- dovecot - dovecot.org

[Dovecot] LDAP w/SASL "Active Directory" authentication failing.
by David Varela 04 Nov '11

04 Nov '11

Hello, I am running a Dovecot server (version 1.2.17) on FreeBSD 8.2, using LDAP to authenticate Active Directory users. I can successfully bind and authenticate using PLAIN and LDAP without SASL, but obviously passwords for the bind user and the user being authenticated are being passed in plain text. I've attempted to configure my server to us SASL however when I attempt to authenticate a user I see authentication failures. I reviewed the security log on my domain controller and see that the bind user is binding properly, so the issue appears to be orginating from the user authentication, however I cannot determine what the issue is. Here is all the information regarding my configuration, along with the logs from the server: Dovecot -n # 1.2.17: /usr/local/etc/dovecot.conf # OS: FreeBSD 8.2-RELEASE i386 ufs log_path: /var/log/dovecot.log info_log_path: /var/log/dovecot_info.log protocols: imap pop3 imaps pop3s ssl_cert_file: /etc/ssl/dovecot/cert.pem ssl_key_file: /etc/ssl//dovecot/key.pem login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login valid_chroot_dirs: /usr/data/vmail verbose_proctitle: yes first_valid_uid: 1001 last_valid_uid: 1001 first_valid_gid: 1001 last_valid_gid: 1001 mail_privileged_group: mail mail_location: maildir:/usr/data/vmail/%u mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh lda: sendmail_path: /usr/sbin/sendmail auth default: mechanisms: plain gssapi ntlm login username_format: %Ln winbind_helper_path: /usr/local/bin/ntlm_auth verbose: yes debug: yes debug_passwords: yes use_winbind: yes passdb: driver: ldap args: /usr/local/etc/dovecot-ldap.conf userdb: driver: static args: uid=vmail gid=vmail home=/usr/data/vmail/%u socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 dovecot-ldap.conf hosts = 192.168.0.240:3268 dn = cn=PostfixBind,ou=IT,ou=Central Office,ou=LMC,dc=smallmountain,dc=Local dnpass = y0urm0mma sasl_bind = yes #sasl_mech = GSSAPI #sasl_realm = smallmountain.local #sasl_authz_id = debug_level = -1 #auth_bind = yes ldap_version = 3 base = dc=smallmountain,dc=Local deref = never scope = subtree user_filter = (&(objectClass=person)(mail=%u)) pass_attrs = mail=user pass_filter = (&(objectClass=person)(sAMAccountName=%n)) dovecot.log Nov 01 09:09:48 dovecot: Warning: Killed with signal 15 (by pid=99758 uid=0 code=kill) Nov 01 09:09:48 auth(default): Error: ldap_pvt_sasl_getmech Nov 01 09:09:48 auth(default): Error: ldap_search Nov 01 09:09:48 auth(default): Error: put_filter: "(objectclass=*)" Nov 01 09:09:48 auth(default): Error: put_filter: simple Nov 01 09:09:48 auth(default): Error: put_simple_filter: "objectclass=*" Nov 01 09:09:48 auth(default): Error: ldap_build_search_req ATTRS: supportedSASLMechanisms Nov 01 09:09:48 auth(default): Error: ldap_send_initial_request Nov 01 09:09:48 auth(default): Error: ldap_new_connection 1 1 0 Nov 01 09:09:48 auth(default): Error: ldap_int_open_connection Nov 01 09:09:48 auth(default): Error: ldap_connect_to_host: TCP 192.168.0.240:3268 Nov 01 09:09:48 auth(default): Error: ldap_new_socket: 11 Nov 01 09:09:48 auth(default): Error: ldap_prepare_socket: 11 Nov 01 09:09:48 auth(default): Error: ldap_connect_to_host: Trying 192.168.0.240:3268 Nov 01 09:09:48 auth(default): Error: ldap_pvt_connect: fd: 11 tm: -1 async: 0 Nov 01 09:09:48 auth(default): Error: ldap_open_defconn: successful Nov 01 09:09:48 auth(default): Error: ldap_send_server_request Nov 01 09:09:48 auth(default): Error: ldap_result ld 0x18611700 msgid 1 Nov 01 09:09:48 auth(default): Error: wait4msg ld 0x18611700 msgid 1 (infinite timeout) Nov 01 09:09:48 auth(default): Error: wait4msg continue ld 0x18611700 msgid 1 all 1 Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:09:48 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:09:48 auth(default): Error: refcnt: 2 status: Connected Nov 01 09:09:48 auth(default): Error: last used: Tue Nov 1 09:09:48 2011 Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:09:48 auth(default): Error: * msgid 1, origid 1, status InProgress Nov 01 09:09:48 auth(default): Error: outstanding referrals 0, parent count 0 Nov 01 09:09:48 auth(default): Error: ld 0x18611700 request count 1 (abandoned 0) Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:09:48 auth(default): Error: Empty Nov 01 09:09:48 auth(default): Error: ld 0x18611700 response count 0 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid 1 all 1 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:09:48 auth(default): Error: ldap_int_select Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 1 all 1 Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 1 message type search-entry Nov 01 09:09:48 auth(default): Error: wait4msg continue ld 0x18611700 msgid 1 all 1 Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:09:48 