- dovecot - dovecot.org

[Dovecot] Dovecot 2.0, 2.1 and 2.2.5 core dump when Quota Plugin (FS) is enabled
by Harald Strack 22 Sep '13

22 Sep '13

Hi, we are actually deploying a new IMAP-Server, targeting dovecot 2.1.17. Unfortunately, our tests with imaptest did not succeed, were ending in core dumps. We did this test: ./imaptest host=example.com port=143 user=strack pass=secret disconnect_quit no_pipelining mbox=dovecot-crlf That's what we get in dovecot's log: Sep 10 11:17:04 imap-login: Info: Login: user=<strack>, method=PLAIN, rip=10.10.10.31, lip=10.10.10.21, mpid=22810, session=<EurP9wPmVgCBu/Qf> Sep 10 11:17:04 imap-login: Info: Login: user=<strack>, method=PLAIN, rip=10.10.10.31, lip=10.10.10.21, mpid=22811, session=<mSXT9wPmWgCBu/Qf> Sep 10 11:17:04 imap-login: Info: Login: user=<strack>, method=PLAIN, rip=10.10.10.31, lip=10.10.10.21, mpid=22812, session=<1GbR9wPmWACBu/Qf> Sep 10 11:17:04 imap-login: Info: Login: user=<strack>, method=PLAIN, rip=10.10.10.31, lip=10.10.10.21, mpid=22813, session=<JKbQ9wPmVwCBu/Qf> Sep 10 11:17:04 imap-login: Info: Login: user=<strack>, method=PLAIN, rip=10.10.10.31, lip=10.10.10.21, mpid=22814, session=<USLS9wPmWQCBu/Qf> Sep 10 11:17:04 imap(strack): Panic: file mbox-storage.c: line 712 (mbox_transaction_unlock): assertion failed: (mbox->box.transaction_count > 0 || mbox->mbox_lock_type == F_UNLCK) Sep 10 11:17:04 imap(strack): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0() [0x3c7824660a] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3c78246656] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3c78219eaa] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3c786600c0] -> /usr/lib/dovecot/lib10_quota_plugin.so(+0xb7e7) [0x7f113b5427e7] -> /usr/lib/dovecot/lib10_quota_plugin.so(+0xb218) [0x7f113b542218] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mbox_sync+0x88) [0x3c7865fea8] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mbox_transaction_save_commit_post+0x27) [0x3c78657c07] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3c786a5313] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_transaction_commit_full+0x9f) [0x3c786b3cdf] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_transaction_commit+0x8a) [0x3c786a4f5a] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3c78660121] -> /usr/lib/dovecot/lib10_quota_plugin.so(+0xb8af) [0x7f113b5428af] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_transaction_commit_get_changes+0x3e) [0x3c7867aa9e] -> dovecot/imap() [0x408b3a] -> dovecot/imap() [0x4088e4] -> dovecot/imap() [0x408d3c] -> dovecot/imap(cmd_append+0x139) [0x408f99] -> dovecot/imap(command_exec+0x3d) [0x41155d] -> dovecot/imap() [0x41046e] -> dovecot/imap() [0x41055a] -> dovecot/imap(client_handle_input+0x135) [0x410785] -> dovecot/imap(client_input+0x5f) [0x4110af] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x36) [0x3c78252c16] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9f) [0x3c78253c9f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x28) [0x3c78252bb8] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x3c7823e083] -> dovecot/imap(main+0x29d) [0x4195bd] Sep 10 11:17:04 imap-login: Info: Login: user=<strack>, method=PLAIN, rip=10.10.10.31, lip=10.10.10.21, mpid=22826, session=<KyHU9wPmWwCBu/Qf> Sep 10 11:17:04 imap-login: Info: Login: user=<strack>, method=PLAIN, rip=10.10.10.31, lip=10.10.10.21, mpid=22827, session=<kxTY9wPmXACBu/Qf> Sep 10 11:17:04 imap-login: Info: Login: user=<strack>, method=PLAIN, rip=10.10.10.31, lip=10.10.10.21, mpid=22828, session=<CXXg9wPmXQCBu/Qf> Sep 10 11:17:05 imap(strack): Fatal: master: service(imap): child 22806 killed with signal 6 (core dumped) Sep 10 11:17:05 imap(strack): Info: Connection closed in=49 out=3832 Sep 10 11:17:05 imap(strack): Info: Connection closed in=49 out=3832 That's the backtrace of the coredump: Loaded symbols for /lib64/libnss_files.so.2 Reading symbols from /lib64/libnss_sss.so.2...Reading symbols from /usr/lib/debug/lib64/libnss_sss.so.2.debug...done. done. Loaded symbols for /lib64/libnss_sss.so.2 Reading symbols from /lib64/libgcc_s.