- dovecot - dovecot.org

[Dovecot] dotlock error
by Muhammad Yousuf Khan 05 Dec '12

05 Dec '12

i finally manage to control access on public folder by File system permission. i have 3 test users. 1. tom 2. fmaster 3 . testmail tom and fmaster are a group called "news-own" and testmail user is a readonly one. here is my folder structure ill share dovecot -n output at the end of this email. drwxrwxr-t 2 tom news-own 4.0K Dec 4 19:08 tmp drwxrwxr-t 2 tom news-own 4.0K Dec 4 19:08 new -rwxrwxrwx 1 tom news-own 68 Dec 4 19:08 dovecot-uidlist -rw-rw-r-T 1 fmaster news-own 16K Dec 4 19:10 dovecot.index.cache drwxrwxr-t 2 tom news-own 4.0K Dec 4 19:15 cur -rw-rw-r-T 1 tom news-own 1.1K Dec 4 19:16 dovecot.index.log everything works fine as far as user fmaster and tom is concern as they are member of "news-own" and this group own the mailbox now the problem i face with readonly users. i am getting this error in /var/log/mail.info (against user testmail) file_dotlock_create(/public/.News/dovecot-uidlist) failed: Permission denied (euid=1002(testmail) egid=1002(testmail) missing +w perm: /public/.News at first point i saw this error and i could not subscribe to the folder. and the said log has been generated. now on second stage i change the dovecot-uidlist file permission to "1666" so that testmail user can also write to the file. now problem starts from here, i see two folder one is News and second one is News-1 and i don't know from where the second folder showed up. and when i click on any of the folder my /var/log/mail.info start to show below massage continuously. until i restart the dovecot service. file_dotlock_create(/public/.News/dovecot-uidlist) failed: Permission denied (euid=1002(testmail) egid=1002(testmail) missing +w perm: /public/.News i search google and i saw that people suggested to set stickey bit on which i already did or suggested to stop "dot locking" so i am here to ask is there any way to solve my said problem with out disabling dot locking? or if i stop dot locking what are the consequences? here i my dovcecot -n root@mailsrv:/public/.News# dovecot -n # 1.2.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.6 log_timestamp: %Y-%m-%d %H:%M:%S ssl_cert_file: /etc/ssl/certs/postfix.pem ssl_key_file: /etc/ssl/private/postfix.key login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login mail_privileged_group: mail mail_location: maildir:~/Maildir:INBOX=~/Maildir/:INDEX=~/Maildir/index mail_debug: yes mbox_write_locks: fcntl dotlock namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: public separator: / prefix: Shared folders/ location: maildir:/public list: yes auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix Thanks in advance, any help or suggestion would be highly appreciated.

2 5

[Dovecot] dovecot backend on director ?
by Thomas Hummel 05 Dec '12

05 Dec '12

Hello Timo, The last time I checked my understanding about director was that : 1. backend/"real" imap servers should not be on the same host (or the same dovecot instance) to avoid proxying loops. Is it still the case with the latest 2.1 stable release ? Is there a plan to be able to run director and real server on the same host, thus requiring only 2 hosts instead of 4 to have load balancing and a redundant director ? 2. director itself was not able or meant to check if one of the real server was down (some script was pointed long time ago in this list). Same questions. 3. you'll have to use dovecot lmtp instead of let's say procmail. Would deliver be still a choice or is lmtp the only deliver compatible choice ? In what case would lmtp be more useful than deliver ? To have some sort of "remote LDA" ? By the way, what gets indexed on deposit on the mailbox since, by definition, the user has not done any request yet ? Thanks. -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Groupe Exploitation et Infrastructure

2 2

Re: [Dovecot] imap-login hanging when firewall blocks ssl handshaking
by Erik A Johnson 05 Dec '12

05 Dec '12

FYI, the tcpdump I sent previously was with one of our previously-discussed patches in place: if (!proxy->client_proxy && net_geterror(proxy->fd_ssl) == EBADF) { I'm attaching that dump again (as tcpdump_output_witholdpatch_headeronly.txt), as well as a dump without any of the patches (tcpdump_output_withoutpatches_headeronly.txt) in case there is any difference. On December 4, 2012 6:18:23 AM PST, Ben Morrow <ben(a)morrow.me.uk> wrote: > At 12PM +0000 on 4/12/12 Ben Morrow wrote: >> Well, it looks to me as though xnu/bsd/kern/uipc_socket.c:soreceive will >> indeed return ENOTCONN for a socket which was once successfully >> connected but has now been disconnected. This happens when the socket is >> in the DEFUNCT state, which is a state that doesn't exist in FreeBSD; >> it's not completely clear but I suspect firewalls may be able to put >> arbitrary sockets into that state. > > Investigating a little further, it should be possible to test for this > situation directly. Assuming I'm correct about what's going on here, > this should be both cleaner and safer than mucking about looking for > ENOTCONN and guessing about what's happening. > > Erik, does this make the problem go away? I left out the > proxy->client_proxy test, since AFAICT this is just as likely to happen > on a client socket. > > Ben > > #ifdef SO_ISDEFUNCT > + if (getsockopt(proxy->fd_ssl, SOL_SOCKET, SO_ISDEFUNCT, > + (void *)&err, sizeof(err)) == 0 && err) { > + errstr = t_strdup_printf( > + "%s: socket is defunct", func_name); > + break; > + } > +#endif Nope, SO_ISDEFUNCT isn't defined.

