- dovecot - dovecot.org

[Dovecot] Problems Configuring Pigeonhole/Seve
by Ian Barton 17 Oct '11

17 Oct '11

I am moving my email server from Ubuntu Lucid to Arch. The Arch server is running Dovecot V2.0.15. Email is working fine, but I can't get Pigeonhiole/sieve to work. My dovecot.conf is: protocols = imap sieve ssl = yes ssl_cert = </etc/ssl/certs/mail2.wilkesley.net.crt ssl_key = </etc/ssl/private/mail2.wilkesley.net.key first_valid_uid = 5000 first_valid_gid = 5000 auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ namespace { location = maildir:/home/vmail/%d/%n/Maildir type = private prefix = INBOX. inbox = yes hidden = yes } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep } protocol lda { postmaster_address = ian(a)wilkesley.net hostname = wilkesley.org sendmail_path = /usr/sbin/sendmail mail_plugins = $mail_plugins sieve } protocol sieve { # Nothing to do here as defaults are OK } plugin { sieve = ~/.dovecot.sieve sieve_global_path = /home/vmail/globalsieverc sieve_dir = ~/ } passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf } userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf } I have created the sieve dir in the virtual users folder. However sieve doesn't appear to be working. I have tried logging in manually to see if sieve is running, but get the following error: ian:~/ $ gnutls-cli --starttls -p 143 mail2.wilkesley.net [8:32:22] Resolving 'mail2.wilkesley.net'... Connecting to '127.0.0.1:143'... - Simple Client Mode: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN] Dovecot ready. STARTTLS STARTTLS BAD Error in IMAP command received by server. According to the Dovecot wiki this should reply with the capabilities of my server, Note the server sends and receives mail OK using starttls. So what am I doing wrong?

2 1

[Dovecot] Question about ionice & dovecot-deliver
by Maria Arrea 16 Oct '11

16 Oct '11

Hello We are running dovecot 2.0.13 with mdbox on RHEL 5.7 x64, ext4 filesystem. Sometimes we have a big load increase because a mailing list server send 16.000 32k messages in less than 3 minutes. We want to "slow down" delivery, we prefer slow delivery instead of logging out webmail users. I have the following line en /etc/postfix/master.cf: flags=DRhu user=userid argv=/usr/libexec/dovecot/deliver -d ${user} And in /etc/postfix/main.cf mailbox_command = /usr/libexec/dovecot/deliver I would like to add ionice to the equation, prefixing /usr/bin/ionice -c2 -n6 before the deliver lines in postfix config. Is there any other way of slowing down delivery speed vs imap access? Regards Maria

3 2

[Dovecot] Issue after upgrading to Ubuntu Server 11.10
by Chris Vanden Berghe 14 Oct '11

14 Oct '11

Hi all, After upgrading to Ubuntu Server 11.10 my mail setup stopped working. The error message I get is: lda: Error: userdb lookup: connect(/var/run/dovecot/auth-userdb) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +r perm: /var/run/dovecot/auth-userdb, euid is not dir owner) Does anybody have an idea how to solve this? Thanks, Chris. --- # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 3.0.0-12-generic x86_64 Ubuntu 11.10 ext3 auth_verbose = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/var/vmail/%u mail_privileged_group = mail maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { fts = squat fts_squat = partial=4 full=10 } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth-client { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { address = localhost port = 143 } inet_listener imaps { address = * port = 993 } } ssl_cert = </etc/ssl/private/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = uid=5000 gid=5000 home=/var/vmail/%u driver = static } protocol imap { mail_max_userip_connections = 50 mail_plugins = fts fts_squat } protocol lda { mail_plugins = sieve }

