July 2017 - dovecot - dovecot.org

Global create ACL allows out of boundaries mailbox
by Loïc Gomez 13 Jul '17

13 Jul '17

Hello Dovecot Team, During my tests I setup a global ACL allowing mailbox create for all authenticated users. Then, I made a mistake in Thunderbird, tried to create a mailbox directly on the "/shared/" special folder. Dovecot created a folder in the global root path of our mail store. Since I use maildir:/var/vmail/%d/%n/mail as mail_location, it created the mailbox in /var/vmail (where my domains are). It was just a test and I can imagine allowing create permission to all users whatever the … [View More]

1 0

Master auth only
by azurit＠pobox.sk 13 Jul '17

13 Jul '17

Hi, i'm trying to configure Dovecot proxy with user authentication on proxy side only, so backends will authenticate using master password (proxy is configured to send it). The problem is that Dovecot, on backends, is telling me that i need to configure at least one auth mechanism: auth: Fatal: No passdbs specified in configuration file. LOGIN mechanism needs one The master auth is correctly configured. I want to accomplished to have user database only on one place (=proxy). Any hints? azur

4 11

System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

I have a need for the following: Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd Virtual Users in SQL (with full user@domain in the DB) When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. Is there a compromise somewhere? Current doveconf –n with %Ln thebighonker.lerctr.org /usr/local/etc/dovecot/conf.d $ doveconf -n # 2.2.31 (65cde28): /usr/… [View More]local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-PRERELEASE amd64 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org jonesonair.com jonesonair.net auth_username_format = %Ln default_vsz_limit = 1 G deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes listen = 192.147.25.65, :: lmtp_save_to_detail_mailbox = yes login_access_sockets = tcpwrap mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes mail_location = mbox:~/mail:INBOX=~/mail/INBOX mail_log_prefix = "%s(%u/%p): " mail_plugins = " fts fts_solr notify stats virtual" mail_privileged_group = mail mail_server_admin = mailto:ler@lerctr.org mail_server_comment = LERCTR Mail Server mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve namespace archive { hidden = no list = no location = mbox:~/MAIL-ARCHIVE prefix = ARCHIVE/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { auto = create } mailbox SENT { special_use = \Sent } mailbox SPAM { special_use = \Junk } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual/Flagged { special_use = \Flagged } mailbox virtual/all { special_use = \All } prefix = } namespace virtual { hidden = no list = yes location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY prefix = Virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = failure_show_msg=yes session=yes max_requests=20 driver = pam } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ fts_tika = http://localhost:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = SPAM imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = SPAM imapsieve_mailbox2_name = * imapsieve_url = sieve://thebighonker.lerctr.org mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 5s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-client { mode = 0666 } unix_listener auth-master { mode = 0666 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } service indexer-worker { drop_priv_before_exec = yes } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = fifo_listener stats-mail { group = mode = 0666 user = } fifo_listener stats-user { group = mode = 0666 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol lda { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol pop3 { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol !doveadm { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} imap_metadata = yes mail_max_userip_connections = 50 mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve imap_stats stats" } thebighonker.lerctr.org /usr/local/etc/dovecot/conf.d $ -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281 [View Less]

2 1

Unable to Kerberos/GSSAPI an existing user on new workstation
by Mark Foley 13 Jul '17

