September 2016 - dovecot

ldap sasl bind and auth_bind
by Matwey V. Kornilov 20 Sep '16

20 Sep '16

Hello, I am using # dovecot --version 2.2.18 # dovecot -n # 2.2.18: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -n > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:24: 'imaps' protocol can no longer be specified (use protocols=imap). to disable non-ssl imap, use service imap-login { inet_listener imap { port=0 } } doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -n > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:24: 'imaps' protocol can no longer be specified (use protocols=imap). to disable non-ssl imap, use service imap-login { inet_listener imap { port=0 } } # OS: Linux 4.1.27-27-default x86_64 openSUSE 42.1 (x86_64) first_valid_uid = 1 mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = lmtp imap service imap-login { inet_listener imap { port = 0 } } ssl = required ssl_ca = /etc/pki/trust/anchors/rootCA.pem ssl_cert = </etc/openldap/openldap.crt ssl_dh_parameters_length = 2048 ssl_key = </etc/openldap/openldap.key ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = uid=vmail gid=vmail home=/var/spool/mail/%d/%n } I use LDAP for user and passwd databases as the following: uris = ldapi:/// sasl_bind = yes sasl_mech = EXTERNAL auth_bind = yes And I found that only first authentication after dovecot restart is successful, the others always fail with temp. The reason is that dovecot rebinds to anonymous bind after succesful auth bind instead of rebinding to external sasl bind.

1 1

Sieve vacation won't send second reply after timeout interval.
by David Williams 20 Sep '16

20 Sep '16

Hi there I'm having problems getting sieve to send a second vacation response. For testing I've set sieve_vacation_min_period = 500s and the seconds option in the script is 600. I send the first test message and get a reply fine I then wait about 12 minutes send a second message and get no reply. In the log I get "discarded duplicate response". I've restarted dovecot and removed the .dovecot.lda-dupes file before running the last test. I'm using LMTP for delivery to Dovecot. The sieve script is require ["vacation-seconds"]; # rule:[Vacation] if true { vacation :seconds 600 :addresses "username(a)mydomain.com" :subject "vacation" "test"; } and doveconf -n is # 2.2.19: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.9 (357ac0a0e68b+) # OS: Linux 3.18.12-gentoo x86_64 Gentoo Base System release 2.2 ext4 auth_username_format = %Ln disable_plaintext_auth = no imap_capability = +XLIST mail_location = maildir:/srv/mail/%n/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate vacation-seconds imapflags notify namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox "Sent Items" { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = * driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/default.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_extensions = +notify +imapflags +vacation-seconds sieve_vacation_default_period = 1d sieve_vacation_min_period = 500s sieve_vacation_use_original_recipient = yes } postmaster_address = postmaster(a)mydomain.com protocols = imap lmtp sieve service auth { unix_listener auth-userdb { group = mode = 0777 user = } } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 10024 } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </etc/ssl/dovecot/server.pem ssl_key = </etc/ssl/dovecot/server.key submission_host = localhost userdb { driver = passwd override_fields = home=/srv/mail/%n } protocol lmtp { mail_plugins = sieve } protocol lda { mail_plugins = sieve } I've changed the identifying info to stop any spammers. Any ideas, suggestions or just another pair of eyes telling me I've done something stupid would be much appreciated. Many thanks David

1 0

[Dovecot] Plugins: virtuals vs acls
by Leho Kraav 20 Sep '16

20 Sep '16

Hi all dovecot-virtual: * all when dovecot-acl files restrict some subset of * for a user, does dovecot respect these ACLs when collecting messages for virtual folder? I'd like a confirmation about what I should be seeing when I start implementing this setup.

2 3

Dovecot and imapproxy
by Grant 20 Sep '16

20 Sep '16

imapproxy sped things up a lot for me when I was using courier. I switched to dovecot a while back and kept using imapproxy. Lately I've been noticing weird TCP Queuing spikes in my munin graphs and discontinuing my use of imapproxy seems to have smoothed them out completely and I haven't noticed a slowdown in webmail. Is imapproxy generally not necessary with dovecot? - Grant

2 1

Re: Dovecot 2.2.25 fails on SSL
by Joseph Tam 19 Sep '16

19 Sep '16

"Andreas M. Kirchwitz" <amk(a)spamfence.net> writes: >> OK, the origin of your problem becomes clearer. You can hardcode these >> paths into the executables by doing something like >> >> env CFLAGS='-I/my'ssl/include' \ >> LDFLAGS='-L/your/ssl/lib -Wl,-rpath,/my/ssl/lib' \ >> configure ... > > Based on your mail I've tried CFLAGS/LDFLAGS again, and > now Dovecot didn't even compile any longer. I don't use the same OS as you, but what errors dis you get? Joseph Tam <jtam.home(a)gmail.com>

