- dovecot - dovecot.org

[Dovecot] Very complex Master User Examples using MySQL
by Marc Perkel 17 Aug '10

17 Aug '10

For those who are interested I have posted in the Wiki examples of using master users in very interesting ways. In these example we will create 3 kinds of master users. The first will be users who can read all email for all domains. The next example will be users who can read all email for their domain only. The third example will be users who can read email of domains listed in a separate ownership table. http://wiki2.dovecot.org/Authentication/MasterUsers Go to Advanced SQL Examples at bottom Let me know what you think. In order to actually make this work you'll have to apply this patch Timo just posted: http://hg.dovecot.org/dovecot-2.0/rev/3ba227176cde

1 0

[Dovecot] dovecot 2.0 convert script
by Marc Perkel 17 Aug '10

17 Aug '10

Since my old config had this: protocols = imap imaps pop3 pop3s ssl_cert_file = /usr/share/ssl/certs/imapd.pem ssl_key_file = /usr/share/ssl/certs/imapd.pem then the convert script should have added ssl = yes Just trying to document all the little issues as I find them.

4 5

[Dovecot] Tricky Master User Query - need MySQL help
by Marc Perkel 17 Aug '10

17 Aug '10

OK - I want to do something very tricky with master users and if I get it to work I'm adding it to the wiki for everyone to use. So far I have a MySQL database that servers multiple domains. I can set a flag making someone a domain owner that allows that person to become master of that domain. Here's the query for that. password_query = SELECT user_name, domain_name, password FROM users WHERE user_name = '%n' AND domain_name = '%d' AND owns_domain='1' AND '%d'='%{login_domain}' So - here's where we get tricky. I have another table called "ownership" where I have 2 fields which is a pairing of email addresses (login_id) and domains owned (owned_object). Data might look like this: joe(a)blow.com domain1.com joe(a)blow.com domain2.com Since joe(a)blow.com owns both domain1.com and domain2.com I want him to be able to log in as anyone in those 2 domains as a master user. Examples: tom@domain1.com*joe@blow.com harry@domain2.com*joe@blow.com So the idea is to create a MySQL query so that if the master user matches the domain part of the login user then it returns true and allows the login. What MySQL query will do that?

1 0

[Dovecot] Master Login using MySQL problem - %{login_domain}
by Marc Perkel 17 Aug '10

17 Aug '10

Hi Timo, Been trying to track this problem down further. The problem seems to be related to verifying the master user failing. My passdb looks like this: passdb { driver = sql args = /etc/dovecot/dovecot-domain-owner-sql.conf master = yes pass = yes } dovecot-domain-owner-sql.conf contains: user_query = SELECT user_name, domain_name FROM users WHERE user_name = '%n' AND domain_name = '%d' AND owns_domain='1' password_query = SELECT user_name, domain_name, password FROM users WHERE user_name = '%n' AND domain_name = '%d' AND owns_domain='1' AND '%d'='%{login_domain}' In this example - bill(a)plf.net is an ordinary user. tom(a)plf.net is a domain owner. Tom wants to read bills email. The login is: bill@plf.net*tom@plf.net This results in tom(a)plf.net being classified as an unknown user. Aug 17 08:38:30 auth: Debug: sql(tom(a)plf.net,127.0.0.1): query: SELECT user_name, domain_name, password FROM users WHERE user_name = 'tom' AND domain_name = 'plf.net' AND owns_domain='1' AND 'plf.net'='' Aug 17 08:38:30 auth: Info: sql(tom(a)plf.net,127.0.0.1): unknown user Aug 17 08:38:32 auth: Debug: client out: FAIL 15 user=tom(a)plf.net Aug 17 08:38:32 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<tom(a)plf.net>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=0, secured Note that the query used to determine that tom(a)plf.net is valid is the password_query and not the user_query resulting in unknown user. I think that's where the problem is.

