hashing scheme, since the plugin is loaded into an already existing process, which needs to get extended. If this is true, which hook would that be and how do I register the new scheme? Or is there no way to accomplish this via a separated .so plugin? Should I extend the sources in /src/auth instead? (separat file for the hashing scheme with preprocessor instructions to include it only on demand) Thank you very much, Andreas

3 8

SSL connection reset by peer
by Vince42 04 Aug '16

04 Aug '16

Hi, I am running a dovecot server and have set up an external monitoring, where every five minutes a login with SSL on port 993 is done. I usually get once a day an error "connection reset by peer - SSL connect", which goes away until the next monitor is executed. Initially I thought that raising the mail_max_userip_connections in protocol imap in 20-imap.conf to 256 should do the trick - but the error stays. What could be the reason for this error and which configuration values could be changed in order to avoid this error? I read a lot of different suggestions - but did not find a plausible explanation and recommendation. Thanks in advance! -- Cheers, \\|// Vince (o o) ----------------------------ooO-(_)-Ooo------------------------- ''' (o)_(o) [ ][0][ ] ô¿ô (=°o°=) World Domination by Copy and Paste [ ][ ][0] - (")_(") [0][0][0] () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Ooo. ---------------------------.ooO----( )------------------------- ( ) (_/ \_)

5 11

auth_bind with "()" in username not working
by Matthias Lay 02 Aug '16

02 Aug '16

Hi all, I have an AD testsetup with auth_bind setting auth_bind_userdn = "spdev\\%Ln" I created a testuser "claasc (test)" which works fine in all ldapfilters but not for the auth_bind. the log shows everything correct just "invalid credentials" mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: auth client connected (pid=12202) mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=T6knVtc0wQB/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39873 mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: client passdb out: CONT 1 mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: client in: CONT<hidden> mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: passwd-file(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): cache miss mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: passwd-file(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): lookup: user=claasc (test) file=/etc/dovecot/passwd.postmaster mail.info: Jun 9 14:12:31 dovecot: auth: passwd-file(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): unknown user (given password: HubertHans99) mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: ldap(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): cache miss mail.info: Jun 9 14:12:31 dovecot: auth: ldap(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): invalid credentials mail.debug: Jun 9 14:12:33 dovecot: auth: Debug: client passdb out: FAIL 1 user=claasc (test) mail.info: Jun 9 14:12:33 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<claasc (test)>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<T6knVtc0wQB/AAAB> So I guess its just a bind problem. strace output from auth process of imap login: write(26, "0-\2\1\4`(\2\1\3\4\25spdev\\claasc \$test\$\200\fHubertHans99", 47) = 47 the additional \\ in front of the brackets look strange to me and might be the reason. tested Version is 2.2.18 Greetz Matze

1 4

IMAP flags and dovecot-keywords not working as expected
by Mark Foley 01 Aug '16

01 Aug '16

I've converted most of our users from Outlook to Thunderbird. One important feature of Thunderbird is that it pays attention to the IMAP non-standard message flags via the 'tags' feature (see http://wiki2.dovecot.org/MailboxFormat/Maildir) This is important because 2 users make extensive use of Outlook categories (Tags, in Thunderbird). I found that when I set a message to the 1st Tbird tag 0 (Important), the corresponding IMAP file got an 'a' suffix. Likewise, if I manually added an 'a' suffix to an IMAP file the corresponding tag was set displayed in Thunderbird. This made it easy for me to exports Outlook Categories and set IMAP messages flags accordingly. This worked perfectly on the user I was experimenting with (me). Recently, I converted one of these Outlook 'categories' users to Thunderbird. I added the appropriate flag letters to their IMAP messages, changed their tag names in Thunderbird, and created the following dovecot-keywords file as: 0 Board_and_Committee 1 Completed 2 Health_Care_meetings 3 Notifications 4 OSHP-DAS 5 personal_or_To_Do 6 Retirement_exits 7 $label5 8 Junk 9 $Forwarded 10 $MDNSent 11 $label2 However, none of the tags show up correctly in Thunderbird. If I manually set a message to have a tag of 0, the corresponding IMAP file gets a flag of 'm', not 'a' and the following is added to the dovecot-keywords files: 12 $label1 How can I fix this? Where is "$label1" text defined? Why did Thunderbird not snag the text for '0' from the dovecot-keywords file and give the IMAP file a tag of 'a'? My current theory is that the "Default" Thunderbird Tags corresponding to IMAP flags are not changeable and if new tags are create in Tbird, they get new flag letters. That would, of course, mean that if a user changes Thunderbird tag name, they would lose all tag settings on existing message. That doesn't seem right and I hope my theory is wrong. Any insight would be appreciated. --Mark

