July 2016 - dovecot - dovecot.org

Cannot connect to Dovecot IMAP or POP
by C. Andrews Lavarre 24 Jul '16

24 Jul '16

Hello all. Thank you for your service. Easy when you know how, but presently I do not. After literally months of research and experimentation we simply cannot log into our PAM / apache2 / postfix / dovecot pop3/imap STARTTLS email server with an ordinary email client, e.g., Evolution or Thunderbird. We can connect to the host server in a host of different ways (no pun intended)—http, https, ssh, vnc, telnet, openssl -sclient Similarly we can connect to postfix and dovecot in yet another number of ways—telnet, openssl -sclient—but cannot log in to the email server with a normal email client (either Evolution or Thunderbird) by either pop3 or imap. SSL certificates are in place, verified, and tested. Part of the problem is the many changes in all the involved operating systems and protocols (e.g., imaps and pop3s are deprecated, openSUSE has migrated to LEAP, etc.) so many of the docs from Google are no longer valid. Additionally, there simply are bugs: Leap 42.1 YAST does not work when it comes to setting up websites. Documented. But I digress. I'm sure it's something really simple, but it evades me. Research details below. Any help would be more than appreciated. Thanks in advance, Andy ======================= Configuration testing details ======================= System is: Linux openSUSE Leap 42.1 Dovecot --version 2.2.18, Postfix Version: 2.11.6-3.1 Apache2 Version: 2.4.16-9.1 Connections 1. Evolution or Thunderbird to pop3 or imap reports: The reported error was "Could not connect to mail.privustech.com: Connection refused". Both connect successfully to googlemail.com with the same protocol: Port 993 SSL on a dedicated port I have also tried Port 143 STARTTLS after connecting without success 2. openssl s_client -connect mail.privustech.com:xxx a. xxx=25, 110, 143 all return error:140770FC b. xxx=993, 995 return socket: Connection refused connect:errno=111 3.telnet to a. smtp works. b. pop3 andy@tm2t:~> telnet 70.186.159.22 110 ... +OK POP3 2007e.104 server ready <48fa.572a0769(a)privustech.com> ... user andy -ERR Unknown AUTHORIZATION state command c. imap connects but does not allow login, and should not. http://marc.info/?l=imap&m=118775891829506&w=2 The most simple answer is "you cannot TELNET to a modern, correctly-configured, IMAP server and log in to it." andy@tm2t:~> telnet 70.186.159.22 143 ... * OK [...] privustech.com IMAP4rev1 2007e.404 at Wed, 4 May 2016 10:26:28 -0400 (EDT) ... A NO Invalid login credentials Modules • Apache2 works just fine. The server is up and answering. ping works just fine. We have http and https to all vhost sites (privustech, mailprivustech, nptbeyond, gvhl, truthcourage, and their www. subsites). • Postfix reports no errors. We can log in on localhost, send a message to ourselves and see the message. • Dovecot: a. Logging is enabled in 10-logging.conf to /var/log/dovecot.conf but no logging has occurred there. b. doveconf -n throws no errors. Checks and tests completed 1. /etc/hosts is just fine. 2. Firewall is open for telnet, postfix, dovecot. 3. Added andy to dovecot, postfix groups, in addition to mail, reset password to ANDYbbs14@. 4. We tried enabling imaps, pop3s, but this command returns errors about these protocols being obsolete. https://tools.ietf.org/html/rfc2595 Use of these ports is discouraged in favor of the STARTTLS or STLS commands. 5. Reviewed doveconf -n: a. Note, there are no Dovecot users established other than user postfix group postfix service auth { unix_listener auth-userdb { group = postfix user = postfix } } i. postfix has its own set of users, including andy, which works just fine within postfix. We can send mail and read mail in the mailbox. b. Authentication is performed by PAM: passdb { driver = pam } i. Examined PAM: A. The files /etc/pam.d/xxx, where xxx = dovecot, pop, imap, are all the same lavarre:~ # cat /etc/pam.d/xxx #%PAM-1.0 auth include common-auth account include common-account password include common-password session include common-session B. They do not resemble at all the form presented in http://wiki2.dovecot.org/PasswordDatabase/PAM passdb { driver = pam args = %s } C. Add (B.) to see if that works: No change. Comment out the original (A.): No change. Restore it. c. SSL is required and apparently configured correctly (the less-than symbol '<'causes the succeeding file to be read into the variable): ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/dovecot.pem ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } i. dovecot.pem, both cert and key, are installed in /etc/ssl as above and verified as a pair with openssl x509. And we point to them in /etc/dovecot/conf.d/10-ssl.conf as seen in the above. 6. Checked listening as it does not appear in doveconf -n: lavarre:~ # doveconf protocols listen protocols = imap pop3 lmtp listen = *, :: a. conf.d/10-master.conf ports for service xxx-login {inet_listener} are commented out. In fact, the entire file is commented out. Uncomment the listeners, restart. But no change. So undo.