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libgcc_s.so.1 Core was generated by `dovecot/imap'. Program terminated with signal 6, Aborted. #0 0x0000003bc02328a5 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.107.el6_4.2.x86_64 keyutils-libs-1.4-4.el6.x86_64 krb5-libs-1.10.3-10.el6_4.4.x86_64 libcom_err-1.41.12-14.el6_4.2.x86_64 libgcc-4.4.7-3.el6.x86_64 libselinux-2.0.94-5.3.el6_4.1.x86_64 openssl-1.0.0-27.el6_4.2.x86_64 zlib-1.2.3-29.el6.x86_64 (gdb) bt #0 0x0000003bc02328a5 in raise () from /lib64/libc.so.6 #1 0x0000003bc0234085 in abort () from /lib64/libc.so.6 #2 0x0000003c78246618 in default_fatal_finish (type=<value optimized out>, status=0) at failures.c:191 #3 0x0000003c78246656 in i_internal_fatal_handler (ctx=0x7fff1c87efa0, format=<value optimized out>, args=<value optimized out>) at failures.c:649 #4 0x0000003c78219eaa in i_panic (format=0x2c1e <Address 0x2c1e out of bounds>) at failures.c:263 #5 0x0000003c786600c0 in mbox_transaction_unlock (box=0x1a51270, lock_id=<value optimized out>) at mbox-storage.c:711 #6 0x00007f95c08c77e7 in quota_mailbox_transaction_rollback (ctx=0x1a589e0) at quota-storage.c:142 #7 0x00007f95c08c7218 in quota_mailbox_sync_notify (box=0x1a51270, uid=0, sync_type=0) at quota-storage.c:301 #8 0x0000003c7865fea8 in mbox_sync (mbox=0x1a51270, flags=<value optimized out>) at mbox-sync.c:2006 #9 0x0000003c78657c07 in mbox_transaction_save_commit_post (_ctx=0x1a53e20, result=<value optimized out>) at mbox-save.c:807 #10 0x0000003c786a5313 in index_transaction_index_commit (index_trans=0x1a5a530, result_r=0x7fff1c87f190) at index-transaction.c:50 #11 0x0000003c786b3cdf in mail_index_transaction_commit_full (_t=0x7fff1c87f1b8, result_r=0x7fff1c87f190) at mail-index-transaction.c:251 #12 0x0000003c786a4f5a in index_transaction_commit (t=<value optimized out>, changes_r=<value optimized out>) at index-transaction.c:132 #13 0x0000003c78660121 in mbox_transaction_commit (t=<value optimized out>, changes_r=<value optimized out>) at mbox-storage.c:729 #14 0x00007f95c08c78af in quota_mailbox_transaction_commit (ctx=0x1a5a390, changes_r=0x7fff1c87f260) at quota-storage.c:124 #15 0x0000003c7867aa9e in mailbox_transaction_commit_get_changes (_t=<value optimized out>, changes_r=0x7fff1c87f260) at mail-storage.c:1515 #16 0x0000000000408b3a in cmd_append_continue_parsing (cmd=0x1a4ea50) at cmd-append.c:284 #17 0x00000000004088e4 in cmd_append_continue_message (cmd=0x1a4ea50) at cmd-append.c:466 #18 0x0000000000408d3c in cmd_append_continue_parsing (cmd=0x1a4ea50) at cmd-append.c:399 #19 0x0000000000408f99 in cmd_append (cmd=0x1a4ea50) at cmd-append.c:519 #20 0x000000000041155d in command_exec (cmd=0x1a4ea50) at imap-commands.c:148 #21 0x000000000041046e in client_command_input (cmd=0x1a4ea50) at imap-client.c:684 #22 0x000000000041055a in client_command_input (cmd=0x1a4ea50) at imap-client.c:735 #23 0x0000000000410785 in client_handle_next_command (client=0x1a4e240) at imap-client.c:776 #24 client_handle_input (client=0x1a4e240) at imap-client.c:788 #25 0x00000000004110af in client_input (client=0x1a4e240) at imap-client.c:827 #26 0x0000003c78252c16 in io_loop_call_io (io=0x1a4cb70) at ioloop.c:379 #27 0x0000003c78253c9f in io_loop_handler_run (ioloop=<value optimized out>) at ioloop-epoll.c:213 #28 0x0000003c78252bb8 in io_loop_run (ioloop=0x1a35670) at ioloop.c:398 #29 0x0000003c7823e083 in master_service_run (service=0x1a35520, callback=<value optimized out>) at master-service.c:544 #30 0x00000000004195bd in main (argc=1, argv=0x1a35370) at main.c:389 That's the full backtrace of the coredump: #0 0x0000003bc02328a5 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.107.el6_4.2.x86_64 keyutils-libs-1.4-4.el6.x86_64 krb5-libs-1.10.3-10.el6_4.4.x86_64 libcom_err-1.41.12-14.el6_4.2.x86_64 libgcc-4.4.7-3.el6.x86_64 libselinux-2.0.94-5.3.el6_4.1.x86_64 openssl-1.0.0-27.el6_4.2.x86_64 zlib-1.2.3-29.el6.x86_64 (gdb) bt full #0 0x0000003bc02328a5 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x0000003bc0234085 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x0000003c78246618 in default_fatal_finish (type=<value optimized out>, status=0) at failures.c:191 backtrace = 0x1a2d3a8 "/usr/lib64/dovecot/libdovecot.so.0() [0x3c7824660a] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3c78246656] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3c78219eaa] -> /usr/lib64/dovecot/libdovecot-stora"... #3 0x0000003c78246656 in i_internal_fatal_handler (ctx=0x7fff1c87efa0, format=<value optimized out>, args=<value optimized out>) at failures.c:649 status = 0 #4 0x0000003c78219eaa in i_panic (format=0x2c1e <Address 