- dovecot - dovecot.org

[Dovecot] ntlm_auth in Dovecot
by Leonardo 09 Jun '12

09 Jun '12

Hi, I'm trying getting NTLM auth working against AD in my Dovecot 2.0.15. I'm getting the following error: Jun 08 14:18:11 auth: Info: winbind(?,10.44.3.151): user not authenticated: NT_STATUS_UNSUCCESSFUL "wbinfo -u" reports all the users of the domain and "ntlm_auth --username=%name% --domain="%domain%" gets authenticated successfully. Debugging winbind I can see the following error: [2012/06/08 14:18:11.129611, 10] winbindd/winbindd.c:651(process_request) process_request: unknown request fn number 14 [2012/06/08 14:18:11.129671, 10] winbindd/winbindd.c:738(winbind_client_response_written) winbind_client_response_written[2822:unknown request]: delivered response to client My dovecot.conf is the following: auth_mechanisms = plain ntlm login auth_username_format = %n auth_verbose = yes auth_winbind_helper_path = /usr/bin/ntlm_auth auth_use_winbind = yes auth_debug = yes disable_plaintext_auth = no info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = maildir:/var/mail/domains/%d/%n plugin { autocreate = Trash autocreate2 = Spam autocreate3 = Sent autosubscribe = Trash autosubscribe2 = Spam autosubscribe3 = Sent } protocols = imap ssl = no userdb { driver = static args = uid=100 gid=101 home=/var/mail/domains/%d/%n first_valid_uid=100 } passdb ldap { driver = ldap args = /etc/dovecot/dovecot-ldap.conf } protocol imap { mail_plugins = autocreate } Sounds like there is an issue when Dovecot runs "ntlm_auth". It doesn't appear to be a permission issue (perms are 755). Any help is appreciated. Thank you in advance. -- leonardo.