2 3

Thunderbird | Attachments failed opened
by Jos Chrispijn 23 Jul '16

23 Jul '16

It lately happens that I cannot open attachments in Thunderbird45.2.0. Only when I resend the email to myself I can open it. What could be done? Found out that with Outlook there is noproblem opening these attachments. Thanks, Jos -- AI is no match for natural ignorance

1 0

Managesieve problem
by Joseph Mays 23 Jul '16

23 Jul '16

Trying to get either avelsieve or server side filters to work with managesieve. Managesieve is running but whenever avelsieve or the server settings backend try to talk to it the same thing happens. So I guess it's really a problem with something about managesieve at this point. I hit the Message Filters option, it takes a long time for it to come back, though it finally just times out and does nothing, and immediately when I click on the Message Filters link the following two messages appear in /var/log/dovecot.... 2016-07-18 17:03:02 managesieve-login: Error: auth: connect(login) in directory / failed: Permission denied (euid=108(<getpwuid() error>) egid=65534(<getgrgid() error>) missing +x perm: /, dir owned by 0:111 mode=0750) 2016-07-18 17:03:02 managesieve-login: Error: auth: connect(login) in directory / failed: Permission denied (euid=108(<getpwuid() error>) egid=65534(<getgrgid() error>) missing +x perm: /, dir owned by 0:111 mode=0750) Seems to be straightforwardly a permissions error on a directory, but I don't believe it's really the / directory, so which directory is it? Any insights on where to look would be appreciated.

2 2

Disable auth_ssl_require_client_cert for SASL
by damir 22 Jul '16

22 Jul '16

Hello! Dovecot version - 2.2.6 Postfix version - 2.10.2 OS: Mageia Linux 4 x86_64 I have configured Dovecot imaps-server on 993 port to authenticate users via private certificates: auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = no Users' database is in OpenLDAP and in dovecot-ldap.conf.ext checking of users' passwords is disabled: pass_attrs = uid=%n, mail=%n@%d, =nopassword=1 It all works fine. I have configured Postfix submission-service on 587 port to connect users via StartTLS: submission inet n - y - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_enforce_tls=yes -o smtpd_tls_req_ccert=yes -o smtpd_tls_ask_ccert=yes -o smtpd_client_restrictions=permit_tls_all_clientcerts,reject -o smtpd_recipient_restrictions=permit_tls_all_clientcerts,reject -o smtpd_helo_restrictions=permit_tls_all_clientcerts,reject It works fine. And now I have a new task: I also need Postfix to authenticate OpenLDAP-users using SASL on smtps-port 465. I need it for using on mobile devices, which don't support StartTLS. So I have configured smtps in Postfix: smtps inet n - y - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination -o smtpd_helo_restrictions=permit_sasl_authenticated,reject While trying to connect to smtps, clients get an error: "Client didn't present valid SSL certificate", and this is clear. The question is: how to configure an additional auth-service in dovecot, which doesn't require private certificates and authenticates users using login/password? Configuration-files: dovecot -n: # 2.2.6: /etc/dovecot/dovecot.conf # OS: Linux 3.14.43-server-1.mga4 x86_64 Mageia 4 ext4 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes base_dir = /var/run/dovecot/ first_valid_gid = 12 first_valid_uid = 8 hostname = myexample.com last_valid_gid = 12 last_valid_uid = 8 listen = * login_greeting = Dovecot L ready. login_trusted_networks = 127.0.0.0/8 10.62.0.0/16 mail_debug = yes mail_gid = 12 mail_home = /home/mail/%d/%n mail_location = maildir:/home/mail/%d/%n mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = homeDirectory=/home/mail/%d/%n driver = ldap } plugin { sieve = /home/mail/%d/%n/sieve/UsersActiveScript.sieve sieve_before = /var/spool/mail/dovecot.sieve sieve_default = /var/spool/mail/dovecot.sieve sieve_dir = /home/mail/%d/%n/sieve } postmaster_address = admin(a)myexample.com protocols = imap service anvil { type = anvil unix_listener anvil-auth-penalty { group = mail mode = 0600 user = mail } unix_listener anvil { mode = 0600 user = mail } } service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = mail mode = 0600 user = mail } } service imap-login { inet_listener imap { port = 0 ssl = no } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } ssl_ca = </etc/pki/CA/private/dovecot-ca.pem grep -v '^ *$#.*$\?$' /etc/dovecot/dovecot-ldap.conf.ext: uris = ldap://localhost dn = cn=service,ou=Systems,dc=myexample,dc=com dnpass = SeCrEt auth_bind = no ldap_version = 3 base = ou=People,dc=myexample,dc=com deref = never scope = subtree user_attrs = homeDirectory=home user_filter = (&(mail=%n@%d)(uid=%n)) pass_attrs = uid=%n, mail=%n@%d, =nopassword=1 pass_filter = (&(mail=%n@%d)(uid=%n)) Kind regards, Damir

