- dovecot - dovecot.org

[Dovecot] [PATCH] Interop problem with Cyrus SASL and GSSAPI
by Ben Morrow 17 Jul '12

17 Jul '12

[I sent this a while ago, but it seems not to have made it to the list. I'm resending it having subscribed first; I apologise if anyone get it twice.] I have been trying to get a Postfix mail server using Dovecot SASL to accept GSSAPI AUTH from another Postfix server using Cyrus SASL, and I believe I have found a couple of bugs in Dovecot's GSSAPI implementation. The first problem is that, because of the way the client invokes libsasl, it sends a GSSAPI request which does not ask for mutual authentication. This means that on the server gss_accept_sec_context returns GSS_S_COMPLETE with a zero-length output token. Dovecot currently sends this to the client as a zero-length continuation response, but this is incorrect according to RFC 4752: what it ought to do instead is proceed straight to the security layer negotiations, and send a gss_wrap packet. The second is that Cyrus sends an empty authz identity; that is, the security layer negotiation packet, when gss_unwrapped, is exactly 4 bytes long. Dovecot objects to this, but in RFC 4422 this is explicitly allowed, and means the authz identity is identical to the authn identity. I believe the attached patches (for the 1.2 and 2.1 branches) fix the problem, though I'm not entirely sure if the difference between the p_strndup in mech_gssapi_unwrap and the t_strndup in get_display_name is important. Ben

2 1

[Dovecot] Timeout (180s) while waiting for lock for transaction log file
by Angel L. Mateo 17 Jul '12

17 Jul '12

Hello, We still have problems with our updated dovecot servers... The problem now is that we are having errors like: Jul 9 10:22:02 myotis31 dovecot: lmtp(15431, <user>): Error: Timeout (180s) while waiting for lock for transaction log file /var/indexes/<user>/.INBOX/dovecot.index.log Jul 9 10:22:02 myotis31 dovecot: lmtp(15431, <user>): Error: +4YfCwKS+k9HPAAAmo+UlA: sieve: msgid=<4FFA8700.2080003(a)um.es>: failed to store into mailbox 'INBOX': Internal error occurred. Refer to server log for more information. [2012-07-09 10:19:02] Jul 9 10:22:02 myotis31 dovecot: lmtp(15431, <user>): Error: +4YfCwKS+k9HPAAAmo+UlA: sieve: script /home/pdi/88/185188/.dovecot.sieve failed with unsuccessful implicit keep (user logfile /home/pdi/88/185188/.dovecot.sieve.log may reveal additional details) in the .dovecot.sieve.log all we have is just: sieve: info: started log at Jul 09 10:22:02. error: msgid=<4FFA8700.2080003(a)um.es>: failed to store into mailbox 'INBOX': Internal error occurred. Refer to server log for more information. [2012-07-09 10:19:02]. maildir are in a nfs storage, but indexes are in local disk. I don't know if the problem could be related with a some "specific" messages or something specific to the user, because we are having this problem only with a few users and the problem repeatedly happens when our mta tries to deliver the queued message. Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 1

[Dovecot] quota fs: Support for hardlimit quotas (where softquota is unset)
by Jan Friesse 17 Jul '12

17 Jul '12

Hi, included is patch which adds support for calculating fs quota from hardlimit where softlimit is unset. I'm usually not setting softlimit on my server causing dovecot work incorrectly (not reporting quota at all). Regards, Jan Friesse

2 1

[Dovecot] Feature request
by Malloc Kilobyte 17 Jul '12

17 Jul '12

Hi, I am implementig Dovecot as a part of my new e-mail server, which is aimed to be replacement for proprietary software I've been using sofar. Appreciating all Dovecot rich features, I lack just one. And this is the ability to customize the "quota exceeded, message rejected" message. I know I can set it's default content using quota_exceeded_message parameter, but i would also like to have ability to set: - to whom the message is sent. Some mail systems send copy not only to the sender, but also to the recipient. It makes sense in case rejected message has big size. - it's subject - if the rejected message is being attached ( with or without it's own attachments ) or not Moreover, I think it would make sense if the "rejected messege" contained information about size of rejected message and current mailbox space usage. Please, consider this in future development. with regards and respect to the tremendousness of Dovecot, -- malloc4k

5 5

[Dovecot] LDAP.conf filter issue
by Tony Hlabse 17 Jul '12

17 Jul '12

All, We are trying to use the user_filter options to limit authentication to a single user group. The cusotmer has security rules that they want to only have users belonging to a group to have access. Sample we have tried. auth_bind = yes auth_bind_userdn = EXAMPLE\%n base = / hosts = example.test.com ldap_version = 3 user_filter = (&(sAMAccountName=)(memberOf=CN=LR3BCC-DL,OU=Autonomy,OU=Exchange,OU=Enterprise Administration,DC=example,DC=test,DC=com)) Thanks Tony

2 1

[Dovecot] dovecot 2.1.8 still tries to touch any mountpoint
by Reindl Harald 17 Jul '12

17 Jul '12

why does dovecot touch any ever used fuse-mountpoint and scream at the next start that is no longer mounted? "If this is intentional, remove it with doveadm mount" why if i never called "doveadm" on any setup at all? Jul 10 09:10:56 rh dovecot: master: Dovecot v2.1.8 starting up (core dumps disabled) Jul 10 09:10:56 rh dovecot: master: Warning: /sys/fs/cgroup/cpu is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /sys/fs/cgroup/cpuacct is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /var/run/vmblock-fuse is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /mnt/arrakis is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /mnt/loungebackup is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /mnt/panel is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /mnt/proxy is no longer mounted. If this is intentional, remove it with doveadm mount

