- dovecot - dovecot.org

[Dovecot] Client workaround?
by David King 24 May '06

24 May '06

I have a phone (LG CU320) with a built-in IMAP client. However, it has some issues. For one, the phone crashes if there are greater than some-as-of-yet-determined-number-of folders. That can't be worked around at the server, but this one can: After a long session of staring at tcpdump, it appears that when it logs in it does so like this: a001 LOGIN "username" myPassword This works unless one has funny characters in their password (which is usually the case). Why on earth it would put quotes around the username and NOT the password is beyond me (which is more likely to have special characters?) It does seem to check the CAPABILITY line to see what authentication is supported, because if I try it with a different (cyrus) server, instead of using LOGIN to authenticate, it uses AUTHENTICATE Dovecot presents that it supports AUTH=PLAIN, whereas Cyrus presents that it supports AUTH=PLAIN AUTH=LOGIN AUTH=CRAM-MD5 AUTH=GSSAPI. This is presumably because Dovecot prefers STARTTLS or simple IMAPS for authentication. So as I see it, getting this phone work with Dovecot and a password with special characters can take one of two forms (either of which I'll be happy to code): 1. Somehow getting Dovecot to look at the second token as if it *were* quoted. 2. Getting Dovecot to present and interpret AUTH=LOGIN (i. e. AUTHENTICATE), which appears to cause the phone to properly escape the password The first one really only fixes certain special characters, and leaves others still broken (like quotes themselves), and in fact violates IMAP4rev1. So I'd just make and run a local patch The second one fixes the problem more cleanly, and my code can be reused and submitted to the Dovecot commiters. So my question to anyone familiar with the codebase is, which of these options is more likely to work, and would the Dovecot team be interested in patches for either one?

2 2

[Dovecot] Re: Apple Mail and too many open files?
by Roger Weeks 24 May '06

24 May '06

On May 24, 2006, at 10:29 AM, Les Mikesell wrote: > On Wed, 2006-05-24 at 11:51, Roger Weeks wrote: > >> If you're running filesharing of ANY kind on your mail server, you >> should stop it. Mail servers should run mail, not run AFP and Samba >> and other things. > > Why? A robust OS can do many things at once up to its resource > limits. Sure it can. But in my experience, it's bad practice, both in the enterprise and in the service provider world. When your box gets hit with a denial of service attack, or 500 users decide to copy the latest cool video to their home dir, and it's also your mail and web server, all of your services go to hell. When you have a box dedicated to specific services, you can upgrade that box without affecting all of your services. If the box dies, not all of your services die. -- Roger J. Weeks Systems & Network Administrator Mendocino Community Network

1 0

[Dovecot] Re: Apple Mail and too many open files?
by Roger Weeks 24 May '06

24 May '06

> Date: Wed, 24 May 2006 19:55:41 +1000 > From: Rob Middleton <robm-dovecot(a)centenary.org.au> > Subject: Re: [Dovecot] Apple Mail and too many open files? > To: Alan Schmitt <alan.schmitt(a)polytechnique.org> > Cc: Dovecot List Mailing <dovecot(a)dovecot.org> > > OS X is configured by default with these numbers way too low. OS X has > some really dumb processes like AFP that will chew through all of your > open files and not cope cleanly with running out of allowable/ > available > filehandles. If you're running filesharing of ANY kind on your mail server, you should stop it. Mail servers should run mail, not run AFP and Samba and other things. > OS X has a DoS vulnerability in the way ssh processes are spawned and > the ssh interaction with their PAM modules (it exhibits with the > symptoms you have described). Have you really got port 22 blocked from > the outside world?? Have you tested that? Consider running ssh on an > alternate port if running OS X server (as Apple's GUI config tools for > the firewall don't always allow you to block port 22). This is a very simple problem to fix, and doesn't require blocking port 22. Set up /etc/hosts.allow: sshd : 192.169.1.0/255.255.255.0 sshd-keygen-wrapper : 192.168.1.0/255.255.255.0 Set up /etc/hosts.deny: ALL: ALL:deny Tcpwrappers will now take care of you, and any DOS attacks you get will simply be dropped. > Do consider running your mail services off a machine that is not a Mac > OS X server. OS X server is merely OS X client/workstation with a > pretty > management utility for some 'nix services. It is not stable under high > load -- and it is not even stable under moderate load without numerous > performance tweaks (it doesn't cope at all well if the disk queue goes > up a touch or loadavg is at all interesting - ie it degrades poorly > under load). While some of this statement may be accurate, there's a lot of FUD here too. Both OS X and OS X server use the same kernel, it is true. However, these operating systems are fast and reliable. We ran our mail server for a couple of years on OS X with exim and courier-imap, and the only reason we did stop and move to Linux is because we needed a bigger solution and intel-based hardware was cheaper than a bunch of XServes. And I will challenge your statement about high load. We have two web servers that average betwen 5 and 10 mbits of constant web load, running on OS X Server and XServes. The average load on these boxes is something like 0.20. Roger Weeks