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:09:48 auth(default): Error: refcnt: 2 status: Connected Nov 01 09:09:48 auth(default): Error: last used: Tue Nov 1 09:09:48 2011 Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:09:48 auth(default): Error: * msgid 1, origid 1, status InProgress Nov 01 09:09:48 auth(default): Error: outstanding referrals 0, parent count 0 Nov 01 09:09:48 auth(default): Error: ld 0x18611700 request count 1 (abandoned 0) Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:09:48 auth(default): Error: * msgid 1, type 100 Nov 01 09:09:48 auth(default): Error: ld 0x18611700 response count 1 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid 1 all 1 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:09:48 auth(default): Error: ldap_int_select Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 1 all 1 Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 1 message type search-result Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 0 new referrals Nov 01 09:09:48 auth(default): Error: read1msg: mark request completed, ld 0x18611700 msgid 1 Nov 01 09:09:48 auth(default): Error: request done: ld 0x18611700 msgid 1 Nov 01 09:09:48 auth(default): Error: res_errno: 0, res_error: <>, res_matched: <> Nov 01 09:09:48 auth(default): Error: ldap_free_request (origid 1, msgid 1) Nov 01 09:09:48 auth(default): Error: adding response ld 0x18611700 msgid 1 type 101: Nov 01 09:09:48 auth(default): Error: ldap_parse_result Nov 01 09:09:48 auth(default): Error: ldap_get_values Nov 01 09:09:48 auth(default): Error: ldap_msgfree Nov 01 09:09:48 auth(default): Error: ldap_sasl_interactive_bind: server supports: GSSAPI GSS-SPNEGO EXTERNAL DIGEST-MD5 Nov 01 09:09:48 auth(default): Error: ldap_int_sasl_bind: GSSAPI GSS-SPNEGO EXTERNAL DIGEST-MD5 Nov 01 09:09:48 auth(default): Error: ldap_int_sasl_open: host=adminserver-1.smallmountain.local Nov 01 09:09:48 auth(default): Error: ldap_sasl_bind Nov 01 09:09:48 auth(default): Error: ldap_send_initial_request Nov 01 09:09:48 auth(default): Error: ldap_send_server_request Nov 01 09:09:48 auth(default): Error: ldap_msgfree Nov 01 09:09:48 auth(default): Error: ldap_result ld 0x18611700 msgid 2 Nov 01 09:09:48 auth(default): Error: wait4msg ld 0x18611700 msgid 2 (infinite timeout) Nov 01 09:09:48 auth(default): Error: wait4msg continue ld 0x18611700 msgid 2 all 1 Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:09:48 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:09:48 auth(default): Error: refcnt: 2 status: Connected Nov 01 09:09:48 auth(default): Error: last used: Tue Nov 1 09:09:48 2011 Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:09:48 auth(default): Error: * msgid 2, origid 2, status InProgress Nov 01 09:09:48 auth(default): Error: outstanding referrals 0, parent count 0 Nov 01 09:09:48 auth(default): Error: ld 0x18611700 request count 1 (abandoned 0) Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:09:48 auth(default): Error: Empty Nov 01 09:09:48 auth(default): Error: ld 0x18611700 response count 0 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid 2 all 1 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:09:48 auth(default): Error: ldap_int_select Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 2 all 1 Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 2 message type bind Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 0 new referrals Nov 01 09:09:48 auth(default): Error: read1msg: mark request completed, ld 0x18611700 msgid 2 Nov 01 09:09:48 auth(default): Error: request done: ld 0x18611700 msgid 2 Nov 01 09:09:48 auth(default): Error: res_errno: 14, res_error: <>, res_matched: <> Nov 01 09:09:48 auth(default): Error: ldap_free_request (origid 2, msgid 2) Nov 01 09:09:48 auth(default): Error: ldap_int_sasl_bind: <null> Nov 01 09:09:48 auth(default): Error: ldap_parse_sasl_bind_result Nov 01 09:09:48 auth(default): Error: ldap_parse_result Nov 01 09:09:48 auth(default): Error: sasl_client_step: 2 Nov 01 09:09:48 auth(default): Error: sasl_client_step: 1 Nov 01 09:09:48 auth(default): Error: ldap_sasl_bind Nov 01 09:09:48 auth(default): Error: ldap_send_initial_request Nov 01 09:09:48 auth(default): Error: ldap_send_server_request Nov 01 09:09:48 auth(default): Error: ldap_msgfree Nov 01 09:09:48 auth(default): Error: ldap_result ld 0x18611700 msgid 3 Nov 01 09:09:48 auth(default): Error: wait4msg ld 0x18611700 msgid 3 (infinite timeout) Nov 01 09:09:48 auth(default): Error: wait4msg continue ld 0x18611700 msgid 3 all 1 Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:09:48 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:09:48 auth(default): Error: refcnt: 2 status: Connected Nov 01 09:09:48 auth(default): Error: last used: Tue Nov 1 09:09:48 2011 Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:09:48 auth(default): Error: * msgid 3, origid 3, status InProgress Nov 01 09:09:48 auth(default): Error: outstanding