- dovecot - dovecot.org

[Dovecot] Weird Dovecot 1.1.6 + pop3s certificate issues
by Bernhard Schmidt 14 Feb '09

14 Feb '09

Hello everyone, I've been asked by a colleague to have a look at some extremely weird dovecot SSL issue they are seeing on one of the student mailservers. They are running dovecot 1.1.6 (yes, I know, a bit old ...) on SLES 10.2 x86_64 with imap(+starttls), imaps, pop3(+starttls) and pop3s enabled. Every couple of weeks the pop3s and pop3+starttls part bail out out. Clients can't connect, when you try openssl s_client you get this: 15960:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1.c:100: 15960:error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed:rsa_eay.c:699: 15960:error:1408D07B:SSL routines:SSL3_GET_KEY_EXCHANGE:bad signature:s3_clnt.c:1414: server logs don't show much except for various SSL_accept() errors, including TLS handshaking: SSL_accept() failed: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac TLS handshaking: SSL_accept() syscall failed: Connection reset by peer TLS handshaking: SSL_accept() failed: error:1409441B:SSL routines:SSL3_READ_BYTES:tlsv1 alert decrypt error imaps and imap+starttls work fine during the whole time (and always have), although they are much more used. Restarting dovecot fixes the issue for a couple of weeks. Does anyone have an idea where to start debugging? As far as I understand the whole SSL_accept() thing is a giant blackbox for Dovecot, but how comes it only affects POP3? dovecot -n (paths and addresses altered, not sure how much I can reveal without getting shot): # 1.1.6: /mnt//usr/local/etc/dovecot.conf # OS: Linux 2.6.16.60-0.25-smp x86_64 SUSE Linux Enterprise Server 10 # (x86_64) protocols: imap imaps pop3 pop3s listen(default): [ipv6]:143, ipv4:143 listen(imap): [ipv6]:143, ipv4:143 listen(pop3): [ipv6]:110, ipv4:110 ssl_listen(default): [ipv6]:993, ipv4:993 ssl_listen(imap): [ipv6]:993, ipv4:993 ssl_listen(pop3): [ipv6]:995, ipv4:995 disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable(default): /mnt//usr/local/libexec/dovecot/imap-login login_executable(imap): /mnt//usr/local/libexec/dovecot/imap-login login_executable(pop3): /mnt//usr/local/libexec/dovecot/pop3-login login_process_per_connection: no login_max_connections: 128 max_mail_processes: 2500 mail_uid: campus mail_gid: lmu mail_location: maildir:~/Maildir:INDEX=/home/something/indexes/%-1.1n/%n mmap_disable: yes mail_nfs_index: yes mail_executable(default): /mnt//usr/local/libexec/dovecot/imap mail_executable(imap): /mnt//usr/local/libexec/dovecot/imap mail_executable(pop3): /mnt//usr/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /mnt//usr/local/lib/dovecot/imap mail_plugin_dir(imap): /mnt//usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /mnt//usr/local/lib/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %08Xv%08Xu namespace: type: private separator: . prefix: INBOX. inbox: yes list: yes subscriptions: yes auth default: worker_max_request_count: 500 passdb: driver: ldap args: /mnt//usr/local/etc/dovecot-ldap.conf userdb: driver: prefetch userdb: driver: ldap args: /mnt//usr/local/etc/dovecot-ldap.conf socket: type: listen master: path: /var/run/dovecot/auth-master mode: 384 user: campus group: lmu plugin: quota: maildir quota_rule: Trash:ignore quota_rule2: *:storage=512M Anyone having an idea? bernhard

