December 2017 - dovecot

Re: Dovecot lmtp doesn't log
by Tomislav Perisic 04 Dec '17

04 Dec '17

Does anyone have any idea regarding this? On 17 Nov 2017 11:36, "Tomislav Perisic" <tomiperisic(a)gmail.com> wrote: Hi, We have 2 servers, server A and server B. Server A has: Postfix dovecot-2.2.33.2-1.el6.x86_64 Server B has: dovecot-2.2.33.2-1.el6.x86_64 dovecot-pigeonhole-2.2.33.2-1.el6.x86_64 Server A receives email on postfix, dovecot then takes that email from postfix and proxies it to Server B Dovecot. Dovecot on Server B takes the proxied email and delivers it with lmtp to the user inboxes. The problem is that the dovecot on server B Doesn't log anything regarding the emails that are being delivered to the mailbox via lmtp. Dovecot on server A logs everything perfectly regarding the proxy, so my assumption is that there is an issue with Dovecot lmtp logging. We changed the logging from syslog directly to a file and we noticed the same problem, missing log entries. We also tried turning on verbose logging and it didn't help. Server B: Red Hat 6.7 x86_64 rpm -qa | grep dove dovecot-2.2.33.2-1.el6.x86_64 dovecot-pigeonhole-2.2.33.2-1.el6.x86_64 doveconf -n # 2.2.33.2: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 auth_cache_negative_ttl = 0 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes listen = * mail_debug = yes mail_gid = mail mail_location = maildir:~/Maildir mail_plugins = " quota zlib" mail_uid = vmail managesieve_notify_capability = mailto namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Virus { auto = subscribe } plugin { quota = maildir:User quota sieve_extensions = +editheader sieve_max_actions = 32 sieve_max_redirects = 4 sieve_max_script_size = 1M sieve_quota_max_scripts = 0 sieve_trace_debug = yes sieve_trace_level = matching sieve_vacation_dont_check_recipient = yes sieve_vacation_send_from_recipient = yes sieve_vacation_use_original_recipient = yes zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service lmtp { inet_listener lmtp { port = xx } } service managesieve-login { inet_listener sieve { port = xx } service_count = 1 } protocol lmtp { mail_plugins = " quota zlib sieve mail_log notify" } protocol imap { mail_plugins = " quota zlib imap_quota imap_zlib" } protocol sieve { managesieve_implementation_string = dovecot managesieve_logout_format = bytes ( in=%i : out=%o ) managesieve_max_line_length = 65536 managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave }

3 6

Re: Howto authenticate smartPhone via Active Directory
by Mark Foley 03 Dec '17

03 Dec '17

Yes, you are right. This link: https://www.redips.net/linux/android-email-postfix-auth/#section2 shows: passdb pam { } used for authenticating Android. Problem #1 is that Slackware does not ship with PAM and the AD/DC Samba4 does not use it. It is used on Slackware for a domain member, but I'm not sure I should try configuring PAM on the AD/DC. Is there some otherway I can get authentication using domain credentials besides pam? the phone can send user and password. --Mark -----Original Message----- > Date: Sun, 03 Dec 2017 15:22:56 +0200 > Subject: Re: Howto authenticate smartPhone via Active Directory > From: Aki Tuomi <aki.tuomi(a)dovecot.fi> > To: Mark Foley <mfoley(a)ohprs.org>, dovecot(a)dovecot.org > > Actually you are authenticating gssapi clients from ad and everyone else from shadow. maybe you need to configure pam module? > ---Aki TuomiDovecot oy > > -------- Original message -------- > From: Mark Foley <mfoley(a)ohprs.org> > Date: 03/12/2017 06:03 (GMT+02:00) > To: dovecot(a)dovecot.org > Subject: Howto authenticate smartPhone via Active Directory > I have a Samba4 Active Directory server. Dovecot authenticates AD Users with domain credentials > using GSSAPI (Thunderbird client). I believe I have Dovecot set to attempt authentication via > shadow first and. failing that, it does authenticate via GSSAPI. > > Smartphones connect to Dovecot via port 143 and SSL. They are not domain members so if the > shadow authentication fails, no other methods are tried and no connection is made. > > What can I do with my dovecot config to fix this? > > > doveconf -n > # 2.2.15: /usr/local/etc/dovecot/dovecot.conf > # OS: Linux 4.4.88 x86_64 Slackware 14.2 > auth_debug = yes > auth_debug_passwords = yes > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /etc/dovecot/dovecot.keytab > auth_mechanisms = plain login gssapi > auth_use_winbind = yes > auth_username_format = %n > auth_verbose = yes > auth_verbose_passwords = plain > disable_plaintext_auth = no > info_log_path = /var/log/dovecot_info > mail_location = maildir:~/Maildir > passdb { > driver = shadow > } > protocols = imap > ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt > ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key > userdb { > driver = passwd > } > verbose_ssl = yes > > Thanks, Mark