3 7

[Dovecot] Managesieve and Dovecot 2.0: clients incompatible?
by Jerrale G 17 Aug '10

17 Aug '10

I successfully converted my 1.2.x config and am trying to use managesieve. This configuration is really for 1.2.x even though it says for 2.0: http://wiki2.dovecot.org/ManageSieve/Configuration Trying to assign the port number is not by using "listen". Anyway, I just reverted, on the client, to using the default port 2000. The managesieve client now hangs trying to login and eventually times out. Is the new pigeonhole managesieve incompatible with clients that worked with managesieve 0.11.11? There is no output in the log concerning managesieve from pigeonhole. I guess I could put log=/path/to/a/file in the managesieve part and see what happens. In the old dovecot 1.2, we would get a "managesieve-login" in the log when a client even TRIED to login; now, nothing! -- Jerrale G. SC Senior Admin

2 1

Re: [Dovecot] v2.0.0 released
by Dennis Clarke 17 Aug '10

17 Aug '10

Well , configure looked good and the summary seemed fine : Install prefix . : /opt/csw File offsets ... : 64bit I/O polling .... : poll I/O notifys .... : none SSL ............ : yes (OpenSSL) GSSAPI ......... : yes passdbs ........ : static passwd passwd-file shadow pam checkpassword ldap sql : -bsdauth -sia -vpopmail userdbs ........ : static prefetch passwd passwd-file checkpassword ldap sql : -vpopmail -nss SQL drivers .... : pgsql mysql sqlite Everything was going swimmingly and then poof : libtool: compile: /opt/studio/SOS11/SUNWspro/bin/cc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-test -I../../src/lib-charset -I../../src/lib-mail -I/opt/csw/include:/opt/csw/mysql51/include/mysql:/opt/csw/postgresql83/include -I/opt/csw/include -xstrconst -xildoff -xarch=v8 -xnolibmil -Xa -xcode=pic32 -xregs=no%appl -xlibmieee -g -xs -I/opt/csw/include -I/opt/csw/mysql51/include/mysql -I/opt/csw/postgresql83/include -D_TS_ERRNO -DSOLARIS2=8 -D_LARGEFILE64_SOURCE -I/opt/csw/include -c imap-id.c -KPIC -DPIC -o .libs/imap-id.o libtool: compile: /opt/studio/SOS11/SUNWspro/bin/cc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-test -I../../src/lib-charset -I../../src/lib-mail -I/opt/csw/include:/opt/csw/mysql51/include/mysql:/opt/csw/postgresql83/include -I/opt/csw/include -xstrconst -xildoff -xarch=v8 -xnolibmil -Xa -xcode=pic32 -xregs=no%appl -xlibmieee -g -xs -I/opt/csw/include -I/opt/csw/mysql51/include/mysql -I/opt/csw/postgresql83/include -D_TS_ERRNO -DSOLARIS2=8 -D_LARGEFILE64_SOURCE -I/opt/csw/include -c imap-id.c -o imap-id.o >/dev/null 2>&1 source='imap-match.c' object='imap-match.lo' libtool=yes \ DEPDIR=.deps depmode=none /opt/csw/bin/bash ../../depcomp \ /opt/csw/bin/bash ../../libtool --tag=CC --mode=compile /opt/studio/SOS11/SUNWspro/bin/cc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-test -I../../src/lib-charset -I../../src/lib-mail -I/opt/csw/include:/opt/csw/mysql51/include/mysql:/opt/csw/postgresql83/include -I/opt/csw/include -xstrconst -xildoff -xarch=v8 -xnolibmil -Xa -xcode=pic32 -xregs=no%appl -xlibmieee -g -xs -I/opt/csw/include -I/opt/csw/mysql51/include/mysql -I/opt/csw/postgresql83/include -D_TS_ERRNO -DSOLARIS2=8 -D_LARGEFILE64_SOURCE -I/opt/csw/include -c -o imap-match.lo imap-match.c libtool: compile: /opt/studio/SOS11/SUNWspro/bin/cc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-test -I../../src/lib-charset -I../../src/lib-mail -I/opt/csw/include:/opt/csw/mysql51/include/mysql:/opt/csw/postgresql83/include -I/opt/csw/include -xstrconst -xildoff -xarch=v8 -xnolibmil -Xa -xcode=pic32 -xregs=no%appl -xlibmieee -g -xs -I/opt/csw/include -I/opt/csw/mysql51/include/mysql -I/opt/csw/postgresql83/include -D_TS_ERRNO -DSOLARIS2=8 -D_LARGEFILE64_SOURCE -I/opt/csw/include -c imap-match.c -KPIC -DPIC -o .libs/imap-match.o "imap-match.c", line 199: identifier redeclared: imap_match_dup current : function(pointer to struct pool {pointer to const struct pool_vfuncs {..} v, unsigned int alloconly_pool :1, unsigned int datastack_pool :1}, pointer to const struct imap_match_glob {pointer to struct pool {..} pool, pointer to struct imap_match_pattern {..} patterns, char sep, array[-1] of char patterns_data}) returning pointer to struct imap_match_glob {pointer to struct pool {..} pool, pointer to struct imap_match_pattern {..} patterns, char sep, array[-1] of char patterns_data} previous: function(pointer to struct pool {pointer to const struct pool_vfuncs {..} v, unsigned int alloconly_pool :1, unsigned int datastack_pool :1}, pointer to const struct imap_match_glob {pointer to struct pool {..} pool, pointer to struct imap_match_pattern {..} patterns, char sep, array[-1] of char patterns_data}) returning pointer to struct imap_match_glob {pointer to struct pool {..} pool, pointer to struct imap_match_pattern {..} patterns, char sep, array[-1] of char patterns_data} : "imap-match.h", line 33 "imap-match.c", line 214: identifier redeclared: imap_match_globs_equal current : function(pointer to const struct imap_match_glob {pointer to struct pool {..} pool, pointer to struct imap_match_pattern {..} patterns, char sep, array[-1] of char patterns_data}, pointer to const struct imap_match_glob {pointer to struct pool {..} pool, pointer to struct imap_match_pattern {..} patterns, char sep, array[-1] of char patterns_data}) returning _Bool previous: function(pointer to const struct imap_match_glob {pointer to struct pool {..} pool, pointer to struct imap_match_pattern {..} patterns, char sep, array[-1] of char patterns_data}, pointer to const struct imap_match_glob {pointer to struct pool {..} pool, pointer to struct imap_match_pattern {..} patterns, char sep, array[-1] of char patterns_data}) returning _Bool : "imap-match.h", line 36 cc: acomp failed for imap-match.c gmake[3]: *** [imap-match.lo] Error 1 gmake[3]: Leaving directory `/export/medusa/dclarke/build/dovecot/sparc/dovecot-2.0.0-sparcv8-001/src/lib-imap' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/export/medusa/dclarke/build/dovecot/sparc/dovecot-2.0.0-sparcv8-001/src' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/export/medusa/dclarke/build/dovecot/sparc/dovecot-2.0.0-sparcv8-001' gmake: *** [all] Error 2 [mimas] So that stops me while I figure out what the issue is with imap-match.h and/or imap-match.c in the Solaris world while using Sun Studio 11. -- Dennis Clarke dclarke(a)opensolaris.ca <- Email related to the open source Solaris dclarke(a)blastwave.org <- Email related to open source for Solaris