1 0

Panic: file auth-request.c
by Chris Wik 19 Sep '16

19 Sep '16

Hello Dovecot list, We've been running a really old CentOS 5 server with the stock dovecot from yum (1.0.7) for years and years with absolutely no problems. If it ain't broke, don't fix it, or something like that. Well it finally broke, but only due to the server no longer being able to handle the load of the increasing user base (many thousands now, with hundreds of concurrent IMAP connections any any given time) So we upgraded to a new CentOS 7 server with SSD RAID, fast CPUs and tons of RAM. No more load problems. We compiled the latest dovecot from source (as the version from CentOS yum repo is already quite old, figure we might as well run the latest version since we were upgrading anyway). Thanks to excellent documentation on dovecot.org and fairly thorough testing, the upgrade was quite smooth. We kept all the message UUIDs intact and tried to match the supported authentication methods etc to the old setup, and we didn't have any problems with clients re-downloading or re-syncing mail. We do however have one problem, which prompted me to join this list. It is the same problem as described in this thread from last month: http://dovecot.org/list/dovecot/2016-July/104899.html Here's the excerpt from our maillog: Sep 17 19:34:57 mail dovecot: auth: Panic: file auth-request.c: line 1049 (auth_request_lookup_credentials): assertion failed: (request->credentials_scheme == scheme) Sep 17 19:34:57 mail dovecot: auth: Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0(+0x89470) [0x7fa9cb8af470] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x8954e) [0x7fa9cb8af54e] -> /usr/local/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fa9cb851f75] -> dovecot/auth() [0x4165bc] -> dovecot/auth() [0x4221fb] -> dovecot/auth() [0x41620b] -> dovecot/auth(auth_request_lookup_credentials_callback+0x58) [0x4162f8] -> dovecot/auth(passdb_handle_credentials+0x6a) [0x4254ba] -> dovecot/auth() [0x425b62] -> dovecot/auth() [0x41c1f8] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x4c) [0x7fa9cb8c207c] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd7) [0x7fa9cb8c3377] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x25) [0x7fa9cb8c2105] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fa9cb8c22b8] -> /usr/local/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fa9cb857f33] -> dovecot/auth(main+0x2eb) [0x40ccdb] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fa9c9dc2b15] -> dovecot/auth() [0x40cf15] On the client side, it manifests as an authentication failure, and the user is prompted to re-enter their password. The reports we've had are all from users who have their passwords saved in a local password manager, so the client is definitely sending the correct password. It's not related to a particular mail client. It is also definitely not related to the particular user or password, as the user will authenticate many times successfully and then (seemingly) randomly be hit by this bug and prompted to re-enter their password. We enabled verbose logging and even logging of passwords for failed authentication attempts in an attempt to find a pattern, but so far we have not found one. Similar to the original poster in the above thread, we are using a MySQL backend, and CentOS 7 on x86_64 It happens quite frequently: in the past 6 days it happened 49175 times, according to a grep of the maillog. In the same period there were 294167 successful IMAP logins and 160322 POP3 logins. For now we have downgraded to 2.2.4 and so far have not seen the crash recorded in the maillog. What can we do to help track down and fix this bug? # dovecot -n # 2.2.24 (a82c823): /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.0-327.28.3.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) ext4 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login digest-md5 cram-md5 ntlm rpa apop auth_verbose = yes auth_verbose_passwords = plain debug_log_path = /var/log/dovecot-debug.log default_client_limit = 5000 default_process_limit = 1000 disable_plaintext_auth = no first_valid_uid = 89 mail_debug = yes mail_fsync = never mail_gid = 89 mail_location = maildir:/var/virtual/%d/%n mail_uid = 89 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl_ca = <*** ssl_cert = <*** ssl_key = <*** userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_ssl = yes protocol lmtp { mail_fsync = optimized } protocol lda { mail_fsync = optimized } protocol imap { mail_max_userip_connections = 50 } protocol pop3 { mail_max_userip_connections = 20 } -- Chris Wik Anu Internet Services www.anu.net | www.cwik.ch

3 5

dovecot --hostdomain
by dovecot＠nspace.de 19 Sep '16

19 Sep '16

Hi, I'm currently debugging replication issues and I found that both servers answer to a "dovecot --hostdomain" simply with localhost From what I've read, this can lead to problems. Where do I configure the dovecot hostdomain name? The machine itself has a valid name in /etc/hostname Thanks, Thomas

