- dovecot - dovecot.org

doveadm-server core dump
by FUSTE Emmanuel 16 Jun '17

16 Jun '17

Hello, coredump found after a force-resync and a replicate Emmanuel. (dovecot-ee 2.2.30.2-1) [New LWP 17168] Core was generated by `dovecot/doveadm-server'. Program terminated with signal SIGABRT, Aborted. #0 0x00007fa334127c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #0 0x00007fa334127c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 17168 selftid = 17168 #1 0x00007fa33412b028 in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0x20d2b48, sa_sigaction = 0x20d2b48}, sa_mask = {__val = {34255104, 0, 140338942616871, 1, 0, 181, 140338929827120, 140725975364353, 0, 0, 140338942645461, 0, 140338930777984, 140338937001888, 34203576, 140725975364140}}, sa_flags = 0, sa_restorer = 0x7ffd51c5b1c8} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007fa334546766 in default_fatal_finish (type=<optimized out>, status=status@entry=0) at failures.c:201 backtrace = 0x209df68 "/usr/lib/dovecot/libdovecot.so.0(+0x8d770) [0x7fa334546770] -> /usr/lib/dovecot/libdovecot.so.0(+0x8d84e) [0x7fa33454684e] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fa3344dcffb] -> dovecot/do"... #3 0x00007fa33454684e in i_internal_fatal_handler (ctx=0x7ffd51c5b3b0, format=<optimized out>, args=<optimized out>) at failures.c:670 status = 0 #4 0x00007fa3344dcffb in i_panic (format=format@entry=0x4530f8 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:275 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffd51c5b4a0, reg_save_area = 0x7ffd51c5b3e0}} #5 0x000000000043a1eb in dsync_brain_sync_mailbox_deinit (brain=brain@entry=0x20d2b48) at dsync-brain-mailbox.c:371 last_common_uid = 0 last_messages_count = 0 last_common_modseq = 4428091 changes_during_sync = 0x0 last_common_pvt_modseq = 140725975364904 require_full_resync = false error = MAIL_ERROR_NONE __FUNCTION__ = "dsync_brain_sync_mailbox_deinit" #6 0x000000000043adc6 in dsync_brain_slave_recv_mailbox (brain=brain@entry=0x20d2b48) at dsync-brain-mailbox.c:841 dsync_box = 0x20d0878 local_dsync_box = {mailbox_guid = "\344B\277\017j\022\271T\002\253\000\000\367\362\265", <incomplete sequence \346>, mailbox_lost = false, have_guids = true, have_save_guids = true, have_only_guid128 = false, uid_validity = 1497621508, uid_next = 10, messages_count = 9, first_recent_uid = 1, highest_modseq = 3, highest_pvt_modseq = 0, cache_fields = {arr = {buffer = 0x209d208, element_size = 24}, v = 0x209d208, v_modifiable = 0x209d208}} box = 0x20e0f88 errstr = 0x2f <error: Cannot access memory at address 0x2f> resync_reason = 0x466b58 "UIDVALIDITY changed during a stateful sync, need to restart" error = MAIL_ERROR_NONE ret = <optimized out> resync = 255 __FUNCTION__ = "dsync_brain_slave_recv_mailbox" #7 0x00000000004387db in dsync_brain_run_real (changed_r=0x7ffd51c5b67f, brain=0x20d2b48) at dsync-brain.c:651 ret = true orig_state = DSYNC_STATE_SLAVE_RECV_MAILBOX orig_box_recv_state = DSYNC_BOX_STATE_MAILBOX orig_box_send_state = DSYNC_BOX_STATE_MAILBOX changed = false #8 dsync_brain_run (brain=brain@entry=0x20d2b48, changed_r=changed_r@entry=0x7ffd51c5b67f) at dsync-brain.c:687 _data_stack_cur_id = 5 #9 0x0000000000438ae1 in dsync_brain_run_io (context=0x20d2b48) at dsync-brain.c:110 brain = 0x20d2b48 changed = false try_pending = true #10 0x000000000044cc7f in dsync_ibc_stream_input (ibc=0x20c1a10) at dsync-ibc-stream.c:230 ibc = 0x20c1a10 #11 0x00007fa33455a802 in io_loop_call_io (io=0x20becc0) at ioloop.c:599 ioloop = 0x20a9f20 t_id = 4 __FUNCTION__ = "io_loop_call_io" #12 0x00007fa33455bd47 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x20a9f20) at ioloop-epoll.c:223 ctx = 0x20ab100 list = 0x20c14f0 io = <optimized out> tv = {tv_sec = 4, tv_usec = 999912} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #13 0x00007fa33455a89c in io_loop_handler_run (ioloop=ioloop@entry=0x20a9f20) at ioloop.c:648 No locals. #14 0x00007fa33455aa58 in io_loop_run (ioloop=0x20a9f20) at ioloop.c:623 __FUNCTION__ = "io_loop_run" #15 0x000000000042065e in cmd_dsync_server_run (_ctx=0x20b6168, user=<optimized out>) at doveadm-dsync.c:1169 ctx = 0x20b6168 ibc = 0x20c1a10 brain = 0x20d2b48 temp_prefix = 0x209cb68 state_str = 0x0 sync_type = <optimized out> name = 0x20a9f00 "10.33.207.136" process_title_prefix = 0x209cb40 "10.33.207.136 " mail_error = MAIL_ERROR_NONE #16 0x0000000000421f96 in doveadm_mail_next_user (ctx=ctx@entry=0x20b6168, cctx=cctx@entry=0x7ffd51c5b8e0, error_r=error_r@entry=0x7ffd51c5b8d8) at doveadm-mail.c:416 input = {module = 0x0, service = 0x4592b0 "doveadm", username = 0x209b5e1 "T0146937", session_id = 0x0, session_id_prefix = 0x0, session_create_time = 0, local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\n!