1 0

Re: [Dovecot] Dovecot-antispam does not work
by Jehan Pagès 14 Feb '09

14 Feb '09

Hi all, just to say that finally the patch of Marcin worked great. Just my configuration is different from yours to get it work: antispam_signature = X-DSPAM-Signature antispam_trash = trash;Trash;Deleted Items antispam_spam = SPAM;Junk antispam_dspam_binary = /usr/bin/dspam antispam_dspam_args = --client;--source=error;--user;%u antispam_mail_tmpdir = /tmp The difference here is in the syntax. You write "--user=somemail" though in the manual, it is written "--user somemail". But also you were proposing 2 lines "antispam_dspam_args" though in all my tests, when I was doing such a thing, the second line seemed to override the first (in the launch logs, only the second line was displayed, so I guess...). Are you sure that it works exactly the way you intend to, Marcin? And that the "--source=error" (your first line) is indeed added as a parameter to the call of dspam? For the patch to the dovecot-antispam, probably it should not be integrated "as is", but I guess that the return code of call_dspam function must probably be checked and fixed if the call can succeed but still give a failure return code. I set Johannes as a main recipient, maybe you will see this email. Bye and thanks all. Jehan On Wed, Feb 4, 2009 at 12:45 PM, Jehan Pagès <jehan.marmottard(a)gmail.com>wrote: > Hi, > > On Wed, Feb 4, 2009 at 12:40 PM, Marcin Rzepecki <m.rzepecki(a)iem.pw.edu.pl > > wrote: > >> Wed, Feb 04, 2009 at 12:12:44PM +0100, Jehan Pag?s wrote: >> > I saw this piece of code and did the same as you in my change of course. >> > Unfortunately, it didn't work (no logged "marked as SPAM", nor change in >> my >> > stats. I have dovecot 1.1.7-r1 though, so it is probably the reason. >> >> Logging '...markes as SPAM..' lines to syslog is my idea, I can send some >> dspam patches, to make it work. It's usefull for me. > > > Ok. Anyway the stats don't change... > > >> >> Are you using mbox or maildir? If you are using mbox, try to upgrade to >> Dovecot >=1.1.8 - it contains several mbox bug fixes (e.g 'Next message >> unexpectedly lost') which are needed to make antispam plugin work. > > > No maildir... > I am doing some stuffs about another way to interact dspam/dovecot/postfix > and will go back to this issue soon. > > Jehan >

2 1

[Dovecot] "failed to map segment from shared object: Cannot allocate memory"
by Vegard Svanberg 13 Feb '09

13 Feb '09

>From /var/log/auth.log (Dovecot 1.1.4 on Ubuntu 8.10): Feb 10 08:29:06 home dovecot-auth: PAM unable to dlopen(/lib/security/pam_ck_connector.so): libdbus-1.so.3: failed to map segment from shared object: Cannot allocate memory Feb 10 08:29:06 home dovecot-auth: PAM adding faulty module: /lib/security/pam_ck_connector.so English, please? :) Strangely, it seemed to disappear after increasing login_processes_count, login_max_processes_count and/or auth_worker_max_count. -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

2 3

[Dovecot] Production server migration from mbox to maildir ( need advice )
by Frank Bonnet 13 Feb '09

13 Feb '09

Hello I'm going to change the raid array of my mailhub in fews days/weeks and I wonder if it would be a good idea to take the opportunity of this migration to also change the storage method from mailbox to maildir. I've never used maildir on my production server only on small satellites. So I really need advice of admins that use maildir format on prod servers. My server has approx 3500 users/mailboxes that is approx 450 Gb of data. The OS is Debian etch amd64 but could change also during the migration Opensuse X86_64, CAOS-NSA, FreeBSD 64 are some options. Any infos/experiences welcome, I'll summarize answers. Thanks a lot.