2 3

POP3 & IMAP inbox setting for virtual
by Michael Fox 01 Aug '16

01 Aug '16

Posted Monday 7/25. Haven't seen a response. Trying again: --- This is a noobie question, so bear with me if it's not worded correctly: Primary Requirements: 1) I'd like to have two namespaces - one private/per-user, and one public (visible by all logged-in users). The public mailbox(s) would be used to distribute information to all users. 2) I'd like both POP3 and IMAP users to see both namespaces. As I understand it, this requires the use of the virtual plugin for POP3, in order to create a virtual namespace which would mix together the private and public namespaces into one mailbox. I have read: http://wiki.dovecot.org/Plugins/Virtual https://sys4.de/de/blog/2013/02/11/dovecot-virtual-setup-mit-globaler-sieve- spamfilter-regel-fur-pop3-nutzer/ (via Google translation) The example uses a CASE statement in the MySQL userdb query. As I understand it, this is done to set which namespace contains the inbox: the private namespace or the virtual namespace -- depending on if the user is connected via the imap or pop3 service, respectively. Question: how do I accomplish the same goal (setting the proper namespace for the inbox) when using a passwd-file style flat file userdb? Thanks, Michael

2 4

self signed certs and dovecot imaps : howto? tlsv1 alert unknown ca
by hanasaki＠gmail.com 01 Aug '16

01 Aug '16

How do you setup dovecot to use a self signed cert? One server will be connected to the internet. One will be totally internal and have no runtime access to the internet. Getting the below error msg. Also, I think I have a TLS 1.0 and need a 1.2 cert?... Thank you. Jul 28 20:09:27 host dovecot: imap-login:: user=<>, rip=10...., lip=10...., TLS: SSL_read() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<kK2aELspLpkKAQF5>

2 1

any news Enterprise Repository Access?
by Götz Reinicke - IT Koordinator 31 Jul '16

31 Jul '16

Hi, we had access to the repository and it was working fine. But as we cant get the 2.2.25 update I was looking into the repofolders and there are RPMs "just" for RHEL 6// but not 5 any more. My be I missed the latest discussions or announcements? Could you give me an update on information and may be the RHEL 5 RPMs too? Thanks a lot and regards . Götz

6 8

dovecot runs on a pbl listed ip ?
by Benny Pedersen 31 Jul '16

31 Jul '16

X-Spam-Report: * 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL * [52.178.156.48 listed in zen.spamhaus.org] * 3.6 FS_REPLICA Subject says "replica" * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0000] * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's * domain * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily * valid * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature * 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS Received: from talvi.dovecot.org (unknown [52.178.156.48]) by wursti.dovecot.fi (Postfix) with ESMTP; Sun, 31 Jul 2016 04:27:22 +0200 (CEST) sorry if its not just me :( make sure all wan ips is in trusted-networks / internal-networks atleast in spamassassin who will make a bug for replica ? :=)

2 1

migration from cyrus; seg fault at mail_namespaces_get_root_sep
by vstargben＠gmail.com 31 Jul '16