0x2c1e out of bounds>) at failures.c:263 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff1c87f070, reg_save_area = 0x7fff1c87efb0}} #5 0x0000003c786600c0 in mbox_transaction_unlock (box=0x1a51270, lock_id=<value optimized out>) at mbox-storage.c:711 mbox = 0x1a51270 __FUNCTION__ = "mbox_transaction_unlock" #6 0x00007f95c08c77e7 in quota_mailbox_transaction_rollback (ctx=0x1a589e0) at quota-storage.c:142 qbox = 0x1a51858 qt = 0x1a66a90 #7 0x00007f95c08c7218 in quota_mailbox_sync_notify (box=0x1a51270, uid=0, sync_type=0) at quota-storage.c:301 qbox = 0x1a51858 uids = <value optimized out> sizep = <value optimized out> i = <value optimized out> count = <value optimized out> size = <value optimized out> #8 0x0000003c7865fea8 in mbox_sync (mbox=0x1a51270, flags=<value optimized out>) at mbox-sync.c:2006 lock_id = 11 ---Type <return> to continue, or q <return> to quit--- ret = 0 __FUNCTION__ = "mbox_sync" #9 0x0000003c78657c07 in mbox_transaction_save_commit_post (_ctx=0x1a53e20, result=<value optimized out>) at mbox-save.c:807 ctx = 0x1a53e20 __FUNCTION__ = "mbox_transaction_save_commit_post" #10 0x0000003c786a5313 in index_transaction_index_commit (index_trans=0x1a5a530, result_r=0x7fff1c87f190) at index-transaction.c:50 t = 0x1a5a390 ret = 0 __FUNCTION__ = "index_transaction_index_commit" #11 0x0000003c786b3cdf in mail_index_transaction_commit_full (_t=0x7fff1c87f1b8, result_r=0x7fff1c87f190) at mail-index-transaction.c:251 t = 0x1a5a530 index = 0x1a4ccc0 index_undeleted = <value optimized out> #12 0x0000003c786a4f5a in index_transaction_commit (t=<value optimized out>, changes_r=<value optimized out>) at index-transaction.c:132 box = 0x1a51270 itrans = 0x0 result = {log_file_seq = 17, log_file_offset = 6032, commit_size = 196, ignored_modseq_changes = 0} ret = <value optimized out> #13 0x0000003c78660121 in mbox_transaction_commit (t=<value optimized out>, changes_r=<value optimized out>) at mbox-storage.c:729 mt = <value optimized out> box = 0x1a51270 lock_id = 11 ret = <value optimized out> #14 0x00007f95c08c78af in quota_mailbox_transaction_commit (ctx=0x1a5a390, changes_r=0x7fff1c87f260) ---Type <return> to continue, or q <return> to quit--- at quota-storage.c:124 qbox = 0x1a51858 qt = 0x1a5a1e0 #15 0x0000003c7867aa9e in mailbox_transaction_commit_get_changes (_t=<value optimized out>, changes_r=0x7fff1c87f260) at mail-storage.c:1515 _data_stack_cur_id = 4 t = 0x1a5a390 ret = <value optimized out> #16 0x0000000000408b3a in cmd_append_continue_parsing (cmd=0x1a4ea50) at cmd-append.c:284 sync_flags = <value optimized out> imap_flags = <value optimized out> changes = {pool = 0x1a61fe0, uid_validity = 1268835246, saved_uids = {arr = {buffer = 0x1a62000, element_size = 8}, v = 0x1a62000, v_modifiable = 0x1a62000}, ignored_modseq_changes = 0, changed = true, no_read_perm = false} msg = <value optimized out> client = 0x1a4e240 ctx = 0x1a4eb48 args = 0x1a59a98 flags_list = <value optimized out> flags = <value optimized out> keywords_list = <value optimized out> keywords = <value optimized out> internal_date_str = <value optimized out> msg = <value optimized out> internal_date = <value optimized out> ret = <value optimized out> timezone_offset = <value optimized out> save_count = <value optimized out> nonsync = <value optimized out> ---Type <return> to continue, or q <return> to quit--- fatal = <value optimized out> __FUNCTION__ = "cmd_append_continue_parsing" #17 0x00000000004088e4 in cmd_append_continue_message (cmd=0x1a4ea50) at cmd-append.c:466 all_written = true client = 0x1a4e240 ctx = 0x1a4eb48 size = 0 ret = <value optimized out> #18 0x0000000000408d3c in cmd_append_continue_parsing (cmd=0x1a4ea50) at cmd-append.c:399 client = 0x1a4e240 ctx = 0x1a4eb48 args = 0x1a59a98 flags_list = 0x0 flags = 0 keywords_list = 0x3c782426aa keywords = 0x0 internal_date_str = <value optimized out> msg = <value optimized out> internal_date = -1 ret = 0 timezone_offset = 0 save_count = <value optimized out> nonsync = true fatal = <value optimized out> __FUNCTION__ = "cmd_append_continue_parsing" #19 0x0000000000408f99 in cmd_append (cmd=0x1a4ea50) at cmd-append.c:519 client = 0x1a4e240 ctx = 0x1a4eb48 mailbox = 0x1a38910 "INBOX" ---Type <return> to continue, or q <return> to quit--- #20 0x000000000041155d in command_exec (cmd=0x1a4ea50) at imap-commands.c:148 hook = 0x1a36cd0 ret = <value