July 2018 - dovecot - dovecot.org

Authentication failure with OpenLDAP
by Anushka Bandara 10 Jul '18

10 Jul '18

Hi all, *Dovecot version: 2.2.22 (fe789d2)* *Ubuntu version: 16.04* *OpenLDAP version: openldap-2.4.42+dfsg* Configurations *# 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf# Pigeonhole version 0.4.13 (7b14904)# OS: Linux 4.10.0-28-generic x86_64 Ubuntu 16.04.3 LTS disable_plaintext_auth = nolisten = *log_path = /var/log/dovecot.logmail_location = maildir:~/Maildirnamespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = }passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap}protocols = pop3 imapservice auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 }}ssl = nouserdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap}* I am having "*Authentication failed" *problem with dovecot-ldap. Before it, I had binding error and I fixed it. Now I am having authentication problem when I am trying to log dovecot (usign telnet localhost 110) using a user which is created in ldap server. I can provide any configuration file and I did this configurations according to this " https://help.ubuntu.com/community/DovecotLDAP". Now I am having an authentication error. Thank you

2 1

slow mailbox refreshes
by Fabian A. Santiago 09 Jul '18

09 Jul '18

Hello, I am using dovecot 2.3.2 on my private email server in conjunction with: centos 7.5 apache 2.4.6 mariadb 10.2.16 roundcube mail 1.3.6 php 5.6.36 postfix 2.10.1 I have one mailbox with nearly 30k messages in it dispersed across several folders. it's often very slow in refreshing the message list, especially in the one largest 25k+ message folder. is this simply to be expected based on my message count or is there some kind of performance optimization and tuning i can do to improve the response times? The mail server itself is a linode hosted VPS: intel xeon e5-2680 v2 @ 2.80 GHz, 4 cores 8 GB real memory 2 GB virtual memory 200 GB local storage (ext4) KVM hypervisor Thanks everyone for any guidance you can offer. -- Fabian S. OpenPGP: 0x643082042DC83E6D94B86C405E3DAA18A1C22D8F (new key) *** 0x3C3FA072ACCB7AC5DB0F723455502B0EEB9070FC (to be retired, still valid)

2 1

New error message with Dovecot/Pigeonhole
by Jerry 08 Jul '18

08 Jul '18

FreeBSD 11.1 / amd64 dovecot --version 2.3.2 (582970113) Pigeonhole version 0.5.2 (7704de5e) I have run 'sieve-test" many times to check out changes in my "sieve" scripts. This morning, it suddenly started issuing this error message: sieve-test(root): Fatal: Couldn't drop privileges: User is missing UID (see mail_uid setting) I am not sure what is wrong or how to correct it, since it never happened before. -- Jerry "Ainsi sera, groigne qui groigne"

3 2

Re: Question about password field in passwd-file
by J Doe 08 Jul '18

08 Jul '18

> On Jul 7, 2018, at 2:12 AM, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > > you can add nopassword attribute to the end. See https://wiki.dovecot.org/PasswordDatabase/ExtraFields > > > --- > Aki Tuomi > Dovecot oy Hi Aki, Thank you for your reply. I have two questions regarding this: 1. Is the “nopassword” attribute the same as specifying a null password field by itself ? The documentation at [1] seems to suggest that having a null password AND specifying “nopassword” will allow someone to authenticate with _no_ password: “nopasword: if you want to allow all passwords, use an empty password and this field.” Farther down, the page seems to indicate that the “nologin” attribute is what I am looking for: “nologin: User isn’t actually allowed to log in even if the password matches . . .” Or possibly “noauthenticate”: “noauthenticate: Do not perform any authentication . . ." 2. Is “nologin” functionally equivalent to specifying no password in the password field ? I am assuming that setting a null password (even without “nologin”), prevents login with ANY or NO password as a blank field would default to a {CRYPT} scheme and a call to crypt() cannot return a null string. As background to why I want to do this, I have a server with a basic Dovecot setup that provides SMTP SASL AUTH, IMAP and LMTP for Postfix. For the passdb and userdb, I use the same passwd-style file: /etc/dovecot/dovecot.conf userdb { driver = passwd-file args = /etc/dovecot/passwd } passdb { driver = passwd-file args = /etc/dovecot/passwd } I use usernames for SMTP SASL AUTH and IMAP that differ from either: user(a)example.com or user. So for one user, for example, I have: /etc/dovecot/passwd # SMTP SASL AUTH and IMAP user accounts and passwords user_account_1:{PLAIN}password: . . . # LMTP username/e-mail address user(a)example.com:: . . . :/var/mail/vhosts/example.com/user_account_1 So in the LMTP entry I specify no password between the colons to prevent someone trying to logon via IMAP using the LMTP username/e-mail address. Is this correct and: is there a better way to do this ? Thanks, - J Sources: [1] https://wiki.dovecot.org/PasswordDatabase/ExtraFields