13 Jul '17

My last message probably contained too much information. This one is more succient. I have a user, 'mark', who has been running a Thunderbird client on Windows to Dovecot server with Kerberos/GSSAPI authentication for over a year. I created a new Tbird account on a new Linux workstation for 'mark', also with Kerberos/GSSAPI and that worked just fine. I have another user, 'dsmith', who has been running a Thunderbird client on Windows to Dovecot server with Kerberos/GSSAPI authentication for … [View More]over a year as well, no problems. I created a new Tbird account on the same new Linux workstation as above for 'dsmith', also with KerberosGSSAPI and that DID NOT WORK! I get the message in Thunderbird: "The Kerberos/GSSAPI ticket was not accepted by the IMAP server ... please check that you are logged into the Kerberos/GSSAPI realm." I created/recreated the smith account numerous time with slightly different settings hoping something will work, but I always get the same message. Why? I need to figure this out ASAP. Here is the dovecot log when user dsmith attempts to connect to dovecot from the Tbird client: Jul 11 19:29:43 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:29:43 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:29:43 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 19:29:43 auth: Debug: Read auth token secret from /usr/local/var/run/dovecot/auth-token-secret.dat Jul 11 19:29:43 auth: Debug: auth client connected (pid=1578) Jul 11 19:29:46 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL alert: close notify [192.168.0.57] Jul 11 19:29:46 imap-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<jR0sExNUTADAqAA5> Jul 11 19:30:17 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:30:17 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:30:17 auth: Debug: auth client connected (pid=3148) Jul 11 19:30:17 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:30:17 auth: Debug: client in: AUTH 1 GSSAPI service=imap secured session=iDUNFRNUUgDAqAA5 lip=192.168.0.2 rip=192.168.0.57 lport=143 rport=58962 Jul 11 19:30:17 auth: Debug: gssapi(?,192.168.0.57,<iDUNFRNUUgDAqAA5>): Using all keytab entries Jul 11 19:30:17 auth: Debug: client passdb out: CONT 1 Jul 11 19:30:17 auth: Debug: client in: CONT 1 YIIE+ [deleted] Jul 11 19:30:18 auth: Debug: gssapi(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): security context state completed. Jul 11 19:30:18 auth: Debug: client passdb out: CONT 1 YIGVB [deleted] Jul 11 19:30:18 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Jul 11 19:30:18 auth: Debug: gssapi(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): Negotiated security layer Jul 11 19:30:18 auth: Debug: client passdb out: CONT 1 BQQF/wAMAAAAAAAAFxWx/AH///9xheyHOAR4oKi3t3M= Jul 11 19:30:18 auth: Debug: client in: CONT 1 BQQE/wAMAAAAAAAANRcNbgEAAABkc21pdGjS3NSV6TWvt53rOLY= (previous base64 data may contain sensitive data) Jul 11 19:30:18 auth-worker(3149): Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 19:30:18 auth-worker(3149): Info: shadow(dsmith,192.168.0.57): unknown user Jul 11 19:30:18 auth: Debug: shadow(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): Credentials: Jul 11 19:30:18 auth: Debug: client passdb out: OK 1 user=dsmith original_user=dsmith(a)HPRS.LOCAL Jul 11 19:30:18 auth: Debug: master in: REQUEST 432275457 3148 1 3f58f611e9a6450ad7291105a93bbe1f session_pid=3150 request_auth_token Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): username changed dsmith -> HPRS\dsmith Jul 11 19:30:18 auth: Debug: master userdb out: USER 432275457 dsmith system_groups_user=HPRS\dsmithuid=3000036 gid=10000 home=/home/HPRS/dsmith auth_token=9ad7ad520ac8da70d07b3353b1c9c4e6ef394004 auth_user=dsmith(a)HPRS.LOCAL Jul 11 19:30:18 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=3150, TLS, session=<iDUNFRNUUgDAqAA5> Thanks, Mark [View Less]

