- dovecot - dovecot.org

Re: [Dovecot] Major CPU spike for SSL parameters?
by Peter Chiu 23 Jan '06

23 Jan '06

I applied the patch to master-settings.c and the problem is still there Jan 19 20:01:51 foxmulder dovecot: SSL parameters regeneration completed Jan 19 20:13:02 foxmulder dovecot: SSL parameters regeneration completed Jan 19 20:21:33 foxmulder dovecot: SSL parameters regeneration completed Jan 19 20:33:17 foxmulder dovecot: SSL parameters regeneration completed Jan 19 20:42:03 foxmulder dovecot: SSL parameters regeneration completed Jan 19 20:52:12 foxmulder dovecot: SSL parameters regeneration completed foxmulder:~$ uname -srp FreeBSD 6.0-RELEASE-p3 i386 foxmulder:etc$ grep ssl dovecot.conf ssl_cert_file = /etc/ssl/certs/dovecot.pem ssl_key_file = /etc/ssl/private/dovecot.pem ssl_parameters_regenerate = 48 Timo Sirainen wrote: > On Wed, 2006-01-18 at 18:40 -0500, Todd Vierling wrote: >> On Wed, 18 Jan 2006, Todd Vierling wrote: >> >>> After setting "ssl_parameters_regenerate" to the explicit value of 168, it's >>> still happening this often. I now set it to 0 to disable regeneration for >>> the moment. >> And it's still happening every 10-ish minutes. Thoughts? > > Happens with 64bit systems. Fix in CVS and here: > > Index: src/master/master-settings.c > =================================================================== > RCS file: /var/lib/cvs/dovecot/src/master/master-settings.c,v > retrieving revision 1.105 > diff -u -r1.105 master-settings.c > --- src/master/master-settings.c 18 Jan 2006 23:14:45 -0000 1.105 > +++ src/master/master-settings.c 19 Jan 2006 20:38:31 -0000 > @@ -64,7 +64,7 @@ > DEF(SET_STR, ssl_cert_file), > DEF(SET_STR, ssl_key_file), > DEF(SET_STR, ssl_key_password), > - DEF(SET_STR, ssl_parameters_regenerate), > + DEF(SET_INT, ssl_parameters_regenerate), > DEF(SET_STR, ssl_cipher_list), > DEF(SET_BOOL, ssl_verify_client_cert), > DEF(SET_BOOL, disable_plaintext_auth), >

4 5

[Dovecot] Compile failure (alpha 5, MySQL 5)
by Tom Sommer 23 Jan '06

23 Jan '06

gcc -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -I/usr/kerberos/include -o dovecot-auth auth.o auth-cache.o auth-client-connection.o auth-master-connection.o auth-master-listener.o auth-module.o auth-request.o auth-request-handler.o auth-stream.o auth-worker-client.o auth-worker-server.o db-ldap.o db-sql.o db-passwd-file.o main.o mech.o mech-anonymous.o mech-plain.o mech-login.o mech-cram-md5.o mech-digest-md5.o mech-ntlm.o mech-gssapi.o mech-rpa.o mech-apop.o passdb.o passdb-blocking.o passdb-bsdauth.o passdb-cache.o passdb-ldap.o passdb-passwd.o passdb-passwd-file.o passdb-pam.o passdb-checkpassword.o passdb-shadow.o passdb-vpopmail.o passdb-sql.o userdb.o userdb-blocking.o userdb-ldap.o userdb-passwd.o userdb-passwd-file.o userdb-prefetch.o userdb-static.o userdb-vpopmail.o userdb-sql.o -Wl,--export-dynamic libpassword.a ../lib-settings/libsettings.a ../lib-ntlm/libntlm.a ../lib-sql/libsql.a ../lib/liblib.a -lcrypt -lpam -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lresolv -L/usr/local/mysql/lib -lmysqlclient -lz -ldl /usr/local/mysql/lib/libmysqlclient.a(sha1.o)(.text+0x50): In function `sha1_result': : multiple definition of `sha1_result' ../lib/liblib.a(sha1.o)(.text+0x820):/usr/local/src/dovecot-1.0.alpha5/src/lib/sha1.c:233: first defined here /usr/bin/ld: Warning: size of symbol `sha1_result' changed from 158 in ../lib/liblib.a(sha1.o) to 316 in /usr/local/mysql/lib/libmysqlclient.a(sha1.o) collect2: ld returned 1 exit status Running MySQL 5.0.16 and Dovecot 1.0 Alpha 5 // Tom

