- dovecot - dovecot.org

[Dovecot] Doubt the relationship between NTLM and Kerberos.
by Maria Jose Yañez Dacosta 01 Jul '13

01 Jul '13

Could someone explain to me what role does the Authenticating Kerberos NTLM in Authenticating NTLM explained in http://wiki.dovecot.org/HowTo/ActiveDirectoryNtlm ? Not understand that relationship between NTLM and Kerberos?. I have to configure thunderbird with simple password method and leave the password to be blank or have to use the gssapi? Although gssapi not supported by windows right? You have to generate a keytab for imap server against AD? I should create in windows and copy it to linux where I have my imap server? I appreciate someone can explain this. Thank you!. -- Maria José

2 1

Re: [Dovecot] Samba4 and user auth
by Pavel Herrmann 01 Jul '13

01 Jul '13

Hi On Monday 01 July 2013 12:36:39 Carsten Laun-De Lellis wrote: > Hi Pavel > > Thankx for your reply. > > When you were setting up your ldap query what kind of password crypto > did you specify plain ntlm gssapi or anything else? The password field > in your query is userPassword or am I wrong here? the password field is hidden (only the user can see it) by default, and not stored as a unix-friendly value (anything a crypt() would understand) what I use is auth_bind (which uses user-supplied password to bind to the LDAP directory). what it means is that on every login there are 2 lookups (first one using your "service" DN to find the user DN, second one with your user DN to check the password) that also means that you need a password format that your LDAP can understand (mostly a plaintext password, or NTLM if your mail server is a Samba domain member). As long as you only offer IMAP/SSL I dont think plaintext (as in "auth_mechanisms = plain") is an issue, security wise. as far as the service account (the one that is used to look up users) goes, I am using the default option (setting "dn" and "dnpass" variables), which I think is a simple bind. it is possible that it only works because Samba4 and dovecot run on the same machine. Pavel Herrmann > > I will try it again. > --- > > Mit freundlichem Gruß > > Carsten Laun-De Lellis > > Hauptstrasse 13 > D-67705 Trippstadt > > Phone: +49 6306 992140 > Fax: +49 6306 992142 > Mobile: +49 151 27530865 > email: carsten.delellis(a)delellis.net > > http://www.linkedin.com/in/carstenlaundelellis [1] > > Am 2013-07-01 11:24, schrieb Pavel Herrmann: > > Hi > > > > On Friday 28 June 2013 07:17:39 Carsten Laun-De Lellis wrote: > >> Hi all I am trying to set up an email Server with a Samba4 AD as user > >> Directory. Does anybody know a good how-to to setup user auth against AD > >> ? Or could anyone tell me how to do it? I am having an email Server up > >> and running with openldap but want to change to Samba4 AD, because of > >> the openchange Integration. I would appreciate any help on this topic.> > > I have an AD/Samba4 auth for dovecot, it works the same as any LDAP would > > (with authenticated lookups and auth_bind) > > > > I would suggest you try it, and ask if there are any issues. > > > > Pavel Herrmann > > Links: > ------ > [1] http://www.linkedin.com/in/carstenlaundelellis