3 12

[Dovecot] authentication failure with known good credentials???
by Dave Stevens 17 Aug '10

17 Aug '10

Hi, I have a problem on my server. To illustrate, I created a new user, unclewiggly, and set up a password. I then used sent an email from my usual account. Logging in with my browser I am able to see the inbox, the mail and contents correctly. I then set up a new instance of Eudora 7.1 on my windows 7 box with the appropriate login id and check the account using the correct password. The fetch fails with the client reporting an authentication failure. Ideas? Places to look? Logfiles I can search? Maillog doesn't seem very informative, should I send a snippet? Thanks, Dave -- "It is no measure of health to be well adjusted to a profoundly sick society." Krishnamurti

3 3

[Dovecot] Using a BSDI 4.X system for Dovecot
by The Doctor 17 Aug '10

17 Aug '10

It might be old but still worked. I am using Dovecot 1.2.11 hoping to replace QualComm Eudora and Cyrus IMAP. dovecot -n yields base_dir: /var/run/dovecot/ protocols: imap imaps pop3 pop3s ssl_listen: 204.209.81.1 ssl_cipher_list: ALL:!LOW:!SSLv2 disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/dovecot/libexec/dovecot/imap-login login_executable(imap): /usr/dovecot/libexec/dovecot/imap-login login_executable(pop3): /usr/dovecot/libexec/dovecot/pop3-login mail_max_userip_connections(default): 10 mail_max_userip_connections(imap): 10 mail_max_userip_connections(pop3): 3 first_valid_uid: 100 last_valid_uid: 65535 last_valid_gid: 65535 mail_privileged_group: mail mail_location: mbox:~/mail:INBOX=/var/mail/%u dbox_rotate_days: 0 mail_executable(default): /usr/dovecot/libexec/dovecot/imap mail_executable(imap): /usr/dovecot/libexec/dovecot/imap mail_executable(pop3): /usr/dovecot/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/dovecot/lib/dovecot/imap mail_plugin_dir(imap): /usr/dovecot/lib/dovecot/imap mail_plugin_dir(pop3): /usr/dovecot/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): auth default: executable: /usr/contrib/libexec/dovecot/dovecot-auth passdb: driver: passwd-file args: /etc/master.passwd userdb: driver: passwd userdb: driver: passwd-file args: /etc/passwd And running SSL here In my logs I see Aug 17 00:35:10 doctor dovecot: POP3(user1): Fatal: setregid(100(user),14(mail)) failed with euid=0(root): Operation not permitted Aug 17 00:35:15 doctor dovecot: IMAP(user2): Fatal: setregid(100(user),14(mail)) failed with euid=0(root): Operation not permitted Question: What are am I not doing right? -- Member - Liberal International This is doctor(a)nl2k.ab.ca Ici doctor(a)nl2k.ab.ca God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! http://twitter.com/rootnl2k http://www.facebook.com/dyadallee Australia!! Vote to throw the REpublicans to the sharks!