4 8

[Dovecot] Corrupted index cache file
by Proskurin Kirill 13 Feb '09

13 Feb '09

Hello all. I run on a problems? dovecot: Feb 13 08:36:13 Error: IMAP(logistic(a)fxclub.org): Maildir filename has wrong W value: /var/spool/dovecot/domains/fxclub.org/logistic/.fxclub/1135926892.Re1a4ad89Q1436.newmail.fxclub.org,S=24630,W=2 4849:2, dovecot: Feb 13 08:36:13 Error: IMAP(logistic(a)fxclub.org): Corrupted index cache file /var/spool/dovecot/domains/fxclub.org/logistic/.fxclub/dovecot.index.cache: Broken virtual size for mail UID 332 dovecot: Feb 13 08:36:13 Info: IMAP(logistic(a)fxclub.org): Disconnected: Disconnected bytes=435/135596 dovecot: Feb 13 08:36:14 Info: imap-login: Login: user=<logistic(a)fxclub.org>, method=PLAIN, rip=194.87.53.162, lip=78.129.148.74, TLS dovecot: Feb 13 08:36:15 Info: IMAP(chief(a)omsk.fxclub.org): Disconnected: Logged out bytes=349/5517 dovecot: Feb 13 08:36:15 Info: IMAP(chief(a)omsk.fxclub.org): Disconnected: Logged out bytes=63/280 dovecot: Feb 13 08:36:15 Error: IMAP(logistic(a)fxclub.org): FETCH for mailbox fxclub UID 332 got too little data: 318 vs 319 dovecot: Feb 13 08:36:15 Error: IMAP(logistic(a)fxclub.org): Maildir filename has wrong W value: /var/spool/dovecot/domains/fxclub.org/logistic/.fxclub/1135926892.Re1a4ad89Q1436.newmail.fxclub.org,S=24630,W=2 4849:2, dovecot: Feb 13 08:36:15 Error: IMAP(logistic(a)fxclub.org): Corrupted index cache file /var/spool/dovecot/domains/fxclub.org/logistic/.fxclub/dovecot.index.cache: Broken virtual size for mail UID 332 dovecot: Feb 13 08:36:15 Info: IMAP(logistic(a)fxclub.org): Disconnected: Disconnected bytes=395/135319 It got then reconfigure MS Outlook 2007 SP1 to make a full download of email - not only headers. Then I reconfig it back to headers only - all work fine. How can I fix it? It is safe to delete index files? Self healing seems to not work here. #dovecot -n mail# dovecot -n # 1.1.8: /usr/local/etc/dovecot.conf # OS: FreeBSD 7.0-RELEASE-p9 i386 ufs base_dir: /var/run/dovecot/ log_path: /var/log/dovecot/dovecot.log info_log_path: /var/log/dovecot/dovecot.log protocols: imap imaps pop3 pop3s managesieve listen(default): * listen(imap): * listen(pop3): * listen(managesieve): *:2000 ssl_ca_file: /usr/local/etc/certs/GlobalSignCA.crt ssl_cert_file: /usr/local/etc/certs/fxclub_org.crt ssl_key_file: /usr/local/etc/certs/fxclub_org.key ssl_cipher_list: ALL:!LOW:!SSLv2 login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_executable(managesieve): /usr/local/libexec/dovecot/managesieve-login login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(pop3): no login_greeting_capability(managesieve): no login_process_size: 128 login_processes_count: 20 login_max_processes_count: 512 mail_max_userip_connections(default): 256 mail_max_userip_connections(imap): 256 mail_max_userip_connections(pop3): 20 mail_max_userip_connections(managesieve): 10 verbose_proctitle: yes first_valid_gid: 0 mail_privileged_group: mail mail_uid: dmail mail_gid: dmail mail_location(default): maildir:/var/spool/dovecot/domains/%d/%n/ mail_location(imap): maildir:/var/spool/dovecot/domains/%d/%n/ mail_location(pop3): maildir:/var/spool/dovecot/domains/%d/%n/ mail_location(managesieve): mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_executable(managesieve): /usr/local/libexec/dovecot/managesieve mail_process_size: 512 mail_plugins(default): quota imap_quota autocreate mail_plugins(imap): quota imap_quota autocreate mail_plugins(pop3): quota mail_plugins(managesieve): mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 mail_plugin_dir(managesieve): /usr/local/lib/dovecot/managesieve imap_client_workarounds(default): delay-newmail tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail tb-extra-mailbox-sep imap_client_workarounds(pop3): imap_client_workarounds(managesieve): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh pop3_client_workarounds(managesieve): sieve_storage(default): sieve_storage(imap): sieve_storage(pop3): sieve_storage(managesieve): % sieve(default): sieve(imap): sieve(pop3): sieve(managesieve): ~/.dovecot.sieve auth default: mechanisms: plain login user: dovecot-auth username_format: %Lu verbose: yes worker_max_count: 100 passdb: driver: ldap args: /usr/local/etc/dovecot-ldap.conf userdb: driver: ldap args: /usr/local/etc/dovecot-ldap.conf socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 user: exim master: path: /var/run/dovecot/auth-master mode: 384 user: dmail plugin: quota: maildir quota_rule: *:storage=1024M quota_rule2: Trash:storage=1256M quota_rule3: SPAM:ignore quota_warning: storage=80%% /usr/local/bin/quota-warning.sh 80 quota_warning2: storage=95%% /usr/local/bin/quota-warning.sh 95 autocreate: Trash autocreate2: Sent autocreate3: Spam autosubscribe: Trash autosubscribe2: Sent autosubscribe3: Spam -- Best regards, Proskurin Kirill

3 3

[Dovecot] Bynari Insight connector
by Maarten Bezemer 13 Feb '09

13 Feb '09

Hi, Since IMAP support in Outlook is 'somewhat broken', and Bynari has some promising specifications on their website, I might want to try their product. Does anyone here have any experience with their software? Would you recommend it? Or maybe point me at alternatives? (If there are any.. aside from ditching Outlook of course :-P ) Regards, Maarten Bezemer