referrals 0, parent count 0 Nov 01 09:09:48 auth(default): Error: ld 0x18611700 request count 1 (abandoned 0) Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:09:48 auth(default): Error: Empty Nov 01 09:09:48 auth(default): Error: ld 0x18611700 response count 0 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid 3 all 1 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:09:48 auth(default): Error: ldap_int_select Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 3 all 1 Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 3 message type bind Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 0 new referrals Nov 01 09:09:48 auth(default): Error: read1msg: mark request completed, ld 0x18611700 msgid 3 Nov 01 09:09:48 auth(default): Error: request done: ld 0x18611700 msgid 3 Nov 01 09:09:48 auth(default): Error: res_errno: 14, res_error: <>, res_matched: <> Nov 01 09:09:48 auth(default): Error: ldap_free_request (origid 3, msgid 3) Nov 01 09:09:48 auth(default): Error: ldap_int_sasl_bind: <null> Nov 01 09:09:48 auth(default): Error: ldap_parse_sasl_bind_result Nov 01 09:09:48 auth(default): Error: ldap_parse_result Nov 01 09:09:48 auth(default): Error: sasl_client_step: 0 Nov 01 09:09:48 auth(default): Error: ldap_sasl_bind Nov 01 09:09:48 auth(default): Error: ldap_send_initial_request Nov 01 09:09:48 auth(default): Error: ldap_send_server_request Nov 01 09:09:48 auth(default): Error: ldap_msgfree Nov 01 09:09:48 auth(default): Error: ldap_result ld 0x18611700 msgid 4 Nov 01 09:09:48 auth(default): Error: wait4msg ld 0x18611700 msgid 4 (infinite timeout) Nov 01 09:09:48 auth(default): Error: wait4msg continue ld 0x18611700 msgid 4 all 1 Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:09:48 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:09:48 auth(default): Error: refcnt: 2 status: Connected Nov 01 09:09:48 auth(default): Error: last used: Tue Nov 1 09:09:48 2011 Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:09:48 auth(default): Error: * msgid 4, origid 4, status InProgress Nov 01 09:09:48 auth(default): Error: outstanding referrals 0, parent count 0 Nov 01 09:09:48 auth(default): Error: ld 0x18611700 request count 1 (abandoned 0) Nov 01 09:09:48 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:09:48 auth(default): Error: Empty Nov 01 09:09:48 auth(default): Error: ld 0x18611700 response count 0 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid 4 all 1 Nov 01 09:09:48 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:09:48 auth(default): Error: ldap_int_select Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 4 all 1 Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 msgid 4 message type bind Nov 01 09:09:48 auth(default): Error: read1msg: ld 0x18611700 0 new referrals Nov 01 09:09:48 auth(default): Error: read1msg: mark request completed, ld 0x18611700 msgid 4 Nov 01 09:09:48 auth(default): Error: request done: ld 0x18611700 msgid 4 Nov 01 09:09:48 auth(default): Error: res_errno: 0, res_error: <>, res_matched: <> Nov 01 09:09:48 auth(default): Error: ldap_free_request (origid 4, msgid 4) Nov 01 09:09:48 auth(default): Error: ldap_int_sasl_bind: <null> Nov 01 09:09:48 auth(default): Error: ldap_parse_sasl_bind_result Nov 01 09:09:48 auth(default): Error: ldap_parse_result Nov 01 09:09:48 auth(default): Error: ldap_pvt_sasl_generic_install Nov 01 09:09:48 auth(default): Error: ldap_msgfree Nov 01 09:10:13 auth(default): Error: ldap_search Nov 01 09:10:13 auth(default): Error: put_filter: "(&(objectClass=person)(sAMAccountName=davidv))" Nov 01 09:10:13 auth(default): Error: put_filter: AND Nov 01 09:10:13 auth(default): Error: put_filter_list "(objectClass=person)(sAMAccountName=davidv)" Nov 01 09:10:13 auth(default): Error: put_filter: "(objectClass=person)" Nov 01 09:10:13 auth(default): Error: put_filter: simple Nov 01 09:10:13 auth(default): Error: put_simple_filter: "objectClass=person" Nov 01 09:10:13 auth(default): Error: put_filter: "(sAMAccountName=davidv)" Nov 01 09:10:13 auth(default): Error: put_filter: simple Nov 01 09:10:13 auth(default): Error: put_simple_filter: "sAMAccountName=davidv" Nov 01 09:10:13 auth(default): Error: ldap_build_search_req ATTRS: mail Nov 01 09:10:13 auth(default): Error: ldap_send_initial_request Nov 01 09:10:13 auth(default): Error: ldap_send_server_request Nov 01 09:10:13 auth(default): Error: ldap_result ld 0x18611700 msgid -1 Nov 01 09:10:13 auth(default): Error: wait4msg ld 0x18611700 msgid -1 (timeout 0 usec) Nov 01 09:10:13 auth(default): Error: wait4msg continue ld 0x18611700 msgid -1 all 1 Nov 01 09:10:13 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:10:13 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:10:13 auth(default): Error: refcnt: 2 status: Connected Nov 01 09:10:13 auth(default): Error: last used: Tue Nov 1 09:10:13 2011 Nov 01 09:10:13 auth(default): Error: Nov 01 09:10:13 auth(default): Error: Nov 01 