2 1

[Dovecot] 2.0 not starting
by Luciano Mannucci 17 Aug '10

17 Aug '10

Hi everybody, I tried to upgrade my 1.2.13 dovecot to 2.0. The configure/make/install process seemed to work flawlessly. I created the dovenull user, converted my config with #src/config/doveconf -n -c /etc/dovecot.conf > /tmp/dovecot.conf and moved the result manually to /etc/dovecot. By typing "dovecot" (after having stopped the previous instance :), I get: Error: service(pop3-login): listen(::, 110) failed: Address already in use Error: service(imap-login): listen(::, 143) failed: Address already in use Fatal: Failed to start listeners tough nor "netstat -ta" nor "lsof -i" do show anything using port 110 or 143. What did I wrong? Here is my doveconf -n: baobab:/usr/src/local/mail/dovecot/current/dovecot-2.0.0 # doveconf -n # 2.0.0: /etc/dovecot/dovecot.conf # OS: Linux 2.6.27.45-0.1-pae i686 openSUSE 11.1 (i586) ext3 doveconf: Warning: Dovecot was last started using /etc/dovecot.conf, but this config is /etc/dovecot/dovecot.conf auth_cache_size = 3072 auth_debug = yes auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 100 info_log_path = /var/log/dovecot/logfile.info log_path = /var/log/dovecot/logfile login_greeting = Dovecot at Baobab ready. mail_location = mbox:/var/spool/mailboxes/%u:INBOX=/var/spool/mail/%u:DIRNAME=mbox:INDEX=/var/dovecot_indexes/%u maildir_copy_with_hardlinks = no namespace { inbox = yes location = prefix = separator = . type = private } passdb { driver = pam } plugin { quota = maildir quota_rule = *:storage=300M } protocols = pop3 imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { inet_listener imaps { address = 212.45.144.44, 212.45.144.70, 192.168.134.44 } process_limit = 512 } service pop3-login { inet_listener pop3s { address = 212.45.144.44, 212.45.144.70, 192.168.134.44 } process_limit = 512 } ssl_ca = </etc/ssl/ca.crt ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } version_ignore = yes protocol imap { imap_client_workarounds = delay-newmail mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes } protocol lda { postmaster_address = postmaster(a)mcs.it } luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.mannucci.ORG/

4 5

[Dovecot] Master User Features I'd like to see
by Marc Perkel 17 Aug '10

17 Aug '10

Here's what I'd like. Limited master users, where someone can be a master users for some domains but not others. I think I could do what I want with the right kinds of variable passing that doesn't yet exist. Let me see if I can explain clearly. From the example in the wiki: auth_master_user_separator = * passdb { driver = sql args = /etc/dovecot/dovecot-sql-master.conf.ext master = yes pass = yes } passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } Login looks like this: # telnet localhost 143 * OK Dovecot ready. 1 login loginuser*masteruser masterpass 1 OK Logged in. I'm assuming that the masteruser and masterpass is passed to the master passdb and when doing so the variable %u is the master user. I assume that %n and %d also represent the name and domain part of the master user. What I need is to also be able to have variables for the loginuser passed to the master user query. Something like %lu, %ln, and %ld perhaps. That way with MySQL tricks I might be able to see if the master user is master for that particular login user. That way I can give domain owners or owners of multiple domains the ability to manage the email accounts within their scope of permission.

5 17