- dovecot - dovecot.org

[Dovecot] Postfix & Dovecot: Client certificate authentication
by "JARRY Jérémy" 16 Aug '12

16 Aug '12

Hello, I would like to set up an authentication using certificate with Dovecot: A user sends mail to Postfix and Dovecot authentication is valid only if certificate is trusted. So, I enable the parameter auth_ssl_require_client_cert in dovecot configuration but it is not running. Here are the postfix logs: Aug 16 09:51:48 myserver dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth Aug 16 09:51:48 myserver dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libauthdb_ldap.so Aug 16 09:51:48 myserver dovecot: auth: Debug: auth client connected (pid=6922) Aug 16 09:51:51 myserver dovecot: auth: Debug: client in: AUTH 1 PLAIN service=smtp nologin lip=127.0.0.1 rip=127.0.0.1 secured resp=xxx Aug 16 09:51:51 myserver postfix/smtpd[6922]: warning: localhost.localdomain[127.0.0.1]: SASL PLAIN authentication failed: Client didn't present valid SSL certificate Aug 16 09:51:51 myserver dovecot: auth: PLAIN(?,127.0.0.1): Client didn't present valid SSL certificate Aug 16 09:51:51 myserver dovecot: auth: Debug: client out: FAIL 1 reason=Client didn't present valid SSL certificate Aug 16 09:51:51 myserver dovecot: auth: Debug: client in: AUTH 2 LOGIN service=smtp nologin lip=127.0.0.1 rip=127.0.0.1 secured Aug 16 09:51:51 myserver dovecot: auth: LOGIN(?,127.0.0.1): Client didn't present valid SSL certificate Aug 16 09:51:51 myserver dovecot: auth: Debug: client out: FAIL 2 reason=Client didn't present valid SSL certificate Aug 16 09:51:51 myserver postfix/smtpd[6922]: warning: localhost.localdomain[127.0.0.1]: SASL LOGIN authentication failed: Client didn't present valid SSL certificate It seems Postfix doesn't send the client certificat to Dovecot. What do you think ? What is wrong ? Below are some information about my configuration: OS: RHEL5 Postfix: 2.7.3 Dovecot: 2.0.14 Dovecot config: auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes auth_verbose = yes mail_debug = yes passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocols = none service auth { unix_listener /data/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } ssl = required ssl_ca = </etc/dovecot/ca.pem ssl_cert = </etc/dovecot/cert.pem ssl_key = </etc/dovecot/key.pem ssl_verify_client_cert = yes userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } verbose_ssl = yes Thanks for your help

2 1

[Dovecot] bcrypt again
by Sven Schwyn 15 Aug '12

15 Aug '12

Hi I'd like Dovecot to consume a list of users exported from an external application which stores bcrypted passwords. This has been asked in the past, however, I'm not sure how to read the following reply: > If you are using Dovecot< 2.0 you can also use any of the algorithms > supported by your system's libc. But then you have to prefix the hashes > with {CRYPT} - not {{BLF,SHA256,SHA512}-CRYPT}. I'm on Dovecot 2.0.19. Does this mean that only the hashes listed with "doveadm pw -l" are supported and even if glibc can do bcrypt, the CRYPT scheme won't do the trick anymore? Thanks for your help!

2 1

[Dovecot] Thread sorting problem
by CpServiceSPb 15 Aug '12

15 Aug '12

Hi. How much may implementing of THREAD=ORDEREDSUBJECT to Dovecot 2.1.x or later cost ? Artyom.

2 2

[Dovecot] about postlogin in dovecot2
by Bulend Mali 15 Aug '12

15 Aug '12

Hello I use dovecot2 on vpopmail,qmail. i want to use login-intranet-imap.sh in order to restrict by emailaddress and ip address. i read it at http://wiki2.dovecot.org/PostLoginScripting. But there is an expression "mail_executable" in conf. but there is no such thing in dovecot2. what is equivalent of it for dovecot2 ? -- View this message in context: http://old.nabble.com/about-postlogin-in-dovecot2-tp34275123p34275123.html Sent from the Dovecot mailing list archive at Nabble.com.

