- dovecot - dovecot.org

Re: [Dovecot] Logging "issue" with PAM authentication
by Steve Johnson 07 Jul '04

07 Jul '04

Great, thanks a lot, solved the problem. No more annoying logs every 2-5 seconds :) Steve Johnson On Wed, 2004-07-07 at 14:39, Ray Miller wrote: > On Wed, Jul 07, 2004 at 02:21:04PM -0400, Steve Johnson wrote: > > > > I've tried with just the following: > > > > auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass > > password sufficient /lib/security/$ISA/pam_ldap.so use_authtok > > session optional /lib/security/$ISA/pam_ldap.so > > [...] > > In both of these situations, users can't authenticate. Is there > > something I'm doing wrong? I'm not that familiar with pam, so it's a > > very plausible cause! :) > > I'm fairly sure you don't need the password line, but that's not > likely to be causing your problem - more likely it's the use_first_pass > option. Try: > > auth required /lib/security/$ISA/pam_ldap.so > account required /lib/security/$ISA/pam_ldap.so > password required /lib/security/$ISA/pam_deny.so > session required /lib/security/$ISA/pam_ldap.so

1 0

[Dovecot] Peer Config Review
by Eric Kahklen 07 Jul '04

07 Jul '04

I am trying to setup a mail server using Postfix and Squirrelmail. The mail server will ONLY use webmail for access. I will not be using any email clients other than Squirrelmail. I've got the server working in a testing environment. Could people who are dovecot savy look over the config I have set? I've only included the directives that are enabled with no comments. I want a simple but secure backup mail server for about 75 users. Thank you, Eric base_dir = /var/run/dovecot/ protocols = imap login_dir = /var/run/dovecot/login login = imap login_executable = /usr/libexec/dovecot/imap-login mbox_locks = fcntl imap_executable = /usr/libexec/dovecot/imap imap_modules = /usr/lib/dovecot/imap auth = default auth_mechanisms = plain auth_userdb = passwd auth_passdb = pam auth_executable = /usr/libexec/dovecot/dovecot-auth auth_user = root --

1 0

[Dovecot] Logging "issue" with PAM authentication
by Steve Johnson 07 Jul '04

07 Jul '04

Hi, We currently have a postfix/dovecot setup using nss_ldap with PAM for authentication. Everything is working fine, but there are excessive "error" messages in /var/log/messages that I'd like to prevent from happening. Since auth_userdb defaults to passwd and that our users are not in the passwd file, we get the following message everytime a user logs in: Jul 7 13:34:37 hostname dovecot(pam_unix)[32206]: check pass; user unknown Jul 7 13:34:37 hostname dovecot(pam_unix)[32206]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= We of course also get the input that a user has logged in, in /var/log/maillog: imap-login: Jul 07 13:34:37 Info: Login: username [xxx.xxx.xxx.xxx] I've tried changing auth_verbose to no, and I still get those messages. Is there any way to prevent this from happening? Thanks a lot, Steve Johnson

2 2

[Dovecot] mbox:~/%u-mail/
by justin 07 Jul '04

07 Jul '04

Is it possible to use something like: default_mail_env = mbox:~/%u-mail/:INBOX=/var/mail/%u such that for a user: user1 with a home directory: /home/share the imap files would then be stored in: /home/share/user1-mail/ ???

2 1

[Dovecot] UID Error on Test 24 and 25
by Doug Eubanks 07 Jul '04

07 Jul '04

I started testing Dovecot 1.0 Test 22! I loved the performance improvements, althought dovecot has been very fast for us from the beginning. However, now I am testing test 24 and 25, and I am seeing these errors in the dovecot log and squirrelmail is giving me a ERROR : Connection dropped by imap-server. Query: STATUS "Mailing Lists.SpamAssassin" (MESSAGES UNSEEN RECENT) This is the dovecot error from the log file dovecot: Jul 07 08:52:33 Info: imap-login: Login: admin [208.*.*.*] dovecot: Jul 07 08:52:33 Error: IMAP(admin): file mail-index-view.c: line 286 (_view_lookup_uid_range): assertion failed: (first_uid > 0) dovecot: Jul 07 08:52:33 Error: child 12469 (imap) killed with signal 6 The user I am loggin in with has a uid and gid of 501, not 0! I am using passwd and shadow auth with Maildirs. If anyone has any pointers, they would greatly be appreciated. Sincerely, Doug Eubanks doug(a)simflex.com Post Hoc, Ergo Propter Hoc *** DISCLAIMER *** This e-mail and any attachments thereto may contain information, which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above. Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by persons other than the designated recipient(s) is prohibited. If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer. Thank you for your cooperation.