1 2

[Dovecot] [ Re: best practises for mail systems]
by Michescu Andrei 09 Jun '12

09 Jun '12

Hello, If disk space and bandwidth are affordable (and from your setup it seems that they are affordable as you have everything locally) I would split the mail storage completely and use replication in between n-master servers (n=2 for your case). The replication is not yet fully tested, but Timo is actively working on this feature. The fear of lossing the imap session does not make sense (at least to me) as the client will reconnect automatically in the background. Like this you have no SPOF and no split-brain and you get the flexibility (if needed) to geographically distribute your servers in the the future. Keep each server with its own ip, connect to them via DNS (round robin etc etc). We are currently experimenting with a setup similar to this one, but with geographically distributed servers (trans-continental) (bandwidth limited and high cost). Best regards, Andrei > We once try to use similar solution as your first. > > 3 servers for LVS -HA > > This master server redirect users for 2 or 3 dovecot backends.. > > The mail storage were maildir ontop of OCFS2 > > Our problem were that OCFS2 were too slow. We could not handle many users. > > So we took an step back and now use only user one server. > > But still thinking in go back to the first one. with LVS > > When using LVS try to sticky user to the same backend, LVs can do ths by > source ip. > > Where i work we have problens on testign storage. If you have any advices > for testing disk performance, i will be thankfull. > > I wil be glad to answer anything else. > > []'sf.rique > > > On Tue, Jun 5, 2012 at 9:59 AM, ëÏÓÔÙÒÅ× áÌÅËÓÁÎÄÒ áÌÅËÓÅÅ×ÉÞ < > a.kostyrev(a)serverc.ru> wrote: > >> I think LVS is just fine and it is not a SPOF 'cause it is actually 2 >> servers: >> active master --> and standby slave. >> LVS supports real time replication of connections from master to slave, >> so if master dies slave knows which IP was connected to which dovecot >> server. >> >> I'm more worried about right design of mailstorage.. should I use some >> cluster fs with all mail of all users >> or should I split mailstorage across servers and somehow avoid long >> downtime if one of servers goes down. >> >> >> -----Original Message----- >> From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] >> On >> Behalf Of Matthias-Christian Ott >> Sent: Tuesday, June 05, 2012 11:28 PM >> To: dovecot(a)dovecot.org >> Subject: Re: [Dovecot] best practises for mail systems >> >> On 2012-06-05 05:14, ëÏÓÔÙÒÅ× áÌÅËÓÁÎÄÒ áÌÅËÓÅÅ×ÉÞ wrote: >> > On each host system we created one VM and passed through 3x2TB disks >> into it. >> > >> > >> > >> > In guests vms on top of this disks we made XFS and fired up glusterfs >> with distributed replicated volumes for our mailstorage. >> > >> > so it looks like this: >> > >> > >> > >> > vm1 replicate vm2 >> > >> > disk1 ------------> disk4 >> > >> > disk2 ------------> disk5 >> > >> > disk3 ------------> disk6 >> > >> > >> > >> > in each vm we mounted glusterfs and pointed dovecot to that dir for >> mail >> creation (as ltmp) and imap4 user access. >> > >> > also we use exim as smtp. >> > >> > >> > >> > So, with glusterfs as mailstorage we can go for LVS to load balancing >> for exim and dovecot. >> > >> > so wherenever one of host systems (hence one of mail vms) goes down, >> users don't notice that >> > >> > 'cause LVS points them to working smtp and imap4 servers >> > >> > and they get their mail 'cause of glusterfs. >> > [...] >> > Cons: >> > >> > - not quite sure if glusterfs is production ready solution 'cause I've >> experienced split-brains during setting it up >> > >> > - IO performance issue. Though we didn't yet run any io tests, but >> glusterfs uses fuse to mount on clients. And guys on #gluster told me >> writing to the glusterfs mount will not be strictly local io. >> >> I'm not familiar with LVS, but from the project description it seems >> that you need a "front server" that does the load balancing, so you >> either have to run at least two of these servers in parallel or add to >> your cons that you introduced a single point of failure. But you >> mentioned that you only have two servers, so you really can do this. >> >> I would rather ensure high availability by running the two servers as >> masters and using either IP address takeover or DNS failover (with >> dynamic DNS) and either use Dovecot's replication (I haven't tested it >> yet and I'm not sure what happens in case of IP address takeover) or a >> file system that can handle these kinds of errors (e.g. Coda). You could >> do load balancing via round-robin DNS. This only protects you against >> the failure of single machine and because IMAP sessions are not >> replicated between the servers, connections will get reset if one server >> fails, but it's cost-effective and uses software that already exists. >> >> Regards, >> Matthias-Christian >> > > > !DSPAM:4fce037e104291424646138! >

4 9

[Dovecot] 2.0.X -> 2.1 pitfalls?
by Frank Elsner 09 Jun '12

09 Jun '12

Hi all, are there any pitfalls known for the migration from 2.0.18 to 2.1? Can I simply stop dovecot, make install and start again? --Frank Elsner