09:10:13 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:10:13 auth(default): Error: * msgid 5, origid 5, status InProgress Nov 01 09:10:13 auth(default): Error: outstanding referrals 0, parent count 0 Nov 01 09:10:13 auth(default): Error: ld 0x18611700 request count 1 (abandoned 0) Nov 01 09:10:13 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:10:13 auth(default): Error: Empty Nov 01 09:10:13 auth(default): Error: ld 0x18611700 response count 0 Nov 01 09:10:13 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid -1 all 1 Nov 01 09:10:13 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:10:13 auth(default): Error: ldap_int_select Nov 01 09:10:13 auth(default): Error: read1msg: ld 0x18611700 msgid -1 all 1 Nov 01 09:10:13 auth(default): Error: read1msg: ld 0x18611700 msgid 5 message type search-entry Nov 01 09:10:13 auth(default): Error: read1msg: ld 0x18611700 msgid 5 message type search-result Nov 01 09:10:13 auth(default): Error: read1msg: ld 0x18611700 0 new referrals Nov 01 09:10:13 auth(default): Error: read1msg: mark request completed, ld 0x18611700 msgid 5 Nov 01 09:10:13 auth(default): Error: request done: ld 0x18611700 msgid 5 Nov 01 09:10:13 auth(default): Error: res_errno: 0, res_error: <>, res_matched: <> Nov 01 09:10:13 auth(default): Error: ldap_free_request (origid 5, msgid 5) Nov 01 09:10:13 auth(default): Error: adding response ld 0x18611700 msgid 5 type 101: Nov 01 09:10:13 auth(default): Error: ldap_parse_result Nov 01 09:10:13 auth(default): Error: ldap_first_attribute Nov 01 09:10:13 auth(default): Error: ldap_get_values Nov 01 09:10:13 auth(default): Error: ldap_next_attribute Nov 01 09:10:13 auth(default): Error: ldap_msgfree Nov 01 09:10:13 auth(default): Error: ldap_result ld 0x18611700 msgid -1 Nov 01 09:10:13 auth(default): Error: wait4msg ld 0x18611700 msgid -1 (timeout 0 usec) Nov 01 09:10:13 auth(default): Error: wait4msg continue ld 0x18611700 msgid -1 all 1 Nov 01 09:10:13 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:10:13 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:10:13 auth(default): Error: refcnt: 1 status: Connected Nov 01 09:10:13 auth(default): Error: last used: Tue Nov 1 09:10:13 2011 Nov 01 09:10:13 auth(default): Error: Nov 01 09:10:13 auth(default): Error: Nov 01 09:10:13 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:10:13 auth(default): Error: Empty Nov 01 09:10:13 auth(default): Error: ld 0x18611700 request count 0 (abandoned 0) Nov 01 09:10:13 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:10:13 auth(default): Error: Empty Nov 01 09:10:13 auth(default): Error: ld 0x18611700 response count 0 Nov 01 09:10:13 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid -1 all 1 Nov 01 09:10:13 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:10:13 auth(default): Error: ldap_int_select Nov 01 09:13:26 auth(default): Error: ldap_search Nov 01 09:13:26 auth(default): Error: put_filter: "(&(objectClass=person)(sAMAccountName=davidv))" Nov 01 09:13:26 auth(default): Error: put_filter: AND Nov 01 09:13:26 auth(default): Error: put_filter_list "(objectClass=person)(sAMAccountName=davidv)" Nov 01 09:13:26 auth(default): Error: put_filter: "(objectClass=person)" Nov 01 09:13:26 auth(default): Error: put_filter: simple Nov 01 09:13:26 auth(default): Error: put_simple_filter: "objectClass=person" Nov 01 09:13:26 auth(default): Error: put_filter: "(sAMAccountName=davidv)" Nov 01 09:13:26 auth(default): Error: put_filter: simple Nov 01 09:13:26 auth(default): Error: put_simple_filter: "sAMAccountName=davidv" Nov 01 09:13:26 auth(default): Error: ldap_build_search_req ATTRS: mail Nov 01 09:13:26 auth(default): Error: ldap_send_initial_request Nov 01 09:13:26 auth(default): Error: ldap_send_server_request Nov 01 09:13:26 auth(default): Error: ldap_result ld 0x18611700 msgid -1 Nov 01 09:13:26 auth(default): Error: wait4msg ld 0x18611700 msgid -1 (timeout 0 usec) Nov 01 09:13:26 auth(default): Error: wait4msg continue ld 0x18611700 msgid -1 all 1 Nov 01 09:13:26 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:13:26 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:13:26 auth(default): Error: refcnt: 2 status: Connected Nov 01 09:13:26 auth(default): Error: last used: Tue Nov 1 09:13:26 2011 Nov 01 09:13:26 auth(default): Error: Nov 01 09:13:26 auth(default): Error: Nov 01 09:13:26 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:13:26 auth(default): Error: * msgid 6, origid 6, status InProgress Nov 01 09:13:26 auth(default): Error: outstanding referrals 0, parent count 0 Nov 01 09:13:26 auth(default): Error: ld 0x18611700 request count 1 (abandoned 0) Nov 01 09:13:26 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:13:26 auth(default): Error: Empty Nov 01 09:13:26 auth(default): Error: ld 0x18611700 response count 0 Nov 01 09:13:26 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid -1 all 1 Nov 01 09:13:26 