- dovecot - dovecot.org

[Dovecot] dovecot 1.2rc5 fails to authenticate user via GSSAPI
by Michal Hlavinka 20 Jul '09

20 Jul '09

Hi, we're facing problem where dovecot 1.2rc5 is not able to authenticate user via gssapi. (I'm forwarding information from red hat's bugzilla) Steps to reproduce: 1. Install dovecot with kerberos support, create mailboxes for the client 2. Get initial credentials on client side 3. Attempt to log in via dovecot using gssapi -> login failed Client side 1. Email client displays: "[AUTHENTICATIONFAILED] Authentication failed." 2. klist before login shows: Valid starting Expires Service principal 06/18/09 20:01:01 06/19/09 20:01:01 krbtgt/realm@realm 3. klist after login attempt shows: Valid starting Expires Service principal 06/18/09 20:01:01 06/19/09 20:01:01 krbtgt/realm@realm 06/18/09 20:01:28 06/19/09 20:01:01 imap/mail.domain@realm Server side 1. /var/log/maillog: dovecot: auth(default): gssapi(user,192.168.0.1): authn_name not authorized dovecot: imap-login: Aborted login (auth failed, 1 attempts): user=<user>, method=GSSAPI, rip=192.168.0.1, lip=192.168.0.2, TLS ---------------- It is possible for the same user to login via other mechanisms. The issue reproduced with different email clients. Evolution and a custom java-based client were attempted. example of dovecot.conf: protocols = imap mail_location = maildir:/home/virtual/%u/Maildir protocol imap { } auth_krb5_keytab=/etc/dovecot.keytab auth default { mechanisms = gssapi userdb static { args = uid=vmail gid=vmail home=/home/virtual/%u } } ------------------------- Exactly the same dovecot setup was working just fine with dovecot 1.1 series. Authentication using kinit works just fine and kerberos infrastructure is functioning well as I use kerberos auth for other services like apache and ssh successfully. /var/log/maillog with using auth_debug=yes can be found here: https://bugzilla.redhat.com/attachment.cgi?id=348710 Regards, Michal Hlavinka