2 1

STARTTLS issue with sieve
by Andreas Oster 13 Jul '17

13 Jul '17

Hi all, I am currently struggling with an odd sieve/Pigeonhole issue. Some weeks ago I had to replace our dovecot certificate due to expiration. In the past I did use a self-signed certificate, but because we now have a little openssl based CA I have decided to create signed certificate for imaps. Dovecot is happily accepting the new certificate which has integrated the whole cert-chain. Unfortunately Pigeonhole does not seem to like the certificate: <--snip gnutls-cli --starttls -… [View More]p4190 mail.novanetwork.local Processed 173 CA certificate(s). Resolving 'mail.novanetwork.loc'... Connecting to '10.2.1.23:4190'... - Simple Client Mode: "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." STARTTLS OK "Begin TLS negotiation now." --> At this point the TLS process does not proceed. When I press CTRL-D I get the following output: *** Starting TLS handshake - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info: - subject `C=DE,ST=Baden-Wuerttemberg,L=Ettlingen,O=NOVA Elektroanlagen GmbH,OU=Mail Server,CN=mail.novanetwork.local', issuer `C=DE,ST=Baden-Wuerttemberg,O=NOVA Elektroanlagen GmbH,OU=NOVA Intermediate CA,CN=NOVA Intermediate CA', RSA key 2048 bits, signed using RSA-SHA256, activated `2017-06-23 06:58:40 UTC', expires `2020-06-22 06:58:40 UTC', SHA-1 fingerprint `51a9b62eaebb6b4a2b8cc9a22740dc689445da0c' Public Key ID: 165eaaa4b36c091ec8f32103da003a1f43b1c57d Public key's random art: +--[ RSA 2048]----+ | .o.. | |. .o. . E | |o.. .. . | |= o . + | |+* o . S | |o==. o o | | .=o+.. | | .ooo | | .o | +-----------------+ - Certificate[1] info: - subject `C=DE,ST=Baden-Wuerttemberg,O=NOVA Elektroanlagen GmbH,OU=NOVA Intermediate CA,CN=NOVA Intermediate CA', issuer `C=DE,ST=Baden-Wuerttemberg,L=Ettlingen,O=NOVA Elektroanlagen GmbH,OU=NOVA Root CA,CN=NOVA Root CA', RSA key 4096 bits, signed using RSA-SHA256, activated `2016-12-05 11:40:29 UTC', expires `2026-12-03 11:40:29 UTC', SHA-1 fingerprint `308870b657dccd4902ca119d18d7ba8d6ad54ec0' - Certificate[2] info: - subject `C=DE,ST=Baden-Wuerttemberg,L=Ettlingen,O=NOVA Elektroanlagen GmbH,OU=NOVA Root CA,CN=NOVA Root CA', issuer `C=DE,ST=Baden-Wuerttemberg,L=Ettlingen,O=NOVA Elektroanlagen GmbH,OU=NOVA Root CA,CN=NOVA Root CA', RSA key 4096 bits, signed using RSA-SHA256, activated `2016-12-05 11:36:47 UTC', expires `2036-11-30 11:36:47 UTC', SHA-1 fingerprint `95326e3ff12683cc40a85874d562d0a6f15dcb37' - Status: The certificate is NOT trusted. The certificate issuer is unknown. *** PKI verification of server certificate failed... *** Fatal error: Error in the certificate. *** Handshake has failed I have checked the certificate with: openssl verify -verbose -CAfile /etc/ssl/certs/ca-chain.cert.pem /etc/ssl/certs/mail.novanetwork.local.cert.pem /etc/ssl/certs/mail.novanetwork.local.cert.pem: OK and also with: openssl verify -verbose -CAfile /etc/ssl/certs/mail.novanetwork.local.cert.pem /etc/ssl/certs/mail.novanetwork.local.cert.pem /etc/ssl/certs/mail.novanetwork.local.cert.pem: OK Does anyone have an idea what could be the cause of the problem and how to fix it ? Thank you for your kind help. best regards Andreas [View Less]