1 0

Upgrade to 2.2.32 from 2.2.15 failed
by Mark Foley 03 Dec '17

03 Dec '17

I have a problem. I have been running Dovecot 2.2.15 and I'd like to upgrade. My distro (Slackware) has dovecot 2.2.32 available. I downloaded and installed that, but it didn't work. No one was able to get messages from the dovecot server on their workstations. The following is the entire dovecot log file from startup to the last message generated. No more messages went into the logfile after line 76, even with clients trying to connect. The 174.233.134.88 IP is from an external user connecting from his iPhone. The normal successful message from this user are shown at bottom. I'm suspecting something to do with line 18 where is says "Auth process broken." If anyone has any insight I'd deeply appreciate it as I'd love to upgrade. THX -- Mark 1 Nov 24 19:22:24 master: Info: Dovecot v2.2.32 (dfbe293d4) starting up for imap (core dumps disabled) 2 Nov 24 19:22:24 ssl-params: Info: Generating SSL parameters 3 Nov 24 19:22:26 ssl-params: Info: SSL parameters regeneration completed 4 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 5 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 6 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 7 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 8 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 9 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 10 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 11 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 12 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 13 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 14 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 15 Nov 24 19:23:02 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 16 Nov 24 19:23:02 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 17 Nov 24 19:23:02 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 18 Nov 24 19:23:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS handshaking, session=<idAcrMNe8xqu6YZY> 19 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 20 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 21 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 22 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 23 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 24 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 25 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 26 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 27 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 28 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 29 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 30 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [174.233.134.88] 31 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [174.233.134.88] 32 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A [174.233.134.88] 33 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [174.233.134.88] 34 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [174.233.134.88] 35 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [174.233.134.88] 36 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 37 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] 38 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] 39 Nov 24 19:23:04 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 40 Nov 24 19:23:04 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 41 Nov 24 19:23:04 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 42 Nov 24 19:23:04 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 2 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS, session=<YGw7rMNe+Rqu6YZY> 43 Nov 24 19:23:04 imap-login: Debug: SSL alert: close notify [174.233.134.88] 44 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 45 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 46 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 47 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 48 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 49 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 50 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 51 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 52 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 53 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 54 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 55 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [174.233.134.88] 56 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [174.233.134.88] 57 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A [174.233.134.88] 58 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [174.233.134.88] 59 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [174.233.134.88] 60 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [174.233.134.88] 61 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 62 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] 63 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] 64 Nov 24 19:23:08 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 65 Nov 24 19:23:08 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 66 Nov 24 19:23:08 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 67 Nov 24 19:23:08 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS, session=<7ZF4rMNe8hqu6YZY> 68 Nov 24 19:23:08 imap-login: Debug: SSL alert: close notify [174.233.134.88] 69 Nov 24 19:23:16 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 70 Nov 24 19:23:16 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 71 Nov 24 19:23:16 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 72 Nov 24 19:23:16 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.54, lip=192.168.0.2, session=<6bbyrMNeGM/AqAA2> 73 Nov 24 19:24:13 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 74 Nov 24 19:24:13 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 75 Nov 24 19:24:13 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 76 Nov 24 19:24:13 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.52, lip=192.168.0.2, session=<b75YsMNeb9nAqAA0> Normal OK messages from dovecot 2.2.15: Nov 24 23:50:49 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] Nov 24 23:50:49 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] Nov 24 23:50:49 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=vQnEacde6QCu6YZY lip=98.102.63.107 rip=174.233.134.88 lport=993 rport=6889 resp=AG0udGhlbQAhbXRfMTAxOQ== (previous base64 data may contain sensitive data) Nov 24 23:50:49 auth-worker(17650): Debug: shadow(m.them,174.233.134.88): lookup Nov 24 23:50:49 auth: Debug: client passdb out: OK 1 user=m.them Finally, the 2.2.15 doveconf, which I used the same for 2.2.32: > doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.88 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes

3 4

Dovecot (doveadm, ssl, sync) - SSL error
by Arkadiusz Majewski 03 Dec '17

03 Dec '17

Hello! I've got a problem to run syncing between both dovecot services on the separate servers. The error indicates to the problem with SSL. Directly using openssl command to connect from one server to other and vice versa is passed without any errors. OS: FreeBSD 11.1-RELEASE-p4 Dovecot: 2.2.33.2_2 and the older one dovecot-2.2.32.1_1 (or similar) - build by ports. OpenSSL: 1.0.2k-freebsd 26 Jan 2017 dovecot: doveadm(10.18.1.15): Error: doveadm client disconnected before handshake: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol dovecot.conf (on both servers): mail_plugins = $mail_plugins notify replication service replicator { process_min_avail = 1 } service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } replication_max_conns = 10 service doveadm { inet_listener { port = 12130 ssl = yes } } ssl = required ssl_protocols = SSLv3 TLSv1 TLSv1.1 TLSv1.2 ssl_cert = </usr/local/etc/dovecot/ssl/cert.crt ssl_key = </usr/local/etc/dovecot/ssl/cert.key ssl_client_ca_file = </usr/local/etc/dovecot/ssl/ca.pem ssl_client_ca_dir = /usr/local/etc/dovecot/ssl Thank you in advance for any help. Kind Regards, Arkadiusz Majewski

1 0

doveadm with 2-level user/domain quotas scheme
by Max Kostikov 03 Dec '17

03 Dec '17

Hi! I believe now it a right time to return to previous discussion about Dovecot's in 2-level user/domain quotas scheme wich was finished here https://dovecot.org/pipermail/dovecot/2015-October/102346.html Here is configuration. 1. Dictionary storage placed in MySQL table "quota2" root@localhost [(none)]> SHOW COLUMNS FROM quota2 FROM exim; +----------+--------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +----------+--------------+------+-----+---------+-------+ | username | varchar(100) | NO | PRI | NULL | | | bytes | bigint(20) | NO | | 0 | | | messages | int(11) | NO | | 0 | | +----------+--------------+------+-----+---------+-------+ 3 rows in set (0,00 sec) 2. Two types of quota - for domains with index "2" and for users without index. ... plugin { quota = dict:user_quota::proxy::sqluserquota quota_rule2 = Trash:storage=+10%% quota_rule3 = Junk:storage=+10%% quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=75%% quota-warning 75 %u quota2 = dict:domain_quota:%d:proxy::sqldomainquota } dict { sqluserquota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql-user.conf sqldomainquota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql-domain.conf } service dict { unix_listener dict { user = mailnull mode = 0660 } } ... 3. Both stored in the same table and files "dovecot-dict-sql-user.conf" and "dovecot-dict-sql-domain.conf" are identical. connect = host=localhost dbname=exim user=user password=password map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } All quotas for users and domains are calculates correctly until "doveadm quota recalc" use. root@beta:~ # doveadm quota recalc -u foo(a)my.domain root@beta:~ # doveadm quota get -u foo(a)my.domain Quota name Type Value Limit % user_quota STORAGE 7850978 - 0 user_quota MESSAGE 32474 - 0 domain_quota STORAGE 7850978 - 0 domain_quota MESSAGE 32474 - , 0 If we look at MySQL table directly foo(a)my.domain quota was counted right but last users data was copied into domains values. ... root@localhost [exim]> SELECT * FROM quota2 WHERE username LIKE '%my.domain'; +-------------------+-------------+----------+ | username | bytes | messages | +-------------------+-------------+----------+ | foo(a)my.domain | 8039401321 | 32474 | | my.domain | 8039401321 | 32474 | | john(a)my.domain | 3455382803 | 11142 | | mary(a)my.domain | 544637146 | 1965 | +-------------------+-------------+----------+ 4 rows in set (0.00 sec) ... Also you may see that "doveadm quota get" above gave wrong values. For domain its produces empty output root@beta:~ # doveadm quota get -u my.domain doveadm(my.domain): Error: User doesn't exist Quota name Type Value Limit % Than if we are trying to calculate quota for domain or for all users (-A) it produces an error. root@beta:~ # doveadm quota recalc -u my.domain doveadm(my.domain): Error: User doesn't exist root@beta:~ # doveadm quota recalc -A Error: User listing returned failure doveadm: Error: Failed to iterate through some users So "doveadm quota" almost useless for such quotas scheme except single user. I wrote small shell-script "dovequota.sh" to resolve this issue but I believe that doveadm need to be fixed too. (script may be found here https://kostikov.co/problemy-uchyota-domennoj-kvoty-v-dovecot-2) -- With best regards, Max Kostikov BBM: 24CA5DF8 | W: https://kostikov.co