1 0

Suggested improvement for antispam plugin documentation
by Ralph Seichter 21 Jul '16

21 Jul '16

Hello, I struggled a bit with getting the antispam plugin to work, because the plugin configuration in http://wiki2.dovecot.org/Plugins/Antispam is incomplete. After some twiddling, I ended up with this: # /etc/dovecot/conf.d/90-plugin.conf plugin { antispam_backend = mailtrain antispam_mail_spam = spam antispam_mail_notspam = ham antispam_mail_sendmail = /path/to/mailtrain/script antispam_spam = Junk;Spam antispam_trash = Deleted Messages;Trash } I know that the antispam plugin has not yet been officially released, but I think it might be worth updating the documentation anyway. Your thoughts? -Ralph

1 0

an e-mail client for dovecot ?
by Spyros Tsiolis 21 Jul '16

21 Jul '16

Hello all, For some years now, I've been using Thunderbird for dovecot. I am not very satisfied with t/b so I thought of using m/s outlook but then I thought that I want to distance my clients from office products. I have a newly created dovecot installation on a very small site. Three nodes, all x86 Windows 7 professional with an ubuntu v14.04 server (x86 again) running dovecot 1.2.17. The clients there use dovecot as an imap server, so they have a real-world e-mail account each and whatever they want to keep , they store by gradding-and-dropping to the imap (local / archive) account. Since I have quite some experiece with thunderbird, I know most of its shortcomings; So I thought if there's an alternative (better?) imap mail client for x86 windows 7 systems than t/b. Even better if there's an alternative client that is also supporeted under linux . Any ideas are welcome, TIA, s.t.

12 12

Absolute path in SUBSCRIPTIONS
by Miloslav Hůla 20 Jul '16

20 Jul '16

Hello, I'm using following two namespaces with Dovecot 2.2.13-12~deb8u1: namespace inbox { inbox = yes list = yes location = prefix = INBOX. # the previous Cyrus compatibility separator = . subscriptions = yes type = private ... } namespace { inbox = no list = children location = maildir:/vmail/user/%%n/Maildir:INDEXPVT=/vmail/user/%n/Maildir/Shared/%%n prefix = user.%%n. separator = . subscriptions = yes type = shared } For the shared namespace, the subscriptions are stored globally in '/vmail/user/%%n/Maildir/subscribtions' which is bad for me. I would like too keep subscriptions per user. I cannot set 'subscriptions = no' because I have no parent namespace. And when I set :SUBSCRIPTIONS=/vmail/user/%n/Maildir/subscriptions-shared it does not work (absolute path does not work) and it creates file in: /vmail/user/%%n/Maildir/vmail/user/%n/Maildir/subscriptions-shared instead of /vmail/user/%n/Maildir/subscriptions-shared I found, that relative path hack works: :SUBSCRIPTIONS=../../%n/Maildir/subscriptions-shared but I'm not sure it is the legitimate solution. Are there other options? Kind regards, Milo