5 11

Cannot Authenticate user with Kerberos/GSSAPI
by mark＠ohprs.org 12 Jul '17

12 Jul '17

My last message probably contained too much information. This one is more succient. I have a user, 'mark', who has been running a Thunderbird client on Windows to Dovecot server with Kerberos/GSSAPI authentication for over a year. I created a new Tbird account on a new Linux workstation for 'mark', also with Kerberos/GSSAPI and that worked just fine. I have another user, 'dsmith', who has been running a Thunderbird client on Windows to Dovecot server with Kerberos/GSSAPI authentication for … [View More]over a year as well, no problems. I created a new Tbird account on the same new Linux workstation as above for 'dsmith', also with KerberosGSSAPI and that DID NOT WORK! I get the message in Thunderbird: "The Kerberos/GSSAPI ticket was not accepted by the IMAP server ... please check that you are logged into the Kerberos/GSSAPI realm." I created/recreated the smith account numerous time with slightly different settings hoping something will work, but I always get the same message. Why? I need to figure this out ASAP. Here is the dovecot log when user dsmith attempts to connect to dovecot from the Tbird client: Jul 11 19:29:43 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:29:43 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:29:43 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 19:29:43 auth: Debug: Read auth token secret from /usr/local/var/run/dovecot/auth-token-secret.dat Jul 11 19:29:43 auth: Debug: auth client connected (pid=1578) Jul 11 19:29:46 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL alert: close notify [192.168.0.57] Jul 11 19:29:46 imap-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<jR0sExNUTADAqAA5> Jul 11 19:30:17 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:30:17 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:30:17 auth: Debug: auth client connected (pid=3148) Jul 11 19:30:17 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:30:17 auth: Debug: client in: AUTH 1 GSSAPI service=imap secured session=iDUNFRNUUgDAqAA5 lip=192.168.0.2 rip=192.168.0.57 lport=143 rport=58962 Jul 11 19:30:17 auth: Debug: gssapi(?,192.168.0.57,<iDUNFRNUUgDAqAA5>): Using all keytab entries Jul 11 19:30:17 auth: Debug: client passdb out: CONT 1 Jul 11 19:30:17 auth: Debug: client in: CONT 1 YIIE+ [deleted] Jul 11 19:30:18 auth: Debug: gssapi(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): security context state completed. Jul 11 19:30:18 auth: Debug: client passdb out: CONT 1 YIGVB [deleted] Jul 11 19:30:18 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Jul 11 19:30:18 auth: Debug: gssapi(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): Negotiated security layer Jul 11 19:30:18 auth: Debug: client passdb out: CONT 1 BQQF/wAMAAAAAAAAFxWx/AH///9xheyHOAR4oKi3t3M= Jul 11 19:30:18 auth: Debug: client in: CONT 1 BQQE/wAMAAAAAAAANRcNbgEAAABkc21pdGjS3NSV6TWvt53rOLY= (previous base64 data may contain sensitive data) Jul 11 19:30:18 auth-worker(3149): Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 19:30:18 auth-worker(3149): Info: shadow(dsmith,192.168.0.57): unknown user Jul 11 19:30:18 auth: Debug: shadow(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): Credentials: Jul 11 19:30:18 auth: Debug: client passdb out: OK 1 user=dsmith original_user=dsmith(a)HPRS.LOCAL Jul 11 19:30:18 auth: Debug: master in: REQUEST 432275457 3148 1 3f58f611e9a6450ad7291105a93bbe1f session_pid=3150 request_auth_token Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): username changed dsmith -> HPRS\dsmith Jul 11 19:30:18 auth: Debug: master userdb out: USER 432275457 dsmith system_groups_user=HPRS\dsmithuid=3000036 gid=10000 home=/home/HPRS/dsmith auth_token=9ad7ad520ac8da70d07b3353b1c9c4e6ef394004 auth_user=dsmith(a)HPRS.LOCAL Jul 11 19:30:18 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=3150, TLS, session=<iDUNFRNUUgDAqAA5> Thanks, Mark [View Less]

1 0

shared namespace not showing in thunderbird
by Rich Simcox 11 Jul '17

11 Jul '17

I have configured dovecot to have a shared namespace so users can share there inboxs with each other but no matter what paths i give it i cant see the folder in thunderbird I've checked my db is listing to and from i've checked i have correct permissions, i'm sure i have everything right here is my config and extract of the debug log while i use the list acl's and try and subscribe to the shared inboxs via thunderbird root@ssd99 [/home/rich]# dovecot -n # 2.2.28 (bed8434): /etc/dovecot/… [View More]

1 0

stopped being able to kerberos/GSSAPI authenticate with new email accounts
by Mark Foley 11 Jul '17