3 12

Re: [Dovecot] exim4 dovecot sasl problem
by Tristan Rex Santiago 20 Jul '09

20 Jul '09

what flag do i need to set in recompiling exim4 to enable dovecot-sasl support? i tried --enable-dovecot-sasl but exim4 still reported dovecot driver error. many thanks --- On Fri, 7/17/09, Tristan Rex Santiago <pgtr3s(a)yahoo.com> wrote: From: Tristan Rex Santiago <pgtr3s(a)yahoo.com> Subject: exim4 dovecot sasl problem To: dovecot(a)dovecot.org Cc: tansanph(a)gmail.com Date: Friday, 17 July, 2009, 4:36 PM hi! i'm trying to do smtp authentication using dovecot and exim4 by following this guide http://wiki.dovecot.org/HowTo/ EximAndDovecotSASL. for the exim4 part, i got an authenticator dovecot: cannot find authenticator driver "dovecot" error after i entered the codes in /etc/exim4/exim4.conf.template and reloaded exim4 with the update-exim4.conf command. i'm running debian lenny. here's the authentication section of exim4.conf.template: begin authenticators cram_md5: driver = cram_md5 public_name = CRAM-MD5 client_name = ${extract{1}{:}{${lookup{$ host}nwildlsearch{CONFDIR/ passwd.client}{$value}fail}}} client_secret = ${extract{2}{:}{${lookup{$ host}nwildlsearch{CONFDIR/ passwd.client}{$value}fail}}} PASSWDLINE=${sg{\ ${lookup{$host}nwildlsearch{ CONFDIR/passwd.client}{$value} fail}\ }\ {\\N[\\^]\\N}\ {^^}\ } plain: driver = plaintext public_name = PLAIN .ifndef AUTH_CLIENT_ALLOW_NOTLS_ PASSWORDS client_send = "<; ${if !eq{$tls_cipher}{}\ {^${extract{1}{:}{PASSWDLINE}} \ ^${sg{PASSWDLINE}{\\N([^:]+:)( .*)\\N}{\\$2}}\ }fail}" .else client_send = "<; ^${extract{1}{:}{PASSWDLINE}}\ ^${sg{PASSWDLINE}{\\N([^:]+:)( .*)\\N}{\\$2}}" .endif login: driver = plaintext public_name = LOGIN .ifndef AUTH_CLIENT_ALLOW_NOTLS_ PASSWORDS # Return empty string if not non-TLS AND looking up $host in passwd-file # yields a non-empty string; fail otherwise. client_send = "<; ${if and{\ {!eq{$tls_cipher}{}}\ {!eq{PASSWDLINE}{}}\ }\ {}fail}\ ; ${extract{1}{::}{PASSWDLINE}}\ ; ${sg{PASSWDLINE}{\\N([^:]+:)(. *)\\N}{\\$2}}" .else # Return empty string if looking up $host in passwd-file yields a # non-empty string; fail otherwise. client_send = "<; ${if !eq{PASSWDLINE}{}\ {}fail}\ ; ${extract{1}{::}{PASSWDLINE}}\ ; ${sg{PASSWDLINE}{\\N([^:]+:)(. *)\\N}{\\$2}}" .endif dovecot_login: driver = dovecot public_name = LOGIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1 dovecot_plain: driver = dovecot public_name = PLAIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1 Design your own exclusive Pingbox today! It's easy to create your personal chat space on your blogs Connect instantly with more friends on your blog and personal website? Create your latest Pingbox today! http://ph.messenger.yahoo.com/pingbox

2 1

[Dovecot] RFC: Different quota for dovecot and deliver
by Philipp Marek 20 Jul '09

20 Jul '09

Hello everybody, I've been with this question in IRC the last days, but no solution was found. So I looked into the sources, and came up with the attached (untested, not even compiled) patch against 1.2.1. Rationale ----------- I'd like to bounce on the external side, which is quite easy if the quota is stored in a SQL database; then eg. postfix can directly query it, and reject accordingly without doing any real work. Now, as discussed some time ago on the postfix list (cannot find it anymore, sorry), it would be best to *not* bounce internally, ie. when the mail is delivered in the mailbox, but to allow a small bit of over-usage instead. Thoughts ---------- Why don't we simply set the value seen by postfix down a bit? I don't think that this is the correct solution; if the difference between these two values is smaller than the allowed mail size we'd get internal bounces again. (And we wouldn't allow to *get* the amount of mail, btw, only to use it via COPY.) There are more complicated schemes, like putting a slightly higher quota in the configuration, and subtracting a bit in postfix again. I wouldn't see that as aesthetical, too. Furthermore all such schemes have the problem of being unstable - larger mails get (internally) rejected earlier than small ones. Wanted behaviour ------------------ What I'd like to achieve is that postfix uses the trigger value from the Database as well, but that deliver allows a small bit more - say 5, 10, or 20MB. Then one incoming mail simply makes the quota go over the defined limit; now postfix no longer accepts mail, but the incoming queue (amavis etc.) can be drained - at least if there's not some big hiccup in queue processing, and that's why I'd like to use a *different* quota, and not simply *none* (for deliver). Idea to solve this -------------------- The idea is that in the SQL configuration the name of an environment variable can be given to the SELECT query; this name, and the value of the environment variable, are used as an additional WHERE constraint. It would be much nicer if a stored procedure could be called with parameters (like Postfix allows), but that would mean a fair bit of change to dovecot. (And in Postgres at least the query could be rewritten with rules - but that's not that nice, either.) I've now looked into the sources, and tried to sketch the basic change that I imagine; please see the attached patch. Would something like that be acceptable? I thought for some time whether the additional query should use the filename part of the executable; then similar things could be done. But as this is a bit more general I settled for the environment variable. Thank you for all answers. Regards, Phil

