- dovecot - dovecot.org

[Dovecot] SSL Certificate Anomalies with latest code changes
by Thomas Leuxner 12 Apr '12

12 Apr '12

Some change between bf5ae73e9475 and 584bd77c38fd seems to have broken something in the SSL Handshake. A previously valid server certificate is deemed invalid by various mail clients. http://hg.dovecot.org/dovecot-2.1/rev/bf5ae73e9475 works fine while http://hg.dovecot.org/dovecot-2.1/rev/584bd77c38fd does not. Regards Thomas

2 7

[Dovecot] ldap idle connection timeout in DoveCot 1.0.13?
by Zhou, Yan 12 Apr '12

12 Apr '12

Hi there, We are using DoveCot 1.0.13, it connects to LDAP server for authentication. It seems that DoveCot keeps the idle LDAP connection open. Our firewall is terminating these connections after some time of idle activity (2 hours), then, we run into authentication problem. If we restart either LDAP or DoveCot, then it is fine. Can we set some kind of LDAP idle connection timeout in DoveCot? /etc/dovecot-ldap.conf. I do not see any configuration available for 1.0.13. Another alternative is to set idle connection timeout in LDAP, but we prefer doing that in DoveCot. Thanks, Yan Confidentiality Notice: The information contained in this electronic transmission is confidential and may be legally privileged. It is intended only for the addressee(s) named above. If you are not an intended recipient, be aware that any disclosure, copying, distribution or use of the information contained in this transmission is prohibited and may be unlawful. If you have received this transmission in error, please notify us by telephone (513) 229-5500 or by email (postmaster(a)MedPlus.com) After replying, please erase it from your computer system.

3 2

[Dovecot] lazy_expunge questions
by James Devine 11 Apr '12

11 Apr '12

I'm messing around with lazy expunge and I just had a couple of questions. If I delete messages or folders with messages, I see them being moved to the expunge namespace, but if I delete an empty folder, all traces of it seem to disappear. Is there a way to move empty folders to the expunge namespace also? My second question is in regards to restoring folders. If I try to execute the imap command 'RENAME EXPUNGED/TEST INBOX/TEST' I get 'NO [CANNOT] Can't rename mailboxes to/from expunge namespace'. Just wondering if this is possible or do I need to recreate the folder and then move messages into it.

2 3

[Dovecot] Bug tracker
by Timo Sirainen 11 Apr '12

11 Apr '12

I started thinking that perhaps I should move my TODO list to a bug tracker. But because of reasons I've explained a few times before, I don't want a full blown public bug tracking system. The requirements for it are: * I am the only person who can add new bugs. Everyone else reports bugs/requests to this mailing list as before. (Well, I guess Stephan could use this as well if he wants to.) * Everyone can comment existing bugs. * Dovecot mailing list integration: Commenting a bug sends a mail to the mailing list. Replies to those comments go back to bug tracker (probably based on some [#1234] tag in subject). I would have the option of adding a comment that doesn't go to the mailing list (= adding some internal comment that nobody else cares about). Notifications about new bugs won't go to the mailing list (most likely it was created due to a recent mailing list post). So the main difference to how things work now is that people would be able to easily browse existing bugs and add comments to them. I would add bugs there only when I'm not planning on fixing them within a few days. I wouldn't add each and every feature request there, only the things that I'm actually interested in developing. So the idea would be to actually get the bug tracker emptied at some point, not to be a graveyard of unimportant feature requests that about 1-2 people in the world would want. So, any suggestions for what software could do these things? I think Request Tracker has those features, but it's not really the nicest/prettiest thing.

9 15

[Dovecot] Proxy and SSO (single sign-on)
by Miguel Tormo 11 Apr '12

11 Apr '12

Hello, I have a running setup with a dovecot imap4/pop3 proxy to a few dovecot backend servers which actually store the mailboxes. This is running smoothly and allows me to transparently distribute mailboxes. I'm using some "extrafield" configured in the LDAP passdb. However, now I would like to use GSSAPI (preferred) and NTLM for single sign-on. Both are pretty straightforward to configure in a single instance environment, but I don't know if they would work with proxy. For example, with GSSAPI there are two cases: 1) Just use gssapi mechanism, without PAM. Then, it a user presents a ticket the passdb ldap is not used, so the extrafields are never read. 2) Use gssapi and PAM (thus allowing using a kerberos password). But the extrafields feature isn't available with PAM passdb driver, so again the proxy won't work. The case for NTLM would fall into the first case, I think. Am I right regarding this scenario? Is there a way I could make SSO and proxying work? I'm currently using dovecot 2.0.16 (had to patch it to increment LOGIN_MAX_INBUF_SIZE to 4096 for GSSAPI to work, as I read somewhere in this list), but I could upgrade to a newer version if that allows all this to work. Thanks!

2 3

Re: [Dovecot] Bug tracker
by interfaSys sàrl 11 Apr '12

11 Apr '12

I second that. New version 3.2 supports sub-projects, editions and components and is user-friendly. Cheers, Olivier > On Wed, Apr 11, 2012 at 09:26:20AM +0300, Timo Sirainen wrote: > > So, any suggestions for what software could do these things? I think > Request > Tracker has those features, but it's not really the nicest/prettiest > thing. > > May be worth to take a look at http://www.thebuggenie.com/. > > Thomas >