1 0

Get rid of the "dbox-Mails"-folder
by Hativ 07 Jul '18

07 Jul '18

Hey to all, is it possible to get rid of the "dbox-Mails"-folder when using sdbox? Currently my folder structure looks like this (I hope the output from tree would be formatted well): /srv/mail/ └── example.com └── user ├── dovecot-acl-list ├── dovecot-attributes ├── dovecot.list.index.log ├── dovecot.mailbox.log ├── dovecot-uidvalidity ├── dovecot-uidvalidity.5b3f746f ├── mailboxes │ ├── Drafts │ │ └── dbox-Mails │ │ └── dovecot.index.log │ ├── INBOX │ │ └── dbox-Mails │ │ ├── dovecot.index.cache │ │ ├── dovecot.index.log │ │ └── u.1 │ ├── Junk │ │ └── dbox-Mails │ │ └── dovecot.index.log │ ├── Sent │ │ └── dbox-Mails │ │ └── dovecot.index.log │ └── Trash │ └── dbox-Mails │ └── dovecot.index.log └── subscriptions I would like to let it look like this: /srv/mail/ └── example.com └── user ├── dovecot-acl-list ├── dovecot-attributes ├── dovecot.list.index.log ├── dovecot.mailbox.log ├── dovecot-uidvalidity ├── dovecot-uidvalidity.5b3f746f ├── mailboxes │ ├── Drafts │ │ └── dovecot.index.log │ ├── INBOX │ │ └── dovecot.index.cache │ │ └── dovecot.index.log │ │ └── u.1 │ ├── Junk │ │ └──dovecot.index.log │ ├── Sent │ │ └── dovecot.index.log │ └── Trash │ └── dovecot.index.log └── subscriptions My path configuration: mail_attribute_dict = file:%h/dovecot-attributes mail_home = /srv/mail/%d/%n/ mail_location = sdbox:~/ I have tried mail_location = sdbox:~/:FULLDIRNAME= and mail_location = sdbox:~/:FULLDIRNAME=/ but it doesn't work. The first doesn't change anything. The second auto-creates the folders after first login like I want, but after next login they are greyed out and no longer accessible. Is it possible to get rid of the "dbox-Mails"-folder? I want this because I don't like to have an unneeded deep folder structure. Or is there a good reason to let the "dbox-Mails" folder in my setup? Greetings, Hativ

2 3

build failure with glibc >= 2.26
by Eray Aslan 07 Jul '18

07 Jul '18

Sun RPC was removed from glibc-2.26 [1] resulting in /bin/sh ../../../libtool --tag=CC --mode=link x86_64-pc-linux-gnu-gcc -std=gnu99 -march=native -O2 -pipe -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -module -avoid-version -Wl,-O1 -Wl,--as-needed -o lib10_doveadm_quota_plugin.la -rpath /usr/lib64/dovecot/doveadm doveadm-quota.lo rquota_xdr.c:4:10: fatal error: rpc/rpc.h: No such file or directory #include <rpc/rpc.h> ^~~~~~~~~~~ compilation terminated. make[4]: *** [Makefile:826: rquota_xdr.lo] Error 1 during build. Apparently, rquota code needs some love. This is dovecot-2.3.2 but 2.2 branch should also result in the same error during make. -- Eray [1] https://fedoraproject.org/wiki/Changes/SunRPCRemoval