3 6

[Dovecot] dovecot as lda : nothing happens
by denis 19 Jul '09

19 Jul '09

Hi, On debian lenny, I try to configure my setup (with Postfix virtual domains) to use dovecot as lda. I adjusted my settings to postfix and dovecot, but nothing happens... The dovecot.log is always empty and nothing seems to change, as if it had no effect. Here are my changes, if someone sees what would be problematic ... Thanks Denis main.cf ###### virtual_transport = dovecot dovecot_destination_recipient_limit = 1 # conf -> http://pastebin.com/mfdf596e master.cnf ######## dovecot unix - n n - - pipe flags=DRhu user=www-data:www-data argv=/usr/lib/dovecot/deliver -d $(recipient) http://pastebin.com/m41e07df0 ## conf -> http://pastebin.com/m41e07df0 ## postconf -n -> http://pastebin.com/m293a05f7 dovecot.conf ########## protocol lda { postmaster_address = root@xxx auth_socket_path = /var/run/dovecot/auth-master mail_plugins = cmusieve log_path = /var/log/dovecot.log } ## conf -> http://pastebin.com/m5c55d5b2 ## dovecot -n -> http://pastebin.com/m268fdb89

2 4

[Dovecot] Changed URLs of the automated Debian repositories
by Stephan Bosch 19 Jul '09

19 Jul '09

Hi, Due to the advent of Dovecot v2.0, I restructured the automated Debian package builder to build packages for v2.0 as well. Those of you using the automated repositories should change their /etc/apt/sources.list files as follows: Dovecot v1.1 for Debian Testing (binary and source): deb http://xi.rename-it.nl/debian/ testing-auto/dovecot-1.1 main deb-src http://xi.rename-it.nl/debian/ testing-auto/dovecot-1.1 main Dovecot v1.2 for Debian Testing (binary and source): deb http://xi.rename-it.nl/debian/ testing-auto/dovecot-1.2 main deb-src http://xi.rename-it.nl/debian/ testing-auto/dovecot-1.2 main Dovecot v2.0 for Debian Testing (binary and source): deb http://xi.rename-it.nl/debian/ testing-auto/dovecot-2.0 main deb-src http://xi.rename-it.nl/debian/ testing-auto/dovecot-2.0 main Dovecot v2.0 ManageSieve and Sieve need quite a few changes yet to become fully functional. ManageSieve is even still pretty much broken for the new Dovecot version. This means that Dovecot v2.0 (at least with respect to the Sieve support) is not quite ready for testing. That is also why the the v2.0 repository is not mentioned in the wiki. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

[Dovecot] Changed URL of the Sieve Mercurial repository.
by Stephan Bosch 19 Jul '09

19 Jul '09

Hi, I've changed the name of the Sieve Mercurial repository form dovecot-libsieve to dovecot-1.2-sieve, to signify the Dovecot version it applies to. The URL thus looks as follows: http://hg.rename-it.nl/dovecot-1.2-sieve Note that there are already dovecot-2.0-sieve and dovecot-2.0-managesieve repositories, but these are still somewhat broken in multiple ways and I wouldn't call these ready for testing yet. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

[Dovecot] dsync - one or two ways?
by Timo Sirainen 18 Jul '09

18 Jul '09

dsync in Dovecot v2.0 tree is a new utility for syncing a mailbox in two locations. Some things it can be used for: - Initially transfer a mailbox to another server via SSH - A faster sync done to an existing mailbox, sending only changes - A superfast sync based on modification sequences. - Source and destination mailboxes can use different formats (convert-tool will be history) dsync can handle all kinds of conflicts in mailboxes, handle mailbox deletions, renames, etc. So it's safe to sync even if both source and destination mailboxes have had all kinds of changes. Now, the question is: Does anyone want dsync to only sync changes from source to destination, instead of doing a full two-way sync? I think in typical cases where you'd think you would want only one-way sync are also the cases where there's no changes coming the other way in any case.