optimized out> #21 0x000000000041046e in client_command_input (cmd=0x1a4ea50) at imap-client.c:684 client = 0x1a4e240 command = <value optimized out> __FUNCTION__ = "client_command_input" #22 0x000000000041055a in client_command_input (cmd=0x1a4ea50) at imap-client.c:735 client = 0x1a4e240 command = <value optimized out> __FUNCTION__ = "client_command_input" #23 0x0000000000410785 in client_handle_next_command (client=0x1a4e240) at imap-client.c:776 size = 1320 #24 client_handle_input (client=0x1a4e240) at imap-client.c:788 _data_stack_cur_id = 3 ret = false remove_io = false handled_commands = false __FUNCTION__ = "client_handle_input" #25 0x00000000004110af in client_input (client=0x1a4e240) at imap-client.c:827 cmd = <value optimized out> output = 0x1a4ca88 bytes = 1320 __FUNCTION__ = "client_input" #26 0x0000003c78252c16 in io_loop_call_io (io=0x1a4cb70) at ioloop.c:379 ioloop = 0x1a35670 t_id = 2 #27 0x0000003c78253c9f in io_loop_handler_run (ioloop=<value optimized out>) at ioloop-epoll.c:213 ctx = 0x1a359e0 ---Type <return> to continue, or q <return> to quit--- events = <value optimized out> event = 0x1a35a50 list = 0x1a4cbc0 io = <value optimized out> tv = {tv_sec = 1799, tv_usec = 999319} msecs = <value optimized out> ret = 1 i = <value optimized out> call = <value optimized out> #28 0x0000003c78252bb8 in io_loop_run (ioloop=0x1a35670) at ioloop.c:398 No locals. #29 0x0000003c7823e083 in master_service_run (service=0x1a35520, callback=<value optimized out>) at master-service.c:544 No locals. #30 0x00000000004195bd in main (argc=1, argv=0x1a35370) at main.c:389 set_roots = {0x41c460, 0x0} login_set = {auth_socket_path = 0x1a2d078 "/var/run/dovecot/auth-master", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x419710 <login_client_connected>, failure_callback = 0x418f30 <login_client_failed>} service_flags = <value optimized out> storage_service_flags = <value optimized out> username = <value optimized out> c = <value optimized out> That's our configuration: # 2.1.17: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-358.18.1.el6.x86_64 x86_64 Red Hat Enterprise Linux Server release 6.4 (Santiago) xfs auth_debug = yes auth_verbose = yes debug_log_path = /var/log/dovecot/dovecot-debug.log default_client_limit = 3000 default_process_limit = 8192 disable_plaintext_auth = no log_path = /var/log/dovecot/dovecot.log login_greeting = Server ready. mail_debug = yes mail_location = mbox:/var/spool/fhmrz_imap/% u/dovecot-home:LAYOUT=maildir++:INBOX=/var/spool/mail/% u:INDEX=/var/opt/index/%u/dovecot-indexes:CONTROL=/var/opt/index/% u/dovecot-control mail_plugin_dir = /usr/lib/dovecot mail_plugins = listescape quota mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { driver = pam } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size flags quota = fs:User quota:user:noenforcing quota_exceeded_message = Quota exceeded, please go to http://www.timbuktu.edu/over_quota_help for instructions on how to fix this. } protocols = imap pop3 service anvil { client_limit = 16744 } service auth { client_limit = 16800 } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 8192 process_min_avail = 8 } service imap { process_limit = 16084 } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { process_limit = 16084 } ssl_cert = </etc/pki/tls/certs/example.pem ssl_key = </etc/pki/tls/private/example-key.pem userdb { driver = passwd } protocol imap { mail_max_userip_connections = 30 mail_plugins = listescape quota imap_quota } protocol pop3 { mail_max_userip_connections = 10 pop3_uidl_format = %08Xu%08Xv } The problem occurs with dovecot-2.0.9 and dovecot-2.1.17 and also dovecot-2.2.5! From the stacktrace I could see that the problem origins from the quota plugin. Thus, when I disabled the quota plugin the problem went away. The problem did only occur on a high concurrency level on one mbox/folder, running imaptest with only one user and 10 clients. When we run imaptest in a more real-world fashion with several thousand of users and clients=100, the error did not occur. Because of this I am not sure how problematic this bug will be in a production environment? What do you think? Any help is greatly appreciated! br Harald Strack -- Harald Strack, Dipl.Inf.(FH) IT Development ssystems c/o berliner gazette Danziger Str. 31 10435 Berlin Tel: +49 30 2023 6071 - 1 http://www.ssystems.de

