- dovecot - dovecot.org

Dovecot GSSAPI Authentication problem
by Lucas Castro 06 Aug '21

06 Aug '21

Hello, I'm getting problem to setup dovecot imap/pop service authentication through Kerberos. Already read https://wiki.dovecot.org/Authentication/Kerberos. My guess is kerberos is working but something goes wrong after. The keytab and ticket ( for ldap userdb lookup ) -rw------- 1 dovecot dovecot 498 ago 3 20:20 /etc/dovecot/imap.keytab -rw------- 1 dovecot root 1503 ago 4 11:40 /etc/dovecot/imap.ticket dovecot --version 2.3.13 (89f716dc2) the dovecot setting # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-7-amd64 x86_64 Debian 11.0 # Hostname: postfix10.zw.local auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/imap.keytab auth_mechanisms = gssapi auth_username_translation = /@ import_environment = TZ KRB5CCNAME=/etc/dovecot/imap.ticket KRB5_KTNAME=/etc/dovecot/imap.keytab mail_gid = 5000 mail_home = /var/mail/virtual/%d/%n mail_location = maildir:~/mail mail_privileged_group = mail mail_uid = 5000 namespace inbox { disabled = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = type = private } protocols = " imap lmtp pop3" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { postmaster_address = postmaster(a)zw.local } When I launch Thunderbird, mail log raise this Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client in: AUTH#0111#011GSSAPI#011service=pop3#011session=Q3GdfL7IvLmsEAAs#011lip=10.16.0.220#011rip=172.16.0.44#011lport=110#011rport=47548 Aug 4 13:42:23 postfix10 dovecot: auth: Debug: gssapi(?,172.16.0.44,<Q3GdfL7IvLmsEAAs>): Using all keytab entries Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client passdb out: CONT#0111#011 Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client in: CONT<hidden> Aug 4 13:42:23 postfix10 dovecot: auth: Debug: gssapi(user0(a)zw.local,172.16.0.44,<Q3GdfL7IvLmsEAAs>): security context state completed. Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client passdb out: CONT#0111#011YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvsoco75BA/W0B9tS+UmJnunUg6vIcO5wr0fzZ7iGmCpsz0K2vL/qniGISDIwF9hDXXxs79bljbZE8Yx4dujqVuTPGMtewfhDtNfRNgYGNk/z28sDz7fs/dpIMKF2FAA1m9pFjBupQ1VkGbzMYc77U Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client in: CONT<hidden> Aug 4 13:42:23 postfix10 dovecot: auth: Debug: gssapi(user0(a)zw.local,172.16.0.44,<Q3GdfL7IvLmsEAAs>): Negotiated security layer Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client passdb out: CONT#0111#011BQQF/wAMAAAAAAAAAdf8bQH///86U2L5ErmqfWFYNQA= Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client in: CONT<hidden> Aug 4 13:42:23 postfix10 dovecot: auth: Error: gssapi(user0(a)domain1.zw.local,172.16.0.44,<Q3GdfL7IvLmsEAAs>): All password databases were skipped Aug 4 13:42:23 postfix10 dovecot: auth: Debug: auth(user0(a)domain1.zw.local,172.16.0.44,<Q3GdfL7IvLmsEAAs>): Auth request finished Aug 4 13:42:25 postfix10 dovecot: auth: Debug: client passdb out: FAIL#0111#011user=user0@domain1.zw.local#011code=temp_fail#011original_user=user0@ZW.LOCAL Aug 4 13:42:25 postfix10 dovecot: pop3-login: Debug: Ignoring unknown passdb extra field: original_user Can someone help on this? -- Lucas Castro

2 2

Pigeonhole v0.5.16 released
by Timo Sirainen 06 Aug '21

06 Aug '21

Hi, Pigeonhole release for Dovecot v2.3.16. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.16.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.16.t…> https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.16.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.16.t…> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * .dovecot.sieve.log file now includes year in the header. * Change Sieve script result execution to delay definitive action execution to the end of a successful Sieve script execution session. This is part of an effort to solve problems with the Sieve duplicate test. As a side-effect, some rare temporary-error cases yield different results, in which partial failure is more likely.

1 0

Dovecot Debian repo instructions need updating
by Laura Smith 05 Aug '21

05 Aug '21

Re: https://doc.dovecot.org/installation_guide/dovecot_community_repositories/d… The instructions need updating for two reasons: 1) Keep up to date with Debian releases (https://wiki.debian.org/DebianReleases) i.e. remove reference to 8.0 "Jessie" and replace with 10.0 "Buster". 2) The instructions presented for key handling are not inline with Debian best-practices. As per https://wiki.debian.org/DebianRepository/UseThirdParty: "The key MUST be downloaded over a secure mechanism like HTTPS to a location only writable by root, which SHOULD be /usr/share/keyrings. The key MUST NOT be placed in /etc/apt/trusted.gpg.d or loaded by apt-key add. A sources.list entry SHOULD have the signed-by option set. The signed-by entry MUST point to a file, and not a fingerprint."

2 4

quota_grace
by dovecot＠ptld.com 05 Aug '21

05 Aug '21

There isn't much documentation on quota_grace. How would you disable quota grace? quota_grace = 0 quota_grace = 0% quota_grace = 0m quota_grace = -1 Assuming "0" isn't an "unlimited" setting?