1 1

Re: [Dovecot] Dovecot not processing through Sieve
by Stephan Bosch 13 Oct '11

13 Oct '11

Please reply to the list as well. On 10/13/2011 3:28 PM, Steven Kiehl wrote: > > On Thu, Oct 13, 2011 at 9:21 AM, Stephan Bosch <stephan(a)rename-it.nl > <mailto:stephan@rename-it.nl>> wrote: > > Are you sure you are using the Dovecot LDA (deliver)? Did you > follow these instructions in the wiki? > > http://wiki1.dovecot.org/LDA > http://wiki1.dovecot.org/LDA/Postfix > > From the looks of things, your Postfix currently still does its > own mail delivery instead of using the Dovecot LDA. You should see > entries in your log relating to LDA/deliver and Sieve, especially > since you enabled mail_debug. To test whether Sieve is configured > correctly (and to see what the Dovecot LDA normally logs), you can > also manually execute /usr/lib/dovecot/deliver and feed it a message. > > I am using Dovecot deliver to perform mail delivery. I'm absolutely > certain of this because I get spam scores and it is SpamAssassin that > actually hands the mail over to deliver. Here is my postfix master.cf > <http://master.cf> entry for spamc/deliver: > > dovespam unix n n n - - pipe > flags=DRhu user=dovemail:dovemail argv=/usr/bin/spamc -f -e > /usr/lib/dovecot/deliver -c /etc/dovecot/dovecot.conf -f ${sender} -d > ${user}@${nexthop} -n -m ${extension} Ok, then what do your logs say about delivery? Even when things are filed in INBOX, the logs should show that deliver and sieve are being executed and putting the mail there. http://wiki1.dovecot.org/Logging Regards, Stephan

2 1

[Dovecot] Sieve and UserDB/SQL support
by ben＠benweblife.fr 13 Oct '11

13 Oct '11

Hi, I would like to know if plugins of sieve support UserDB/SQL backend. For example, for the vacation plugin, is it possible to retrieve a field like "sieve_vacation_days", "sieve_vacation_reason", and so on.. on user_query? Or, there is a plan for implement this? Thanks ------ dovecot version: 2.0.13

2 1

[Dovecot] Dovecot not processing through Sieve
by Steven Kiehl 13 Oct '11

13 Oct '11

Hello everyone, I'm fairly new to Dovecot, but I've gotten the majority of things working except for Sieve. I'm running Dovecot 1.2.9 coupled with Postfix and SpamAssassin all with a virtual domains setup. I am receiving mail and it is being processed by all the plugins that operate through Postfix. The quota configured in Dovecot appears to be working because my mail client shows the configured quota. But the Sieve rules are not processing. I created a rule as follows to filter spam: require ["fileinto"]; # rule:[global-spam] if anyof (header :contains "Subject" "[SPAM]", header :contains "X-Spam-Flag" "YES") { fileinto "Junk"; } If I mail myself a message with [SPAM] in the title, it goes into my inbox regardless. I've run 'sieve-test' with the same email and it says it will file it into Junk. The Junk folder exists. I even tried adding :create and the "mailbox" plugin, but that didn't do anything either. Here is the relevant majority of my dovecot configuration: login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login login_executable(managesieve): /usr/lib/dovecot/managesieve-login mail_privileged_group: mail mail_location: maildir:/home/dovecot/mail/domains/%d/%n/Maildir mail_debug: yes mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_executable(managesieve): /usr/lib/dovecot/managesieve mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 mail_plugin_dir(managesieve): /usr/lib/dovecot/modules/managesieve imap_client_workarounds(default): outlook-idle delay-newmail tb-extra-mailbox-sep imap_client_workarounds(imap): outlook-idle delay-newmail tb-extra-mailbox-sep imap_client_workarounds(pop3): imap_client_workarounds(managesieve): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh pop3_client_workarounds(managesieve): namespace: type: private separator: / inbox: yes list: yes subscriptions: yes lda: *mail_plugins: quota sieve* quota_full_tempfail: yes deliver_log_format: msgid=%m: %$ rejection_reason: Your message to <%t> was automatically rejected:%n%r auth default: mechanisms: cram-md5 plain login passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: sql args: /etc/dovecot/dovecot-sql.conf socket: type: listen master: path: /var/run/dovecot/auth-master mode: 384 user: dovemail group: dovemail socket: type: listen client: path: /var/spool/postfix/private/dovecot-auth mode: 432 user: postfix group: postfix plugin: convert_mail: maildir:/home/dovecot/mail/domains/%d/%u/Maildir * sieve: /etc/dovecot/sieve/domains/%d/%n.sieve* * sieve_global_dir: /etc/dovecot/sieve/global/* quota: maildir:User quota_rule: INBOX:storage=500M quota_rule2: INBOX.Trash:storage=100M The sieve plugin exists in /usr/lib/dovecot/modules/lda/lib90_sieve_plugin.so, so I would assume I'd have to use *mail_plugin: sieve* as my configuration setting. Like I said, I am receiving emails to my domains without any problem, but sieve rules are not being processed. I can see the rules set up by using the Roundcube plugin, and I can create and edit rules through Roundcube, but nothing different happens when I send myself an email. It all just delivers to the inbox. Thanks for your help, Steve K.