2 1

[Dovecot] Read-only account through INDEX=MEMORY:CONTROL=MEMORY and non-writable Unix-permissions
by Steffen Kaiser 22 Sep '13

22 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, my goal is to provide a special mailbox for some mail accounts. The user should get the information, to look somewhere else. The user must not change anything at all. I also don't want to provide a mailbox for each user. I got the setup below, which seems to run with Dovecot v2.2; however, "CONTROL=MEMORY" is not documented. Is the setup stable for next versions of Dovecot or is CONTROL=MEMORY not a feature, but a bug? ====== user settings: home=/home/nomailbox mail=maildir:/home/nomailbox/Maildir:INDEX=MEMORY:CONTROL=MEMORY uid=vmail gid=vmail The structure of the directory: /home/nomailbox/: total 12 drwxr-xr-x 3 root root 4096 Oct 24 2007 ./ drwxr-xr-x 18 root root 4096 Sep 9 10:36 ../ dr-xr-xr-x 5 root root 4096 Oct 24 2007 Maildir/ /home/nomailbox/Maildir: total 20 dr-xr-xr-x 5 root root 4096 Oct 24 2007 ./ drwxr-xr-x 3 root root 4096 Oct 24 2007 ../ dr-xr-xr-x 2 root root 4096 Oct 24 2007 cur/ dr-xr-xr-x 2 root root 4096 Sep 9 08:23 new/ dr-xr-xr-- 2 root root 4096 Oct 24 2007 tmp/ /home/nomailbox/Maildir/cur: total 8 dr-xr-xr-x 2 root root 4096 Oct 24 2007 ./ dr-xr-xr-x 5 root root 4096 Oct 24 2007 ../ - -rw-r--r-- 1 root root 0 Oct 24 2007 .placeholder /home/nomailbox/Maildir/new: total 12 dr-xr-xr-x 2 root root 4096 Sep 9 08:23 ./ dr-xr-xr-x 5 root root 4096 Oct 24 2007 ../ - -r--r--r-- 1 root root 804 Sep 9 08:24 no-mailbox-for-you /home/nomailbox/Maildir/tmp: total 8 dr-xr-xr-- 2 root root 4096 Oct 24 2007 ./ dr-xr-xr-x 5 root root 4096 Oct 24 2007 ../ - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEVAwUBUi22kF3r2wJMiz2NAQLJEAf/WM0jXqVmZ6HtEvoKTB4grE2xFfN4Ylig imhPVf/yufYLzQw+w98fhrozEcm7UK0mUWpiJQzMowYyLNdF8tVwhgTdAfFa6fhK +L0+GxVcCuvRq/YjIivhgQ7gwZlhjLWa43Fo65HAqude4nnuyb5/RuVb0aPBlB73 1V5nMB5f9PSrlAjtK4kLOq1VRNp2SCVfBem/ESqhYSZ+O51gGZ8JRm7skWr82GmZ tdeYDa52h8CWm67S1lzNK42yNoElkLrH5MZJLCBmjg/hLjD99aMCAdgWRL5zyg/h bZzoOZNztQq0CwBHTB+KY9YBkfMmXzFtse3C0a2Eg9m5bmJmNblPGw== =iYWU -----END PGP SIGNATURE-----