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:13:26 auth(default): Error: ldap_int_select Nov 01 09:13:26 auth(default): Error: read1msg: ld 0x18611700 msgid -1 all 1 Nov 01 09:13:26 auth(default): Error: read1msg: ld 0x18611700 msgid 6 message type search-entry Nov 01 09:13:26 auth(default): Error: read1msg: ld 0x18611700 msgid 6 message type search-result Nov 01 09:13:26 auth(default): Error: read1msg: ld 0x18611700 0 new referrals Nov 01 09:13:26 auth(default): Error: read1msg: mark request completed, ld 0x18611700 msgid 6 Nov 01 09:13:26 auth(default): Error: request done: ld 0x18611700 msgid 6 Nov 01 09:13:26 auth(default): Error: res_errno: 0, res_error: <>, res_matched: <> Nov 01 09:13:26 auth(default): Error: ldap_free_request (origid 6, msgid 6) Nov 01 09:13:26 auth(default): Error: adding response ld 0x18611700 msgid 6 type 101: Nov 01 09:13:26 auth(default): Error: ldap_parse_result Nov 01 09:13:26 auth(default): Error: ldap_first_attribute Nov 01 09:13:26 auth(default): Error: ldap_get_values Nov 01 09:13:26 auth(default): Error: ldap_next_attribute Nov 01 09:13:26 auth(default): Error: ldap_msgfree Nov 01 09:13:26 auth(default): Error: ldap_result ld 0x18611700 msgid -1 Nov 01 09:13:26 auth(default): Error: wait4msg ld 0x18611700 msgid -1 (timeout 0 usec) Nov 01 09:13:26 auth(default): Error: wait4msg continue ld 0x18611700 msgid -1 all 1 Nov 01 09:13:26 auth(default): Error: ** ld 0x18611700 Connections: Nov 01 09:13:26 auth(default): Error: * host: 192.168.0.240 port: 3268 (default) Nov 01 09:13:26 auth(default): Error: refcnt: 1 status: Connected Nov 01 09:13:26 auth(default): Error: last used: Tue Nov 1 09:13:26 2011 Nov 01 09:13:26 auth(default): Error: Nov 01 09:13:26 auth(default): Error: Nov 01 09:13:26 auth(default): Error: ** ld 0x18611700 Outstanding Requests: Nov 01 09:13:26 auth(default): Error: Empty Nov 01 09:13:26 auth(default): Error: ld 0x18611700 request count 0 (abandoned 0) Nov 01 09:13:26 auth(default): Error: ** ld 0x18611700 Response Queue: Nov 01 09:13:26 auth(default): Error: Empty Nov 01 09:13:26 auth(default): Error: ld 0x18611700 response count 0 Nov 01 09:13:26 auth(default): Error: ldap_chkResponseList ld 0x18611700 msgid -1 all 1 Nov 01 09:13:26 auth(default): Error: ldap_chkResponseList returns ld 0x18611700 NULL Nov 01 09:13:26 auth(default): Error: ldap_int_select dovecot_info.log Nov 01 09:09:48 dovecot: Info: Dovecot v1.2.17 starting up Nov 01 09:09:49 auth(default): Info: new auth connection: pid=99773 Nov 01 09:09:49 auth(default): Info: new auth connection: pid=99774 Nov 01 09:09:49 auth(default): Info: new auth connection: pid=99775 Nov 01 09:09:49 auth(default): Info: new auth connection: pid=99776 Nov 01 09:09:49 auth(default): Info: new auth connection: pid=99777 Nov 01 09:09:49 auth(default): Info: new auth connection: pid=99778 Nov 01 09:10:09 auth(default): Info: new auth connection: pid=99782 Nov 01 09:10:13 auth(default): Info: client in: AUTH 1 PLAIN service=imap secured lip=127.0.0.1 rip=127.0.0.1 lport=993 rport=55010 resp=AGRhdmlkdgBlbGkqNDJ0dW4= Nov 01 09:10:13 auth(default): Info: ldap(davidv,127.0.0.1): pass search: base=dc=smallmountain,dc=Local scope=subtree filter=(&(objectClass=person)(sAMAccountName=davidv)) fields=mail Nov 01 09:10:13 auth(default): Info: auth(davidv,127.0.0.1): username changed davidv -> davidv(a)smallmountain.net Nov 01 09:10:13 auth(default): Info: ldap(davidv(a)smallmountain.net,127.0.0.1): result: mail(user)=davidv(a)smallmountain.net Nov 01 09:10:13 auth(default): Info: ldap(davidv(a)smallmountain.net,127.0.0.1): No password returned (and no nopassword) Nov 01 09:10:15 auth(default): Info: client out: FAIL 1 user=davidv(a)smallmountain.net Nov 01 09:13:13 imap-login: Info: Disconnected: Inactivity (auth failed, 1 attempts): user=<davidv(a)smallmountain.net>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Nov 01 09:13:21 auth(default): Info: new auth connection: pid=99797 Nov 01 09:13:26 auth(default): Info: client in: AUTH 1 PLAIN service=imap secured lip=127.0.0.1 rip=127.0.0.1 lport=993 rport=61080 resp=AGRhdmlkdgBlbGkqNDJ0dW4= Nov 01 09:13:26 auth(default): Info: ldap(davidv,127.0.0.1): pass search: base=dc=smallmountain,dc=Local scope=subtree filter=(&(objectClass=person)(sAMAccountName=davidv)) fields=mail Nov 01 09:13:26 auth(default): Info: auth(davidv,127.0.0.1): username changed davidv -> davidv(a)smallmountain.net Nov 01 09:13:26 auth(default): Info: ldap(davidv(a)smallmountain.net,127.0.0.1): result: mail(user)=davidv(a)smallmountain.net Nov 01 09:13:26 auth(default): Info: ldap(davidv(a)smallmountain.net,127.0.0.1): No password returned (and no nopassword) Nov 01 09:13:28 auth(default): Info: client out: FAIL 1 user=davidv(a)smallmountain.net Nov 01 09:13:36 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<davidv(a)smallmountain.net>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Your assistance is greatly appreciated, David