1 0

Re: Howto authenticate smartPhone via Active Directory
by Aki Tuomi 03 Dec '17

03 Dec '17

Actually you are authenticating gssapi clients from ad and everyone else from shadow. maybe you need to configure pam module? ---Aki TuomiDovecot oy -------- Original message --------From: Mark Foley <mfoley(a)ohprs.org> Date: 03/12/2017 06:03 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Howto authenticate smartPhone via Active Directory I have a Samba4 Active Directory server. Dovecot authenticates AD Users with domain credentials using GSSAPI (Thunderbird client). I believe I have Dovecot set to attempt authentication via shadow first and. failing that, it does authenticate via GSSAPI. Smartphones connect to Dovecot via port 143 and SSL. They are not domain members so if the shadow authentication fails, no other methods are tried and no connection is made. What can I do with my dovecot config to fix this? > doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.88 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes Thanks, Mark

1 0

mmap() Error, Invalid Argument - Double slash in path?
by GE Junk 02 Dec '17

02 Dec '17

I get a ton of these mmap() errors in the log. I noticed there's a double slash before Maildir. Is this normal? Config error? Dovecot bug? dovecot: imap(email(a)email.net): Error: mmap() failed with file /shares/email/vmail/vmail1/email.net/e/m/a/email-2017.02.25.08.09.39//Maildir/dovecot.index.cache: Invalid argument I'm running dovecot version 2.2.22 Thanks Eric

2 2

Re: Lua Auth
by Aki Tuomi 02 Dec '17

02 Dec '17

-------- Original message --------From: Mark Moseley <moseleymark(a)gmail.com> Date: 02/12/2017 02:34 (GMT+02:00) To: Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Lua Auth On Thu, Nov 30, 2017 at 5:26 AM, Stephan Bosch <s.bosch(a)ox.io> wrote: > > > Op 29-11-2017 om 6:17 schreef Aki Tuomi: > >> On November 29, 2017 at 4:37 AM Mark Moseley <moseleymark(a)gmail.com> >>> wrote: >>> >>> >>> Just happened to be surfing the docs and saw this. This is beyond >>> awesome: >>> >>> https://wiki2.dovecot.org/AuthDatabase/Lua >>> >>> Any words of wisdom on using it? I'd be putting a bunch of mysql logic in >>> it. Any horrible gotchas there? When it says 'blocking', should I assume >>> that means that a auth worker process will *not* accept any new auth >>> lookups until both auth_passdb_lookup() and auth_userdb_lookup() have >>> completed (in which I'd be doing several mysql calls)? If that's the >>> case, >>> I assume that the number of auth workers should be bumped up. >>> >>> And is a 2.3 release fairly imminent? >>> >> Hi! >> >> This feature was added very recently, and there is very little >> operational experience on it. As the docs should say, blocking=yes means >> that an auth worker is used, and yes, it will block each auth worker during >> authentication, but what we tried, it should perform rather nicely. >> >> The most important gotcha is to always test your lua code rigorously, >> because there is not much we can do to save you. >> >> It should be present in master branch, so if someone feels like trying it >> out, please let us know if you find any bugs or strangeness. It's not >> present in nightlies yet. >> >> We are planning on releasing 2.3.0 this year. >> > > The Xi package builder has this feature enabled since yesterday. It is > available in the dovecot-lua package; the first Xi package that doesn't > have an official Debian equivalent (yet anyway). > > > I've been playing with Lua auth and so far no issues. I was previously putting together a very ugly MySQL stored procedure. Using Lua would be a lot easier (esp when it comes to returning an arbitrary number of columns). I'd love to see any test Lua code that the dovecot team has been playing around with (and realize it's not remotely production-ready, so don't worry about caveats I did have a couple of questions though: 1) Is the data returned by Lua auth not cacheable? I've got the following settings (and I'm just using Lua in the userdb lookup, not passdb -- passdb is doing a lightweight SQL lookup for username/password): auth_cache_negative_ttl = 1 mins auth_cache_size = 10 M auth_cache_ttl = 10 mins but I notice that every time I auth, it'll redo all the queries in my Lua code. I'd have expected that data to be served out of cache till the 10min TTL is up 2) Is there an appropriate way to return data with spaces in it (or presumably other non-alphanum chars. My quota name had a space in it, which somehow got interpreted as 'yes' , i.e.: imap: Error: Failed to initialize quota: Invalid quota root quota: Unknown quota backend: yes I simply changed the space to an underscore as a workaround, but I'm curious if there's a better way. I tried various quoting without success. Didn't try escaping yet. 3) Can you elaborate on the "auth_request#response_from_template(template)" and "auth_request#var_expand(template)" functions? Specifically how to use them. I'm guessing that I could've used one of them to work around #2 (that it would have done the escaping for me) Thanks! ----- 1) I'll have to check this. 2) Instead of string, return a key value table. you can have spaces in values. 3) response_from_template expands a key=value string into table by var expanding values. var_expand can be used to interpolation for any purposes. it returns a string. see https://wiki.dovecot.org/Variables for details on how to use it. Individual variable access is more efficient to do directly. --- Aki Tuomi