2 1

[Dovecot] Auth Worker failures
by Simon Brereton 12 Oct '11

12 Oct '11

Hi I have a script that checks the logs each day and mails me invalid user attempts and authentication failures for the previous day. (I use fail2ban to ban multiple attempts in a short space of time). For some reason, this appears every day: Oct 11 06:25:12 mail dovecot: auth-worker(default): sql(simon(a)mydomain.net,127.0.0.1): Password mismatch Oct 11 06:25:19 mail dovecot: auth-worker(default): sql(simon(a)mydomain.net,127.0.0.1): Password mismatch Oct 11 06:25:31 mail dovecot: auth-worker(default): sql(simon(a)mydomain.net,127.0.0.1): Password mismatch Oct 11 06:25:48 mail dovecot: auth-worker(default): sql(simon(a)mydomain.net,127.0.0.1): Password mismatch Oct 11 06:26:10 mail dovecot: imap-login: Aborted login (auth failed, 4 attempts): user=<simon(a)mydomain.net>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Of all the accounts on the box, it's only mine that throws this up. Since its LIP is localhost, it could really only be for webmail - but I don't always leave the webmail open, so I'm curious to know how this gets there and what it is. Any suggestions? I find it difficult to believe I have an IMAP process in a script somewhere (especially with my user account - the postmaster account, I could believe, but not with my personal one).. The log time is UTC, so watching the process list at 2.24 is less than appealing! Simon

1 0

[Dovecot] dovecot2 auth-worker socket perms ignoring assigned ownership settings in conf.d/10-master.conf?
by mephistopheles＠operamail.com 12 Oct '11

12 Oct '11

I have Dovecot2 auth setup to run as user = doveauth group = dovecot configured in, vi conf.d/10-master.conf ... service auth { unix_listener /var/spool/postfix/private/auth { user = postfix group = postfix mode = 0660 } user = doveauth group = dovecot } service auth-worker { user = doveauth group = dovecot } ... When I start Dovecot, ls -al /var/run/dovecot/auth-* /bin/ls: No match. service dovecot-custom start Starting Dovecot ... done Dovect's auth-process sockets are created with different ownership than what I specified, ls -al /var/run/dovecot/auth-* srw------- 1 root root 0 Oct 11 19:30 /var/run/dovecot/auth-client srw------- 1 dovecot root 0 Oct 11 19:30 /var/run/dovecot/auth-login srw------- 1 root root 0 Oct 11 19:30 /var/run/dovecot/auth-master srw------- 1 root root 0 Oct 11 19:30 /var/run/dovecot/auth-userdb srw------- 1 dovecot root 0 Oct 11 19:30 /var/run/dovecot/auth-worker Which causes problems when I test AUTH, telnet 127.0.0.1 143 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. a login "xxx(a)domain.loc" "testpass" a NO [UNAVAILABLE] Temporary authentication failure. * OK Waiting for authentication process to respond.. In logs, ==> /var/log/dovecot/dovecot-debug.log <== Oct 11 19:32:11 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/modules/auth Oct 11 19:32:11 auth: Debug: Module loaded: /usr/lib64/dovecot/modules/auth/libauthdb_ldap.so Oct 11 19:32:11 auth: Debug: Module loaded: /usr/lib64/dovecot/modules/auth/libdriver_mysql.so Oct 11 19:32:11 auth: Debug: Module loaded: /usr/lib64/dovecot/modules/auth/libdriver_pgsql.so Oct 11 19:32:11 auth: Debug: Module loaded: /usr/lib64/dovecot/modules/auth/libdriver_sqlite.so Oct 11 19:32:11 auth: Debug: Module loaded: /usr/lib64/dovecot/modules/auth/libmech_gssapi.so Oct 11 19:32:11 auth: Debug: auth client connected (pid=2397) Oct 11 19:32:17 auth: Debug: client in: AUTH 1 PLAIN service=imap secured lip=127.0.0.1 rip=127.0.0.1lport=143 rport=47016 resp=<hidden> ==> /var/log/dovecot/dovecot.log <== Oct 11 19:32:17 auth: Fatal: net_connect_unix(auth-worker) in directory /var/run/dovecot failed: Permission denied (euid=1101(doveauth) egid=305(dovecot) missing +r perm: /var/run/dovecot/auth-worker, dir owned by 305:305 mode=0755) What needs to change to get those sockets created with correct/assigned ownership & perms?