2 1

[Dovecot] Quotas 2.1clarification
by Nick Edwards 05 Dec '12

05 Dec '12

Timo, I have much suspicion that our quota system is not working correctly since we migrate to 2.1 Currently using 2.1.10 Previously we had for issue of warnings quota_warning = storage=90%% /scripts/dqwarn-90.sh quota_warning2 = storage=75%% /scripts/dqwarn-75.sh worked great, these lines also migrated to new conf upon conversion. But quota conf example shows plugin { #quota_warning = storage=95%% quota-warning 95 %u #quota_warning2 = storage=80%% quota-warning 80 %u } # Example quota-warning service. The unix listener's permissions should be # set in a way that mail processes can connect to it. Below example assumes # that mail processes run as vmail user. If you use mode=0666, all system users # can generate quota warnings to anyone. #service quota-warning { # executable = script /usr/local/bin/quota-warning.sh # user = dovecot # unix_listener quota-warning { # user = vmail # } #} So this seems to indicate /scripts/dqwarn-75.sh should be a service name, which then calls the service quota-warning with that script in it etc etc etc surely this old 4 line method has not been replaced into a 20 line mess? Is this old way still functioning as I suspect it is not, and we need to write up two separate new quota warning services given our warnings are worded differently, or should the old methods still be working as they did in 1.2 and we have an error elsewhere? Niki

2 2

[Dovecot] [OT] MS Exchange Alternative?
by Marc Perkel 04 Dec '12

04 Dec '12

Just wondering if there's an open source Linux alternative to MS Exchange so that all the features of outlook work?

12 14

[Dovecot] doveadm fts optimize undocumented
by Dave Abrahams 04 Dec '12

04 Dec '12

Subject says all. Timo, would you write something up where the world will find it? Also, it would be great if doveadm fts was covered in the doveadm manpage. Thanks, -- Dave Abrahams BoostPro Computing Software Development Training http://www.boostpro.com Clang/LLVM/EDG Compilers C++ Boost

2 6

[Dovecot] Maidir layout : why and how ?
by Thomas Hummel 04 Dec '12

04 Dec '12

Hello Timo, I've been using dovecot from many years now using Maildir mailbox format with default layout (Maildir++, everthing in a single directory). What would be the reason(s) to convert to Layout=fs ? I can only think of one : to allow dots in mailbox names. And even in that case, I guess I still have the option to use the litescape plugin. Besides, how would one process to do the conversion ? Using dsync ? Thanks. -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Groupe Exploitation et Infrastructure

2 1

[Dovecot] CVE-2012-5620
by Timo Sirainen 04 Dec '12

04 Dec '12

This CVE isn't worthy of existence. A user can crash his/her own IMAP session by issuing a specific SEARCH command, which is just slightly worse than user issuing a LOGOUT command. It took years for people to notice this bug, because just about no IMAP client issues such a command.

1 0

[Dovecot] imap-login hanging when firewall blocks ssl handshaking
by Erik A Johnson 04 Dec '12