4 14

[Dovecot] vacation and field FROM
by Николай Клименко 14 Aug '12

14 Aug '12

Hi to all Here is the following scheme: Dovecot in a link with AD. For LDA and IMAP different views are used in a base. For example there is a user with such e-mail type - 1.name(a)domain.ltd with the name of authorization auth_1.name. Incoming male folds up in /var/mail/domain/auth_1.name When vacation is on, the letters from 1.name(a)domain.ltd are sent in a following way auth_1.name(a)domain.ltd I guess the problem is in two different data-base queries. Could you please tell me how to solve this problem and to make the answer to be sent from the same adress it is comes to. part of dovecot.conf protocol lda { mail_plugins = sieve acl hostname = domain.ltd postmaster_address = <postmaster(a)domain.ltd> auth_socket_path = /var/run/dovecot/auth-master_lda log_path = /var/log/dovecot-deliver.log } auth default { verbose = no debug = no debug_passwords = no mechanisms = plain user = dovecot passdb passwd-file { args = /etc/dovecot/passwd.masterusers master = yes } passdb ldap { args = /etc/dovecot/dovecot-ldap.conf } userdb static { args = uid=20000 gid=20000 home=/opt/mail/user_mailbox/%Lu allow_all_users=yes } socket listen { master { path = /var/run/dovecot/auth-master mode = 0660 user = vmail group = vmail } client { path = /var/spool/postfix/private/dovecot-auth mode = 0660 user = postfix group = postfix } } } auth auth_lda { verbose = no debug = no debug_passwords = no mechanisms = plain user = dovecot passdb ldap { args = /etc/dovecot/dovecot-ldap_lda.conf } userdb ldap { args = /etc/dovecot/dovecot-ldap_lda.conf } socket listen { master { path = /var/run/dovecot/auth-master_lda mode = 0660 user = vmail group = vmail } part of dovecot-ldap.conf (filter options) pass_attrs = sAMAccountName=user pass_filter = (&(sAMAccountName=%u)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) part of dovecot-ldap_lda.conf user_attrs = sAMAccountName=user user_filter = (mail=%u) pass_attrs = sAMAccountName=user pass_filter = (mail=%u) --

1 0

[Dovecot] Libdovecot-sieve segfaults
by Nikita Koshikov 14 Aug '12

14 Aug '12

Hello Stephan, Preface - one of my users went to vacation and changed his sieve script to run autoreply vacation message, after that - I have noticed some annoying errors in system log, like: dovecot-lda[2400]: segfault at 3eb3333f ip b7446c7a sp bfaab050 error 4 in libdovecot-sieve.so.0.0.0[b7429000+5b000] Dovecot-error log is empty, but in exim log(exim runs dovecot-lda) I got: 2012-08-13 09:35:27 1T0oFK-0000aW-6j ** sr(a)domain.com (sr(a)domain.com, root(a)domain.com) <postmaster(a)domain.com > F=<59942270813(a)mymail.in.ua> R=ldap_accept T=local_delivery: Child process of local_delivery transport (running command "/usr/libexec/dovecot/dovecot-lda -e -d $local_part@$domain") was terminated by signal 11 (Segmentation fault) sr(a)domain.com - is the user, who created such sieve-script, which cause segfaults. I have tried run the same message over this script from sieve-test utility - but result is success. Can you please, take a look to this sieve script and check is it ok, I'll send it to you privately since it contains user's data. Also I'll attach message.eml which triggers segfault. Dovecot version - 2.0.21, Sieve version - 0.2.6. Relevant to sieve dovecot config section: plugin { sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve/default-after.sieve sieve_dir = ~/sieve sieve_extensions = +notify +spamtest sieve_spamtest_max_value = 10 sieve_spamtest_status_header = X-Spam-Scan-Score sieve_spamtest_status_type = score } Hope you'll help.