1 0

[Dovecot] Folder Aliases - Revisited Yet Again
by Daniel L. Miller 11 Apr '12

11 Apr '12

I just did a search through my archives - seems this topic has been requested a few times since my posting two years ago. I asked about a specific implementation - which Mr. Sirainen never commented on. He was probably focused on something more important at the time - like a paying job. So I'll ask again... Calling Timo! If we can't get clients to agree on a "standard" set of folders (probably reasonably safe assumption) and if protocol implementations of variations of "*LIST*" are too far in the future...what about having alternative folder names presented based on login name - maybe by an extension? So where my usual login might be "user(a)domain.com", and that would continue to be supported as the default login, I could now have "user(a)domain.com+thunderbird", "user(a)domain.com+mobile", etc.? And each of those extensions would then have a system-wide map defining folder name relationships, like "Sent=Sent Items". Does this seem doable? -- Daniel

2 4

[Dovecot] F5 SLB iRule - POP3 TLS Offload & Add Realm
by Lee Standen 11 Apr '12

11 Apr '12

Hey Guys, I figured someone might have use of this at some point. I've created an iRule for our F5 Load Balancer which performs the following tasks: - Appends STLS to the POP3 Capability list (it does this blindly, so expects the backend POP3 server to not return this) - Watches for the STLS command and initiates SSL negotiation with the client (leaves the connection to the backend POP3 server unencrypted) - Watches for the USER command (login attempt) and appends a realm if the user hasn't supplied one - Stops watching once a successful login occurs It's designed to be attached to port 110 and port 995 at the same time, and will disable SSL if the user is connecting to port 110 until the STLS command is issued. This is a first pass, so there's probably room for improvement, but it does seem to work. This will require LTM v10 (at least), as the SSL::collect command didn't exist prior to that version. Here's the rule: when CLIENT_ACCEPTED { if { [TCP::local_port clientside] == "110" } { # Disable SSL if we're on port 110 (as we're doing TLS Offload) set secure 0 SSL::disable } else { set secure 1 } set realm "mydomain.com" set debug 0 set loggedin 0 } when SERVER_CONNECTED { TCP::collect } when CLIENTSSL_HANDSHAKE { SSL::collect set secure 1 } when CLIENTSSL_DATA { if { $debug } { log local0. "CLIENT DATA: [SSL::payload]" } set lcpayload [string tolower [SSL::payload]] if { $lcpayload starts_with "user" } { scan [SSL::payload] {%s%s} command user set pos [string first $user [SSL::payload] 0] SSL::payload replace $pos [string length $user] "$user@$realm" if { $debug } { log local0. [SSL::payload] } } SSL::release if { $loggedin == 0 } { SSL::collect } } when CLIENT_DATA { if { $debug } { log local0. "CLIENT DATA: [TCP::payload]" } set lcpayload [string tolower [TCP::payload]] if { $lcpayload starts_with "stls" } { TCP::respond "+OK Begin TLS negotiation\r\n" TCP::payload replace 0 [TCP::payload length] "" TCP::release SSL::enable return } elseif { $lcpayload starts_with "user" } { scan [TCP::payload] {%s%s} command user set pos [string first $user [TCP::payload] 0] TCP::payload replace $pos [string length $user] "$user@$realm" if { $debug } { log local0. [TCP::payload] } } TCP::release if { $loggedin == 0 } { TCP::collect } } when SERVER_DATA { if { $debug } { log local0. "SERVER DATA: [TCP::payload]" } set lcpayload [string tolower [TCP::payload]] if { $lcpayload starts_with "+ok logged in" } { TCP::release set loggedin 1 event disable if { $debug } { log local0. "POP3 Login Successful" } return } elseif { $lcpayload contains "capa" } { TCP::payload replace [expr [TCP::payload length] - 3] 0 "STLS\r\n" } if { $secure == 1 && $loggedin == 0 } { clientside { SSL::collect } } elseif { $secure == 0 && $loggedin == 0 } { clientside { TCP::collect } } TCP::release if { $loggedin == 0 } { TCP::collect } }

1 0

[Dovecot] sieve replace dot string for foldername
by Robert Schetterer 11 Apr '12

11 Apr '12

Hi, i am playing about mail archive this is what allready works for me require ["variables","date","fileinto","mailbox","envelope","subaddress","regex"]; # Extract date info if currentdate :matches "year" "*" { set "year" "${1}"; } if currentdate :matches "month" "*" { set "month" "${1}"; } if currentdate :matches "day" "*" { set "day" "${1}"; } if envelope :detail :matches "to" "*" { set "to" "${1}"; } if true { fileinto :create "INBOX.${year}.${month}.${day}.${to}"; stop; } but ${to} may have a dot included, foldernames with dot are not allowed in my dove setup yet ( and i dont want to change it ) i am looking for a way ( guess regex ) for replace a dot in string replaced by a space char on the fly -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

2 2

[Dovecot] Username from rfc822Name subject alternative name
by Бранко Мај ић 11 Apr '12

11 Apr '12

Hello, I'm looking into adding support for extracting the username from client certificate's rfc822Name (from the subjectAltName extension). The question I have is what would be the best approach to do this? Current implementation has a kind of clean code since it just goes through the subject name, extracting the values with X509_NAME_get_text_by_NID (while NID is obtained with OBJ_txt2nid). If I were to add this, it's bound to make the code a little bit more complicated since SAN's can't be retrieved in the same way. So far in terms of options I have, I can see the following: 1. Create a distinct configuration option for the ssl_cert_username_field (i.e. specify something like "sanrfc822Name" to have Dovecot extract the username from the designated alternative name). 2. Make the current code fail-over to rfc822Name SAN if emailAddress is provided for ssl_cert_username (less invasion in code, but less flexibility as well). Any input/recommendation/directioning is welcome. I've wanted to actually first write a patch, and then submit it, but I think it might be better to check what would be preferable by Dovecot maintainers/devs. Best regards -- Branko Majic Jabber: branko(a)majic.rs Please use only Free formats when sending attachments to me. Бранко Мајић Џабер: branko(a)majic.rs Молим вас да додатке шаљете искључиво у слободним форматима.

3 3