- dovecot - dovecot.org

Howto pin user in proxy/director <-> backend server setup
by Marc Roos 12 Nov '19

12 Nov '19

I have 1x proxy/director server 2x backend mail server The backend servers are using a ldap database and do not have the option to put a proxy=y value. So I put this as a default in the passdb option in the proxy/director config. When I do telnet localhost 110 on the proxy/director, I can authenticate with a test account on svr1.local 1. Will automatically all users be directed to the first server configured in director_mail_servers = svr1.local svr2.local, when the do not have a proxy=y or host=? If this is the case maybe, we should write this somewhere on https://wiki2.dovecot.org/Director https://doc.dovecot.org/configuration_manual/authentication/proxies/ 2. If I change the host= in the ldap server, I think the proxy/director has archived the previous host and still redirects to the old value. Is there a way around this? (stopping/starting dovecot -F resolves this) 3. Do I need the director even in this setup?

1 0

[SOLVED] dovecot -2.2.24 on Fedora 31
by Frank Elsner 12 Nov '19

12 Nov '19

Hello Aki, thanks for your patience and help. I solved my problems by compiling dovecot-2.3.8 and following the migration hints I got it working. Happy, Frank

1 0

postfix + spamassassin + dovecot-lda (with sieve support)
by Дмитрий До лженко 12 Nov '19

12 Nov '19

Hello, I have FreeBSD 12 server with postfix + spamassassin. Old config work fine. ------ old postfix master.cf spamfilter unix - n n - - pipe flags=R user=nobody argv=/usr/local/bin/spamc -e /usr/sbin/sendmail -oi -f ${sender} ${recipient} ------ I try to add dovecot-lda (with sieve support) as local delivery agent to postfix config ----------- postfix master.cf # Spamd filter spamfilter unix - n n - - pipe flags=DRhu user=nobody argv=/usr/local/bin/spamc -e /usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} ----------- Test mail is bounced with report - --------- If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <dol(a)mig.hys.msu.ru>: user unknown --------- /var/log/maillog Nov 11 22:40:49 mig postfix/smtpd[55978]: disconnect from acs366.hys.msu.ru[93.10.51.14] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Nov 11 22:40:49 mig dovecot[64447]: auth-worker(55751): passwd(dol(a)mig.hys.msu.ru): unknown user System user dol exist, but LDA try to deliver to dol(a)mig.hys.msu.ru Please, help me to solve this problem. I need to serve IMAP and POP3 clients with delivery to /var/mail/username mailboxes if no user sieve rules exists. Best regards, Dmitry.

2 1

dovecot -2.2.24 on Fedora 31
by Frank Elsner 12 Nov '19

12 Nov '19

Hi, I try to compile dovecot -2.2.24 on Fedora 31 and get the following error: iostream-openssl.c: In function ‘openssl_iostream_verify_client_cert’: iostream-openssl.c:118:37: error: dereferencing pointer to incomplete type ‘X509_STORE_CTX’ {aka ‘struct x509_store_ctx_st’} 118 | subject = X509_get_subject_name(ctx->current_cert); | ^~ make[3]: *** [Makefile:561: iostream-openssl.lo] Error 1 All openssl packages installed. What's the reason and how solve the problem? Kind regards, Frank Elsner

2 8

Login/director not created
by Marc Roos 11 Nov '19

11 Nov '19

I have this[0] config, yet the /var/run/dovecot/login/director is not created, what to check in the config? dovecot: imap-login: Error: auth: connect(director) failed: No such file or directory [0] service director { unix_listener login/director { #mode = 0666 } fifo_listener login/proxy-notify { #mode = 0666 } unix_listener director-userdb { #mode = 0600 } inet_listener { #port = } }

2 4

gssapi without passdb
by David Wells 11 Nov '19

11 Nov '19

Good afternoon. I'm configuring dovecot to authenticate users against a samba server running as an active directory domain controller. I followed the instructions as stated in the page https://wiki.dovecot.org/Authentication/Kerberos and considering the sentence that states [...]The Kerberos authentication mechanism doesn't require having a passdb, but you do need a userdb[...] I produced a configuration file that looked like this > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /etc/dovecot/dovecot.keytab > auth_mechanisms = gssapi > auth_username_format = %u > mail_location = > maildir:~/Maildir:INDEX=/var/lib/dovecot/%d/%n:CONTROL=/var/lib/dovecot/%d/%n:UTF-8 > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope > encoded-character vacation subaddress comparator-i;ascii-numeric > relational regex imap4flags copy include variables body enotify > environment mailbox date index ihave duplicate mime foreverypart > extracttext > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > } > protocols = imap > ssl_ca = /etc/ssl/certs/cacertificate.crt > ssl_cert = </etc/ssl/certs/certificate.crt > ssl_key = # hidden, use -P to show it > userdb { > args = uid=vmail gid=vmail home=/var/vmail/%d/%n allow_all_users=yes > driver = static > } When I ran these settings I would get an error that read > Nov 8 17:00:00 mail dovecot: auth: Error: > gssapi(user(a)KERBEROSPRINCIPAL,192.168.182.137,<IQMcOtuWI+3AqLaJ>): All > password databases were skipped > Nov 8 17:00:02 mail dovecot: imap-login: Disconnected (auth service > reported temporary failure): user=<user@KERBEROSPRINCIPAL>, > method=GSSAPI, rip=192.168.182.137, lip=192.168.182.4, TLS, > session=<IQMcOtuWI+3AqLaJ> After Trying many things I finally modified my config > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /etc/dovecot/dovecot.keytab > auth_mechanisms = gssapi > auth_username_format = %u > mail_location = > maildir:~/Maildir:INDEX=/var/lib/dovecot/%d/%n:CONTROL=/var/lib/dovecot/%d/%n:UTF-8 > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope > encoded-character vacation subaddress comparator-i;ascii-numeric > relational regex imap4flags copy include variables body enotify > environment mailbox date index ihave duplicate mime foreverypart > extracttext > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = /etc/dovecot/dovecot-ldap.conf.ext > driver = ldap > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > } > protocols = imap > ssl_ca = /etc/ssl/certs/cacertificate.crt > ssl_cert = </etc/ssl/certs/certificate.crt > ssl_key = # hidden, use -P to show it > userdb { > args = uid=vmail gid=vmail home=/var/vmail/%d/%n allow_all_users=yes > driver = static > } The dovecot-ldap.conf.ext file looks like this > hosts = dc1:3268 > tls = yes > auth_bind = yes > auth_bind_userdn = %u > base = With this configuration I can authenticate to the imap server sending user@KERBEROSPRINCIPAL as my username and without setting a password so I'm wondering if the wiki page needs to be updated or if there is something wrong with my first setup. Thanks in advance. Best regards, David Wells.