4 5

Re: [Dovecot] Major CPU spike for SSL parameters?
by Peter Chiu 23 Jan '06

23 Jan '06

Yay. It works. SSL regenerated statement is gone. I was using alpha and upgraded to b1, b2 afterward. login directory is root:dovecot and when you create a brand new ssl-parameters.dat in freebsd, it inherited the gid (87) from the directory. I chgrp it to wheel and it works now. Thanks. -rw-r--r-- 1 root wheel 230 Jan 23 02:18 ssl-parameters.dat Jan 23 02:19:39 foxmulder dovecot: Dovecot v1.0.beta2 starting up Jan 23 02:19:39 foxmulder dovecot: 1138000736 + 172800 (1138173536) < 1138000779, size=230, uid=0 vs 0, gid=0 vs 0 Jan 23 02:29:40 foxmulder dovecot: 1138000736 + 172800 (1138173536) < 1138001380, size=230, uid=0 vs 0, gid=0 vs 0 Timo Sirainen wrote: > On 23.1.2006 09:04, "Peter Chiu" <pc8888(a)gmail.com> wrote: > >> I tried to set the guid, howerver dovecot reset it back to the way it >> was. Did I do something wrong? > > No, I meant that you shouldn't have had it if it was there for some reason. > > Well, try then just "chgrp root ssl-parameters.dat" and that should work. > But I still don't know why it would get created with GID 87 (dovecot?) > instead of root. > >

1 0

Re: [Dovecot] Major CPU spike for SSL parameters?
by Peter Chiu 23 Jan '06

23 Jan '06

I tried to set the guid, howerver dovecot reset it back to the way it was. Did I do something wrong? foxmulder:dovecot# ll total 8 drwxr-xr-x 3 root wheel 512 Jan 23 01:03 . drwxr-xr-x 7 root wheel 512 Jan 18 05:13 .. srw------- 1 root wheel 0 Jan 23 01:03 auth-worker.54141 drwxr-x--- 2 root dovecot 512 Jan 23 01:54 login -rw------- 1 root wheel 6 Jan 23 01:03 master.pid foxmulder:dovecot# chmod 2750 login foxmulder:dovecot# ll total 8 drwxr-xr-x 3 root wheel 512 Jan 23 01:03 . drwxr-xr-x 7 root wheel 512 Jan 18 05:13 .. srw------- 1 root wheel 0 Jan 23 01:03 auth-worker.54141 drwxr-s--- 2 root dovecot 512 Jan 23 01:54 login -rw------- 1 root wheel 6 Jan 23 01:03 master.pid foxmulder:dovecot# /usr/local/etc/rc.d/210.dovecot.sh start Warning: Corrected permissions for login directory /var/run/dovecot//login foxmulder:dovecot# ll total 8 drwxr-xr-x 3 root wheel 512 Jan 23 01:58 . drwxr-xr-x 7 root wheel 512 Jan 18 05:13 .. srw------- 1 root wheel 0 Jan 23 01:57 auth-worker.64310 drwxr-x--- 2 root dovecot 512 Jan 23 01:58 login -rw------- 1 root wheel 6 Jan 23 01:57 master.pid Timo Sirainen wrote: > On Mon, 2006-01-23 at 01:07 -0500, Peter Chiu wrote: >> Jan 23 00:38:03 foxmulder dovecot: Dovecot v1.0.beta2 starting up >> Jan 23 00:38:03 foxmulder dovecot: 1137994456 + 172800 (1138167256) < >> 1137994683, size=230, uid=0 vs 0, gid=87 vs 0 > > So, the GID is wrong. Does your /var/run/dovecot/login directory (or > wherever the ssl-parameters file exists) have setgid-bit set? > > Maybe I should make it change the group just in case anyway. >

