- dovecot - dovecot.org

[Dovecot] dovecot SASL as auth backend to exim?
by OpenMacNews 29 Aug '06

29 Aug '06

hi, i'm running dovecot branch_10 cvs on OSX 10.4.7 w/ exim 4.63. i'd like to use Dovecot's SASL as an auth backend to exim, instead of Cyrus-SASL. @ dovecot's sasl page: http://wiki.dovecot.org/Sasl i know there's a patch against exim 4.43: http://www.exim.org/eximwiki/AuthenticatedSmtpUsingDovecot that, purportedly, enables EXIM to use dovecot's SASL as an auth backend. questions: (1) with 'recent' updates to both dovecot/exim, is that patch still required? (2) if so, is that patch still viable/safe against 4.63? (3) can anyone provide a _specific_ example of the exim config(s) (Makefile, Router, Transport) they're using to 'make it work'? i've asked this question @ exim list, but, other than a 'why would you bother?' and a 'good luck with your efforts', no "joy" so far ... thanks, richard -- /"\ \ / ASCII Ribbon Campaign X against HTML email, vCards / \ & micro$oft attachments [GPG] OpenMacNews at gmail dot com fingerprint: 50C9 1C46 2F8F DE42 2EDB D460 95F7 DDBD 3671 08C6

2 1

[Dovecot] Auto-blacklisting hosts after too many failed logins
by Amon Ott 29 Aug '06

29 Aug '06

Hi folks, first of all thanks for Dovecot, I appreciate it a lot. On one of our servers, we experience regular tries to brute force logins, probably based on harvested mail addresses. Now I wonder if dovecot has or could in future have some mechanism to blacklist remote IP addresses after a configurable number of failures to login to any account. Blacklisted IPs could simply be disconnected without giving them a chance to do anything. After e.g. one day or one hour of no further connection, the blacklist entry could be dropped. As a bonus, it would be great to have a way to close the POP3/IMAP firewall ports to these IPs to avoid dovecot seeing the connection at all. A kind of blacklist status file on disk would be enough, from which some cron job could fill a firewall chain. If necessary, I would try to add this functionality myself. Amon. -- http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22

5 4

[Dovecot] 1.0rc7 working well
by Bruce Lane 29 Aug '06

29 Aug '06

Fellow dove-users, Just a note to say that Dovecot 1.0rc7 is working very well indeed, supplying SPOP3, regular POP3, and TLS/SASL services on FreeBSD 6.1 Production, in conjunction with Postfix 2.3.2. I have authentication methods PAM and passwd in use. Keep the peace(es). -=-=-=-=-=-=-=-=-=-=-=- Bruce Lane, Owner & Head Hardware Heavy, Blue Feather Technologies -- http://www.bluefeathertech.com kyrrin (at) bluefeathertech do/t c=o=m "If Salvador Dali had owned a computer, would it have been equipped with surreal ports?"

2 1

[Dovecot] dovecot-1.0_rc7 crashes (Login process died too early) with repeated deletes from thunderbird
by Tim Schafer 28 Aug '06

28 Aug '06

I can consistently reproduce a crash in dovecot: Select 20 or more messages and copy them to a test folder. Go into that test folder and SHIFT-DEL the messages rapidly (holding down SHIFT-DEL works best) Just rapidly DELing them (even holding down DEL) doesn't do it (unless it's the Trash folder) I'm using the following namespace (in case that's relevant) namespace private { separator = . prefix = INBOX. inbox = yes } The /var/log/syslog for the session reads: Aug 24 14:58:54 hostname dovecot: Dovecot v1.0.rc7 starting up Aug 24 14:58:55 hostname slapd[7243]: conn=147 fd=9 ACCEPT from IP=127.0.0.1:41074 (IP=0.0.0.0:389) Aug 24 14:58:55 hostname slapd[7243]: conn=147 op=0 BIND dn="" method=128 Aug 24 14:58:55 hostname slapd[7243]: conn=147 op=0 RESULT tag=97 err=0 text= Aug 24 14:59:09 hostname dovecot: auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Ilip=192.168.0.7^Irip=192.168.0.100 Aug 24 14:59:09 hostname dovecot: auth(default): client out: CONT^I1^I Aug 24 14:59:09 hostname dovecot: auth(default): client in: CONT^I1^IAHRdfmkerjejfkdeie Aug 24 14:59:09 hostname dovecot: auth(default): client out: OK^I1^Iuser=username Aug 24 14:59:09 hostname dovecot: auth(default): master in: REQUEST^I1^I10081^I1 Aug 24 14:59:09 hostname dovecot: auth(default): master out: USER^I1^Iusername^Isystem_user=username^Iuid=1000^Igid=100^Ihome=/home/username Aug 24 14:59:09 hostname dovecot: imap-login: Login: user=<username>, method=plain, rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:10 hostname dovecot: auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Ilip=192.168.0.7^Irip=192.168.0.100 Aug 24 14:59:10 hostname dovecot: auth(default): client out: CONT^I1^I Aug 24 14:59:10 hostname dovecot: auth(default): client in: CONT^I1^IAHRdfmkerjejfkdeie Aug 24 14:59:10 hostname dovecot: auth(default): client out: OK^I1^Iuser=username Aug 24 14:59:10 hostname dovecot: auth(default): master in: REQUEST^I2^I10082^I1 Aug 24 14:59:10 hostname dovecot: auth(default): master out: USER^I2^Iusername^Isystem_user=username^Iuid=1000^Igid=100^Ihome=/home/username Aug 24 14:59:10 hostname dovecot: imap-login: Login: user=<username>, method=plain, rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:12 hostname dovecot: auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Ilip=192.168.0.7^Irip=192.168.0.100 Aug 24 14:59:12 hostname dovecot: auth(default): client out: CONT^I1^I Aug 24 14:59:12 hostname dovecot: auth(default): client in: CONT^I1^IAHRdfmkerjejfkdeie Aug 24 14:59:12 hostname dovecot: auth(default): client out: OK^I1^Iuser=username Aug 24 14:59:12 hostname dovecot: auth(default): master in: REQUEST^I3^I10085^I1 Aug 24 14:59:12 hostname dovecot: auth(default): master out: USER^I3^Iusername^Isystem_user=username^Iuid=1000^Igid=100^Ihome=/home/username Aug 24 14:59:12 hostname dovecot: imap-login: Login: user=<username>, method=plain, rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:14 hostname dovecot: IMAP(username): Disconnected Aug 24 14:59:14 hostname dovecot: imap-login: Disconnected: rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:14 hostname last message repeated 2 times Aug 24 14:59:14 hostname dovecot: Login process died too early - shutting down Aug 24 14:59:14 hostname dovecot: imap-login: Disconnected: rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:14 hostname slapd[7243]: conn=147 op=1 UNBIND Aug 24 14:59:14 hostname slapd[7243]: conn=147 fd=9 closed -- Regards, Tim Schafer