χ", '\000' <repeats 11 times>, __u6_addr16 = {8458, 34767, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2278498570, 0, 0, 0}}}, ip4 = {s_addr = 2278498570}}}, remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\n!ψ", '\000' <repeats 11 times>, __u6_addr16 = {8458, 35023, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2295275786, 0, 0, 0}}}, ip4 = {s_addr = 2295275786}}}, local_port = 12345, remote_port = 55819, userdb_fields = 0x0, flags_override_add = (unknown: 0), flags_override_remove = (unknown: 0), no_userdb_lookup = 0, debug = 0} error = 0x20 <error: Cannot access memory at address 0x20> ip = <optimized out> ret = <optimized out> __FUNCTION__ = "doveadm_mail_next_user" #17 0x0000000000422909 in doveadm_mail_single_user (ctx=ctx@entry=0x20b6168, cctx=cctx@entry=0x7ffd51c5b8e0, error_r=error_r@entry=0x7ffd51c5b8d8) at doveadm-mail.c:447 __FUNCTION__ = "doveadm_mail_single_user" #18 0x0000000000435484 in doveadm_mail_cmd_server_run (cctx=0x7ffd51c5b8e0, mctx=0x20b6168, conn=0x20b1d48) at client-connection.c:164 error = 0x0 ret = <optimized out> #19 doveadm_cmd_handle (cctx=0x7ffd51c5b8e0, argv=0x209b618, argc=3, cmd_name=<optimized out>, conn=0x20b1d48) at client-connection.c:247 ioloop = 0x20a9f20 mail_cmd = 0x20aa138 mctx = 0x20b6168 cmd_ver2 = <optimized out> prev_ioloop = 0x20a39d0 cmd = 0x0 #20 client_handle_command (args=<optimized out>, conn=0x20b1d48) at client-connection.c:315 cctx = {cmd = 0x0, argc = 0, argv = 0x0, username = 0x209b5e1 "T0146937", cli = false, tcp_server = true, local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\n!χ", '\000' <repeats 11 times>, __u6_addr16 = {8458, 34767, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2278498570, 0, 0, 0}}}, ip4 = {s_addr = 2278498570}}}, remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\n!ψ", '\000' <repeats 11 times>, __u6_addr16 = {8458, 35023, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2295275786, 0, 0, 0}}}, ip4 = {s_addr = 2295275786}}}, local_port = 12345, remote_port = 55819, conn = 0x20b1d48} flags = <optimized out> cmd_name = <optimized out> argc = <optimized out> #21 client_connection_input (conn=0x20b1d48) at client-connection.c:432 args = <optimized out> _data_stack_cur_id = 3 line = <optimized out> ok = true #22 0x00007fa33455a802 in io_loop_call_io (io=0x20a8660) at ioloop.c:599 ioloop = 0x20a39d0 t_id = 2 __FUNCTION__ = "io_loop_call_io" #23 0x00007fa33455bd47 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x20a39d0) at ioloop-epoll.c:223 ctx = 0x20af660 list = 0x20a35c0 io = <optimized out> tv = {tv_sec = 2147483, tv_usec = 0} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #24 0x00007fa33455a89c in io_loop_handler_run (ioloop=ioloop@entry=0x20a39d0) at ioloop.c:648 No locals. #25 0x00007fa33455aa58 in io_loop_run (ioloop=0x20a39d0) at ioloop.c:623 __FUNCTION__ = "io_loop_run" #26 0x00007fa3344e6e43 in master_service_run (service=0x20a3870, callback=callback@entry=0x437690 <client_connected>) at master-service.c:666 No locals. #27 0x0000000000413ff7 in main (argc=1, argv=0x20a35e0) at main.c:143 set_roots = {0x464b40 <doveadm_setting_parser_info>, 0x0} input = {roots = 0x7ffd51c5ba60, config_path = 0x0, preserve_environment = false, preserve_user = false, preserve_home = false, never_exec = false, use_sysexits = false, parse_full_config = false, module = 0x4592b0 "doveadm", service = 0x4592b0 "doveadm", username = 0x0, local_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, remote_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, local_name = 0x0} output = {specific_services = 0x0, service_uses_local = 0, service_uses_remote = 0, used_local = 0, used_remote = 0, permission_denied = 0} error = 0x7fa334f3f520 "\200\364\363\064\243\177" c = <optimized out>