1 0

Panic when runing "doveadm mailbox status ... vsize"
by Mark Costlow 20 Jul '16

20 Jul '16

I'm using dovecot 2.2.24 on FreeBSD 10.3. I'm working on converting users from maildir to mdbox, for the usual reasons. I have converted some test users and they generally work fine. But when I run "doveadm mailbox status" I get a Panic if I ask for the vsize field (or "all"), but other fields work fine. For example: # doveadm mailbox status -u bubbacheex3 "messages" INBOX INBOX messages=53 # doveadm mailbox status -u bubbacheex3 "guid" INBOX INBOX guid=bf976912f3748957761d0100f906a3d0 # doveadm mailbox status -u bubbacheex3 "unseen" INBOX INBOX unseen=52 # doveadm mailbox status -u bubbacheex3 "vsize" INBOX doveadm(bubbacheex3): Panic: file file-lock.c: line 269: unreached Abort trap I've only converted a few users, but they all exhibit this problem. I converted them with: dsync -u bubbacheex3 mirror maildir:/var/tmp/bubbacheex3 I have done a force-resync, which succeeds but doesn't change the behavior. I spent a little time trying to get gdb running but didn't get very far (couldn't seem to get it to find the source files once I got a few levels deep in the call stack). Before I beat my head on the gdb issue more, I thought I'd check here to see if anyone has any ideas. I didn't turn up anything in google or searching this list. Here's my "doveconf -n" output: ------------------------------------------------------ # 2.2.24 (a82c823): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.3-RELEASE-p3 amd64 ufs auth_failure_delay = 1 secs auth_mechanisms = plain login auth_winbind_helper_path = /usr/local/bin/ntlm_auth auth_worker_max_count = 60 base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_gid = 100 first_valid_uid = 1000 listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_location = mdbox:/var/mail/%u:INDEX=/var/dovecot/%u mail_log_prefix = "%Us(%u): " mail_nfs_storage = yes mail_privileged_group = mail mdbox_rotate_interval = 1 days mdbox_rotate_size = 4 M mmap_disable = yes namespace { inbox = yes location = prefix = separator = . } passdb { args = session=yes dovecot driver = pam } protocols = imap pop3 service auth { unix_listener auth-client { mode = 0660 } unix_listener auth-master { mode = 0600 } user = root vsz_limit = 256 M } service imap-login { chroot = login process_limit = 128 process_min_avail = 10 service_count = 1 user = dovecot vsz_limit = 64 M } service imap { drop_priv_before_exec = no process_limit = 512 vsz_limit = 256 M } service pop3-login { chroot = login process_limit = 128 process_min_avail = 5 service_count = 1 user = dovecot vsz_limit = 64 M } service pop3 { drop_priv_before_exec = no process_limit = 512 vsz_limit = 256 M } ssl_cert = </etc/mail/certs/mail.swcp.com.pem ssl_cipher_list = ALL:!LOW:!SSLv2 ssl_key = </etc/mail/certs/mail.swcp.com.pem userdb { args = blocking=yes driver = passwd } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_logout_format = bytes=%i/%o imap_max_line_length = 64 k mail_max_userip_connections = 20 mail_plugin_dir = /usr/local/lib/dovecot/imap } protocol pop3 { mail_max_userip_connections = 10 mail_plugin_dir = /usr/local/lib/dovecot/pop3 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = yes pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master deliver_log_format = msgid=%m: %$ mail_plugin_dir = /usr/local/lib/dovecot/lda postmaster_address = postmaster(a)swcp.com quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r sendmail_path = /usr/sbin/sendmail } ------------------------------------------------------ Thanks, Mark -- Mark Costlow | Southwest Cyberport | Fax: +1-505-232-7975 cheeks(a)swcp.com | Web: www.swcp.com | Voice: +1-505-232-7992 Mail Minder - Intelligent Push Notifications for Email on the iPhone http://mailminderapp.com/download or in the App Store

3 3

Virtual mailboxes
by Lefteris Tsintjelis 19 Jul '16

19 Jul '16

I have been banging my head to the walls for the past couple of days to make virtual mailboxes work and I finally found the problem. It seems when prefetch is used the user_query is not working at all. However, I have not found any reference to this one. http://wiki.dovecot.org/Plugins/Virtual I have tried to add the SQL statements to the password_query with prefetch but it did not work. It seems that it only works with prefetch off.

1 0

dovecot --version tarball
by Leon Kyneur 19 Jul '16

19 Jul '16

Hi, Trying to understand what the version numbers mean. I typically build from the stable tarball and then apply patches as needed.. however since 2.2.25 this hasn't been working (not sure if it worked before or never really looked closely TBH). http://dovecot.org/releases/2.2/dovecot-2.2.25.tar.gz - shows GITID 7be1766 however it has commits / changes newer than this. Also the github tag for 2.2.25 is c1527e5 which doesn't match the source tarball as well. Should the source tarball and git commit hash be related? Thanks Leon

1 0