December 2017 - dovecot

Re: Lua Auth
by Aki Tuomi 02 Dec '17

02 Dec '17

-------- Original message --------From: Mark Moseley <moseleymark(a)gmail.com> Date: 02/12/2017 02:34 (GMT+02:00) To: Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Lua Auth On Thu, Nov 30, 2017 at 5:26 AM, Stephan Bosch <s.bosch(a)ox.io> wrote: > > > Op 29-11-2017 om 6:17 schreef Aki Tuomi: > >> On November 29, 2017 at 4:37 AM Mark Moseley <moseleymark(a)gmail.com> >>> wrote: >>> >>> >>> Just happened to be surfing the docs and saw this. This is beyond >>> awesome: >>> >>> https://wiki2.dovecot.org/AuthDatabase/Lua >>> >>> Any words of wisdom on using it? I'd be putting a bunch of mysql logic in >>> it. Any horrible gotchas there? When it says 'blocking', should I assume >>> that means that a auth worker process will *not* accept any new auth >>> lookups until both auth_passdb_lookup() and auth_userdb_lookup() have >>> completed (in which I'd be doing several mysql calls)? If that's the >>> case, >>> I assume that the number of auth workers should be bumped up. >>> >>> And is a 2.3 release fairly imminent? >>> >> Hi! >> >> This feature was added very recently, and there is very little >> operational experience on it. As the docs should say, blocking=yes means >> that an auth worker is used, and yes, it will block each auth worker during >> authentication, but what we tried, it should perform rather nicely. >> >> The most important gotcha is to always test your lua code rigorously, >> because there is not much we can do to save you. >> >> It should be present in master branch, so if someone feels like trying it >> out, please let us know if you find any bugs or strangeness. It's not >> present in nightlies yet. >> >> We are planning on releasing 2.3.0 this year. >> > > The Xi package builder has this feature enabled since yesterday. It is > available in the dovecot-lua package; the first Xi package that doesn't > have an official Debian equivalent (yet anyway). > > > I've been playing with Lua auth and so far no issues. I was previously putting together a very ugly MySQL stored procedure. Using Lua would be a lot easier (esp when it comes to returning an arbitrary number of columns). I'd love to see any test Lua code that the dovecot team has been playing around with (and realize it's not remotely production-ready, so don't worry about caveats I did have a couple of questions though: 1) Is the data returned by Lua auth not cacheable? I've got the following settings (and I'm just using Lua in the userdb lookup, not passdb -- passdb is doing a lightweight SQL lookup for username/password): auth_cache_negative_ttl = 1 mins auth_cache_size = 10 M auth_cache_ttl = 10 mins but I notice that every time I auth, it'll redo all the queries in my Lua code. I'd have expected that data to be served out of cache till the 10min TTL is up 2) Is there an appropriate way to return data with spaces in it (or presumably other non-alphanum chars. My quota name had a space in it, which somehow got interpreted as 'yes' , i.e.: imap: Error: Failed to initialize quota: Invalid quota root quota: Unknown quota backend: yes I simply changed the space to an underscore as a workaround, but I'm curious if there's a better way. I tried various quoting without success. Didn't try escaping yet. 3) Can you elaborate on the "auth_request#response_from_template(template)" and "auth_request#var_expand(template)" functions? Specifically how to use them. I'm guessing that I could've used one of them to work around #2 (that it would have done the escaping for me) Thanks! ----- 1) I'll have to check this. 2) Instead of string, return a key value table. you can have spaces in values. 3) response_from_template expands a key=value string into table by var expanding values. var_expand can be used to interpolation for any purposes. it returns a string. see https://wiki.dovecot.org/Variables for details on how to use it. Individual variable access is more efficient to do directly. --- Aki Tuomi