1 0

Re: Minor patches for builds against ancient platforms
by Joseph Tam 15 Jun '17

15 Jun '17

> I do know that this little box of horrors has 200-300MB mbox INBOXes on an > ext3 filesystem formatted in 2005. I am very nervous about converting them to > Maildir at this point. Fortunately, it just involves reformatting the data and a little reconmfiguration of dovcot. If you can find the tool and disk space, it's well worth doing. Of course, when running a proverbial dinosaur, you're often more preoccupied with preventing the next proverbial meteorite strike. > What I meant was, are certain types of filenames "blocked" by policy from > being created via IMAP commands? I'm sure I could run a few tests to answer > this for myself, or better still, go through Timo's code. I never saw anything that could do that -- maybe you can torture the virtual mailbox facility to get that done. If all your concerned is dovecot dot-files, you can place the indices somewhere else other than the user's filesapace. > One last problem area is that many users have soft-links to mailboxes > located on a second drive, but these never appear in folder enumeration > lists or they appear grayed out in SeaMonkey/Thunderbird. I've tried > just symbolically linking to directories containing other mboxes, but > sometimes it works, and sometimes it doesn't. I wonder if there's > paranoia checking in the code that follows symbolic links to ensure > that uids/gids of the "owning" directory and the linked-to directory > (or files within it) are the same. It works for me. From what I see, the ownership of the symlink is ignored; it's the underlying file that counts. Maybe a subscription issue? Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: Minor patches for builds against ancient platforms
by Joseph Tam 14 Jun '17

