- dovecot - dovecot.org

[Dovecot] imap, imaps, ports; config for secure-only service
by Ronald Leach 23 Aug '10

23 Aug '10

Hello, having difficulty setting up a 'secure-only' service on a non-standard port. Objective is to open a secure Dovecot service on an internet-visible port, while also using an insecure service for hosts on an internal network (so that one particular client which is not SSL/TLS-capable can continue to use the service). Checking wiki1 and wiki2, I think that port 143 can be used for a service in both encrypted and unencrypted operations. (Wiki2 describes how port 143 can be used with or without STARTTLS.) I've managed to run both TB/Vista, and KMail/Debian on 143 from local machines, and they seem to work fine. (Though they do only work if the clients are set to use 'unencrypted logins' such as KMail's 'clear text' setting, and TB's 'don't use secure authentication'.) Dovecot's SSL certificate on the server expires in 2028. But I cannot get my 'secure-only service' working at all. I've chosen port 10943 for that service, and have been testing from both KMail on the server, and TB/Vista on another local machine. Here's the config: protocol imap { # inet users, and also users presented from offsite via an SSH tunnel, # will use IMAP (any capability) on 143. listen = *:143 # 143 will not be reachable from outside the internal network (except # via an SSH tunnel) # # External users will be allowed only to use port 10943 (as forwarded # from the gateway), and will have to use SSL ssl_listen = *:10943 } Other settings include: #other settings protocols = imap imaps disable_plaintext_auth = no ssl_disable = no ssl_cert_file = /etc/ssl/certs/dovecot.pem ssl_key_file = /etc/ssl/private/dovecot.pem ssl_verify_client_cert = no ssl_cipher_list = ALL:!LOW ssl_require_client_cert = no ssl_username_from_cert = no mail_location = maildir:~/Maildir #log and debug settings mail_debug = yes auth_debug = yes Log from a successful session on port 143: Logs (using port 143, KMail on the server) 14:43:22 auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Isecured^Ilip=127.0.0.1^Irip=127.0.0.1^Iresp=<hidden> 14:43:22 auth(default): client out: OK^I1^Iuser=ron 14:43:22 auth(default): master in: REQUEST^I1^I4057^I1 14:43:22 auth(default): master out: USER^I1^Iron^Isystem_user=ron^Iuid=1001^Igid=1001^Ihome=/home/ron 14:43:22 IMAP(ron): Effective uid=1001, gid=1001 14:43:22 IMAP(ron): maildir: data=/home/ron/Maildir 14:43:22 IMAP(ron): maildir: root=/home/ron/Maildir, index=/home/ron/Maildir, control=, inbox= 14:43:22 imap-login: Login: user=<ron>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Unsuccessful session Logs (using 10943, KMail on the server) - absolutely no sign of any authentication, and the client reports a timeout. 17:03:30 imap-login: Disconnected: Inactivity: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 17:04:06 imap-login: Disconnected: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 17:05:08 imap-login: Disconnected: Inactivity: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 143 works fine, so Dovecot is (of course) perfectly good at managing the auth and service, so I must have something wrong in the config. I cannot see it. Could anyone share a config they've used for *secure-only* IMAP service on an internet-visible port? I'd like to compare the settings. regards, Ron

4 3

[Dovecot] Build failure building dbox and gnutls
by Elisamuel Resto 23 Aug '10

23 Aug '10

Hello! I'm having two issues building dovecot, one is with dbox storage, and another building gnutls as the SSL backend (builds fine with openssl). Software versions are Dovecot v2.0.0, GnuTLS 2.8.6 and OpenSSL 1.0.0a Configure: ./configure --prefix=/usr --sysconfdir=/etc/dovecot --localstatedir=/var --libexecdir=/usr/lib --with-moduledir=/usr/lib/dovecot/modules --with-zlib --with-sqlite --with-ssl=openssl --with-ssldir=/etc/ssl --with-gssapi --with-pam --with-bzlib --with-docs --without-mysql --without-vpopmail --without-sia --without-bsdauth --with-libcap --with-ioloop=epoll --with-storages=maildir,mbox,dbox,mdbox For the dbox build error, the log states: libdovecot-storage.so: undefined reference to `dbox_storage' Configure: http://pastie.org/1106301 - Make: http://pastie.org/private/qtt76kxomhmwqwii20oroq Configure: ./configure --prefix=/usr --sysconfdir=/etc/dovecot --localstatedir=/var --libexecdir=/usr/lib --with-moduledir=/usr/lib/dovecot/modules --with-zlib --with-sqlite --with-ssl=gnutls --with-ssldir=/etc/ssl --with-gssapi --with-pam --with-bzlib --with-docs --without-mysql --without-vpopmail --without-sia --without-bsdauth --with-libcap --with-ioloop=epoll For the gnutls build error, the log states quite a few errors, so see the linked logs. Configure: http://pastie.org/1108356 - Make: http://pastie.org/private/dxmmmopnodptut77o6fx2g -- Elisamuel Resto <ryuji(a)codemages.net> http://www.simplysam.us/ - Simply Sam Blog