2 1

Fwd: Re[4]: [Dovecot] dovecot can't start!
by Oleg D. 24 May '06

24 May '06

Hello Chris, Wednesday, May 24, 2006, 8:36:00 PM, you wrote: CH> Quoting "Oleg D." <dzoleg(a)rsute.ru>: >> MB> Hmmm... I was seeing a problem rather like this with 1.0beta8 >> under Solaris >> MB> with Sun's compiler: only it was with the IMAP protocol rather than POP. >> >> MB> The problem there was an assumption Tio had made that everyone >> was using a >> MB> C99-compatible compiler. Apparently this handles some aspects of >> variable >> MB> initialisation differently from earlier C compilers. >> >> MB> In my case adding a command-line option to the C compiler to flip it into >> MB> C99 mode seemed to solve the problem. The option for our compiler was >> MB> "-xc99" -- however if your compiler has such an option it may have a >> MB> different name. If you check the manual page for your C compiler you may >> MB> find an equivalent option to try. >> >> MB> However another solution was provided by Timo in the form of a >> simple patch >> MB> that made changes to a couple of source files. I hope Timo doesn't mind: >> MB> I'm re-sending his patch as an attachment to this message as it is tiny. >> MB> You could try applying it and rebuilding Dovecot. >> >> MB> Cheers, >> MB> Mike Brudenell >> >> But I use FreeBSD 4.11-RELEASE-p15 with native compiler. >> Really nobody has this problem on freebsd? >> >> And the main - Why I can't start dovecot without SSL :) >> Why I see in log "pop3-login: BUG: SSL initialization parameters not >> given while they should have been" >> even if I have "ssl_disable = yes" in dovecot.conf >> 1.0b3 works fine. >> This problem is main for me >> because I don't want to use SSL. CH> I run FreeBSD here, and my hunch is that SSL (or some form) was CH> compiled it. Which would help explain the errors you describe. CH> What "knobs" did you use when you built it? Did you simply take CH> the default without examining the Makefile? My hunch is that if CH> you take a closer look at how it was built and installed; you'll CH> find some form of SSL/ encryption was built into it, and you'll CH> either have to: cd /usr/ports/mail/dovecot; make deinstall; CH> tweak the Makefile to your needs; make reinstall. Or figure out CH> how to utilize the security method that was built in by default. CH> Perhaps SASL2, or GSSAPI, as I see they're options in the Makefile. CH> Best wishes. I hope this helps. CH> --Chris H. I tried to add --without-ssl in port's Makefile and compile dovecot without ssl. But I have all the same seen "pop3-login: BUG: SSL initialization parameters not given while they should have been" When I have set "ssl_disable = no" I saw another error: "Error: SSL support not compiled in but ssl_disable=no" WITHOUT_KQUEUE=true WITHOUT_SASL2=true WITHOUT_GSSAPI=true WITHOUT_VPOPMAIL=true WITHOUT_LDAP=true WITHOUT_PGSQL=true WITH_MYSQL=true WITHOUT_SQLITE=true only mysql is enable -- Best regards, Oleg mailto:dzoleg@rsute.ru