7 23

[Dovecot] SMTP Auth Issue for non /etc/passwd accounts
by Mark R. Baith 17 Jul '09

17 Jul '09

Folks - With Dovecot 1.0.7, we're seemingly unable to authenticate users for out-going SMTP access who are not residing directly within the main system passwd/shadow files. (I.e. the users seeded within our non-system "dovecot" userdbs & passwd files have no "smtp-auth" joy! (Ye olde "Relaying denied. Proper authentication required") I've mucked around with this from several different angles and clearly saslauthd is the sticking point in terms of "locking-in" on the /etc system files ONLY for smtp-auth. Our defined dovecot user/passwd files are entirely ignored. Can anyone provide a direction regarding the appropriate smtp-auth in-road? Thanks, -M Regards, M

3 5

[Dovecot] Question regarding layout.
by Johan Hendriks 17 Jul '09

17 Jul '09

Hello all. I have a question regarding my mail flow. We have some users who are in a mail group (alias), and these alias receives a lot of attached documents. So i have the document in all the mailboxes of the alias. If the attached document is 2MB and that is not rare, i have 10 times 2 MB on my mail server. Is there a way to tackle this. Maybe by making the alias a mailbox itself and give other users acces or are there other options. Also i have very lame and lazy users. They refuse to clean thrash cans (i asked about that earlier,and got that tackled through the expire plugin.),also the do not remove old mail not even reading it. So is there also a option to remove mail that is not been opened, and is older than xx days or weeks. Thanks -- _______________________ *Johan Hendriks* *Schavemaker Transport* Tel: +31 (0)251 229098 Fax: +31 (0)251 212016 email: j.hendriks(a)schavemaker.com <mailto:j.hendriks@schavemaker.com> web: http://www.schavemaker.com _______________________

2 2

[Dovecot] exim4 dovecot sasl problem
by Tristan Rex Santiago 17 Jul '09

17 Jul '09

hi! i'm trying to do smtp authentication using dovecot and exim4 by following this guide http://wiki.dovecot.org/HowTo/EximAndDovecotSASL. for the exim4 part, i got an authenticator dovecot: cannot find authenticator driver "dovecot" error after i entered the codes in /etc/exim4/exim4.conf.template and reloaded exim4 with the update-exim4.conf command. i'm running debian lenny. here's the authentication section of exim4.conf.template: begin authenticators cram_md5: driver = cram_md5 public_name = CRAM-MD5 client_name = ${extract{1}{:}{${lookup{$ host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}} client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}} PASSWDLINE=${sg{\ ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}\ }\ {\\N[\\^]\\N}\ {^^}\ } plain: driver = plaintext public_name = PLAIN .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS client_send = "<; ${if !eq{$tls_cipher}{}\ {^${extract{1}{:}{PASSWDLINE}}\ ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}\ }fail}" .else client_send = "<; ^${extract{1}{:}{PASSWDLINE}}\ ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}" .endif login: driver = plaintext public_name = LOGIN .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS # Return empty string if not non-TLS AND looking up $host in passwd-file # yields a non-empty string; fail otherwise. client_send = "<; ${if and{\ {!eq{$tls_cipher}{}}\ {!eq{PASSWDLINE}{}}\ }\ {}fail}\ ; ${extract{1}{::}{PASSWDLINE}}\ ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}" .else # Return empty string if looking up $host in passwd-file yields a # non-empty string; fail otherwise. client_send = "<; ${if !eq{PASSWDLINE}{}\ {}fail}\ ; ${extract{1}{::}{PASSWDLINE}}\ ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}" .endif dovecot_login: driver = dovecot public_name = LOGIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1 dovecot_plain: driver = dovecot public_name = PLAIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1 How can I fight insomnia? Discover how on Yahoo! Answers. http://ph.answers.yahoo.com

2 1