2 1

Re: [Dovecot] Major CPU spike for SSL parameters?
by Peter Chiu 23 Jan '06

23 Jan '06

I tried your patch again b2 and I am still having the same problem. Jan 22 17:57:30 foxmulder dovecot: Dovecot v1.0.beta2 starting up Jan 22 17:57:30 foxmulder dovecot: ssl_parameters_regenerate = 48 Jan 22 17:58:30 foxmulder dovecot: SSL parameters regeneration completed Jan 22 18:07:31 foxmulder dovecot: ssl_parameters_regenerate = 48 Jan 22 18:07:43 foxmulder dovecot: SSL parameters regeneration completed Btw, my machine is only i386, not 64bits. Let me know if you need anything else. Timo Sirainen wrote: > On Sun, 2006-01-22 at 23:26 +0800, John Wong wrote: >> i upgrade 1.0-beta1 to cvs version, i use openbsd/i386 >> i tried this 3 settings >> ----------------------------------------------------------------- >> ssl_parameters_regenerate = 0 >> ssl_parameters_regenerate = 68 >> #ssl_parameters_regenerate = 168 (default) >> ----------------------------------------------------------------- >> all setting have this problem too (every 10mins regen SSL) > > Could you try what it writes to logs with this patch: > > diff -u -r1.21 ssl-init.c > --- src/master/ssl-init.c 22 Jan 2006 10:50:54 -0000 1.21 > +++ src/master/ssl-init.c 22 Jan 2006 16:16:14 -0000 > @@ -98,6 +98,7 @@ > are correct */ > regen_time = set->ssl_parameters_regenerate == 0 ? ioloop_time : > st.st_mtime + (time_t)(set->ssl_parameters_regenerate*3600); > + i_info("ssl_parameters_regenerate = %d", set->ssl_parameters_regenerate); > if (regen_time < ioloop_time || st.st_size == 0 || > st.st_uid != master_uid || st.st_gid != getegid()) { > if (foreground) { >

2 1

[Dovecot] Thanks
by ohp＠pyrenet.fr 22 Jan '06

22 Jan '06

Many thanks for helping me solving my problems After a few conf tweakings, dovecot works so well that I may put it on prod tomorrow. Many thanks to Timo!!! A few questions though: I had to raise the number of auth_process to 10 to avoid tons of messages "can't connect to socket 'default' is that ok? After tweaking my postgresql database to authenticate virtual users I notices that SQL userdb MUST have home AND mbox file. Not wanting virtual users to have anything but INBOX, I've set home dir in query to /tmp/%u. is that ok too? Best regards to all and many thanks again. -- Olivier PRENANT Tel: +33-5-61-50-97-00 (Work) 15, Chemin des Monges +33-5-61-50-97-01 (Fax) 31190 AUTERIVE +33-6-07-63-80-64 (GSM) FRANCE Email: ohp(a)pyrenet.fr ------------------------------------------------------------------------------ Make your life a dream, make your dream a reality. (St Exupery)

1 0

Re: [Dovecot] plain text auth
by Timo Sirainen 22 Jan '06

22 Jan '06

On Sun, 2006-01-22 at 12:18 +0100, ohp(a)pyrenet.fr wrote: > Hi Timo, > > Attached is my conf file. > > I spent hours running dovecot through the debugger, and I know for sure > that client->auth_mechs is empty. What client->auth_mechs? There's no such variable anywhere :) > I could'nt find where it is set the first time. Looking at the code, it should always complain in every possible situation where something might go wrong. So, first it should be figured out if the problem is in dovecot-auth or imap-login. Try adding some debugging first: diff -u -r1.16 auth-server-connection.c --- src/lib-auth/auth-server-connection.c 14 Jan 2006 18:47:23 -0000 1.16 +++ src/lib-auth/auth-server-connection.c 22 Jan 2006 13:08:19 -0000 @@ -164,6 +164,8 @@ conn->refcount++; while ((line = i_stream_next_line(conn->input)) != NULL) { + i_info("auth server: %s", line); + if (strncmp(line, "OK\t", 3) == 0) ret = auth_client_input_ok(conn, line + 3); else if (strncmp(line, "CONT\t", 5) == 0) It should be sending a MECH line with PLAIN parameter.