1 0

Re[2]: Fwd: Re[2]: [Dovecot] dovecot can't start!
by Oleg D. 24 May '06

24 May '06

Hello Chris, Tuesday, May 23, 2006, 2:13:24 PM, you wrote: CW> Oleg D. wrote: >> >> >> BTW >> If I have enable SSL and set "protocols = pop3s" only >> I see "Fatal: Protocol pop3s given more than once" >> >> CW> That's odd. It looks like it's deducing you want POP3 from somewhere CW> else. Can you send us your dovecot.conf file, or output of "dovecot -n"? CW> Chris I set "protocols = pop3s" for testing vpn# dovecot -n protocols: pop3s disable_plaintext_auth: no verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/pop3-login login_process_size: 64 verbose_proctitle: yes first_valid_gid: 0 mail_extra_groups: mail default_mail_env: mbox:/var/mail/%u mail_executable: /usr/local/libexec/dovecot/pop3 mail_plugin_dir: /usr/local/lib/dovecot/pop3 pop3_uidl_format: %08Xu%08Xv pop3_client_workarounds: outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login digest-md5 cram-md5 apop default_realm: xxxxx.xx verbose: yes debug: yes debug_passwords: yes passdb: driver: pam passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: passwd userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf But I see "Fatal: Protocol pop3s given more than once" -- Best regards, Oleg mailto:dzoleg@rsute.ru

2 2

[Dovecot] Busy, again
by Timo Sirainen 24 May '06

24 May '06

Just a note to people if you're wondering why I'm not replying to most of my mails: I'm trying to get into university to start stydying cellular biology (so I'm applying to biochemistry and biotechnology). Their entrance exams are next wednesday, so I'm trying to use most of my time left to study for them (and also do some work..). I don't know much about the subject, so I really need to study for them. :) Then again, if I don't pass, my fallback plan is to go in via computer science and try again next year. Hopefully they allow taking the same bio-classes even if it's not my major.

7 10

[Dovecot] Two INBOX locations
by arilinux 24 May '06

24 May '06

Hello I'm running dovecot v1.0.beta3 on a fedora 4 machine. I have two kinds of clients: - first use IMAP and receive their mails (maildir) in /home/%u/mail - second use POP and receive their mails (mbox) in /var/mail/%u Problem is when I want to provide an access for second with squirrelmail which use IMAP, as the INBOX is in /var/mail/%u and IMAP settings tell that INBOX is in /home/%u/mail, they can't view their emails. Is there a way to tell to dovecot to search IMAP mails both in /home/%u/mail and in /var/mail/%u Thanks > Emmanuel RIZZI > ERILOG > 103 rue Beaupoil > 39210 DOMBLANS > Tel: 03 84 44 66 66 > Fax: 03 84 44 62 00 > > >

2 1

Fwd: Re[2]: [Dovecot] dovecot can't start!
by Oleg D. 24 May '06

24 May '06

Hello Chris, Tuesday, May 23, 2006, 1:13:17 PM, you wrote: CW> Oleg D. wrote: >> Hello HenkJan, >> >> >> Tuesday, May 23, 2006, 11:30:37 AM, you wrote: >> >> >> >>>do you have "disable_plaintext_auth = no" in dovecot.conf? >> >> Yes. >> >> >>>"auth_verbose = yes" and "auth_debug = yes" in dovecot.conf for more logging >> >> Yes. >> >> >>>what happens if you telnet to your dovecotserver? >> >> I have already tried it many times. >> >> And I don't see any prompt. >> >> >> In log: >> >> "dovecot: Dovecot v1.0.beta8 starting up >> >> dovecot: Generating Diffie-Hellman parameters for the first time. This may take >> a while.. >> >> dovecot: auth-worker(default): mysql: Connected to /tmp/mysql.sock (mail)" >> >> >> after telnet: >> >> "dovecot: pop3-login: Waiting for SSL parameter file ssl-parameters.dat" >> >> and nothing else >> >> >> I found ssl-parameters.dat.tmp in /var/run/dovecot/login >> >> >> After starting/stopping dovecot several times ssl-parameters.dat is appear in >> /var/run/dovecot/login >> >> But nothing again >> >> >> OK. I try all of this to start dovecot anyway. >> >> But I don't want to use SSL! >> >> >> THE MAIN QUESTION: >> >> Why I see "pop3-login: BUG: SSL initialization parameters not given while they >> should have been" >> >> even if I have "ssl_disable = yes" in dovecot.conf >> >> >> 1.0b3 works fine. >> >> >> -- >> >> Best regards, >> >> Oleg mailto:dzoleg@rsute.ru >> CW> What do you have as your "protocols" line? Make sure there's no "imaps" CW> or "pop3s". Also, make sure you don't have any "ssl_listen" options set. CW> Also, do you ever get the "SSL parameters regeneration completed" line CW> in your log file (it can take several minutes on a slow machine)? If CW> it's decided (however wrongly) to do the SSL paramters generation, you CW> won't be able to login until it's finished. CW> Chris "protocols = pop3" only >"ssl_listen" options set dont't set. BTW If I have enable SSL and set "protocols = pop3s" only I see "Fatal: Protocol pop3s given more than once" -- Best regards, Oleg mailto:dzoleg@rsute.ru