1 0

Question about password field in passwd-file
by J Doe 07 Jul '18

07 Jul '18

Hello, I have a question regarding the password field of the passwd-file [1]. According to the wiki, the password field assumes a {SCHEME} of CRYPT when the {SCHEME} is not prefixed to this field. So, a passwd-file like: user:password: . . . … is equivalent to: user:{CRYPT}password: . . . Does that mean an example passwd-file with NEITHER {SCHEME} or password, like: user(a)example.com:: . . . (note no scheme or password specified between colons) …means that the user(a)example.com user does not have any valid crypted password and therefore the user(a)example.com user cannot be authenticated ? For example, if I use doveadm to create a null CRYPT password: $ sudo doveadm pw -s CRYPT -p “” -u user(a)example.com … gives the result: {CRYPT}txR1JRq9140Qk … which differs from the example password field having NEITHER {SCHEME} or password, like: user(a)example.com:: . . . … so if I attempt to logon using a null password for user(a)example.com when nothing is specified in the password field for the passwd-file: /etc/dovecot/passwd user(a)example.com:: . . . $ sudo doveadm auth test user(a)example.com password: passdb: user(a)example.com auth failed … it is impossible to logon as user(a)example.com with ANY PASSWORD and/or a NULL password ? Thanks, - J Sources: [1] https://wiki2.dovecot.org/AuthDatabase/PasswdFile

2 1

Re: support for Blowfish $2y$10$
by Graham S. Jarvis 07 Jul '18

07 Jul '18

Hei Aki! # doveadm pw -t '{BLF-CRYPT}$2y$10$UEm8SR/IuX.ZONebRt40XOKTuZ9bXktYWpGDiLw2h7MTPcnvmuIRK' Enter password to verify: {BLF-CRYPT}$2y$10$UEm8SR/IuX.ZONebRt40XOKTuZ9bXktYWpGDiLw2h7MTPcnvmuIRK (verified) - Great, thanks! -Graham- PS: Sorry I just "posted" to your personal address instead of the list. Aki Tuomi wrote on 06/07/18 23:06: > Hi! > > $2y$ is supported in 2.3, and supported in 2.2 if your bcrypt provider > supports it. > > You can use doveadm pw -t '{BLF-CRYPT}$2y$...' to verify this. > > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: "Graham S. Jarvis" <gsjarvis(a)pt.lu> > Date: 07/07/2018 00:03 (GMT+02:00) > To: dovecot(a)dovecot.org > Subject: support for Blowfish $2y$10$ > > Hello, > > does dovecot support bcrypt $2y$ version? (BLF-CRYPT - Blowfish crypt) > > > doveadm pw -s BLF-CRYPT > generates a > {BLF-CRYPT}$2a$05$....... > password. > > Does this mean that dovecote will not authenticate against a > $2y$10$....... > password? > > Thanks in advance, > > -Graham-

1 0

support for Blowfish $2y$10$
by Graham S. Jarvis 07 Jul '18

07 Jul '18

Hello, does dovecot support bcrypt $2y$ version? (BLF-CRYPT - Blowfish crypt) doveadm pw -s BLF-CRYPT generates a {BLF-CRYPT}$2a$05$....... password. Does this mean that dovecote will not authenticate against a $2y$10$....... password? Thanks in advance, -Graham-

2 1

Replication fails over SSL
by Vladimir Tiukhtin 06 Jul '18

06 Jul '18

Hi Replication works fine on poor TCP, when I enable SSL it fails Jul 06 17:28:48 mail dovecot[13114]: doveconf: Fatal: execvp(/usr/libexec/dovecot/managesieve) failed: Argument list too long Jul 06 17:28:48 mail dovecot[13114]: config: Error: managesieve-login: dump-capability process returned 89 Jul 06 17:28:48 mail dovecot[13114]: doveadm: Error: Corrupted SSL parameters file in state_dir: ssl-parameters.dat - disabling SSL 360 Jul 06 17:28:48 mail dovecot[13114]: doveadm: Error: Couldn't initialize SSL parameters, disabling SSL I have set: service doveadm { inet_listener { address = {{ dovecot_doveadm_listen_address }} port = {{ dovecot_doveadm_listen_port }} ssl = yes } } ssl_client_ca_file = </etc/ssl/certs/ca-bundle.crt plugin { mail_replica = tcps:{{ dovecot_replica }}:{{ dovecot_doveadm_listen_port }} } I am running native dovecot 2.2.10 on Centos 7. File ssl-parameters.dat exists. I have already removed it and regenerated - does not help Thanks for any advice. Vladimir

1 0