2 5

[Dovecot] dovecot-lda and vpopmail
by John Peacock 22 Jan '06

22 Jan '06

I'm setting up a new box with Dovecot 1.0 beta1 and vpopmail. Normal operations works like a charm, i.e. vpopmail virtual can log in sucessfully using TLS. However, when trying to test dovecot-lda out of CVS, it is not locating the user: > *** Starting dovecot-imapd service... > dovecot: Info: Dovecot v1.0.beta1 starting up > dovecot: Info: auth(default): master in: USER 1 postmaster(a)example.com service=deliver > dovecot: Info: auth(default): master out: USER 1 postmaster uid=89 gid=89 home=/home/vpopmail/domains/example.com/postmaster > dovecot: Error: auth(default): except that the "master out" line *has* the correct information, though I don't know what that "Error" line is trying to tell me. However, I am getting the mail bounced back with: > deliver: Fatal: mail setting not given which is this error in the src/deliver.c:607 /* MAIL comes from userdb, DEFAULT_MAIL_ENV from dovecot.conf */ mail_env = getenv("MAIL"); if (mail_env == NULL) mail_env = getenv("DEFAULT_MAIL_ENV"); if (mail_env == NULL) i_fatal_status(EX_CONFIG, "mail setting not given"); which would certainly suggest that the userdb access failed in deliver (though the log would see to seem to suggest otherwise). I even tried setting the DEFAULT_MAIL_ENV in dovecot.conf, but that didn't work either. Anyone have any ideas about what I am missing? John -- John Peacock Director of Information Research and Technology Rowman & Littlefield Publishing Group 4501 Forbes Boulevard Suite H Lanham, MD 20706 301-459-3366 x.5010 fax 301-429-5748

2 4

[Dovecot] 1.0 beta1 released
by Timo Sirainen 22 Jan '06

22 Jan '06

As promised, here it is finally. v1.0 is getting nearer and I want people to start looking at Dovecot's sources. Getting some more help with development would be nice, but I'd also like to hear if there are any hidden bugs in the code. So, one week from now I'll start offering 1000 EUR for the first person to point out a remotely exploitable security hole in Dovecot. See http://dovecot.org/security.html for more information. Changes since 1.0alpha5: UPGRADE WARNING: Unlike earlier Dovecot versions, 1.0 beta1 now requires Diffie-Hellman parameters to have been generated before SSL/TLS is used. These are generated when Dovecot is started for the first time and it may take several minutes. During this time SSL/TLS connections aren't working. (I decided to leave it this way at least for now. I don't think any new Dovecot admins will try to log in with SSL within the first 5 minutes of the installation?) Features: - DSA SSL connections provide now forward secrecy (which causes the DH parameter issue mentioned above) - Support for password protected SSL private keys - LDAP: Added authentication bind support. Patch by J.M. Maurer - LDAP: Added fast authentication binding. Patch by Geff <boing(a)boing.com> - PAM: Changed -session parameter to session=yes - kqueue support. Patch by Vaclav Haisman - dbox updates. Kind of works now, but not recommended for more than testing yet. There still are known bugs. - maildir_copy_with_hardlinks=yes works again - Sometimes Dovecot kept telling about keyword changes over and over again even if there weren't any. - Beginnings of fallbacking to in-memory indexes when write fails with "out of disk space" error. Not perfect yet, but helps in some cases. - When IDLEing, send a small notification every 2 minutes so that NATs/firewalls don't close the connection. - Added gdbhelper binary to help debugging Performance improvements: - Don't fdatasync() cache file. Not that important and gives better performance. - mmap_disable=yes mode doesn't keep rewriting index file now constantly, so it uses much less disk I/O. - Some other minor index file improvements Bugfixes: - UID STORE command wasn't returning UIDs in replies - Fixes for various problems with IDLE command. - THREAD command crashed if no search matches were found - Some fixes to handling LIST command with namespaces. Helps Pine. - Fixed a situation in mbox when it could get the process to infinite loop - Fixed one mbox assert crash - Use long line wrapping for X-IMAPbase, X-IMAP and X-Keywords headers for UW-IMAP compatibility - dovecot --exec-mail wasn't cleaning existing environment variables properly

16 26

[Dovecot] sqlite patch
by Jakob Hirsch 22 Jan '06

22 Jan '06

Hi, http://plonk.de/sw/dovecot/dovecot.sqlite.4.diff It uses sqlite3 and is not heavily tested, but it works quite fine here. Have fun!

2 2