2 1

[Dovecot] post login script
by Osvaldo Alvarez Pozo 04 Nov '11

04 Nov '11

Hello all, I am testing postlogin script with dovecot 2. I works but i would like that the imap and pop session get executed even if the post-login script fail. my postlogin script is very simple: #/etc/dovecot/conf.d/10-master.conf service imap { executable = imap imap-postlogin } # service imap-postlogin { executable = script-login /usr/local/bin/postlogin.sh unix_listener imap-postlogin { } } service pop3 { executable = pop3 imap-postlogin } #/usr/local/bin/postlogin.sh echo "UPDATE mailbox SET last_login = now() WHERE username = '$USER'" | mysql -upostlogin -pXXXXXXXX postfixadmin exec "$@" Thanks in advance Osvaldo

3 4

[Dovecot] What owner/permissions for virtual homes?
by sean darcy 04 Nov '11

04 Nov '11

VirtualUsers.Home.txt: The directory layouts for home and mail directories could look like one of these (in the preferred order): 1. Mail directory under home, for example: home='/var/vmail/domain/user/' mail='/var/vmail/domain/user/mail/' Who should be the owner of these directories, with that permissions? Does it make a difference if it's /home/vmail rather than /var/vmail? Thanks, Jay

2 2

[Dovecot] doveadm 'proxy list' or 'who' not working ?
by de Lafond Guillaume 04 Nov '11

04 Nov '11

Hi, I switched from dovecot 1.2.* to 2.0.* for a mail proxy. I try to play with the new cool utility doveadm, but I don't manage to get results from it. # /usr/local/dovecot-2.0.15/bin/doveadm proxy list username proto src ip dest ip port # As 'proxy list' does not return anything, I tried with 'who' # /usr/local/dovecot-2.0.15/bin/doveadm who -a /var/run/dovecot-socket-auth/anvil username # proto (pids) (ips) # I think it should display something as I have many user connected : #ps axww | grep imap ... 21194 ? S 0:11 dovecot/imap-login [13 connections (8 TLS)] 21195 ? S 3:38 dovecot/imap-login [47 connections (38 TLS)] 29463 ? S 1:00 dovecot/imap-login [210 connections (183 TLS)] ... I should have something that is not well configured.. but I don't manage to find it. Does anybody have an idea where I should look to solve this ? Here is my dovecot.conf : # /usr/local/dovecot-2.0.15/bin/doveadm config # 2.0.15: /usr/local/dovecot-2.0.15/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 auth_anonymous_username = anonymous auth_cache_negative_ttl = 0 auth_cache_size = 1 k auth_cache_ttl = 15 mins auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_first_valid_uid = 500 auth_gssapi_hostname = auth_krb5_keytab = auth_last_valid_uid = 0 auth_master_user_separator = auth_mechanisms = plain login apop cram-md5 auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /var/run/dovecot-proxy config_cache_size = 1 M debug_log_path = default_client_limit = 1000 default_idle_kill = 60 default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_doveadm_port = 0 director_mail_servers = director_servers = director_user_expire = 15 mins disable_plaintext_auth = no dotlock_use_excl = yes doveadm_allowed_commands = doveadm_password = doveadm_proxy_port = 0 doveadm_socket_path = doveadm-server doveadm_worker_count = 0 first_valid_gid = 1 first_valid_uid = 89 hostname = imap_capability = imap_client_workarounds = imap_id_log = imap_id_send = imap_idle_notify_interval = 2 mins imap_logout_format = bytes=%i/%o imap_max_line_length = 64 k import_environment = TZ info_log_path = /var/log/mail/dovecot_info-proxy.log last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_original_recipient_header = libexec_dir = /usr/local/dovecot-2.0.15/libexec/dovecot listen = * lmtp_proxy = no lmtp_save_to_detail_mailbox = no lock_method = fcntl log_path = /var/log/mail/dovecot-proxy.log log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Proxy POP/IMAP login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c login_trusted_networks = mail_access_groups = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = mail_log_prefix = "%s(%u): " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/local/dovecot-2.0.15/lib/dovecot mail_plugins = mail_privileged_group = mail_save_crlf = no mail_temp_dir = /tmp mail_uid = mailbox_idle_check_interval = 30 secs mailbox_list_index_disable = no maildir_copy_with_hardlinks = yes maildir_stat_dirs = no maildir_very_dirty_syncs = no master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = dotlock fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 2 M mmap_disable = yes namespace { hidden = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace { hidden = yes inbox = no list = no location = prefix = INBOX/ separator = / subscriptions = yes type = private } passdb { args = /usr/local/dovecot/etc/dovecot-sql-proxy.conf deny = no driver = sql master = no pass = no } plugin { quota = maildir } pop3_client_workarounds = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_format = %08Xu%08Xv postmaster_address = protocols = imap pop3 quota_full_tempfail = no recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s sendmail_path = /usr/sbin/sendmail service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 4096 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0600 user = } unix_listener login/login { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns_client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 256 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = * port = 143 ssl = no } inet_listener imaps { address = * port = 993 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 20 protocol = imap service_count = 0 type = login user = mail vsz_limit = 64 M } service imap { chroot = client_limit = 1 drop_priv_before_exec = yes executable = imap extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 256 M } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 0 drop_priv_before_exec = no executable = lmtp extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 0 } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log user = vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 256 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = * port = 110 ssl = no } inet_listener pop3s { address = * port = 995 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 20 protocol = pop3 service_count = 0 type = login user = mail vsz_limit = 64 M } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = yes executable = pop3 extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 256 M } service ssl-params { chroot = client_limit = 0 drop_priv_before_exec = no executable = ssl-params extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = startup unix_listener login/ssl-params { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_ca = </etc/ssl/certificat_2011/ssl.inter.crt ssl_cert = </etc/ssl/certificat_2011/ssl.crt ssl_cert_username_field = commonName ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_key = </etc/ssl/certificat_2011/ssl.key ssl_key_password = ssl_parameters_regenerate = 168 ssl_verify_client_cert = no submission_host = syslog_facility = mail userdb { args = uid=0 gid=0 driver = static } valid_chroot_dirs = verbose_auth = no verbose_proctitle = yes verbose_ssl = no version_ignore = no protocol imap { imap_client_workarounds = delay-newmail mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %f } -- de Lafond Guillaume