2 1

[Dovecot] Thunderbird 1.5 and messages with no Date: header
by grant beattie 24 May '06

24 May '06

hi, some of my Thunderbird users have a minor but annoying problem with messages that have no Date: header. these clients use BODY[HEADER.FIELDS (Date)] as the date for messages. when a message has no Date: header, they display the date as 01/01/1970 10:00:00 because Dovecot returns empty string. would it be possible for Dovecot to return INTERNALDATE instead, for messages that contain no Date: header? I know this is not *technically* correct, but it's a reasonable best-guess, and better than returning nothing. perhaps as a client-workaround? I vaguely recalled a previous message about this, but I couldn't find it today. grant.

6 10

[Dovecot] Shared folder (namespace) access hanging
by Jeff Turner 24 May '06

24 May '06

Hi, I'm using Dovecot 1.0-b8. We use a shared 'support' account for incoming support mail. For security reasons we want to instead have everyone with their own account, accessing a shared 'support' folder. So I've configured dovecot with a public 'Support' namespace: default_mail_env = maildir:/imap/mailboxes/%u namespace private { separator = / prefix = inbox = yes } namespace public { separator = / location = maildir:/imap/mailboxes/support:CONTROL=/imap/mailboxes/%u/shared-settings/support/control prefix = Support/ hidden = no } So now: - User 'support' logs in (this is the user whose folder is being shared). Dovecot creates a dovecot-uidlist file: root@redback:/imap/mailboxes/support/.INBOX.test# cat dovecot-uidlist 1 1147757548 9 1 1147755677.P8078Q3M183587.redback.sydney.atlassian.com:2,RSace 2 1147755677.P8078Q2M183587.redback.sydney.atlassian.com:2,abcdf 3 1147755677.P8078Q1M183587.redback.sydney.atlassian.com:2,Sabcd 4 1147756077.P8078Q8.redback.sydney.atlassian.com:2,Sabcd 5 1147756440.P8461Q3M643698.redback.sydney.atlassian.com:2,Sa 6 1147756440.P8461Q2M643698.redback.sydney.atlassian.com:2,Sa 7 1147756440.P8461Q1M643698.redback.sydney.atlassian.com:2,Sa 8 1147756440.P8461Q0M643698.redback.sydney.atlassian.com:2,Sa root@redback:/imap/mailboxes/support/.INBOX.test# ls -la total 60 drwxrwx--- 5 jturner mail 4096 May 16 15:32 . drwxrwxrwx 59 support mail 4096 May 16 15:31 .. drwxrwx--- 2 jturner mail 4096 May 16 15:18 cur -rw-rw-rw- 1 support mail 448 May 16 15:32 dovecot.index -rw-rw-rw- 1 support mail 21504 May 16 15:32 dovecot.index.cache -rw-rw-rw- 1 support mail 512 May 16 15:32 dovecot.index.log -rw------- 1 support mail 72 May 16 15:28 dovecot-keywords -rw-rw-rw- 1 jturner mail 0 May 16 14:52 dovecot-shared -rw-rw-rw- 1 support mail 516 May 16 15:32 dovecot-uidlist drwxrwx--- 2 jturner mail 4096 May 16 15:01 new drwxrwx--- 2 jturner mail 4096 May 16 15:14 tmp root@redback:/imap/mailboxes/support/.INBOX.test# - If I now log in as 'jturner' and subscribe to this folder, there appears to be nothing in the 'test' folder. On disk, the folder subscription is registered but the test folder's CONTROL directory is empty: # ls /imap/mailboxes/jturner/shared-settings/support/control/ subscriptions # cat /imap/mailboxes/jturner/shared-settings/support/control/subscriptions INBOX.test # ls /imap/mailboxes/jturner/shared-settings/support/control/.INBOX.test/ # Restarting dovecot and Thunderbird makes no difference. However, if I delete dovecot.index and dovecot.index.log from /imap/mailboxes/support/.INBOX.test/, then suddenly it works. User 