31 Jul '16

Hi all, I am currently trying to migrate from cyrus to dovecot on a new system. Though only few accounts, I decided to use the mdbox format. To convert I use cyrus2dovecot first, then I use dsync to import the mailboxes. For compatibility I set the namespace of inbox to prefix = INBOX. and separator = . (as described here: http://wiki2.dovecot.org/Migration/Cyrus http://wiki.dovecot.org/Namespaces) This works except that the clients (mutt and Thunderbird) show an additional folder/mailbox "INBOX" below the inbox. How can I fix that? Should I add a prefix during conversion and not change the namespace config? On disk, the subfolders are next to INBOX. Well, I then tried to set list = children instead of "yes" for namespace inbox. On login a segfault occurs with this setting. See the information and backtrace below. Regards, Vincent ########################################################### linux-server2:~ # dovecot --version 2.2.25 (7be1766) linux-server2:~ # dovecot -n # 2.2.25 (7be1766): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.15 (97b3da0) # OS: Linux 4.1.21-14-default x86_64 openSUSE 42.1 (x86_64) btrfs base_dir = /data/mail/dovecot/ disable_plaintext_auth = no mail_debug = yes mail_gid = dovecot mail_location = mdbox:/data/mail/dovecot/maildat/%u mail_privileged_group = dovecot mail_uid = dovecot managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes list = children location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp ssl = no ssl_dh_parameters_length = 2048 ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } ################################################################ GNU gdb (GDB; openSUSE Leap 42.1) 7.9.1 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-suse-linux". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://bugs.opensuse.org/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib/dovecot/imap...Reading symbols from /usr/lib/debug/usr/lib/dovecot/imap.debug...done. done. [New LWP 8366] Core was generated by `dovecot/imap'. Program terminated with signal SIGSEGV, Segmentation fault. #0 mail_namespaces_get_root_sep (namespaces=0x0) at mail-namespace.c:601 601 mail-namespace.c: Datei oder Verzeichnis nicht gefunden. Missing separate debuginfos, use: zypper install glibc-debuginfo-2.19-19.1.x86_64 (gdb) bt full #0 mail_namespaces_get_root_sep (namespaces=0x0) at mail-namespace.c:601 No locals. #1 0x0000559bfb1792a5 in cmd_list_ref_root (ref=0x559bfd155d78 "", client=0x559bfd155020) at cmd-list.c:324 ns = 0x0 ns_prefix = 0x559bfb1963ea "" ns_sep = <optimized out> str = <optimized out> #2 cmd_list_full (cmd=0x559bfd155c00, lsub=<optimized out>) at cmd-list.c:461 client = 0x559bfd155020 args = 0x559bfd1289b8 list_args = 0x7f02a7ab0093 <t_malloc0+35> arg_count = 21915 patterns = {arr = {buffer = 0x559bfd155d88, element_size = 8}, v = 0x559bfd155d88, v_modifiable = 0x559bfd155d88} ref = 0x559bfd155d78 "" pattern = 0x559bfd155d80 "" str = <optimized out> #3 0x0000559bfb1818ed in command_exec (cmd=cmd@entry=0x559bfd155c00) at imap-commands.c:180 hook = 0x559bfd125110 finished = <optimized out> cmd_start_timeval = {tv_sec = 1469732468, tv_usec = 662738} cmd_start_bytes_in = 29 cmd_start_bytes_out = 746 __FUNCTION__ = "command_exec" #4 0x0000559bfb17fe4f in client_command_input (cmd=cmd@entry=0x559bfd155c00) at imap-client.c:969 client = 0x559bfd155020 command = <optimized out> __FUNCTION__ = "client_command_input" #5 0x0000559bfb17fedf in client_command_input (cmd=0x559bfd155c00) at imap-client.c:1029 client = 0x559bfd155020 command = <optimized out> __FUNCTION__ = "client_command_input" #6 0x0000559bfb180285 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x559bfd155020) at imap-client.c:1069 No locals. #7 client_handle_input (client=client@entry=0x559bfd155020) at imap-client.c:1081 _data_stack_cur_id = 3 remove_io = false handled_commands = true __FUNCTION__ = "client_handle_input" #8 0x0000559bfb180785 in client_input (client=0x559bfd155020) at imap-client.c:1128 cmd = 0x559bfd136130 output = 0x559bfd155a40 bytes = 36 ---Type <return> to continue, or q <return> to quit--- __FUNCTION__ = "client_input" #9 0x00007f02a7ac49dc in io_loop_call_io (io=0x559bfd155b10) at ioloop.c:564 ioloop = 0x559bfd124740 t_id = 2 __FUNCTION__ = "io_loop_call_io" #10 0x00007f02a7ac5ce7 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x559bfd124740) at ioloop-epoll.c:220 ctx = 0x559bfd126260 list = 0x559bfd127c90 io = <optimized out> tv = {tv_sec = 1799, tv_usec = 999471} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #11 0x00007f02a7ac4a65 in io_loop_handler_run (ioloop=ioloop@entry=0x559bfd124740) at ioloop.c:612 No locals. #12 0x00007f02a7ac4c18 in io_loop_run (ioloop=0x559bfd124740) at ioloop.c:588 __FUNCTION__ = "io_loop_run" #13 0x00007f02a7a5a1e3 in master_service_run (service=0x559bfd1245e0, callback=<optimized out>) at master-service.c:640 No locals. #14 0x0000559bfb173eb2 in main (argc=1, argv=0x559bfd124390) at main.c:460 set_roots = {0x559bfb39c520 <imap_setting_parser_info>, 0x7f02a8274b20 <lda_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x559bfd11c050 "\210\300\021\375\233U", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x559bfb18cbd0 <login_client_connected>, failure_callback = 0x559bfb18c560 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = 0x559bfb19530e "auth-master" c = <optimized out> (gdb)

1 0

Occasional lock timeouts on Linode VM with Dovecot Replication
by Reuben Farrelly 31 Jul '16

31 Jul '16

I've been seeing periodic entries in my dovecot logs like this: dovecot[3464]: dsync-server(kaylene): Error: Couldn't lock /home/kaylene/.dovecot-sync.lock: Timed out after 30 seconds: 3 Time(s) dovecot[3464]: dsync-server(reuben): Error: Couldn't lock /home/reuben/.dovecot-sync.lock: Timed out after 30 seconds: 1 Time(s) They occur several times per day, but don't appear to have any obvious cause and I am not aware of any problems this is causing. [They could be the cause of some reappearing UID type messages that also periodically are logged, but I can't be sure] They occur on a lightly loaded Linode VM, KVM Paravirtualised and with only local SSD disk storage. The VM is a Gentoo Linux VM running the latest kernels that Linode provide. I also saw this problem under Xen. The dovecot setup is a dsync replication between two hosts, there is about 150ms of latency between them. The host where I am seeing these messages on (lightning) is a dovecot replica of another system (thunderstorm). I am using Maildir storage. Thunderstorm sees the vast majority of the client side reads and writes and lightning just functions as a not-so-active replica. Thunderstorm is also a VM but on VMware (also on SSDs). This system has never had this problem. I've had this across many dovecot versions going back many months now so it's impossible to pinpoint when this started. I am currently running dovecot -git master-2.2 branch at the moment. I've never seen disk latency in excess of 30s on any system either so I doubt that raw IO is the cause. I don't have any settings specified in 10-mail.conf in the Mail processes section relating to locking or mmap. Has anyone else experienced this and/or any ideas about where to look next to determine the root cause? Is this a common warning to see in cloud hosted/shared environments? Reuben

2 2