2 1

[Dovecot] POP server migration and duplicate messages.
by Ernie Dunbar 04 Nov '11

04 Nov '11

I'm having trouble with Dovecot where my mail client (if it matters, I'm using Evolution) collects some duplicate messages when switching between POP servers that have the same messages on them. I'm doing this as a test for server migration for all of our clients. Here's my procedure: 1. set up Dovecot and Exim on the new server so that everything works like on the old server. The old server also uses Dovecot and Exim, so very few things changed. 2. On the new server, use NFS to access the users' Maildirs on a remote NFS server. 3. Sync the Maildirs on the NFS store from the old server with SCP (and I do a quick SCP sync on my own Maildir during testing to ensure that this process is quick). 4. Check mail in Evolution on the old server. 5. Change Evolution's server settings to use the new server. 6. Check mail again. Evolution is set to keep messages on the server for one week, and about 20 of the 184 messages on the server keep getting re-downloaded. From a random sampling, the UIDL of the messages checks out between both servers, so I really don't understand what's going on here. If this is just a bug in Evolution, then that means I can just go ahead with the full migration and hope that people aren't going to be stuck with re-downloading their entire mailbox which in some cases, means hundreds or thousands of messages.

2 1

[Dovecot] GSSAPI and deny=yes passdb
by Sergey Urushkin 04 Nov '11

04 Nov '11

Hi. Is it possible to use GSSAPI authentication and deny passdb together? Seems it doesn't work as I expect: GSSAPI doesn't check deny passdb, so I'm not able to restrict access to GSSAPI-users. I can see these in logs when user tries to connect with PLAIN authentication (via pam_krb5): Oct 4 11:14:31 vm03 auth: Debug: passwd-file(testuser,172.17.0.123): lookup: user=testuser file=/etc/dovecot/auth.d/.passwd-deny Oct 4 11:14:31 vm03 dovecot: auth: passdb(tesetuser,172.17.0.123): User found from deny passdb But that's what I see if user logs in with GSSAPI: ... Oct 4 11:21:38 vm03 dovecot: auth: Debug: gssapi(testuser(a)REALM.LAN,172.17.0.123): Negotiated security layer Oct 4 11:21:38 vm03 dovecot: auth: Debug: client out: CONT#0111#011BQQF/wAMAAAAAAAAKSUwaQH///+3JRmZMw01WMX+CHM= Oct 4 11:21:38 vm03 dovecot: auth: Debug: client in: CONT<hidden> Oct 4 11:21:38 vm03 dovecot: auth: Debug: client out: OK#0111#011user=testuser Oct 4 11:21:38 vm03 dovecot: auth: Debug: passwd-file(testuser,172.17.0.123): lookup: user=testuser file=/etc/dovecot/auth.d/.passwd-ldap Oct 4 11:21:38 vm03 dovecot: auth: Debug: master out: USER#0111632763905#011testuser#011home=/var/mail/realm.lan/testuser Oct 4 11:21:38 vm03 dovecot: imap-login: Login: user=<testuser>, method=GSSAPI, rip=172.17.0.123, lip=172.25.0.35, mpid=1085 Here is my auth configuration: auth_mechanisms = plain login apop gssapi # Kerberos auth_realms = REALM.LAN auth_gssapi_hostname = vm03.realm.lan auth_krb5_keytab = /etc/dovecot/dovecot.keytab ###### # PASSDB # Denied users passdb { driver = passwd-file deny = yes args = username_format=%n /etc/dovecot/auth.d/%d.passwd-deny } # Internal manual passwd-file passdb { driver = passwd-file args = scheme=CRAM-MD5 username_format=%n /etc/dovecot/auth.d/%d.passwd # override_fields = allow_nets=127.0.0.0/8,172.16.0.0/12 } # External passwd-file passdb { driver = passwd-file args = scheme=CRAM-MD5 username_format=%n /etc/dovecot/auth.d/%d.passwd-ext } # Internal kerberos pam passdb { driver = pam args = max_requests=100 cache_key=%u%r dovecot # override_fields = allow_nets=127.0.0.0/8,172.16.0.0/12 } ###### #USERDB # Manual passwd-file userdb { driver = passwd-file args = username_format=%n /etc/dovecot/auth.d/%d.passwd # default_fields = home=/var/mail/%d/%n } # External passwd-file userdb { driver = passwd-file args = username_format=%n /etc/dovecot/auth.d/%d.passwd-ext # default_fields = home=/var/mail/%d/%n } # Automatic passwd-file, imported from LDAP. UserDB only userdb { driver = passwd-file args = username_format=%n /etc/dovecot/auth.d/%d.passwd-ldap # default_fields = home=/var/mail/%d/%n } ### END #### /etc/dovecot/auth.d/realm.lan.passwd-ldap: testuser:::::/var/mail/realm.lan/testuser:: testuser2:::::/var/mail/realm.lan/testuser:: ... /etc/dovecot/auth.d/realm.lan.passwd-deny: testuser /etc/dovecot/auth.d/realm.lan.passwd* are symlinked to /etc/dovecot/auth.d/.passwd* to allow users without domain part (auth_default_realm doesnt work with pam) I know that in my case I can just exclude denied users from .passwd-ldap file, and even use .passwd-deny as filter file:) But problem exists and should be solved, I think. Thanks. -- Best regards, Sergey Urushkin