7 9

[Dovecot] Reproduced the Login process died too early issue.
by Johnny Vestergaard 28 Aug '06

28 Aug '06

Hi. I tried for some time to reproduce the "Login process died too early issue". It seems related to when the system run out of file descriptors, to force the issue i forwarded 3k of messages trough the server(using thunderbird). I also tried with my usual mail application - mail.app, but no luck there. Aug 26 18:46:36 soekris postfix/cleanup[14739]: fatal: accept connection: Too many open files in system Aug 26 18:46:36 soekris dovecot: imap-login: imap-login: can't load library 'libcrypto.so.12.0' Aug 26 18:46:37 soekris dovecot: child 16480 (login) returned error 4 Aug 26 18:46:37 soekris dovecot: child 23241 (login) returned error 4 Aug 26 18:46:37 soekris dovecot: Login process died too early - shutting down Aug 26 18:46:37 soekris dovecot: imap-login: imap-login: can't load library 'libc.so.39.0' Aug 26 18:46:36 soekris postfix/bounce[24767]: fatal: open file bounce 5D0B141743: Too many open files in system /jkv

4 4

[Dovecot] How to make 'pureged mails to Trash Box'?
by hshh 28 Aug '06

28 Aug '06

Hi, Is it possible add feature to make purged mails to Trash Box for default?

1 0

Re: [Dovecot] LDAP authentication via PAM
by Stephen Warren 28 Aug '06

28 Aug '06

Oscar A. Valdez wrote: > El lun, 10-04-2006 a las 11:17 -0600, Stephen Warren escribió: >> Oscar A. Valdez wrote: >>> Before trying Luis' suggestion, I had the following in /var/log/messages: >>> >>> dovecot(pam_unix)[4691]: check pass; user unknown >>> dovecot(pam_unix)[4691]: authentication failure; logname= uid=0 euid=0 >>> tty= ruser= rhost= >> >> I believe this is because your PAM configuration checks both local files >> (pam_unix: /etc/passwd) and pam_ldap: LDAP. The pam_unix module can't >> find the user in the local database, and complains, then LDAP finds the >> user information, and allows the login/whatever. >> >> The solution is probably to create a /etc/pam.d/system-auth-ldap-only >> file that doesn't reference pam_unix, and use that pam configuration for >> network services such as Dovecot. >> >> Or, possible, check pam_ldap first with a "sufficient" setting; perhaps >> this will stop pam_unix being tried at all? >> >> I keep meaning to try this, since I'm seeing those messages from a >> number of network services, but have never gotten around to it! > > They tend to fill up the message log quickly, so if you get around to > it, I'm interested in your fix. Well, I finally got around to fiddling with this, and I now have created a /etc/pam.d/system-auth that doesn't trigger the annoying authentication failure messages in syslog. The file is shown below. I've tested this by connecting in using SSH (setup for PAM) both as a user in the local /etc/passwd and as a user in LDAP. Also, I tested /etc/passwd users with the LDAP server stopped, and that worked too. Finally, I tested connecting to Dovecot as an LDAP user. Note: The only section that references LDAP is the auth section. That's because account and session rely on pam_unix to pick up the information using nss_ldap (i.e. /etc/nsswitch.conf says "files ldap" for passwd, group, etc.) This seems to work for me... Also, note that my LDAP server stores Samba passwords too, so that's why the password section uses pam_smbpass (which in turn is setup to access LDAP via /etc/samba/smb.conf) rather than pam_ldap. This is so both the Unix and SMB passwords are updated in LDAP. Anyway, here's my file. Anyone want to pick holes in it? Indented lines are just mail formatting... #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_ldap.so debug auth sufficient /lib/security/$ISA/pam_unix.so use_first_pass likeauth auth required /lib/security/$ISA/pam_deny.so account required /lib/security/$ISA/pam_unix.so account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet account required /lib/security/$ISA/pam_permit.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 password sufficient /lib/security/$ISA/pam_smbpass.so use_authtok password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow password required /lib/security/$ISA/pam_deny.so session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so session required /lib/security/$ISA/pam_mkhomedir.so skel=/etc/skel/ umask=0077