3 4

[Dovecot] doveadm director status username != doveadm director status username@mailserver
by Joseba Torre 17 Jul '12

17 Jul '12

Hi, I've almost finished my new director based setup, but in the first test I discovered that imap and lmtp connections were not always being proxied to the same server. After some research now I think that the main problem is that in imap connections users connect as 'username' while lmtp connections are as 'username@mailserver'. In my current setup I receive mail via SMTP in my director servers (which are loadbalanced by a CISCO machine), and then they send them to dovecot running on localhost. I've tried to get rid of the @mailserver in postfix in a generic way with no success. Is there any way to redirect connections based only in the local part of the address? Or there is a way to get rid of the @mailserver in the postfix -> lmtp connection? Both doveadm config -n and postconf -n are attached. Thanks. $ doveadm config -n # 2.1.8: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-220.17.1.el6.x86_64 x86_64 Red Hat Enterprise Linux Server release 6.2 (Santiago) auth_debug = yes auth_master_user_separator = * auth_verbose = yes director_mail_servers = buzones2.ehu.es buzones3.ehu.es director_servers = director1.ehu.es director2.ehu.es doveadm_proxy_port = 4444 lmtp_proxy = yes mail_debug = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = proxy=y nopassword=y starttls=any-cert driver = static } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { port = 3333 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service doveadm { inet_listener { port = 4444 } } service imap-login { executable = imap-login director } service lmtp { inet_listener ltmp { address = director2.ehu.es 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { executable = managesieve-login director vsz_limit = 128 M } service pop3-login { executable = pop3-login director } ssl_cert = </etc/ssl/private/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem syslog_facility = local1 userdb { args = allow_allusers=yes driver = static } protocol lmtp { auth_socket_path = director-userdb mail_plugins = " sieve" syslog_facility = local2 } protocol doveadm { auth_socket_path = director-userdb } $ postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases canonical_maps = hash:/etc/postfix/canonical command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 html_directory = no inet_interfaces = all inet_protocols = all local_destination_concurrency_limit = 10 local_recipient_maps = ldap:/etc/postfix/ldap-local-recipients.cf proxy:unix:passwd.byname $alias_maps mail_owner = postfix mailbox_transport = lmtp:inet:localhost:24 mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 15000000 mydestination = ehu.es, mailsever.ehu.es, othermailserver.ehu.es mydomain = ehu.es myhostname = director1.ehu.es mynetworks_style = host myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES relayhost = [smtp.ehu.es] sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop unknown_local_recipient_reject_code = 550

3 4

Re: [Dovecot] doveadm director status username != doveadm director status username@mailserver
by Joseba Torre 17 Jul '12

17 Jul '12

El 17/07/12 13:34, Lee Standen escribió: > One thing that stands out to me is the lack of passdb. One of the > recommendations I got from the passdb documentation was to override the > user field, so the user is always logged in consistently. Without this, > "BOB", "bob" and "bob(a)mydomain.com <mailto:bob@mydomain.com>" might all > accept auth, but be handled differently! If you configure your passdb, > then you'll get some consistency, which will probably fix your director > problem. We don't use passdb in the directors because incoming mails have already been checked by postfix, and the final mail server need to check our ldap server for other values, so we check there. Actually, I still feel that I can override some ldap connections if I think about it carefully. Thank you. > > At the very least, you probably want to lowercase all your usernames. >

1 0

[Dovecot] different mail_max_userip settings
by Federico Bianchi 17 Jul '12

17 Jul '12

Is it possible to have mail_max_userip set to a value for localhost (webmail) and to another value for everything else? Best regards Federico Bianchi Dipartimento di Storia delle Arti Universita` di Pisa via Trieste, 38 - I-56126 Pisa (Italy) tel.(+39) 050 221 6 024; fax (+39) 050 221 6 001 e-mail: <f.bianchi(a)arte.unipi.it> =================================================== !DISCLAIMER!: my e-mail reflects _my_own_ opinions! ===================================================

3 3

[Dovecot] Seq-range order in sequence-set are matter?
by Lay András 17 Jul '12

17 Jul '12

Hi! I have a mailbox with 12 messages. Theese two commands: x fetch 5,8:12 (UID) * 5 FETCH (UID 10) * 8 FETCH (UID 13) * 9 FETCH (UID 14) * 10 FETCH (UID 15) * 11 FETCH (UID 16) * 12 FETCH (UID 17) x OK Fetch completed. and x fetch 8:12,5 (UID) * 5 FETCH (UID 10) * 8 FETCH (UID 13) * 9 FETCH (UID 14) * 10 FETCH (UID 15) * 11 FETCH (UID 16) * 12 FETCH (UID 17) x OK Fetch completed. outputs are equeal, this clean. But: x fetch 1:*,5 (UID) * 1 FETCH (UID 4) * 2 FETCH (UID 5) * 3 FETCH (UID 6) * 4 FETCH (UID 7) * 5 FETCH (UID 10) * 6 FETCH (UID 11) * 7 FETCH (UID 12) * 8 FETCH (UID 13) * 9 FETCH (UID 14) * 10 FETCH (UID 15) * 11 FETCH (UID 16) * 12 FETCH (UID 17) x OK Fetch completed. and x fetch 5,1:* (UID) * 5 FETCH (UID 10) * 6 FETCH (UID 11) * 7 FETCH (UID 12) * 8 FETCH (UID 13) * 9 FETCH (UID 14) * 10 FETCH (UID 15) * 11 FETCH (UID 16) * 12 FETCH (UID 17) x OK Fetch completed. command outputs are NOT equal? Why? Thank you! Lay

2 1