'jturner' can view the folder contents, and a uidlist file for them appears: # cat /imap/mailboxes/jturner/shared-settings/support/control/.INBOX.test/dovecot-uidlist 1 1147758095 9 1 1147755677.P8078Q3M183587.redback.sydney.atlassian.com:2,RSace 2 1147755677.P8078Q2M183587.redback.sydney.atlassian.com:2,abcdf 3 1147755677.P8078Q1M183587.redback.sydney.atlassian.com:2,Sabcd 4 1147756077.P8078Q8.redback.sydney.atlassian.com:2,Sabcd 5 1147756440.P8461Q3M643698.redback.sydney.atlassian.com:2,Sa 6 1147756440.P8461Q2M643698.redback.sydney.atlassian.com:2,Sa 7 1147756440.P8461Q1M643698.redback.sydney.atlassian.com:2,Sa 8 1147756440.P8461Q0M643698.redback.sydney.atlassian.com:2,Sa Although the contents is the same (1-8), the UIDVALIDITY at the top is different to that for the 'support' user: # head -1 /imap/mailboxes/jturner/shared-settings/support/control/.INBOX.test/dovecot-uidlist 1 1147758095 9 # head -1 /imap/mailboxes/support/.INBOX.test/dovecot-uidlist 1 1147757548 9 and now if I log back in as 'support' and access the folder, dovecot complains: dovecot: May 16 15:47:05 Error: IMAP(support): Corrupted index cache file /imap/mailboxes/support/.INBOX.test/dovecot.index.cache: indexid changed Switching back and forth results in various errors: dovecot: May 16 15:48:04 Error: IMAP(support): Corrupted transaction log file /imap/mailboxes/support/.INBOX.test/dovecot.index.log: end_offset (656) > current sync_offset (512) dovecot: May 16 15:48:04 Error: IMAP(support): Corrupted transaction log file /imap/mailboxes/support/.INBOX.test/dovecot.index.log: invalid indexid (1147758095 != 1147757548) dovecot: May 16 15:48:04 Error: IMAP(support): Corrupted transaction log file /imap/mailboxes/support/.INBOX.test/dovecot.index.log: invalid new transaction log sequence (2 >= 2) dovecot: May 16 15:48:04 Error: IMAP(support): Lost transaction log file /imap/mailboxes/support/.INBOX.test/dovecot.index.log seq 1 ------------------------------ In the wild, I've seen frequent occurrences of this error, where dovecot seems to switch between the UIDVALIDITY of 'support' and a user's dovecot-uidlists: dovecot: May 16 13:56:28 Error: IMAP(jturner): Maildir /imap/mailboxes/support/.INBOX sync: UIDVALIDITY changed (1147751603 -> 1147686345) and here's it toggling back from 'support' to jturner's dovecot-uidlist uidvalidity: dovecot: May 16 14:16:04 Error: IMAP(support): Maildir /imap/mailboxes/support/.INBOX sync: UIDVALIDITY changed (1147752716 -> 1147751603) I've also seen plenty of processes being killed, seemingly at random, about 3 or 4 a minute: # cat /usr/local/logs/dovecot | grep killed.wit ... dovecot: May 16 12:00:16 Error: child 32706 (imap) killed with signal 6 dovecot: May 16 12:00:16 Error: child 32649 (imap) killed with signal 14 dovecot: May 16 12:00:45 Error: child 32412 (imap) killed with signal 6 dovecot: May 16 12:01:02 Error: child 32702 (imap) killed with signal 6 dovecot: May 16 12:01:02 Error: child 368 (imap) killed with signal 6 dovecot: May 16 12:01:02 Error: child 357 (imap) killed with signal 6 dovecot: May 16 12:01:16 Error: child 383 (imap) killed with signal 6 dovecot: May 16 12:02:26 Error: child 32297 (imap) killed with signal 6 ... So I'm confused. Am I doing something stupid? Why is there a common .cache file (it doesn't get created in the CONTROL dir), but not a common dovecot-uidlists? Is anyone actually *using* shared folders? :) Thanks, Jeff

2 2