2 1

Re: Dovecot 2.2.25 fails on SSL
by Andreas M. Kirchwitz 19 Sep '16

19 Sep '16

Joseph Tam <jtam.home(a)gmail.com> wrote: >> For every program I compile myself, I link it against my custom >> OpenSSL library (always newest version; distributions usually tend >> to stick with a specific version and only apply security fixes). > > OK, the origin of your problem becomes clearer. You can hardcode these > paths into the executables by doing something like > > env CFLAGS='-I/my'ssl/include' \ > LDFLAGS='-L/your/ssl/lib -Wl,-rpath,/my/ssl/lib' \ > configure ... Yes, exactly, that's my usual approach. I've used this as well for building other software with custom libraries. Unfortunately, I remember CFLAGS/LDFLAGS didn't play well with Dovecot, so I used SSL_CFLAGS/SSL_LIBS as suggested by the documentation and that worked well. > I use this myself (except the -Wl part since these libs are > symlinked to my shared library path). I think "-R/my/ssl/lib" > might also be synonymous with -Wl,... Based on your mail I've tried CFLAGS/LDFLAGS again, and now Dovecot didn't even compile any longer. I was close to giving up. But obviously, I didn't ... :-) After some investigation I found the non-default linker option "-Wl,--as-needed" as problem which is enabled by Dovecot for unknown reasons. Finally, this call to "configure" generates proper Makefile files to build Dovecot with a custom SSL library: env CPPFLAGS="-I/usr/local/ssl/include" LDFLAGS="-L/usr/local/ssl/lib -Wl,-R/usr/local/ssl/lib" LIBS="-Wl,--no-as-needed -lcrypto -lssl" SSL_CFLAGS="-I/usr/local/ssl/include" SSL_LIBS="-L/usr/local/ssl/lib -Wl,-R/usr/local/ssl/lib -Wl,--no-as-needed -lcrypto -lssl" ./configure --prefix=/usr/local/dovecot --with-ssl=openssl (chances are that SSL_CFLAGS/SSL_LIBS could be removed completely but it won't hurt) I've read the section in the "ld" manual but still don't understand why Dovecot enables --as-needed (never seen that before with other software) and why it's such a big problem. But I'm no expert here. > I don't have that problem -- I use configure to tell dovecot where to find > my self-compiled openssl, and the resulting executables load from where I > want. Thanks for pointing me at the proper direction again. Now Dovecot 2.2.25 compiles for me with a custom SSL. I understand that this issue might not have a high priority but maybe one of the developers could check if "--as-needed" is really needed (as it confuses people who try to use custom libraries) and what's the deeper meaning of SSL_CFLAGS/SSL_LIBS. My system is a regular CentOS 6 (latest sub-release with all patches), nothing special except for a custom SSL installation. Greetings, Andreas

1 0

BUG - DELETE Public/Folder not working with Thunderbird
by Leander Schäfer 18 Sep '16

18 Sep '16

Hi, Unfortunately it looks like the parameter: "imap_client_workarounds = tb-extra-mailbox-sep" does not work. Neither inside nor outside "protocol imap {}" configuration section. ACLs are set correctly. Manual "DELETE Public/Test" via telnet is working as expected. Is this a known bug? See: - https://help.ubuntu.com/community/Dovecot#Thunderbird - http://wiki.dovecot.org/Clients#Thunderbird # 2.2.25 (7be1766): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.15 (97b3da0) # OS: FreeBSD 10.3-RELEASE amd64 [...] imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags [...] namespace { list = children location = maildir:%%h/maildir:INDEX=~/maildir/Shared/%%u:CONTROL=~/maildir/Shared/%%u:INDEXPVT=~/maildir/Shared prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace { hidden = no list = children location = maildir:~/../Public:LAYOUT=fs:INDEX=~/../Public:CONTROL=~/../Public:INDEXPVT=~/maildir/Public prefix = Public/ separator = / subscriptions = no type = public } [...] Best regards Leander Schäfer

2 4

how to mass delete after a hacked mail?
by voytek＠sbt.net.au 17 Sep '16

17 Sep '16

I had a hacked user account resulting in several thousand bounces back to that email inbox, account now corrected, but, how can I mass delete bounces with say subject like: "Undelivered Mail Returned to Sender" (by from ? ""Mail Delivery System" <MAILER-DAEMON(a)emu.sbt.net.au>") or what other ways to clean the mess ? thanks, V

4 3