3 4

[Dovecot] Mobile phone client detects 'PUSH' server
by Ron Leach 22 Aug '10

22 Aug '10

Does Dovecot really provide a 'PUSH' email service? The mobile phone client (standard with SonyEricsson C510, in this case) reported that the server (our Dovecot installation) offered PUSH email service. I hadn't seen that in the documentation that I'd read and had understood the client-server protocol to be a client-PULL service, in that the clients decide which folders to retrieve, and check what messages there are and fetch any new messages. The clients we've used so far have settings for frequency of these checks. I didn't explore the option further, yet, being unsure whether there was a genuine PUSH service from our server or whether the phone was using a proxy somewhere (not ours) which would provide an intermediate fetch/aggregation/'pull then push' service of some sort - perhaps similar to the public offers from Yahoo etc. regards, Ron

2 2

[Dovecot] sieve rule help
by Piyush Joshi 21 Aug '10

21 Aug '10

Dear All, I am using dovecot-2.0.0 version and all my sieve filters are working perfectly except the following one. I am trying to flag message coming from jagdish(a)example.net mail id. require ["fileinto","envelope","reject","vacation","imap4flags","relational","comparator-i;ascii-numeric","regex","body","date"]; if address :contains "From" "jagdish(a)example.net" { keep :flags ["Flagged"] ; } Is it possible to make it work without using addflag to add a flag ?

2 1

[Dovecot] dsync and active-active fault tolerance mail servers
by Luigi Rosa 21 Aug '10

21 Aug '10

I would like to set up an active-active fault tolerance couple of mail servers. Is the following procedure correct? Let's suppose I want to set up two servers for acme.com, mail1.acme.com and mail2.acme.com I declare both servers as MX in DNS configuration. Mailbox are stored in maildir with a single UID/GID owner for all the maildir files Userbase is MySQL, user tables are replicated using MySQL tools; in this case, the replica is one way, that is mail1.acme.com holds the "master" copy of MySQL tables and mail2.acme.com hold the "copy". The replica is done via dsync with a procedure like this executed on mail1.acme.com server: foreach mailbox { dsync mirror mailbox } Where mailbox is the full mail address, used also as a login name for authentication. My goal is to allow users to connect the mail servers they like and have all their mail (a 10/15 minute of sync delay is acceptable). This is the theory, now some questions. 1) Use Linux user/group owner of the files and directories are the same on both hosts (they are both foobar), but have different numeric ID, in one host foobat has UID 1234 and on the other host foobar has UID 2345. Is this an issue? 2) Mail location path is the same on both hosts, but where does dsync get it? Does dsync get all the information from the userbase defined in dovecot.conf (and other included files)? 3) Have I to scan the entire userbase and execute dsync for each user, or is there a trick to do for every user with a single command? 4) How often is good to run the synchronization? 5 minutes? 10? 15? 5) What is the correct command line to invoke dsync in this scenario? 6) Does anyone else tried this? :) Thank you. Ciao, luigi -- / +--[Luigi Rosa]-- \ (1) Everything depends. (2) Nothing is always. (3) Everything is sometimes.