11 Jul '17

I've been running with Dovecot 2.2.15 on my mail server and Thunderbird on workstations with Kerberos/GSSAPI authentication. This has been working for over a year for 10 users. The other day, I replaced a user's workstation and set up this user with a Thunderbird client. Unfortunately, I got the error: "The Kerberos/GSSAPI ticket was not accepted by the IMAP server ... please check that you are logged into the Kerberos/GSSAPI realm." Doing more experimentation I've found that I cannot set … [View More]up *any* existing user with a new account without getting that same message. Interestingly, all existing users can still connect just fine from their Tbird clients on their current workstations which were set up over a year ago, I just can't create an account for them on a different workstation. I'm at a loss as to where to start on this. My config is: $ dovconf -n: # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.38 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes Here is the log from an existing user, configured a long time ago, that works OK: Jul 11 17:28:31 auth-worker(5858): Debug: shadow(mark,192.168.0.99): lookup Jul 11 17:28:31 auth-worker(5858): Info: shadow(mark,192.168.0.99): unknown user Jul 11 17:28:31 auth: Debug: shadow(mark,192.168.0.99,<OxGMYRFUsADAqABj>): Credentials: Jul 11 17:28:31 auth: Debug: client passdb out: OK 1 user=mark original_user=mark(a)HPRS.LOCAL Jul 11 17:28:31 auth: Debug: master in: REQUEST 3872522241 6421 1 46614c53fd96efa48a94b889ad2405d3 session_pid=6429 request_auth_token Jul 11 17:28:31 auth-worker(5858): Debug: shadow(mark,192.168.0.99): lookup Jul 11 17:28:31 auth-worker(5858): Debug: shadow(mark,192.168.0.99): username changed mark -> HPRS\mark Jul 11 17:28:31 auth: Debug: master userdb out: USER 3872522241 mark system_groups_user=HPRS\mark uid=10001 gid=10000 home=/home/HPRS/mark auth_token=4959011413324b3d5d2d6f77c0adf2629551d91d auth_user=mark(a)HPRS.LOCAL Jul 11 17:28:31 imap-login: Info: Login: user=<mark>, method=GSSAPI, rip=192.168.0.99, lip=192.168.0.2, mpid=6429, TLS, session=<OxGMYRFUsADAqABj> Here is that same user set up on a new client computer, with all the same settings (as far as I can tell. This one apparently doesn't even try kerberos. Jul 11 18:08:25 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 18:08:25 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 18:08:25 auth: Debug: auth client connected (pid=1055) Jul 11 18:08:25 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 18:08:25 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 18:08:25 auth: Debug: client in: AUTH 1 GSSAPI service=imap secured session=grVG8BFU2gDAqAA5 lip=192.168.0.2 rip=192.168.0.57 lport=143 rport=58586 Jul 11 18:08:25 auth: Debug: gssapi(?,192.168.0.57,<grVG8BFU2gDAqAA5>): Using all keytab entries Jul 11 18:08:25 auth: Debug: client passdb out: CONT 1 Jul 11 18:08:25 auth: Debug: client in: CONT 1 YIIE+ [deleted] Jul 11 18:08:26 auth: Debug: gssapi(dsmith,192.168.0.57,<grVG8BFU2gDAqAA5>): security context state completed. Jul 11 18:08:26 auth: Debug: client passdb out: CONT 1 YIGVB [deleted] Jul 11 18:08:26 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Jul 11 18:08:26 auth: Debug: gssapi(dsmith,192.168.0.57,<grVG8BFU2gDAqAA5>): Negotiated security layer Jul 11 18:08:26 auth: Debug: client passdb out: CONT 1 BQQF/wAMAAAAAAAAFuHbYgH///9r9NgQ1SHdkCg7kho= Jul 11 18:08:26 auth: Debug: client in: CONT 1 BQQE/wAMAAAAAAAAF9wdQwEAAABtYXJrXNhf7+Xh4YGqvoA5 (previous base64 data may contain sensitive data) Jul 11 18:08:26 auth-worker(30944): Debug: shadow(mark,192.168.0.57): lookup Jul 11 18:08:26 auth-worker(30944): Info: shadow(mark,192.168.0.57): unknown user Jul 11 18:08:26 auth: Debug: shadow(mark,192.168.0.57,<grVG8BFU2gDAqAA5>): Credentials: Jul 11 18:08:26 auth: Info: gssapi(mark,192.168.0.57,<grVG8BFU2gDAqAA5>): User not authorized to log in as mark Jul 11 18:08:28 auth: Debug: client passdb out: FAIL 1 user=mark original_user=dsmith(a)HPRS.LOCAL Jul 11 18:08:28 imap-login: Debug: Ignoring unknown passdb extra field: original_user Jul 11 18:08:28 imap-login: Debug: SSL alert: close notify [192.168.0.57] Jul 11 18:08:28 imap-login: Debug: SSL alert: close notify [192.168.0.57] Jul 11 18:08:28 imap-login: Info: Disconnected (auth failed, 1 attempts in 3 secs): user=<mark>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<grVG8BFU2gDAqAA5> Lastly, at the risk of too much information, here is the log info for the actual user (dsmith) for whom I'm trying to set up tbird email on his new workstation. I get the "Kerberos/GSSAPI ticket was not accepted by the IMAP server ..." message shown at the top of this post when this user opens Thunderbird. Note that this user can connect and get mail just find from his old workstation. Jul 11 18:24:29 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 18:24:29 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 18:24:29 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 18:24:29 auth: Debug: Read auth token secret from /usr/local/var/run/dovecot/auth-token-secret.dat Jul 11 18:24:29 auth: Debug: auth client connected (pid=11449) Jul 11 18:24:29 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 18:24:29 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 18:24:29 auth: Debug: auth client connected (pid=11452) Jul 11 18:24:30 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 18:24:30 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 18:24:30 auth: Debug: client in: AUTH 1 GSSAPI service=imap secured session=dYHDKRJUJgDAqAA5 lip=192.168.0.2 rip=192.168.0.57 lport=143 rport=58662 Jul 11 18:24:30 auth: Debug: client in: AUTH 1 GSSAPI service=imap secured session=dYHDKRJUJADAqAA5 lip=192.168.0.2 rip=192.168.0.57 lport=143 rport=58660 Jul 11 18:24:30 auth: Debug: gssapi(?,192.168.0.57,<dYHDKRJUJgDAqAA5>): Using all keytab entries Jul 11 18:24:30 auth: Debug: client passdb out: CONT 1 Jul 11 18:24:30 auth: Debug: gssapi(?,192.168.0.57,<dYHDKRJUJADAqAA5>): Using all keytab entries Jul 11 18:24:30 auth: Debug: client passdb out: CONT 1 Jul 11 18:24:30 auth: Debug: client in: CONT 1 YIIE+ [deleted] Jul 11 18:24:30 auth: Debug: gssapi(dsmith,192.168.0.57,<dYHDKRJUJADAqAA5>): security context state completed. Jul 11 18:24:30 auth: Debug: client passdb out: CONT 1 YIGVB [deleted] Jul 11 18:24:30 auth: Debug: client in: CONT 1 YIIE+ [deleted] Jul 11 18:24:30 auth: Debug: gssapi(dsmith,192.168.0.57,<dYHDKRJUJgDAqAA5>): security context state completed. Jul 11 18:24:30 auth: Debug: client passdb out: CONT 1 YIGVB [deleted] Jul 11 18:24:30 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Jul 11 18:24:30 auth: Debug: gssapi(dsmith,192.168.0.57,<dYHDKRJUJADAqAA5>): Negotiated security layer Jul 11 18:24:30 auth: Debug: client passdb out: CONT 1 BQQF/wAMAAAAAAAAH1+3awH////7bf0e2rfKTxNaqLg= Jul 11 18:24:30 auth: Debug: client in: CONT 1 BQQE/wAMAAAAAAAALn6AhAEAAABkc21pdGgQuBsLom6nqscutNM= (previous base64 data may contain sensitive data) Jul 11 18:24:30 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Jul 11 18:24:30 auth: Debug: gssapi(dsmith,192.168.0.57,<dYHDKRJUJgDAqAA5>): Negotiated security layer Jul 11 18:24:30 auth: Debug: client passdb out: CONT 1 BQQF/wAMAAAAAAAAFRtpiAH///9zZJNlQtcDSy2+KYo= Jul 11 18:24:30 auth: Debug: client in: CONT 1 BQQE/wAMAAAAAAAANzdOTQEAAABkc21pdGhTz0R9AmEjueuv4Kk= (previous base64 data may contain sensitive data) Jul 11 18:24:30 auth-worker(12060): Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 18:24:30 auth-worker(12060): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 18:24:30 auth-worker(12060): Info: shadow(dsmith,192.168.0.57): unknown user Jul 11 18:24:30 auth: Debug: shadow(dsmith,192.168.0.57,<dYHDKRJUJADAqAA5>): Credentials: Jul 11 18:24:30 auth: Debug: client passdb out: OK 1 user=dsmith original_user=dsmith(a)HPRS.LOCAL Jul 11 18:24:30 auth-worker(12062): Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 18:24:30 auth: Debug: master in: REQUEST 2956591105 11449 1 c9c09995778a3d70b6569097b3d3fe34 session_pid=12064 request_auth_token Jul 11 18:24:30 auth-worker(12060): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 18:24:30 auth-worker(12062): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 18:24:30 auth-worker(12062): Info: shadow(dsmith,192.168.0.57): unknown user Jul 11 18:24:30 auth: Debug: shadow(dsmith,192.168.0.57,<dYHDKRJUJgDAqAA5>): Credentials: Jul 11 18:24:30 auth: Debug: client passdb out: OK 1 user=dsmith original_user=dsmith(a)HPRS.LOCAL Jul 11 18:24:30 auth: Debug: master in: REQUEST 313131009 11452 1 8af9373d65d7d3dc2f556156d6c1c979 session_pid=12066 request_auth_token Jul 11 18:24:30 auth-worker(12062): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 18:24:30 auth-worker(12060): Debug: shadow(dsmith,192.168.0.57): username changed dsmith -> HPRS\dsmith Jul 11 18:24:30 auth: Debug: master userdb out: USER 2956591105 dsmith system_groups_user=HPRS\dsmithuid=3000036 gid=10000 home=/home/HPRS/dsmith auth_token=5e36f7c4ae98f7873aefcb9186d661e54a94f180 auth_user=dsmith(a)HPRS.LOCAL Jul 11 18:24:30 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=12064, TLS, session=<dYHDKRJUJADAqAA5> Jul 11 18:24:30 auth-worker(12062): Debug: shadow(dsmith,192.168.0.57): username changed dsmith -> HPRS\dsmith Jul 11 18:24:30 auth: Debug: master userdb out: USER 313131009 dsmith system_groups_user=HPRS\dsmithuid=3000036 gid=10000 home=/home/HPRS/dsmith auth_token=057d47a48c1d97b4c5a8b413c4b4753de41f0a19 auth_user=dsmith(a)HPRS.LOCAL Jul 11 18:24:30 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=12066, TLS, session=<dYHDKRJUJgDAqAA5> HELP! THX - Mark [View Less]