1 0

Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 02 Dec '17

02 Dec '17

"David.M.Clark" <david(a)davrom.com> wrote: > I have modified mail_max_userip_connections to 400 which made no difference. > > The end user customer actually had Apple remote into their device and > they were impressed that the end user knew their IMAP settings. They > tested it and during this connection time, it worked as expected with > send and receive of e-mails. After Apple support disconnected from the > device, it not longer worked. I'm not sure your problem is the same as mine. Apart from getting a lot of these log messages ... Oct 24 21:32:54 server dovecot: imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=12): user=<user> my users are not reporting any functional problems. I investigated this a little further. I bumped mail_max_userip_connections to 100, and looked at one of these connection bursts for one of my users. What I found was that it would steadily open new connections, hit the cap, then disconnect them all, and start the cycle over again. However, it would stop when the total number of connections made roughly equal to the number of mailboxes the user had. So a rough algorithm for these clients is for each mailbox[1..n] { if open mailbox[i] { ... do operation ... } else { // Hit cap close all open mailboxes } } close all open mailbox For example, if the user has 13 mailboxes and mail_max_userip_connections=5, you would see (c=connect, d=disconnect, m=max log lessage): ccccc m ddddd ccccc m ddddd ccc ddd I'm not sure whether the reader client displays partial results, or it collects all the results when the entire operation finishes. So the final effect I saw of bumping mail_max_userip_connections from the server perspective is that I get fewer "Maximum number of connections" log messages. Joseph Tam <jtam.home(a)gmail.com>

1 0

client unable to send mail, dovecot-imap errors
by GE Junk 02 Dec '17

02 Dec '17

Hi, I have an email client that is currently unable to send mail through imap. I am getting a ton of errors in dovecot-imap.log. All of these errors continue to show up, even after purging the dovecot*.* files from the offending folders. This happens to all email accounts on the server. Clearing the cache files doesn't fix, the error appears pretty much immediately after the new cache is generated. ============================== Error: mmap() failed with file path/Maildir/dovecot.index.cache: Invalid argument ============================== These errors are associated with an account unable to send right now. They seem to have only started since the send problem started. ============================== Error: Corrupted transaction log file path/Maildir/dovecot.index.log seq 5: indexid changed 1512100549 -> 1512183737 (sync_offset=0) Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=12576: Failed to map file seq=178 offset=40..18446744073709551615 (ret=0) Warning: fscking index file path/Maildir/dovecot.index Error: Fixed index file path/Maildir/dovecot.index: log_file_seq 5 -> 179 IMAP session state is inconsistent, please relogin. in=26 out=1276 ============================== This error is also associated with the offending email client ============================== message repeated 9 times: [ imap(emailaddress): Error: Transaction log path/Maildir/dovecot.index.log: duplicate transaction log sequence (2)] ============================== Some additional info: dovecot: 2.2.22 (fe789d2) Ubuntu Server 16.04 Running on a qemu VM installed on an Unraid 6.3.5 Server 4GB RAM mail folder is located on virtio 9p2000 host passthru fs located on the same physical machine as the VM. Anyone have any ideas? Need additional information? Thanks, Eric

1 0

Lua Auth
by Mark Moseley 02 Dec '17

02 Dec '17

Just happened to be surfing the docs and saw this. This is beyond awesome: https://wiki2.dovecot.org/AuthDatabase/Lua Any words of wisdom on using it? I'd be putting a bunch of mysql logic in it. Any horrible gotchas there? When it says 'blocking', should I assume that means that a auth worker process will *not* accept any new auth lookups until both auth_passdb_lookup() and auth_userdb_lookup() have completed (in which I'd be doing several mysql calls)? If that's the case, I assume that the number of auth workers should be bumped up. And is a 2.3 release fairly imminent?

3 3

Autoreplies are not sent
by Sergio Belkin 01 Dec '17

01 Dec '17

Hi, Let's say I have 2 domains: - Virtual Mailbox Domain: example.local (internal domain) - Virtual Alias Domain: example.com (public domain) Every mail sent to @example.com is really sent to @example.local. I have a virtual alias that forward mails sent to support-abc(a)example.com is sent finally to: op1(a)example.local Now, I'd want to every mail was sent to support-abc(a)example.com it triggers an autoreply vacation style. So, I've wrote and compiled a sieve filter, something like that and put in op1(a)example.local sieve folder. But it fails complaining like that: nov 29 15:55:39 muteriver.example.local dovecot[12549]: lmtp(12675, op1(a)example.local) CqNdF6sCH1qDMQAAcSFsIQ: sieve: msgid=< ded22f3d-f1e3-157e-0667-ca73d851d1a8(a)example.com>: discarding vacation response for implicitly delivered message; no known (envelope) recipient address found in message headers (recipient=<op1(a)example.local>, and additional `:addresses' are specified) I've tried appending in dovecot configuration: lda_original_recipient_header = X-Original-To But it does not work either. Using: dovecot-pigeonhole-2.2.10-8.el7.centos.x86_64 and postfix-2.10.1-6.el7.x86_64 Please could you help me? Thanks in advance! -- -- Sergio Belkin LPIC-2 Certified - http://www.lpi.org

2 3