2 1

Sieve vacation :addresses match only case-sensitive?
by Philipp Faeustlin 11 Nov '19

11 Nov '19

The recipients in the vacation :addresses String list are matched case-sensitive. If the recipient gets a mail with wrong case, the message is discarded with: "discarding vacation response for implicitly delivered message; no known (envelope) recipient address found in message headers" I think the matching should be case-insensitive. Is this a bug or do I miss some option? I'm using Dovecot 2.3.7.2, Pigeonhole version 0.5.7.2. -- Philipp Fäustlin

5 9

Proxy testing in container( chown failed /var/dovecot/login)
by Marc Roos 11 Nov '19

11 Nov '19

I am testing a bit with the proxy, and trying to run dovecot as a normal user. (with cap bind_service). I was wondering what the minimum configuration is for running like a proxy. I am now getting issues like unable to chown on /var/dovecot/login, but I do not need this in such a setup do I? passdb { driver = static args = proxy=y host=192.168.11.10 nopassword=y }

2 3

Error: Corrupted index cache file and Error: Maildir filename has wrong S value
by Brent Clark 11 Nov '19

11 Nov '19

Good day Guys I have been met with a very interesting set of error messages. Here is the snippet(s) https://pastebin.com/raw/nFf79Ebc (Sorry for all the redacted REMOVED_*.) Google is proving to be a bit challenging in helping and explaining. Could anyone please share how something like this happens, but more importantly how to recover from this. doveadm index -u <username> INBOX do the trick? I also would like to ask the community, is there any tips or tricks any of you guys do to mitigate index / cache corruptions. Many thanks Regards Brent Clark

2 5

User found but password failure
by Mauricio Tavares 11 Nov '19

11 Nov '19

Trying to figure out which step is causing me not to be able to login. I am using a password file, passdb { driver = passwd-file args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/passwd } We will assume that the pw I created using 'doveadm pw -s SHA512-CRYPT' matches the password I will be using to login below. I crank the debugging mode, auth_debug_passwords = yes auth_debug = yes And then try to login [root@mail ~]# nc -t localhost 143 * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=GSSAPI] Howdy a login raub(a)example.com password [blank] which from what I gathered from /var/log/dovecot means it found matching username but did not match password: secured session=lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB lip=::1 rip=::1 lport=143 rport=36340 resp=base64-reply (previous base64 data may contain sensitive data) Aug 26 03:25:52 auth: Debug: passwd-file(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): lookup: user=raub(a)example.com file=/etc/dovecot/passwd Aug 26 03:25:52 auth: Debug: client passdb out: OK 1 user=raub(a)example.com Aug 26 03:25:52 auth: Debug: master in: REQUEST 1520959489 26560 1 63ee7f45236f85fd39573a5c8a2eb46a session_pid=26563 request_auth_token Aug 26 03:25:52 auth-worker(26562): Debug: passwd(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): lookup Aug 26 03:25:52 auth-worker(26562): Info: passwd(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): unknown user Aug 26 03:25:52 auth: Debug: passwd-file(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): lookup: user=raub(a)example.com file=/etc/dovecot/passwd Aug 26 03:25:52 auth: Error: plain(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): user not found from any userdbs Aug 26 03:25:52 auth: Debug: master userdb out: NOTFOUND 1520959489 Aug 26 03:25:52 imap: Error: Authenticated user not found from userdb, auth lookup id=1520959489 (auth connected 1 msecs ago, handshake 0 msecs ago, request took 1 msecs, client-pid=26560 client-id=1) Aug 26 03:25:52 imap-login: Info: Internal login failure (pid=26560 id=1) (internal failure, 1 successful auths): user=<raub(a)example.com>, method=PLAIN, rip=::1, lip=::1, mpid=26563, secured, session=<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB> Per [1] I decided to see what the response (base64-reply) I am submitting to dovecot looks like: echo 'base64-reply' | base64 -d raub(a)example.compassword Which has the right username and password but follows the userpassword format, not useruserpassword as I was led to believe by [1]. Is that to be expected? If it is then the issue is further down the line. [1] https://wiki.dovecot.org/Debugging/Authentication

3 5