10 22

[Dovecot] Maildir filename has wrong S value
by Wouter de Geus 09 Jun '12

09 Jun '12

Hello folks, This morning I tried to open an old archive mail folder using Mutt. However, while fetching headers it aborted. Checking the dovecot log gave me this: @400000004fb21996267d37d4 imap(benv): Error: Cached message size smaller than expected (9115 < 9420) @400000004fb21996267e8bac imap(benv): Error: Maildir filename has wrong S value, renamed the file from /home/vpopmail/domains/benv.junerules.com/benv/Maildir/.Old.2009/cur/1260395566.28175.black,S=9115:2,S to /home/vpopmail/domains/benv.junerules.com/benv/Maildir/.Old.2009/cur/1260395566.28175.black,S=9420:2,S @400000004fb21996267e937c imap(benv): Error: Corrupted index cache file /home/vpopmail/domains/benv.junerules.com/benv/Maildir/.Old.2009/dovecot.index.cache: Broken physical size for mail UID 294 @400000004fb21996267eaaec imap(benv): Error: read(/home/vpopmail/domains/benv.junerules.com/benv/Maildir/.Old.2009/cur/1… failed: Input/output error (uid=294) @400000004fb219962680683c imap(benv): Info: Disconnected: Internal error occurred. Refer to server log for more information. [2012-05-15 10:53:32] in=6503 out=192718 I've retried opening this folder several times, but each time Dovecot only fixes 1 file and then aborts. (the folder apparently has a lot more files with incorrect sizes). My question here is: Why does dovecot abort? Isn't the issue fixed after the rename? Also: The files are not corrupted or unreadable, reading them through the commandline works fine. I've looked through my backups and saw that at least half a year ago this mismatch in size was already present. I've been running dovecot for quite a while, so the cause of this size mismatch might very well be a issue in an older version of dovecot / my configuration. Right now I'm running dovecot 2.1.6, but I've been running the v1.2 version for quite a while before that. Is this something that can be improved in dovecot so it doesn't abort after 1 rename? (of course I could script a rename operation, but that seems like a workaround to me) Thanks for reading. Wouter. My current configuration: ========================= # 2.1.6: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32.32-g3d14ce7 x86_64 Slackware 11.0.0 base_dir = /var/run/dovecot2/ disable_plaintext_auth = no first_valid_uid = 89 info_log_path = /dev/stderr last_valid_uid = 89 log_path = /dev/stderr log_timestamp = mail_debug = yes mail_location = maildir:~/Maildir mail_max_userip_connections = 50 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify e nvironment mailbox date namespace { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { driver = vpopmail } plugin { autocreate = INBOX.Spam quota = maildir sieve = ~/.sieve/dovecot.sieve sieve_dir = ~/.sieve sieve_global_dir = /etc/dovecot/sieve/ sieve_subaddress_sep = -+ } protocols = imap pop3 sieve service auth { unix_listener auth-master { group = vchkpw mode = 0660 } unix_listener auth-userdb { group = vchkpw mode = 0660 } } service imap-login { inet_listener imap { address = [::] * port = 143 } inet_listener imaps { address = [::] * port = 993 } process_limit = 256 process_min_avail = 3 service_count = 1 user = dovecot } service managesieve-login { process_limit = 256 process_min_avail = 3 service_count = 1 user = dovecot } service pop3-login { inet_listener pop3 { address = [::] * port = 110 } inet_listener pop3s { address = [::] * port = 995 } process_limit = 256 process_min_avail = 3 service_count = 1 user = dovecot } ssl_cert = </var/qmail/control/servercert.pem ssl_cipher_list = ALL:!LOW ssl_key = </var/qmail/control/servercert.pem userdb { driver = vpopmail } verbose_proctitle = yes protocol lda { hostname = mail.benv.junerules.com info_log_path = /var/log/dovecot/dovecot2-deliver.log log_path = /var/log/dovecot/dovecot2-deliver-errors.log mail_plugins = sieve postmaster_address = postmaster(a)benv.junerules.com sendmail_path = /var/qmail/bin/sendmail } protocol imap { imap_max_line_length = 64 k mail_plugins = quota imap_quota autocreate } protocol pop3 { mail_plugins = quota autocreate pop3_no_flag_updates = no pop3_uidl_format = %v-%u } =================================

5 5

[Dovecot] 2.1.7 altmove not working
by Alex Crow 09 Jun '12

09 Jun '12

Hi list, I've just set up a 2.1.7 server, and have migrated a couple of accounts across from a 2.0.15 server, keeping the old configs. I have a strange problem on the new box in that altmove just doesn't work. I have my main storage under /home/email, indexes under /home/indexes and ALT under /home/email_archive. When I run the altmove command, the following broken symlink is created in /home/email/integrafin.co.uk/acrow: lrwxrwxrwx. 1 email email 54 Jun 8 10:46 dbox-alt-root -> /home/email_archive/integrafin.co.uk/a/acrow/mailboxes But nothing is created in the archive other than the empty directory: /home/email_archive/integrafin.co.uk/a/acrow. My mail_location is: mail_location = mdbox:/home/email/%d/%n:INDEX=/home/indexes/%d/%1n/%n:ALT=/home/email_archive/%d/%1n/%n This worked perfectly on the older server. I have attached my doveconf -a output. Any help much appreciated. Regards Alex