1 0

[Dovecot] pop3 proxying error
by tonio＠starbridge.org 13 Aug '12

13 Aug '12

Hi Timo, I've got some errors with pop3 proxying and dovecot 2.1.9 I's occured on the proxy side: Aug 7 13:16:47 dev1 dovecot: pop3-login: Fatal: master: service(pop3-login): child 23046 killed with signal 11 (core dumped) Server side shows no error, and runs the same dovecot version. Thanks for your help. Best regards Tonio Buonaguidi Core dump: GNU gdb (GDB) 7.4.1-debian Copyright (C) 2012 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i486-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/lib/dovecot/pop3-login...done. [New LWP 23046] warning: Can't read pathname for load map: Erreur d'entrée/sortie. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1". Core was generated by `dovecot/pop3-login -D'. Program terminated with signal 11, Segmentation fault. #0 settings_parser_dup (old_ctx=0x8783480, new_pool=0x632e6465) at settings-parser.c:1742 1742 pool_ref(new_pool); doveconf -n # 2.1.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32.2-xxxx-std-ipv6-32 i686 Debian wheezy/sid auth_cache_size = 4 k auth_mechanisms = plain login director_mail_servers = bb.bb.bb.bb cc.cc.cc.cc director_servers = dd.dd.dd.dd aa.aa.aa.aa log_timestamp = %Y-%m-%d %H:%M:%S mail_debug = yes managesieve_notify_capability = mailto managesieve_sieve_capability = comparator-i;octet comparator-i;ascii-casemap fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date spamtest spamtestplus virustest passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0660 user = postfix } unix_listener auth-master { mode = 0660 user = vmail } unix_listener auth-userdb { mode = 0660 user = vmail } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { address = aa.aa.aa.aa port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director inet_listener imap { address = aa.aa.aa.aa yy.yyy.yy.yy xx.xx.xx.xx port = 143 } inet_listener imaps { address = aa.aa.aa.aa yy.yyy.yy.yy xx.xx.xx.xx port = 993 } process_limit = 256 process_min_avail = 2 service_count = 0 vsz_limit = 256 M } service managesieve-login { inet_listener sieve { address = aa.aa.aa.aa yy.yyy.yy.yy xx.xx.xx.xx port = 4190 } vsz_limit = 64 M } service pop3-login { executable = pop3-login -D inet_listener pop3 { address = aa.aa.aa.aa yy.yyy.yy.yy xx.xx.xx.xx port = 110 } inet_listener pop3s { address = aa.aa.aa.aa yy.yyy.yy.yy xx.xx.xx.xx port = 995 } service_count = 0 } ssl_ca = </etc/dovecot/ca-bundle.crt ssl_cert = </etc/dovecot/imap.xxx.certchained2.pem ssl_client_cert = </etc/dovecot/imap.xxx.certchained2.pem ssl_client_key = </etc/dovecot/imap.xxx.key.pem ssl_key = </etc/dovecot/imap.xxx.key.pem userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { imap_client_workarounds = delay-newmail imap_max_line_length = 64 k mail_max_userip_connections = 10 } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol sieve { passdb { args = /etc/dovecot/sieve-sql.conf driver = sql } } local xx.xx.xx.xx { disable_plaintext_auth = no } local yy.yyy.yy.yy { protocol imap { ssl = required ssl_cert = </etc/dovecot/mail.pem ssl_key = </etc/dovecot/mail.key.pem } } local yy.yyy.yy.yy { protocol sieve { ssl = required ssl_cert = </etc/dovecot/mail.pem ssl_key = </etc/dovecot/mail.pem } } local xx.xx.xx.xx { protocol imap { ssl = yes ssl_cert = </etc/dovecot/imap.certchained.pem ssl_key = </etc/dovecot/imap.key.pem } } local xx.xx.xx.xx { protocol pop3 { ssl = yes ssl_cert = </etc/dovecot/pop.certchained.pem ssl_key = </etc/dovecot/pop.key.pem } } local xx.xx.xx.xx { protocol sieve { ssl = yes ssl_cert = </etc/dovecot/mail.certchained.pem ssl_key = </etc/dovecot/mail.key.pem } }