1 0

pigeonhole-0.4.14
by j.emerlik 10 Jul '17

10 Jul '17

Hi, my global sieve filter looks like this: require "fileinto"; if header :contains "X-Spam-Status" "YES" { fileinto "INBOX.Junk"; } if header :contains "X-Spam-Level" "********************" { discard; stop; } Why Dovecot 2.2.24 and pigeonhole-0.4.14 moves all e-mails to spam eg .: with "X-Spam-Status: No," too ? Regards, Jack

3 6

how to make user iteration work (with active directory ldap)
by mj 07 Jul '17

07 Jul '17

We received no replies to this email that we sent a few days ago. We're not sure why. If we miss something that is obvious to everybody, kindly point it out. We ẃould like to get iteration working, to be able to mass-delete specific emails from all mailboxes, in case of for example received virusses... Here is my question again: Hi, User iteration doesn't work, we're getting: > auth: Error: Trying to iterate users, but userdbs don't support it The way I understand it, I need to set … [View More]iterate_attrs and iterate_filter for iteration to work. I have set it (see configs below) and yet dovecot says "userdbs don't support it". What else do I need to do to enable it? Our config is against samba Active Directory ldap and generally works fine. Can anyone here take a quick look at the configs below, and tell me how to make doveadm user -u "*" work? Below are our configs. Any tips would be appreciated...! MJ > root@dovetest:/etc/dovecot# doveconf -n > # 2.2.26.0 (23d1de6): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.16 (fed8554) > # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.7 xfs > auth_debug = yes > auth_debug_passwords = yes > auth_failure_delay = 400 secs > auth_master_user_separator = * > auth_mechanisms = plain login > auth_username_format = %Ln > auth_verbose = yes > auth_verbose_passwords = plain > debug_log_path = /var/log/dovecot/dovecot.debug > deliver_log_format = %f | %s | msgid=%m: %$ > disable_plaintext_auth = no > info_log_path = /var/log/dovecot/dovecot.info > lda_mailbox_autocreate = yes > lda_mailbox_autosubscribe = yes > log_path = /var/log/dovecot/dovecot.err > login_greeting = Dovecot ready. > mail_gid = vmail > mail_location = maildir:/var/vmail/%Ln/Maildir:LAYOUT=fs:DIRNAME=mAildir > mail_plugins = acl lazy_expunge zlib quota mail_log notify > mail_uid = vmail > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave > namespace { > list = children > location = maildir:/var/vmail/%%u/Maildir:LAYOUT=fs:DIRNAME=mAildir:INDEX=/var/vmail/%u/shared/%%u > prefix = shared/%%n/ > separator = / > subscriptions = no > type = shared > } > namespace inbox { > inbox = yes > location = > mailbox "Deleted items" { > special_use = \Trash > } > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent items" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > mailbox inbox { > auto = subscribe > } > prefix = > separator = / > type = private > } > passdb { > args = /etc/dovecot/master-users > driver = passwd-file > master = yes > } > passdb { > args = failure_show_msg=yes dovecot > driver = pam > } > passdb { > args = /etc/dovecot/dovecot-ldap.conf.ext > driver = ldap > skip = authenticated > } > plugin { > acl = vfile > acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename append > mail_log_fields = uid box msgid from subject > quota = maildir > quota_rule = ?:storage=5G > quota_rule2 = Trash:storage=+100M > quota_warning = storage=97%% quota-warning 97 %u > quota_warning2 = storage=95%% quota-warning 95 %u > quota_warning3 = storage=90%% quota-warning 90 %u > quota_warning4 = storage=85%% quota-warning 85 %u > quota_warning5 = storage=80%% quota-warning 80 %u > quota_warning6 = -storage=100%% quota-warning below %u > sieve = ~/.dovecot.sieve > sieve_default = /var/lib/dovecot/default.sieve > sieve_dir = ~/sieve > } > protocols = imap lmtp sieve > service auth { > unix_listener /var/spool/postfix/private/auth { > mode = 0666 > } > unix_listener auth-userdb { > group = vmail > mode = 0666 > user = vmail > } > } > service imap-login { > process_limit = 500 > process_min_avail = 2 > } > service quota-warning { > executable = script /usr/local/bin/quota-warning.sh > unix_listener quota-warning { > user = vmail > } > user = dovecot > } > ssl_ca = </etc/ssl/comodo/chain.crt > ssl_cert = </etc/ssl/comodo/server.crt > ssl_key = # hidden, use -P to show it > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = uid=vmail gid=vmail home=/var/vmail/%n allow_all_users=yes > driver = static > } > verbose_proctitle = yes > protocol lda { > mail_plugins = acl lazy_expunge zlib quota mail_log notify sieve quota > } > protocol imap { > imap_max_line_length = 2 M > mail_max_userip_connections = 30 > mail_plugins = acl lazy_expunge zlib quota mail_log notify imap_quota imap_acl > } and dovecot-ldap.conf.ext: > hosts = 127.0.0.1:391 > dn = cn=search,cn=users,dc=company,dc=com > dnpass = secret > tls = no > debug_level = 0 > auth_bind = yes > base = CN=Users, DC=samba, DC=cmpany, DC=com > scope = subtree > user_attrs = =home=/var/vmail/%n/Maildir:LAYOUT=fs:DIRNAME=mAildir:INDEX=/var/vmail/%n/shared/%n,=mail=maildir:/var/vmail/%n/Maildir:LAYOUT=fs:DIRNAME=mAildir:INDEX=/var/vmail/%n/shared/%n > user_filter = (&(objectclass=person)(sAMAccountName=%n)(!(userAccountControl=514))) > pass_filter = (&(objectclass=person)(sAMAccountName=%n)(!(userAccountControl=514))) > iterate_attrs = sAMAccountName=user > iterate_filter = (objectClass=person) [View Less]

2 2