2 1

[Dovecot] fdatasync -- Error -- bad file descriptor
by Vijay Rajah 22 Sep '13

22 Sep '13

Hello list, I have a dovecot 2.2.5 instance configured to use mdbox as mailbox format. I configured to use separate storage attachments and use SIS.. (doveconf -n below) I get this error Sep 6 12:29:52 vrajah.mydomain.tld dovecot: lmtp(14258, email(a)mydomain.tld) Error: fdatasync(/apps/mail/mailbox/attachments/23/12/2312039008db057a1c75-2efc2d00687d2952b2370000f89409f1) failed: Bad file descriptor I'm using centos 6.4 on a KVM with ext4 as fs. Can someone tell me why i'm getting this error? and how to fix this? -Thanks in advance Vijay ##########doveconf -n # 2.2.5: /apps/mail/dovecot/2.2.5/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-358.14.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) ext4 auth_mechanisms = plain login digest-md5 cram-md5 auth_socket_path = /apps/mail/var/dovecot/run/auth-userdb base_dir = /apps/mail/var/dovecot/run/ debug_log_path = /var/log/dovecot-debug.log dict { sqlquota = mysql:/apps/mail/dovecot/2.2.5/etc/dovecot/conf.d/sqlquota.dict.ext } hostname = mail1(a)mydomain.tldmydomain.tld mail_attachment_dir = /apps/mail/mailbox/attachments mail_attachment_hash = %{sha256:80} mail_debug = yes mail_location = mdbox:/apps/mail/mailbox/%d/%n/mdbox mail_plugin_dir = /apps/mail/dovecot/2.2.5/lib/dovecot/ mail_plugins = " virtual quota zlib" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl dotlock mdbox_rotate_size = 1 M namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /apps/mail/dovecot/2.2.5/etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:User quota::proxy::sqlquota quota_grace = 10%% quota_rule = *:storage=1GB quota_rule2 = Trash:storage=+10%% quota_rule3 = Spam:storage=+20%% quota_status_nouser = DUNNO quota_status_overquota = 450 4.2.2 Mailbox is full. Try again later quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u sieve = ~/.dovecot.sieve sieve_before = /apps/mail/var/dovecot/sieve/ sieve_dir = ~/sieve sieve_global_dir = /apps/mail/var/dovecot/sieve zlib_save = bz2 zlib_save_level = 9 } protocols = imap lmtp sieve service auth { unix_listener /apps/mail/var/postfix/dovecot-auth { group = postfix mode = 0660 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /apps/mail/var/postfix/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 10 vsz_limit = 64 M } service managesieve { process_limit = 1024 } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /apps/mail/dovecot/2.2.5/etc/dovecot/conf.d/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } shutdown_clients = no ssl_ca = </apps/mail/dovecot/2.2.5/etc/dovecot/ssl/mayca.crt.pem ssl_cert = </apps/mail/dovecot/2.2.5/etc/dovecot/ssl/mail1.mydomain.tld.pem ssl_key = </apps/mail/dovecot/2.2.5/etc/dovecot/ssl/mail1.mydomain.tld.key ssl_parameters_regenerate = 30 hours submission_host = 127.0.0.1:587 userdb { driver = prefetch } userdb { args = /apps/mail/dovecot/2.2.5/etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = " virtual quota zlib sieve zlib" } protocol imap { mail_plugins = " virtual quota zlib imap_quota imap_zlib" } protocol lmtp { debug_log_path = /var/log/dovecot-lmtp-debg.log mail_plugins = " virtual quota zlib sieve zlib" }