2 1

[Dovecot] Server shutting down
by Simon B 01 Jul '13

01 Jul '13

Hi I recently moved to Debian Wheezy and installed dovecot from apt-get. root@mail:~# dpkg -l | grep dovecot ii dovecot-common 1:2.1.7-7 all Transitional package for dovecot ii dovecot-core 1:2.1.7-7 amd64 secure mail server that supports mbox, maildir, dbox and mdbox mailboxes ii dovecot-gssapi 1:2.1.7-7 amd64 GSSAPI authentication support for Dovecot ii dovecot-imapd 1:2.1.7-7 amd64 secure IMAP server that supports mbox, maildir, dbox and mdbox mailboxes ii dovecot-ldap 1:2.1.7-7 amd64 LDAP support for Dovecot ii dovecot-managesieved 1:2.1.7-7 amd64 secure ManageSieve server for Dovecot ii dovecot-mysql 1:2.1.7-7 amd64 MySQL support for Dovecot ii dovecot-pgsql 1:2.1.7-7 amd64 PostgreSQL support for Dovecot ii dovecot-pop3d 1:2.1.7-7 amd64 secure POP3 server that supports mbox, maildir, dbox and mdbox mailboxes ii dovecot-sieve 1:2.1.7-7 amd64 sieve filters support for Dovecot ii dovecot-sqlite 1:2.1.7-7 amd64 SQLite support for Dovecot Having previously been on 1.2 on Debian Squeeze the upgrade went flawlessly (and automatically, as I'd already placed the 1.2 dovecot.conf file before installing 2.1.7). And I've been very happy. However, yesterday the server just just shutdown. /var/log/mail.log.1:42890:Jun 30 17:27:04 mail dovecot: imap: Server shutting down. in=14 out=648 /var/log/mail.log.1:42891:Jun 30 17:27:04 mail dovecot: imap: Server shutting down. in=14 out=648 /var/log/mail.log.1:42893:Jun 30 17:27:04 mail dovecot: imap: Server shutting down. in=14 out=648 /var/log/mail.log.1:42895:Jun 30 17:27:34 mail dovecot: imap: Server shutting down. in=739 out=2081 /var/log/mail.log.1:42896:Jun 30 17:27:34 mail dovecot: imap: Server shutting down. in=1764 out=4027 There's no error|panic|warning|fatal messages in any of the logs. root@mail:~# grep -in dovecot /var/log/syslog | grep '(fatal|error|warning|panic)' root@mail:~# grep -in dovecot /var/log/messages | grep '(fatal|error|warning|panic)' root@mail:~# grep -in dovecot /var/log/daemon.log | grep '(fatal|error|warning|panic)' root@mail:~# grep -inr dovecot /var/log/mail* | grep '(fatal|error|warning|panic)' Although everything should log to mail.log if I set up rsyslog properly. The timestamp is not correlated to any of my cron jobs. How can I find out what caused this? Of course with Dovecot shut down Postfix refused to send mail as there was no auth service available. Simon

2 2

[Dovecot] Samba4 and user auth
by Carsten Laun-De Lellis 01 Jul '13

01 Jul '13

Hi all I am trying to set up an email Server with a Samba4 AD as user Directory. Does anybody know a good how-to to setup user auth against AD ? Or could anyone tell me how to do it? I am having an email Server up and running with openldap but want to change to Samba4 AD, because of the openchange Integration. I would appreciate any help on this topic. -- Mit freundlichem Gruß Carsten Laun-De Lellis Hauptstrasse 13 D-67705 Trippstadt Phone: +49 6306 992140 Fax: +49 6306 992142 Mobile: +49 151 27530865 email: carsten.delellis(a)delellis.net http://www.linkedin.com/in/carstenlaundelellis [1] Links: ------ [1] http://www.linkedin.com/in/carstenlaundelellis

2 1

[Dovecot] LIST command -- quoting of folder names
by Eric Abrahamsen 01 Jul '13

01 Jul '13

If I open an imap connection to a local maildir installation like so: /usr/lib/dovecot/imap -o mail_location=maildir:$HOME/.mail/account/:LAYOUT=fs And issue: c list "" * This is the result (this is a gmail account): * LIST (\HasChildren) "/" [Gmail] * LIST (\HasNoChildren) "/" [Gmail]/Spam * LIST (\HasNoChildren) "/" [Gmail]/Starred * LIST (\HasNoChildren) "/" [Gmail]/Trash * LIST (\HasNoChildren) "/" [Gmail]/Drafts * LIST (\HasNoChildren) "/" "[Gmail]/Sent Mail" * LIST (\HasNoChildren) "/" [Gmail]/Important * LIST (\HasNoChildren) "/" INBOX Only "[Gmail]/Sent Mail" is quoted. This is messing up gnus, my MUA, which truncates other folder names after the / separator. Examples of testing I've seen online have shown all folder names quoted, which would allow things to work correctly here. Is this something I can affect with local configuration, or is there some other solution? Would removing "LAYOUT=fs" affect this issue? Thanks! Eric Output of dovecot -n: # 2.2.4: /etc/dovecot/dovecot.conf # OS: Linux 3.9.7-1-ARCH i686 Arch Linux info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log protocols = imap

2 2

Re: [Dovecot] Passdb + single sing on + NTLM + Thunderbird.
by Luis Binotto HOTMAIL 28 Jun '13