3 3

[Dovecot] Google Summer of Code
by Charles Marcus 13 Feb '09

13 Feb '09

On another list, someone wrote: > Google Summer of Code is on it's Way. Start collecting students to > throw at projects now! This sounds like a great idea for dovecot too... Timo, maybe there are a few dovecot enhancements that would be good candidates for this? Maybe the test suite? Replication? LMTP server? Anyway, its just a thought... -- Best regards, Charles

1 0

[Dovecot] Corrupted index cache file
by Frank Bonnet 13 Feb '09

13 Feb '09

Hello I got this error yesterday dovecot: Feb 11 16:07:27 Error: IMAP(dumontj): FETCH for mailbox Sent UID 7139 got too little data: 11112 vs 11160 dovecot: Feb 11 16:07:27 Error: IMAP(dumontj): Corrupted index cache file /user/dumontj/.imap/Sent/dovecot.index.cache: Broken virtual size for mail UID 7139 Does remove the cache will cure the problem ? Thanks

4 5

Re: [Dovecot] Mapping usernames [RESOLVED]
by Henry 13 Feb '09

13 Feb '09

Resolved. For others, this is the simple solution which works for me: /etc/dovecot.conf: auth default { userdb passwd-file { args = /etc/passwd } passdb passwd-file { args = scheme="MD5-CRYPT" /etc/dovecot.passwd } } /etc/dovecot.passwd: bob@vhost.com:$1$yAOjs09l$...::::::userdb_user=vabc_bob (the encrypted password "$1$yAOjs09l$..." comes from /etc/shadow) /etc/passwd: vabc_bob:x:20838:2362:bob:/home/mailusers/vabc_bob:/sbin/nologin "abc" could also be the domain ("vhost"), but this might be too large for really long domain names. So we rather use a short unique prefix for each domain. Cheers Henry -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.5 (GNU/Linux) mOIESXlwDRECAOycneJPOwSkETRkjJZdArag8V2rKOR2IUwlDOydIZXv/ITDlWDU dookzEdWh7Ektf1Jlh+YbPNEGoPpQunL8O8AoJbWmNkpoX7jP0Sw/5rDN2eKGHR7 Af9mxTqQ/j3C5LkrTRo9iCTt1TxoqPi6R/w0KkIAuTXBq6j+vIFJcOFgABlMQoXs V2crh1BUCmXVsV1puRJsLWKbAf4uL0V+N8WF4rvWHmJiYjgDn6exv3XHS0F6NhRz n1KVnV0XDWMDq/B/tmj4L2JYxEzWzeNulC5yQBOdx/dLU12XtCNIZW5yeSAoemVu LmNvLnphKSA8aGVucnlAemVuLmNvLnphPohgBBMRAgAgBQJJeXANAhsjBgsJCAcD AgQVAggDBBYCAwECHgECF4AACgkQCHhhdg2iQafVGACdEMtEuUGIW2XJyn9Fig7n sX4qzb4An0PGStBZvAP2qtzYP3SGlzsllzLjuI0ESXlwDRACAMsi4nl8/Yar2m9F ex4dFDgWylLgScQrEhhb2xN0Upcglm60nHQD7c1rP+63Iu+lU0eWvyr8o3JTCN4y PpoGMOMAAwUCAIUnLDMW/tz+qsYaOPyoh7HdAYqcrvVar7t+eKpihNBqfP4CT2Py aRVMN6cSJj9NKZDW6b0QQSCGgN7PpzrLqf6ISQQYEQIACQUCSXlwDQIbDAAKCRAI eGF2DaJBpxeiAJ9cNiuaftSoWke75RT1pn7qoibFfgCdHl6BgP9f450/oziDwaMM w49UeHQ= =qgmL -----END PGP PUBLIC KEY BLOCK-----

1 0

[Dovecot] file name missing component in error message
by Mike Abbott 13 Feb '09

13 Feb '09

Hi, we occasionally see this error message from maildir_mail_set_cache_corrupted(): "Maildir filename has wrong W value: %s/%s" but the path it prints is missing a component, specifically, the new/cur/tmp component. For example: /Volumes/Spool/user/maildir/12345.M123P123.example.com.... should be /Volumes/Spool/user/maildir/cur/12345.M123P123.example.com.... This is using dovecot-1.1.10. Now I just have to figure out why the file is corrupted in the first place.

2 3