2 2

[Dovecot] dovecot evaluation on a 30 gb mailbox
by Rajesh M 04 Nov '11

04 Nov '11

hi all i use qmail toaster. i recently changed over to dovecot. posting below my evaluation on the same my machine dual core dual xeon 5140 processor, with 4 gb ram, centos linux with qmailtoaster i had setup a qmail tap account which backups up data for a client of mine mailbox size over 30 gb setup dovecot with squirrelmail and logged in it had over one hundred and thirty nine thousand emails 139019 emails in the 30 gb mailbox Reports 1) first login : took 7 minutes to parse 139019 mails but never timed out. this was simply impossible with courier 2) the next login it took 5 seconds by which time the mail numbers increased to 139045 3) next i changed squirrelmail display preference to list 500 mails per page and then clicked on inbox ... expecting dovecot to take atleast around 1-2 mins to show the mails ... the mails were displayed in just 8 seconds .. awesome performance qmailtoaster is simply waiting for a dovecot integration i am evaluating the stability of dovecot now in the next 2-3 weeks i post stability report rajesh

19 43

[Dovecot] Expire plugin not executing for sieve plugin?
by Dan Swartzendruber 04 Nov '11

04 Nov '11

Running dovecot 1.2.12 on ubuntu 10.10. Here is the problem: I have mysql backend for expire. I am using the dovecot-postfix package which creates /etc/dovecot/conf.d/01-mail-stack-delivery.conf which looks like this: # Some general options protocols = imap imaps managesieve disable_plaintext_auth = no ssl = yes ssl_cert_file = /etc/ssl/certs/ssl-mail.pem ssl_key_file = /etc/ssl/private/ssl-mail.key ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM mail_location = maildir:~/Maildir auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ # IMAP configuration protocol imap { mail_max_userip_connections = 10 imap_client_workarounds = outlook-idle delay-newmail mail_plugins = expire } # LDA configuration protocol lda { postmaster_address = postmaster mail_plugins = sieve expire quota_full_tempfail = yes deliver_log_format = msgid=%m: %$ rejection_reason = Your message to <%t> was automatically rejected:%n%r } # Plugins configuration plugin { sieve=~/.dovecot.sieve sieve_dir=~/sieve # If the user has no personal active script (i.e. if the file # indicated in sieve= does not exist), use this one: sieve_global_path = /var/lib/dovecot/sieve/default.sieve } The sieve is: require "fileinto"; require "imap4flags"; if header :contains "X-Spam-Flag" "YES" { setflag "\\Seen"; fileinto "SPAM"; stop; } Originally, this did not have the setflag or stop - I added them hoping to fix the problem, but no luck. The problem is this: when spam assassin has flagged a message as spam, the sieve runs and the message is in fact filed into the SPAM folder, but no expire entry is added to the database. If I move such a message from the SPAM folder to the Inbox and then back to SPAM, voila, I *do* get the entry created. Here is the mysql table before and after I did the move/move: mysql> select * from expires; +----------+---------------+--------------+ | username | mailbox | expire_stamp | +----------+---------------+--------------+ | dswartz | Deleted Items | 1319720163 | | dswartz | Sent | 1319120165 | | denise | Trash | 1319139920 | | samantha | Trash | 1319136146 | | denise | Sent | 1319655872 | | danielle | Sent | 1319192230 | | samantha | Sent | 1319268855 | | dswartz | Trash | 1319725884 | | samantha | SPAM | 1321504531 | +----------+---------------+--------------+ 9 rows in set (0.00 sec) mysql> select * from expires; +----------+---------------+--------------+ | username | mailbox | expire_stamp | +----------+---------------+--------------+ | dswartz | Deleted Items | 1319720163 | | dswartz | Sent | 1319120165 | | denise | Trash | 1319139920 | | samantha | Trash | 1319136146 | | denise | Sent | 1319655872 | | danielle | Sent | 1319192230 | | samantha | Sent | 1319268855 | | dswartz | Trash | 1319725884 | | samantha | SPAM | 1321504531 | | dswartz | SPAM | 1321714666 | +----------+---------------+--------------+ 10 rows in set (0.00 sec) It's almost like the fileinto stuff is not running the plugin code at all, or am I totally on drugs? If I can't get a fix for this, I at least now can think of a hack to "fix" it. e.g. every night, run a script that adds a "now" timestamp for everyone's SPAM folder to trick the periodic expire tool code into checking that folder, but obviously I'd rather have a real fix :) If this is just 'how it works', is it better in 2.0?

3 3

[Dovecot] iterate_query not working
by Piotr NetExpert 04 Nov '11

04 Nov '11

Hi, I have got iterate_query defined in dovecot-sql.conf.ext. However when I run a command like: doveadm search -A BEFORE 10d I receive an error message (Failed to iterate ...) There is an error message in a log file too: Error: Trying to iterate users, but userdbs don't support it The problem is that monitoring a database server shows that dovecot does not try to execute any query. What I am doing wrong? password_query lookups work fine. -- pozdrawiam Piotr Szafarczyk http://www.netexpert.pl

2 2

[Dovecot] Getting the SMTP envelope through IMAP?
by Hadmut Danisch 04 Nov '11

04 Nov '11

Hi, just a simple question about dovecot: The mbox file format contains the SMTP envelope sender and transmission date in a FROM ... line preceding the RFC822 mail header and body. As far as I see at the moment, the IMAP protocol does not support transmission of that SMTP envelope data in either way, but confusingly uses the term „envelope” for a structure describing the RFC822 mail header. My question is, whether there is any way to retrieve the SMTP envelope through dovecot's IMAP anyway, maybe through some extension. regards Hadmut

5 12