1 0

[Dovecot] failed to start
by Don Citarella 28 Aug '06

28 Aug '06

Hello, i saw you posted on dovecot.org and was hoping you could assist with a problem i have with dovecot. I installed the attached file to webmin and clicked it said it installed correctly: Dovecot IMAP/POP3 Server in /usr/libexec/webmin/dovecot (372 kB) under category Servers I clicked the link and then clicked "Start Dovecot Server" from the webmin panel and got this error: Failed to start Dovecot : I assume this means a file is missing. My config file looks like this: dovecot=/usr/sbin/dovecot dovecot_config=/etc/dovecot.conf init_script=dovecot pid_file=/var/run/dovecot/master.pid There doesn't appear to be a dovecot directory in: etc/rc.d/init.d/ Perhaps that's the issue? I'm running Redhat Linux 4. Can you assist in any way? Any help is most appreciated. Thanks, Don

3 2

[Dovecot] vmysql: sql error[3]
by Charles M. Gerungan 27 Aug '06

27 Aug '06

I keep getting these messages in the log: @4000000044f1db7732acaddc dovecot: Error: auth(default): vmysql: sql error[3]: MySQL server has gone away I see that at least one user has the same problem: http://www.mail-archive.com/vchkpw@inter7.com/msg23311.html Unfortunately, no solution is given. I also found the MySQL Problems page on the wiki, but the issues are supposed to be resolved for my version of MySQL. The only way to get dovecot to authenticate again is to restart the daemon. Is there a solution to this problem? If yes, please share it! dovecot 1.0 RC7 FreeBSD 5.4-RELEASE-p17 #6 vpopmail 5.4.13 mysql version: Ver 14.12 Distrib 5.0.24, for portbld-freebsd5.4 (i386) using 4.3 Dovecot and vpopmail are compiled from source. MySQL is compiled from source via the FreeBSD ports system. -- Regards, Charles.

1 0

[Dovecot] imap service not working
by LeVA 26 Aug '06

26 Aug '06

Hi! I'm using dovecot-1.0.rc7 with pop3 and imap. The pop3 is ok, really, no problem at all. With imap, I have the following problem: From the client side it looks like it logs in - logs out - logs in - logs out... can not see any emails or directories. From the server side, I can see these in the logs: dovecot: Aug 26 22:29:00 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=x.x.x.x rip=x.x.x.x dovecot: Aug 26 22:29:00 Info: auth(default): client out: CONT 1 dovecot: Aug 26 22:29:00 Info: auth(default): client in: CONT 1 AHRlc3p0AGxvZmFzeg== dovecot: Aug 26 22:29:00 Info: auth(default): client out: OK 1 user=teszt MAIL=maildir:/ dovecot: Aug 26 22:29:00 Info: auth(default): master in: REQUEST 30 15660 1 dovecot: Aug 26 22:29:00 Info: auth(default): master out: USER 30 teszt uid=8010 gid=8010 home=/var/mail/virtual/teszt/Maildir/./ dovecot: Aug 26 22:29:00 Info: IMAP(teszt): Effective uid=8010, gid=8010 dovecot: Aug 26 22:29:00 Info: IMAP(teszt): maildir: data=/ dovecot: Aug 26 22:29:00 Info: IMAP(teszt): maildir: root=, index=, control=, inbox= dovecot: Aug 26 22:29:00 Info: imap-login: Login: user=<teszt>, method=plain, rip=x.x.x.x, lip=x.x.x.x, TLS These messages are repeating, but with an incrementing number: "USER 30 teszt". This number after the 'USER' word increments with every login. The user's mail directory has 770 perms, and owned by 8010:8010 (the teszt user's UID and GID). The cur/new/tmp folders gets created, but nothing more. The MTA on the server puts the messages inside the new/ folder, and I can get the mails with pop3 from the 'teszt' account. Only imap is acting funny. This "infinite loop" happens with Thunderbird, but I tried it with KMail too. The latter says right after the login procedure: "The connection to the server IMAP Account was unexpectedly closed or timed out. It will be re-established automatically if possible." Is there some script which makes the maildir folder "ready" for use (like the mkmaildir with courier imap), or is there some special file which I must put in it to make it work? Thanks for the help! Daniel -- LeVA

1 0