2 10

[Dovecot] HA Mailbox Design
by Nikolaos Milas 13 Aug '12

13 Aug '12

Hi, We would like to implement a Highly Available Mail Server and would like to ask advice on how to architect this. Some details on our setup: Currently we have only one internal mail server (Postfix/Dovecot 2.0 - planning to move to 2.1), receiving mail from a gateway server (filtering spam/viruses) - a Cisco Ironport - which we are considering to replace with one (or a set of) cloud-based Postfix/Amavis-new/SpamAssassin/ClamAV VMs (currently in testing mode). Delivery uses Dovecot LDA. User accounts are LDAP-based. We use Maildir and the load is low (aside spam). Only about 250 users/mailboxes (4G each). All servers are CentOS 5.8 (planning move to 6.3) KVM VMs (on a cloud where we don't have control on the host, but on highly reliable hardware/networks). We can have VMs on two different clouds and we also have at least two different connections (routes) to the cloud(s) (to support HA). Any directions will be appreciated. Hoping to design an HA architecture but aiming to keep it simple and (as much as possible) easily maintainable one. Thanks for your response and help, Nick

5 8

[Dovecot] master user auth problem
by Ibrahim Harrani 13 Aug '12

13 Aug '12

Hi, I tried to setup a master auth authentication. I also use auth_pop3wrapper to authenticate from qmail-ldap. But I could not login with master user. Here is the config. auth_master_user_separator = * passdb { driver = passwd-file args = /usr/local/etc/dovecot/passwd.masterusers master = yes pass = yes } passdb { # Path for checkpassword binary driver = checkpassword args = /var/qmail/bin/auth_popwrapper } userdb { driver = prefetch } cat /opt/surmail/etc/dovecot/passwd.masterusers user:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g= The log: #telnet localhost 143 Trying 0.0.0.0... Connected to 0. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN] SurGATE Messaging Suite POP3/IMAP ready. o login user(a)domain.com*user password o NO [AUTHORIZATIONFAILED] Authorization failed Aug 09 16:17:44 auth: Debug: auth(user,127.0.0.1,master,<KmGNDdXGrwB/AAAB>): Master user lookup for login: user(a)domain.com Aug 09 16:17:44 auth: Debug: passwd-file(user,127.0.0.1,master,<KmGNDdXGrwB/AAAB>): lookup: user=user file= /usr/local/etc/dovecot/passwd.masterusers Aug 09 16:17:44 auth: Info: passdb(user,127.0.0.1,master,<KmGNDdXGrwB/AAAB>): Master user logging in as user(a)domain.com Aug 09 16:17:44 auth: Debug: checkpassword(user(a)domain.com,127.0.0.1,<KmGNDdXGrwB/AAAB>): execute: /var/qmail/bin/auth_popwrapper /usr/local/dovecot/libexec/dovecot/checkpassword-reply Aug 09 16:17:44 auth: Debug: checkpassword(user(a)domain.com,127.0.0.1,<KmGNDdXGrwB/AAAB>): Received input: Aug 09 16:17:44 auth: Debug: checkpassword(user(a)domain.com,127.0.0.1,<KmGNDdXGrwB/AAAB>): exit_status=3 Aug 09 16:17:44 auth: Info: checkpassword(user(a)domain.com,127.0.0.1,<KmGNDdXGrwB/AAAB>): Login failed (status=3) Aug 09 16:17:46 auth: Debug: client out: FAIL 1 user=user(a)domain.com authz Aug 09 16:18:08 auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=KmGNDdXGrwB/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=48047 resp=<hidden>

1 0

[Dovecot] Running spamc during LMTP delivery
by martin f krafft 12 Aug '12

12 Aug '12

Hello list, we are using dovecot-lmtp for delivery to virtual users, and vmm[1] to manage them. 1. http://vmm.localdomain.org/ One nice feature of vmm is that every virtual user has their own UID/GID on the UNIX filesystem. There is no passwd entry, so no shell login, but each user effectively has a home directory and can run commands in isolation and with lowered privileges. This requires dovecot-lmtp because only the LMTP LDA runs with root rights and can drop privileges to become the specific user for which it is delivering mail. We would now like to run SpamAssassin with the possibility of using the antispam plugin to enable virtual users to train their databases. Do you have an idea how I could let dovecot-lmtp invoke spamc? Or an external command as a filter, to be run by the final user? Thanks, -- martin | http://madduck.net/ | http://two.sentenc.es/ "truth is stranger than fiction, but it is because fiction is obliged to stick to possibilities; truth isnt." -- mark twain spamtraps: madduck.bogus(a)madduck.net

4 6