2 2

[Dovecot] permission problem when using public namespace and "subscription = yes"
by Lars Uhlmann 22 Sep '13

22 Sep '13

I have configured an public namespace "Test" for a group of users: | namespace public { | separator = . | prefix = Test. | location = maildir:/mailroot/public/Test | hidden = no | list = yes | subscriptions = yes | } Using each users own subscription file for a public mailbox doesn't make sense when the mailbox is heavily used. Every directory operation (create/rename) needs to be synced between all subscribers automatically and immediately. So I set "subscriptions = yes". My ACLS look like this: | user=mark lrwstiekx | user=tim lrwstiekx | user=max lr | user=jenny lrwstiekx | user=louis lr Nevertheless _all_ my mail users still have access to the namespace's directory tree. It is my understanding that when a user doesn't has 'lookup' access, he should not be able to subscribe to this mailbox. In my opinion this is a security problem. ACLs must be processed _before_ a shared subscrition file is parsed. regards Lars

2 1

Re: [Dovecot] Logging passwords on auth failure/dealing with botnets
by Joseph Tam 22 Sep '13

22 Sep '13

"Michael Smith (DF)" writes: > Or another option, is there any good DNS based RBLs for botnet IPs, and > is there any way to tie that in to the dovecot auth system? I've been > looking for botnet rbls, but what I've found so far doesn't seem to > work very well. Most of the IPs that I've had to firewall don't exist > in them. /dev/rob0 writes: > The problem with using XBL, anyway, is that you might have legitimate > logins from listed hosts. Example: a traveler using hotel wifi. We > (TINW) really would need a new DNSBL type (or a special result) for > this sort of abuse. > > It's a nice idea, worth building upon, if someone can fund it (or > find the time to develop it, which really amounts to the same thing.) > Imagine also a Dovecot network of reporters, where brute force > attempts worldwide are reported from Dovecots to the DNSBL, not > merely a one-way tie in. > > I'd also suggest listing SSH brute force attacks in the same DNSBL, > possibly with a different result (127.0.0.$port, so IMAP attackers > list as 127.0.0.143, SSH attackers as 127.0.0.22. Yes, we'd have to > incorporate the third quad for ports > 255, but the general idea is > for result codes to be both machine and human readable as much as > possible.) I use bl.blocklist.de as a DNSRBL for ssh BFD, but I think it also detects BFD for other protocols: http://www.blocklist.de/en/index.html The nice thing about this RBL is that you can also contribute by configuring your Fail2Ban/DenyHost to forward logs to the maintainers, to widen the detection network. I get about a 60% hit on ssh BFD attacks. I also found http://openbl.org but they distribute it as a downloadable file rather than as a DNSRBL. Maybe I can introduce the latter to the former. Joseph Tam <jtam.home(a)gmail.com>

3 2

[Dovecot] Solved: startup failures "net_listen_unix(...) failed: Invalid argument"
by C. Mills 22 Sep '13

22 Sep '13

I ran into this and had a bit of trouble tracking a diagnosis down, so here it is for the archives in case anyone else runs into this. A new installation of dovecot was failing to start, with these messages: $ ./sbin/dovecot Error: service(imap-urlauth): net_listen_unix(.../var/run/dovecot/token-login/imap-urlauth) failed: Invalid argument Error: service(auth): net_listen_unix(.../var/run/dovecot/token-login/tokenlogin) failed: Invalid argument Fatal: Failed to start listeners Some of the other processes seemed to be starting up fine, and they created sockets in the expected dir, but the above two wouldn't. stracing the processes didn't show a lot, but eventually I checked the length of the installation path, and found the above two socket paths were exceeding the maximum path length limit for Unix sockets -- 108 chars on my Linux boxen. I haven't checked SuS or Posix to see what the standards say the actual minimum required size for the maximum path length is -- it might be shorter yet on other systems. Moving the installation to a less deeply nested hierarchy fixed the problem. I hope this saves someone else a headache someday. C. C. -- ----------------------------------------------------------------------- C. Mills -----------------------------------------------------------------------