2 5

[Dovecot] To query two SQL tables for user verification over LMTP, should I use (a) two separate lookups? or (b) just one lookup with a boolean query?
by jake0534＠airpost.net 12 Oct '11

12 Oct '11

Hey all I've been running a Dovecot 1X server for awhile. Most of the config was pretty simple using flat files. I'm switching to Dovecot 2X now, and want to switch to using SQL for lookups so I can share info with the Postfix front end. For starters I setup two SIMPLE SQL tables -- a 'users' table and a 'aliases' table, where each user can have many aliases. I want to have Postfix check Dovecot's SASL/LMTP passdb to see if a <user>@<domain> exists. If yes, deliver through LMTP. If NO, reject it. Here are the table definitions so far, CREATE TABLE user ( userid TINYINT, user VARCHAR(64), domain VARCHAR(128), password VARCHAR(64), PRIMARY KEY (userid), UNIQUE (user,domain) ); CREATE TABLE alias ( aliasid TINYINT, alias VARCHAR(64), user VARCHAR(64), domain VARCHAR(128), PRIMARY KEY (aliasid), UNIQUE (domain,user,alias), CONSTRAINT fk_alias1 FOREIGN KEY (user) REFERENCES user (user) ON DELETE NO ACTION ON UPDATE NO ACTION, CONSTRAINT fk_alias2 FOREIGN KEY (domain) REFERENCES user (domain) ON DELETE NO ACTION ON UPDATE NO ACTION ); With flat file and just one table, 'users', I get how to setup LMTP. I can get Postfix delivering/rejecting over LMTP depending on if the user exists in the Dovecot passdb or not. I don't get how to do the SQL query in Dovecot if I have the TWO tables. An inbound <user>@<domain> needs to be auth'd as valid if it exists in EITHER 'user' OR 'alias' table. Do I need to use a single lookup for passdb with some sort of "IF EXISTS IN TABLE 'user' OR TABLE 'alias'" query? Or do I need to have TWO lookups, the main one for 'user' and a fallback one for 'alias' (like talked about here http://wiki2.dovecot.org/Authentication/MultipleDatabases)? Cheers! Jake

2 5

[Dovecot] using ecc-certificates (ellyptic curve) will not establish connection
by Fresel Michal - hi competence e.U. 11 Oct '11

11 Oct '11

hi I want to use ECC(ellyptic curve cryptography) for SSL-connections but somehow dovecot doesn't like my ECC-certificates :( I tried to test using following scenario: machine: debian 6 (x64) dovecot 2.0.15-0~auto+21 ((f6a2c0e8bc03) from http://xi.rename-it.nl/debian openssl 1.0.0e-2 from testing (as the default 0.9.8o-4squeeze3 needs also the parameter -cipher ECCdraft for testing) creating keys+cert for ecc (i.e. curves prime192v1, secp521r1) # openssl ecparam -name prime192v1 -genkey -out prime192v1.key # openssl req -new -key prime192v1.key -out prime192v1.csr # openssl req -x509 -in prime192v1.csr -key prime192v1.key -out prime192v1.crt testing these in 2 windows # openssl s_server -cert prime192v1.crt -key prime192v1.key -www # openssl s_client note: when using the default openssl version 0.9.8o-4squeeze3 you need to append -cipher ECCdraft output (cut) ... New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES256-SHA Server public key is 192 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : SSLv3 Cipher : ECDHE-ECDSA-AES256-SHA Session-ID: xxxxx Session-ID-ctx: Master-Key: xxxxx Key-Arg : None PSK identity: None PSK identity hint: None Compression: 1 (zlib compression) Start Time: xxxxx Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) looks promising - also for the secp521r1 curve but when changing dovecot.conf to use these keys and certificates it won't use them and return errors # openssl s_client -port 993 CONNECTED(00000003) 140543456835240:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1195:SSL alert number 40 140543456835240:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:591: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None Start Time: xxxxx Timeout : 7200 (sec) Verify return code: 0 (ok) --- and the log gives (using verbose_ssl = yes in dovecot.conf) ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] from doveconf -a: ssl = required ssl_ca = ssl_cert = </etc/ssl/certs/prime192v1.crt ssl_cert_username_field = commonName ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_key = </etc/ssl/certs/prime192v1.key ssl_key_password = ssl_parameters_regenerate = 168 ssl_verify_client_cert = no Has anybody already tested this and made it working? Or do i have just to recompile everything to make it work? Greetings Mike

1 1