2 1

dovecot + Procmail -> junk emails
by Stephane Magnier 03 Aug '21

03 Aug '21

Hi, Having moved from 'mbox' to 'Maildir', I'm trying to use a way to move a spam email to the Junk folder I declared the junk folder as; namespace inbox { type = private disabled = no ignore_on_failure = no list = yes subscriptions = yes #hidden = no #inbox = yes #prefix = INBOX/ mailbox "Drafts" { auto = subscribe special_use = \Drafts } mailbox "Junk" { auto = subscribe autoexpunge = 12 weeks special_use = \Junk } mailbox "Trash" { auto = no autoexpunge = 12 weeks special_use = \Trash } mailbox "Sent" { auto = subscribe special_use = \Sent } and spamassassin, very basic loadplugin Mail::SpamAssassin::Conf required_hits 5 required_score 5 rewrite_header subject [** SPAM ** ] add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_ spf_timeout 60 rewrite_header to [Email could be SPAM ] fold_headers 0 #defang_mime 0 report_safe 0 and Procmail.. basic and I used what I found on the webpage : https://wiki.dovecot.org/procmail <https://wiki.dovecot.org/procmail> DELIVER="/usr/lib/dovecot/deliver -d $LOGNAME" SHELL="/bin/bash" SENDMAIL="/usr/sbin/sendmail -oi -t" LOGFILE="/var/log/procmail.log" DEFAULT="/var/spool2/mail/%u :0fw | /bin/spamc -s any ####################################### #:0 #* ^X-Spam-Status: Yes #$DEFAULT ####################################### :0 w * ^X-Spam-Status: Yes | $DELIVER -m Junk # ## deliver to INBOX and stop # deliver to INBOX and stop :0 w | $DELIVER But with this config, a spam email, stay into the Inbox :-( /var/log/procmail.log... doesn't exist Thanks for you help

3 3

Multiple Quota Limit Configurations
by Joseph D Wagner 02 Aug '21

02 Aug '21

Is this a valid quota rule? *:storage=0,messages=0 Or do I need to make them two separate rules? Joseph D Wagner

1 0

Timo - is the v2.3.15 GCC limitation really necessarily or it's just a bug?
by Mart Pirita 02 Aug '21

02 Aug '21

Hello. So far I have successfully built Dovecot until v2.3.14 on Centos 4-6 (yes I know, they are old, but as they are remote servers, distros can't upgraded), and sometimes I have also met compilation issues, but after highlighting them, Timo have fixed the code. Found from similar thread (Dovecot 2.3.15 compilation fails https://dovecot.org/list/dovecot/2021-June/122412.html ) that new GCC is needed. However I can't find such requirement in v2.3.15 change log. As seems that I'm not the only one with compilation issues, then @Timo - can You please fix the code so that also v2.3.15 can compiled on older distros? Compilation options: ./configure --prefix=/usr --with-ssl=openssl --with-ssldir=/etc/ssl --sysconfdir=/etc --with-pam --without-bsdauth --without-sql --without-nss --without-ldap --without-pgsql --without-mysql --without-sqlite --with-rundir=/var/run/dovecot --without-cassandra --without-lucene --without-solr --without-textcat --without-libcap --without-stemmer --disable-rpath --disable-dependency-tracking --disable-silent-rules --without-gssapi --without-cdb Compilation error: builtin-strftime -c -o test-smtp-params.o test-smtp-params.c test-smtp-params.c:29: error: unknown field `data' specified in initializer test-smtp-params.c:29: warning: missing braces around initializer test-smtp-params.c:29: warning: (near initialization for `test_params_buffer1.<anonymous>') test-smtp-params.c:30: warning: missing initializer test-smtp-params.c:30: warning: (near initialization for `test_params_buffer1.<anonymous>.<anonymous>.used') test-smtp-params.c:30: error: unknown field `used' specified in initializer test-smtp-params.c:31: warning: excess elements in struct initializer test-smtp-params.c:31: warning: (near initialization for `test_params_buffer1') test-smtp-params.c:33: error: unknown field `data' specified in initializer test-smtp-params.c:33: warning: missing braces around initializer test-smtp-params.c:33: warning: (near initialization for `test_params_buffer2.<anonymous>') test-smtp-params.c:34: warning: missing initializer test-smtp-params.c:34: warning: (near initialization for `test_params_buffer2.<anonymous>.<anonymous>.used') test-smtp-params.c:34: error: unknown field `used' specified in initializer test-smtp-params.c:35: warning: excess elements in struct initializer test-smtp-params.c:35: warning: (near initialization for `test_params_buffer2') make[3]: *** [test-smtp-params.o] Error 1 make[3]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.3.15/src/lib-smtp' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.3.15/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.3.15' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.7364 (%build) -- Mart

9 12

SQL Backend for IMAP METADATA Dictionary
by Joseph D Wagner 01 Aug '21

01 Aug '21

I've seen documentation on using a SQL backend for quota dictionary and passdb&userdb dictionary. However, I can't find any examples of a SQL backend for IMAP METADATA / mail_attributes_dict. Is this combination possible? If so, is there an example somewhere? I am unsure what data structures it's expected or how to create the map entries for it. Thanks in advance. Joseph D. Wagner

2 4

Disable authentication for submission service
by Dan Conway 01 Aug '21

01 Aug '21

Hello, Is it possible to disable the requirement for authentication on the submission service? I'm trying to require authentication for all, except for a handful of IP addresses. Thank you. ehlo test.com 250-aaa 250-AUTH PLAIN LOGIN 250-BURL imap 250-CHUNKING 250-DSN 250-ENHANCEDSTATUSCODES 250-SIZE 250 PIPELINING MAIL FROM:<test(a)test.com> 530 5.7.0 Authentication required.

8 11

Re: check_policy_service sends size=0
by dovecot＠ptld.com 01 Aug '21

01 Aug '21

> It sounds like a better approach would be to make Dovecot reject any > email no matter what the size is (even size=0) if a user is over > quota. I'll take further discussion to the dovecot mailing list then. If you are not aware, dovecot has by default a 10% over quota grace. So even being a couple of bytes over quota it would still accept a small message.

3 3