2 2

[Dovecot] sieve_after scripts with virtual domains
by Ciro Scognamiglio 21 Aug '10

21 Aug '10

Hi all, first of all I am new to the list, so hello everyone :) I recently encountered an annoying problem with sieve, I am using dovecot version 1.2.13 on centos 5.5, the packages installed are the following: dovecot-sieve-0.1.17-5.el5 dovecot-managesieve-0.11.11-0_4.el5 dovecot-1.2.13-1_111.el5 the mail server is configured with virtual hosts (mysql), also the sieve plugin and managesieve are active. Users can create their own filters through roundcube and everything works fine. I also put two script to be executed before all sieve scripts in sieve_before, they just move any SPAM or VIRUS tagged message to a Junk folder. The problem is that while this works for my domain (that is also the server domain) it doesn't for the others domains, it seems the sieve_before scripts get ignored. I made many tests with the domains I am hosting, if I send a spam message (I am using the spamassassin test messages) it gets marked as SPAM, but gets only moved to the junk folder if the recipient is @cslash.net (that is my domain). here is some config extracts: === dovecot.conf === plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_before = /srv/mail/sieve-before sieve_after = /srv/mail/sieve-after } ======= /srv/mail $ cat sieve-before/spam.sieve require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "Junk"; } P.S. The sieve scripts are all compiled.

1 0

[Dovecot] pigeonhole sieve imapflags bug
by Tim Traver 21 Aug '10

21 Aug '10

Hi all, ok, I just instealled the dovecot 2.0.0 release, and the latest mercurial pigeonhole source. All is well, except for a particular sieve rule that may not be working right. It is a simple rule that looks like this : require ["fileinto","imap4flags"]; # rule:[Past Due Notices] if allof (header :contains "Subject" "Account Past Due Notice") { fileinto "Billing"; setflag "\\Seen"; stop; } Anyways, what happens is the message that matches that rule does indeed get moved to the "Billing" folder, but it does not get marked as read. BUT! if I change the order of the actions to mark it as read first, then move it to the "Billing" folder, it does both of those actions... Is that the way it is supposed to work? or is that a bug? Thanks, Tim.

3 2

[Dovecot] Logged out format in log
by Jerrale G 21 Aug '10

21 Aug '10

I was naive to not check the log more thoroughly for changes. I need "dovecot: imap(jerrale(a)sheltoncomputers.com): Disconnected: Logged out bytes=1921/2983" to say the rip (ip address) as 1.2.x did; how do I accompish such? Jerrale G SC Senior Admin SC Senior Admin

2 2

[Dovecot] Mobile phone client - first access
by Ron Leach 21 Aug '10

21 Aug '10

Ladies and gentlemen, good morning! With my first post to the list, may I begin by saying how impressed I have been by Dovecot's performance on our Debian server. We've configured it to run with Exim and Fetchmail, using Dovecot to manage professional and domestic emails for a small home office, serving a number of Windows and Linux clients both on the internal network and, when working overseas, via SSH tunnels back to the Debian server. Dovecot's performance has been, simply, rock-solid; a very impressive piece of work by Timo and all those supporting him. My ordinary mobile phone - a Sony Ericsson C510 - includes an email client with IMAP capability (and none, TLS, or SSL encryption). Configured to access our server across the mobile carrier's network, the results surprised me; they were not what I expected. The first surprise was, it worked. More seriously, the messages it retrieved were not what I expected; the phone received around 58 messages, but from the 'inbox', the 'junk' box, and a couple from a 'project' box. I had expected to only retrieve the messages that were in the 'inbox'. How does Dovecot 'decide' what messages to give the phone client? [I think I may have the wrong 'mental model' of what should have happened, and would appreciate being put right.] Is it possible to configure Dovecot to only serve specific boxes? The mobile phone client is extremely simple - it does not have the facility to 'browse' the folders, it only has an inbox, sentbox, etc; I have wondered whether there might be a 'jar' email client that is richer, and which might help - I will look for something anyway. But I was impressed that my mobile phone could check our home and office email while offsite; if I can get that working it will save having to fire up the laptop at each opportunity. Thanks very much for reading this far, and, also, thanks everyone who takes the time to contribute to the list, regards, Ron

3 5

[Dovecot] Director mailserver health monitoring script
by Brad Davidson 20 Aug '10

20 Aug '10

Timo et al; The last bit of functionality that the Dovecot director is missing compared to our existing load balancers is mailserver health monitoring. As I understand it, if a mailserver goes down, Dovecot does not take any action to route connections around the offline node, and will keep trying to proxy clients to it. Since we're hoping to cut over to Directors soon, but don't want to lose any functionality, I've hacked up a script that: * Polls the local director for a list of mailservers * Performs health checks against a list of ports on each mailserver * Disables or enables mailservers (by altering the vhost count) as necessary I've published the script on github in hopes that it might be useful to others: http://github.com/brandond/poolmon/ Maybe someday Dovecot will do something like this internally and I won't need the script any more, but for now I'm pretty happy with it. -Brad

2 2