04 Dec '12

imap-login processes are hanging (using 100% of CPU) when connected from a client that is partially blocked by a firewall. It appears that imap-login is stuck in a loop trying to complete an ssl handshake. imap-login is working fine for other clients not blocked by the firewall (including localhost). This is dovecot 2.1.10 under Mac OS X 10.8.2 (compiled from sources); the firewall is Little Snitch 3.0.1 blocking port 993, which appears to let the connection initiate but then squashes and disconnects the socket during ssl handshaking. gdb backtrace and Activity Monitor's "Sample Process" show that imap-login is stuck calling ioloop-kqueue's io_loop_handler_run -> io_loop_call_io -> ssl_step repeatedly; dtruss shows that it is repeatedly making system calls to kevent and read, the latter returning -1 with errno 57=ENOTCONN="Socket is not connected". (I also tried ./configure --with-ioloop=poll and --with-iopoll=select instead of the default best = kqueue but the results were the same; --with-iopoll=epoll didn't work because epoll is not available on this machine.) The client, initiated by the command "openssl s_client -connect SERVER:993", first responds "CONNECTED(00000003)" but then immediately the error "60278:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/SourceCache/OpenSSL098/OpenSSL098-44/src/ssl/s23_lib.c:182:". The infinite loop is in src/lib/ioloop.c in the function "io_loop_run" where the statement "while (ioloop->running) io_loop_handler_run(ioloop)" is executed. While I think the firewall is not doing the right thing (i.e., it lets a connection start but then kills it), it seems that imap-login should fail gracefully when the socket is no longer connected. Ideas? Thanks. ----------------------------------- /usr/local/sbin/dovecot -n # 2.1.10: /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 12.2.0 x86_64 default_internal_user = _dovecot default_login_user = _dovenull namespace { hidden = no list = yes location = mbox:/Users/%u/Documents/Mailboxes prefix = mbox/ separator = / type = private } namespace { inbox = yes location = maildir:/Users/%u/Documents/Maildir mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { driver = pam } protocols = imap lmtp ssl = required ssl_cert = </usr/local/etc/dovecot/dovecot.pem ssl_key = </usr/local/etc/dovecot/dovecot.pem userdb { driver = passwd } protocol imap { mail_plugins = " zlib imap_zlib" } ----------------------------------- gdb's "bt full" gives various results depending on where in the loop, but they are they same from ssl23_accept on down. (gdb) bt full #0 0x00007fff92d19f63 in sha1_block_data_order () #1 0x00007fff92d1a4ae in SHA1_Final () #2 0x00007fff92d45430 in EVP_DigestFinal_ex () #3 0x00007fff92d17d7a in ssleay_rand_add () #4 0x00007fff974529be in ssl23_accept () #5 0x000000010cac0729 in ssl_handshake [inlined] () at /private/tmp/johnsone/dovecot-2.1.10/src/login-common/ssl-proxy-openssl.c:465 ret = -949939536 #6 0x000000010cac0729 in ssl_step (proxy=0x7fff53152b90) at ssl-proxy-openssl.c:528 ret = -949939536 #7 0x000000010cb11bd1 in io_loop_call_io (io=0x7f7fa0c1c240) at ioloop.c:379 ioloop = (struct ioloop *) 0x7f7fa0c03b00 t_id = 2 #8 0x000000010cb12c69 in io_loop_handler_run (ioloop=0x0) at ioloop-kqueue.c:148 tv = { tv_sec = 130, tv_usec = 124797 } ctx = (struct ioloop_handler_context *) 0x7f7fa0c1a890 ret = 1 ts = { tv_sec = 130, tv_nsec = 124797000 } events = (struct kevent *) 0x10cb4ee78 #9 0x000000010cb11b88 in io_loop_run (ioloop=0x7fff53152b90) at ioloop.c:398 No locals. #10 0x000000010cafde9b in master_service_run (service=0x7f7fa0c039f0, callback=0x7f7fa0c1c2d8) at master-service.c:543 No locals. #11 0x000000010cabdcd1 in main_deinit [inlined] () at /private/tmp/johnsone/dovecot-2.1.10/src/login-common/main.c:406 set_pool = (pool_t) 0x7f7fa100b420 login_socket = 0x10cb4f7f8 "?9??" #12 0x000000010cabdcd1 in login_binary_run (argc=1, argv=0x7f7fa0c037c0, binary=0x7fff53152b90) at main.c:407 set_pool = (pool_t) 0x7f7fa100b420 login_socket = 0x10cb4f7f8 "?9??" #13 0x00007fff8ac847e1 in start () (gdb) bt full #0 0x00007fff96e4c110 in malloc_zone_malloc () #1 0x00007fff96e4cba7 in malloc () #2 0x00007fff92d2c9e2 in CRYPTO_malloc () #3 0x00007fff92d4535f in EVP_DigestInit_ex () #4 0x00007fff92d17caa in ssleay_rand_add () #5 0x00007fff974529be in ssl23_accept () ... #0 0x00007fff94775ffa in read () #1 0x00007fff92cf41e6 in sock_read () #2 0x00007fff92d15598 in BIO_read () #3 0x00007fff9745294a in ssl23_read_bytes () #4 0x00007fff97452c3e in ssl23_get_client_hello () #5 0x00007fff97452b4d in ssl23_accept () ... -----------------------------------

4 14

[Dovecot] clucene (in)stability
by Dave Abrahams 04 Dec '12

04 Dec '12

Considering two crashing bugs, which have got no response (https://sourceforge.net/tracker/?func=detail&aid=3587525&group_id=80013&ati… and https://sourceforge.net/tracker/?func=detail&aid=3592291&group_id=80013&ati…) and the lack of activity in its Git repository, I am inclined to think that CLucene's current release series (e.g. 2.3.3.4) should be considered unsuitable for serious use (including with Dovecot). I'm going to try CLucene 0.9.21, which they claim has been "proven to be stable over time" (see http://clucene.sourceforge.net) and see how it works out. I wonder if there's a future envisioned for FTS with Dovecot that's suitable for small installations (i.e. doesn't require a Solr server) and has a good chance of correctness and stability? -- Dave Abrahams BoostPro Computing Software Development Training http://www.boostpro.com Clang/LLVM/EDG Compilers C++ Boost

2 2