2 1

[Dovecot] 1.0-test25 with new cache file code
by Timo Sirainen 07 Jul '04

07 Jul '04

http://dovecot.org/test/ Pretty much the only change since test24 is a redesign of how cache file writing works. Reading works as before - without locks. Before (in 1.0-tests, 0.99 was worse) we used to just try to lock it. If it failed, we just didn't update cache. If it didn't fail, the lock could have been kept a long time. For example if a user was downloading a 10MB mail, the lock could have been kept the whole time and no-one else could have modified the cache. The old behaviour wasn't actually too bad, as normally it didn't matter if something couldn't be written to cache. It would have been the next time, all it did was cost some I/O. The new behaviour is more reliable as the locks are kept only a very short time. It works by first writing the updates only into internal 32kB buffer. Once the buffer gets full, or the transaction completes, it's written to disk. When buffer gets full, space is reserved from the cache file for the current transaction. The amount of space is more than is needed for writing the internal buffer, so we don't have to lock the cache file every time the buffer gets full (and so we don't need a huge buffer). Once transaction completes, we lock the cache again and try to free the extra reserved space we have left. If multiple processes weren't updating the cache file at the same time, the freeing should be as simple as decreasing "used_file_size" field in header. Alternatively we'll update a linked list of "holes" in the file. When reserving space, we first try to use those holes instead of appending to end of file. Pointers to new cache records are also written to transaction log at the end of cache transaction. They'll get written to index at next sync after which they become visible to other processes. Each cache record contains a pointer to previous record, so there can be multiple cache records for a single message. The bad thing with the new logic is that nothing prevents two processes from writing the same cache records and so using twice as much space as necessary. But I don't think it's much of a problem. They'll go away at next cache compression. These changes also make it quite simple to make cache file work with shared filesystems. I'd just need to implement some kind of internal caching buffer which remembers what parts of file are read into memory. These changes also make it possible to easily and reliably store X-UIDL headers into cache file, where the POP3 UIDL command could quickly get them. Not in this release yet, though..

3 2

[Dovecot] appenduid?
by Johannes Berg 06 Jul '04

06 Jul '04

Hi, Does dovecot support APPENDUID? If not, would it be possible to add? johannes

2 1

Re: [Dovecot] [PATCH, RFC] add APOP authentication mechanism
by Timo Sirainen 06 Jul '04

06 Jul '04

On 1.7.2004, at 16:26, Andrey Panin wrote: >> + if (strcmp(auth_request->protocol, "POP3")) { >> + if (verbose) >> + i_info("apop(%s): wrong protocol %s", >> get_log_prefix(auth_request), >> + auth_request->protocol); >> + mech_auth_finish(auth_request, NULL, 0, FALSE); >> + return TRUE; >> + } >> >> I don't think there's really any point in checking this? Maybe someone >> really wants to use APOP with another protocol :) > > This will be RFC violation isn't it ? (I'll send a public reply, the last question could need input from others) Well, it's not compatible with any RFC of course, but I don't think it would violate anything? I'd just rather like to avoid unnecessary code bloat. Well, except now that I thought about the logic instead of just the code, there are problems. APOP prevents replay attacks by sending different timestamp in greeting, but you're sending the greeting to dovecot-auth as user input to APOP authentication mechanism. So, a user could simply say "AUTH APOP" and send wanted timestamp as input. One way to fix this would be to disallow APOP mechanism to be used with AUTH command in pop3-login and require that the request was done with POP3 protocol. But I think that's pretty ugly kludge. It also requires that processes connecting to dovecot-auth are trusted, which is something I've tried to avoid as much as possible. So dovecot-auth doesn't really know if it's pop3-login which connects to it.. Better fix would be to get part of the timestamp from dovecot-auth itself. It could send a growing ID number as handshake which would be used as part of the timestamp, and APOP mechanism processing would check that timestamp really contains the ID. So timestamp would be <authid.unixtime@hostname>. That also makes the PID go away, which was another thing I would have suggested. POP3 RFC also says: It is conjectured that use of the APOP command provides origin identification and replay protection for a POP3 session. Accordingly, a POP3 server which implements both the PASS and APOP commands should not allow both methods of access for a given user; that is, for a given mailbox name, either the USER/PASS command sequence or the APOP command is allowed, but not both. But I don't know if there's any nice way to do it, except perhaps by defining APOP password scheme which would actually be plaintext but wouldn't work with anything but APOP authentication. Do any other servers prevent it either?

2 5

[Dovecot] Debian dovecot news
by Jaldhar H. Vyas 04 Jul '04

04 Jul '04

I uploaded 0.99.10.6 to sid. Owing to the importance of the dot lock fix, I've tried to have this pushed to sarge quickly. Let's see how that goes. I've prepared a backport of 0.99.10.6 to woody which should be showing up on www.backports.org soon hopefully. In the meantime, if you desperately need it and don't mind working out dependencies yourself, you can find it at http://www.braincells.com/backports/ I uploaded 1.0test18 to http://src.braincells.com/dovecot-test/ (I'll do test20 tomorrow) I told Timo I'd port dovecot's gnutls support from gnutls7 to gnutls10 but I have absolutely no time for it so if someone would volunteer, contact me, I'd really appreciate it. -- Jaldhar H. Vyas <jaldhar(a)debian.org> La Salle Debain - http://www.braincells.com/debian/

4 7

[Dovecot] index file regeneration?
by Paul Reilly 02 Jul '04

02 Jul '04

Quick question: How does dovecot keep the message headers index file updated? Eg: if my MDA delivers an extra 10 messages while I'm logged in. How does the message index get updated? At what points is it regenerated? Thanks, Paul

2 7