1 2

Re: [Dovecot] auth trouble
by Joseph Tam 08 Jun '12

08 Jun '12

Glenn English writes: > I'm getting a lot of what I think is a local socket asking > dovecot:auth to verify username/passwords: > >> May 31 09:00:54 server dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost= If dovecot-auth is getting input from a local socket, then rhost information is irrelevant since the host doing the asking is the server itself (maybe from another daemon connected to a remote host). Maybe someone is brute forcing your server's Postfix authenticated SMTP service since Postfix can be configured to use Dovecot's SASL authentication framework. Joseph Tam <jtam.home(a)gmail.com>

4 5

[Dovecot] upgrade from 1.0.5 to 2.1.7
by Andreas Meyer 08 Jun '12

08 Jun '12

Hello! I want to upgrade the docevot-installation from v 1.0.5 to 2.1..7 Now I get the following executing doveconf -n -c /etc/dovecot/dovecot.conf > /home/mail1/dovecot-2.conf doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:217: add auth_ prefix to all settings inside auth {} and remove the auth {} section completely doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:219: passdb passwd-file {} has been replaced by passdb { driver=passwd-file } doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:222: userdb passwd-file {} has been replaced by userdb { driver=passwd-file } The section at line 217 looks like this: auth default { mechanisms = plain passdb passwd-file { args = /etc/dovecot/passwd } userdb passwd-file { args = /etc/dovecot/passwd } How do I change it to fullfill the new needs? And how do I handle line 217? add auth_ prefix to all settings inside auth {} and remove the auth {} section completely ? Thanks for help! Andreas

3 14

[Dovecot] Fwd: ntlm_auth in Dovecot
by Алексей Переклад 08 Jun '12

08 Jun '12

Try to delete your server from domain and add it again by "net ads join..." > I'm trying getting NTLM auth working against AD in my Dovecot 2.0.15. > > I'm getting the following error: > > > Jun 08 14:18:11 auth: Info: winbind(?,10.44.3.151): user not > authenticated: NT_STATUS_UNSUCCESSFUL

1 0

[Dovecot] Director pop3 real ips v2.1.1
by Костырев Александр Алексеевич 08 Jun '12

08 Jun '12

good day! I'm experiencing problem with pop3 proxying: on backend servers in logs there's director's ip instead of remote's like this: Jun 8 15:21:23 host-01 dovecot: pop3-login: Login: user=<test1(a)example.com>, method=PLAIN, rip=192.168.5.102, lip=192.168.5.100, mpid=26170, secured Jun 8 15:32:16 host-01 dovecot: pop3-login: Login: user=<test1(a)example.com>, method=PLAIN, rip=192.168.5.102, lip=192.168.5.100, mpid=26426, secured -- С уважением, Костырев Александр системный администратор ЗАО "Сервер-Центр" тел.: (423) 262-02-62 (доб. 2037) факс: (423) 262-02-10 a.kostyrev(a)serverc.ru icq: 404-198-497

3 3

[Dovecot] dovecot ignores entries in virtual_alias_maps when using dovecot lda
by Marko Weber 08 Jun '12

08 Jun '12

hello list, i need help. dovecot dont look into my virtual_alias_maps . i set via postzfixadmin an alias postmaster(a)domain.tld to newmail(a)domainother.tld. when i send mails to postmaster(a)domain.tld mails are rejected. dovecot authworker tells me in log: user unknown. but i can request the data via postmap -v -q postmaster(a)domain.tld mysql:/etc/postfix/mysql_virtual_alias.cf and get result "newmail(a)domainother.tld". any ideas, hwo to get dovecot to look into my alias maps? marko

2 2