2 1

[Dovecot] dovecot and PFS
by Emmanuel Dreyfus 22 Sep '13

22 Sep '13

Hi Is there known advices on how to favor PFS with dovecot? In Apache, I use the following directives, with cause all modern browsers to adopt 256 bit PFS ciphers, while keeping backward compatibility with older browsers and avoiding BEAST attack: SSLProtocol all -SSLv2 SSLHonorCipherOrder On SSLCipherSuite ECDHE@STRENGTH:ECDH@STRENGTH:DH@STRENGTH:HIGH:-SSLv3-SHA1:-TLSv10 -SHA1:RC4:!MD5:!DES:!aNULL:!eNULL dovecot does not care about BEAST, since attacker cannot inject trafic. Therefore the cipher list get simplier in dovecot.conf: ssl_cipher_list = ECDHE@STRENGTH:ECDH@STRENGTH:DH@STRENGTH:HIGH:!MD5:!DES:!aNULL :!eNULL But that list is good for browsers. I am not aware of documentation about what ciphers are advertised by various mail client. How can I know if that setting has some success pushing PFS? How can I discover which clients fail to negociate PFS ciphers? -- Emmanuel Dreyfus manu(a)netbsd.org

4 4

[Dovecot] mailbox_list_index, stops showing new mails in mailboxes
by Anton Lundin 22 Sep '13

22 Sep '13

Hello. I'm having some weird problem with (probably) mailbox_list_index, that it doesn't see new mail in mailboxes. I'm using 2.2.4 over imap and ssh/imap, and after a while dovecot stops noticing new mail in some folders. Its always the same 2-3 folders of about 30. I read something about list-index corruption in 2.2.2, and i thought it was that i was running into earlier, but this problem still occurs. This is dovecot 2.2.4, running on Solaris 10 x86_64 to homedirs on zfs, where procmail is used to deliver mail to mailboxes in mbox-format. I've tried to purge all indexes and let dovecot rebuild them, but the problem reoccurs after a couple of days. How can i help to debug this issue? Should i grab dovecot.list.index when its out-of-sync for debugging? //Anton -- Anton Lundin +46702-161604

2 1

[Dovecot] verbose_proctitle cuts dsync to proctitle to "dsyn"
by Sven Hartge 22 Sep '13

22 Sep '13

Hi Timo, little cosmetic bug report: using "verbose_proctitle = yes" shortens the proctitle of dsync to just "dsyn". Example: Note the whitespace instead of the 'c' in the proctitle: root@m-st-01:~# ps auwwwx | grep [d]syn virtmail 18141 13.0 0.1 49916 7952 pts/6 R+ 00:49 0:00 dsyn -v -u xxyyzz7 -R backup maildir:/staging/xxyyzz7/Maildir With "verbose_proctitle = no" the output looks like this: root@m-st-01:~# ps auwwwx | grep [d]syn virtmail 18347 78.6 1.6 127356 68884 pts/6 D+ 00:53 0:02 dsync -v -u aabbcc7 -R backup maildir:/staging/aabbcc7/Maildir Version of dovecot is 2.2.5 from the autobuilder (but rebuild locally): root@m-st-01:~# doveadm config -n # 2.2.5 (ec62ea3c940e): /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.1 [...] Grüße, Sven. -- Sigmentation fault. Core dumped.

2 1

[Dovecot] Problem with MySQL virtual users and dsync
by Jordan Cook 22 Sep '13

22 Sep '13

Hello, I am using dovecot 2.2.5 on FreeBSD and I am having trouble using dsync with SSH. Everything on the server seems to be working fine (I can login, receive and send emails etc). I am using SQL for both passdb, and userdb and this seems to work fine. The 'doveadm user' command returns all the correct information for the user. I am getting the following errors in my log file: Aug 27 21:34:17 server dovecot: replicator: Error: userdb lookup: Connecting timed out Aug 27 21:34:17 server dovecot: replicator: Error: userdb lookup: Disconnected unexpectedly Aug 27 21:34:20 server last message repeated 173381 times It did seem to do an initial sync, but after that nothing is being synchronised. Has anyone else solved this problem previously or is able to help? Regards, Jordan Cook -- Packet House Limited is a company registered in England and Wales. Registered number: 07602377. Registered office: 40 Preston Avenue, Alfreton, Derbyshire, DE55 7JY This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Packet House Limited. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error.

2 1