28 Jun '13

Hello I have configured Dovecot against AD, using outlook with NTLM and is working like a charm... Try the following this link... http://wiki.dovecot.org/HowTo/ActiveDirectoryNtlm I hope this will help you... -----Original Message----- From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of Maria Jose Yañez Dacosta Sent: viernes, 28 de junio de 2013 02:59 p.m. To: Dovecot Mailing List Subject: Re: [Dovecot] Passdb + single sing on + NTLM + Thunderbird. "Notificación Automática: Este mensaje ha sido recibido desde la Internet, no se garantiza la autenticidad del remitente. " Thank you very much for the reply :) I try with that. 2013/6/27 Stan Hoeppner <stan(a)hardwarefreak.com> > On 6/27/2013 7:48 AM, Maria Jose Yañez Dacosta wrote: > > Thanks!!. > > I have a little question, > > This page explains AUTH = GSSAPI but I'm interested in AUTH = NTLM. > > I want to get single sign on with clients in Windows against a > > Windows Active Directory. > > For NTLM should use another library like pam_krb5.so? > > Sorry for so many questions and thanks again > > http://wiki2.dovecot.org/Authentication/Mechanisms/Winbind > http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM > > > 2013/6/26 Stan Hoeppner <stan(a)hardwarefreak.com> > > > >> On 6/26/2013 1:17 PM, Maria Jose Yañez Dacosta wrote: > >> > >>> I want to use single sign on from Windows with Thunderbird or > >>> Outlook > >> using > >>> NTLM. > >> > >> http://wiki2.dovecot.org/Authentication/Kerberos > > -- Maria José

1 0

Re: [Dovecot] Passdb + single sing on + NTLM + Thunderbird.
by Stan Hoeppner 28 Jun '13

28 Jun '13

On 6/27/2013 7:48 AM, Maria Jose Yañez Dacosta wrote: > Thanks!!. > I have a little question, > This page explains AUTH = GSSAPI but I'm interested in AUTH = NTLM. > I want to get single sign on with clients in Windows against a Windows > Active Directory. > For NTLM should use another library like pam_krb5.so? > Sorry for so many questions and thanks again http://wiki2.dovecot.org/Authentication/Mechanisms/Winbind http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM > 2013/6/26 Stan Hoeppner <stan(a)hardwarefreak.com> > >> On 6/26/2013 1:17 PM, Maria Jose Yañez Dacosta wrote: >> >>> I want to use single sign on from Windows with Thunderbird or Outlook >> using >>> NTLM. >> >> http://wiki2.dovecot.org/Authentication/Kerberos

2 1

[Dovecot] Issues when compiling dovecot antispam on debian wheezy
by Joan 28 Jun '13

28 Jun '13

I've been trying to compile the latest version of dovecot-antispam, and it doesn't work, the latest patch fixes compilation for dovecot versions greater than 2.1.16 but the packaged version in debian is 2.1.7 and doesn't provide the DOVECOT_PREREQ macro. It seems there are some solutions: 1) Rollback to the last working version so it can be used on wheezy 2) Open a bug report in debian to see if they can backport the macro here ( http://www.dovecot.org/list/dovecot-cvs/2013-March/022903.html) 3) Use the packaged version from debian 4) .. What's your opinion?

2 1

[Dovecot] Zero-sized Maildir files and index corruption on over-quota
by Edgar Fuß 28 Jun '13

28 Jun '13

We are using Postfix as an MTA delivering via Dovecot's LDA (with sieve). We also use Dovecot as a POP/IMAP server. Mail storage is Maildir on NFS, indexes are stored locally. Quotas are FS quotas enforced by the NFS server. The Dovecot version is 1.2.11. Recently, for one user being over quota, some attempts to deliver mail bounced as expected while some others resulted in zero-sized Maildir files. I can verify zero-sized files in cur, while I cannot tell whether they were already zero-sized in new. However, since nobody except Dovecot is accessing the mail storage, it's either Dovecot's LDA or Dovecot's IMAP producing the zero-sized files. Logs show successful delivery (deliver: stored mail into mailbox 'INBOX') but ,,Corrupted index cache file /var/db/dovecot/indexes/XXX/.INBOX/dovecot.index.cache: Corrupted virtual size for uid=YYY: 0 != NNNN'' alerts on IMAP access. It looks like all mails which correctly got bounced are >64KB while those resulting in zero-sized files are <64KB (there is one >32KB). My first guess would be that maybe for large files, write() fails, while for small ones, close() fails or there is some buffering involved for large files.

3 10

[Dovecot] traffic statistics
by Martin Waschbüsch 28 Jun '13

28 Jun '13

Hi all, Does anyone know a good tool to gather traffic statistics for imap? And what level of logging would I need to set for dovecot to make it happen. Ideally this would be able to filter per domain, too. ;-) Thanks a lot, Martin -- Martin Waschbüsch IT-Dienstleistungen Lautensackstr. 16 80687 München Telefon: +49 89 57005708 Fax: +49 89 57868023 Mobil: +49 170 2189794 martin(a)waschbuesch.de http://martin.waschbuesch.de

4 5