1 0

Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 02 Dec '17

02 Dec '17

"David.M.Clark" <david(a)davrom.com> wrote: > I have modified mail_max_userip_connections to 400 which made no difference. > > The end user customer actually had Apple remote into their device and > they were impressed that the end user knew their IMAP settings. They > tested it and during this connection time, it worked as expected with > send and receive of e-mails. After Apple support disconnected from the > device, it not longer worked. I'm not sure your problem is the same as mine. Apart from getting a lot of these log messages ... Oct 24 21:32:54 server dovecot: imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=12): user=<user> my users are not reporting any functional problems. I investigated this a little further. I bumped mail_max_userip_connections to 100, and looked at one of these connection bursts for one of my users. What I found was that it would steadily open new connections, hit the cap, then disconnect them all, and start the cycle over again. However, it would stop when the total number of connections made roughly equal to the number of mailboxes the user had. So a rough algorithm for these clients is for each mailbox[1..n] { if open mailbox[i] { ... do operation ... } else { // Hit cap close all open mailboxes } } close all open mailbox For example, if the user has 13 mailboxes and mail_max_userip_connections=5, you would see (c=connect, d=disconnect, m=max log lessage): ccccc m ddddd ccccc m ddddd ccc ddd I'm not sure whether the reader client displays partial results, or it collects all the results when the entire operation finishes. So the final effect I saw of bumping mail_max_userip_connections from the server perspective is that I get fewer "Maximum number of connections" log messages. Joseph Tam <jtam.home(a)gmail.com>

1 0

client unable to send mail, dovecot-imap errors
by GE Junk 02 Dec '17

02 Dec '17

Hi, I have an email client that is currently unable to send mail through imap. I am getting a ton of errors in dovecot-imap.log. All of these errors continue to show up, even after purging the dovecot*.* files from the offending folders. This happens to all email accounts on the server. Clearing the cache files doesn't fix, the error appears pretty much immediately after the new cache is generated. ============================== Error: mmap() failed with file path/Maildir/dovecot.index.cache: Invalid argument ============================== These errors are associated with an account unable to send right now. They seem to have only started since the send problem started. ============================== Error: Corrupted transaction log file path/Maildir/dovecot.index.log seq 5: indexid changed 1512100549 -> 1512183737 (sync_offset=0) Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=12576: Failed to map file seq=178 offset=40..18446744073709551615 (ret=0) Warning: fscking index file path/Maildir/dovecot.index Error: Fixed index file path/Maildir/dovecot.index: log_file_seq 5 -> 179 IMAP session state is inconsistent, please relogin. in=26 out=1276 ============================== This error is also associated with the offending email client ============================== message repeated 9 times: [ imap(emailaddress): Error: Transaction log path/Maildir/dovecot.index.log: duplicate transaction log sequence (2)] ============================== Some additional info: dovecot: 2.2.22 (fe789d2) Ubuntu Server 16.04 Running on a qemu VM installed on an Unraid 6.3.5 Server 4GB RAM mail folder is located on virtio 9p2000 host passthru fs located on the same physical machine as the VM. Anyone have any ideas? Need additional information? Thanks, Eric

1 0