14 Jun '17

"M. Balridge" <dovecot(a)r.paypc.com> writes: > I assume it's a rarely seen issue because few Dovecot users compile the > software in caves on computers powered by horse-pulled generator > wheels. I resemble that remark. >> Warning: Transaction log file /home/luser/mail/.imap/INBOX/dovecot.index.log >> was locked for 95 seconds (rotating while syncing) Timo recently explained to me it's probably caused by slow I/O or processing. This explanation is consistent with my observation that the users who get these messages have jumbo mailboxes. > imap(luser): Error: fchown(/home/luser/mail/.subscriptions.lock, > group=501(coregroup)) failed: Operation not permitted (egid=200(users), group > based on /home/luser/mail - see http://wiki2.dovecot.org/Errors/ChgrpNoPerm) > > imap(luser): Error: file_dotlock_open() failed with subscription file > /home/luser/mail/.subscriptions: Operation not permitted > > .subscriptions doesn't exist either as a file or a directory in the named > directories. > > Is there a "filter" against dot-files being opened within the bowels of dovecot? You can disable dotclock altogether, but I don't think this is what you meant. You can use locking method "dotlock_try" rather than "dotlock" -- the former will ignore quota/permissions problems and plow on. (It still logs it.) You could also align luser's mail folder group with with luser's GID, which is usually what I do. Maybe locks are created even when files don't exist as there may be a race condition where another process is creating/deleting it at the same time. Joseph Tam <jtam.home(a)gmail.com>

4 5

v2.2.30 released
by Timo Sirainen 13 Jun '17

13 Jun '17

https://dovecot.org/releases/2.2/dovecot-2.2.30.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.30.tar.gz.sig * auth: Use timing safe comparisons for everything related to passwords. It's unlikely that these could have been used for practical attacks, especially because Dovecot delays and flushes all failed authentications in 2 second intervals. Also it could have worked only when passwords were stored in plaintext in the passdb. * master process sends SIGQUIT to all running children at shutdown, which instructs them to close all the socket listeners immediately. This way restarting Dovecot should no longer fail due to some processes keeping the listeners open for a long time. + auth: Add passdb { mechanisms=none } to match separate passdb lookup + auth: Add passdb { username_filter } to use passdb only if user matches the filter. See https://wiki2.dovecot.org/PasswordDatabase + dsync: Add dsync_commit_msgs_interval setting. It attempts to commit the transaction after saving this many new messages. Because of the way dsync works, it may not always be possible if mails are copied or UIDs need to change. + imapc: Support imapc_features=search without ESEARCH extension. + imapc: Add imapc_features=fetch-bodystructure to pass through remote server's FETCH BODY and BODYSTRUCTURE. + imapc: Add quota=imapc backend to use GETQUOTA/GETQUOTAROOT on the remote server. + passdb imap: Add allow_invalid_cert and ssl_ca_file parameters. + If dovecot.index.cache corruption is detected, reset only the one corrupted mail instead of the whole file. + doveadm mailbox status: Add "firstsaved" field. + director_flush_socket: Add old host's up/down and vhost count as parameters - More fixes to automatically fix corruption in dovecot.list.index - dsync-server: Fix support for dsync_features=empty-header-workaround - imapc: Various bugfixes, including infinite loops on some errors - IMAP NOTIFY wasn't working for non-INBOX if IMAP client hadn't enabled modseq tracking via CONDSTORE/QRESYNC. - fts-lucene: Fix it to work again with mbox format - Some internal error messages may have contained garbage in v2.2.29 - mail-crypt: Re-encrypt when copying/moving mails and per-mailbox keys are used. Otherwise the copied mails can't be opened. - vpopmail: Fix compiling

7 12

rescann / reindex / rebuild a subfolder structure
by Götz Reinicke - IT Koordinator 13 Jun '17

13 Jun '17

Hi, an user is missing all mail from a folder and all subfolders which are still saved in the users maildir directory on the dovecot server. From an imap client she sees the main folder but empty. No subfolders. She told me with an other imap client and a new created account she has the same problem. Question: Can I resync / regenerate some folder... index.... something....-files from the dovecot side? Thanks for hints and regards . Götz

1 0

Re: Minor patches for builds against ancient platforms
by Joseph Tam 13 Jun '17

13 Jun '17

> On that note, has anyone written a tool that "harmonises" users mail > directories' permissions - ideally reading the dovecot configuration to assess > where *THE* mail directories are actually used by dovecot? doveadm user $user which will supply the second half: it will spit out the UID, GID, home and mail directories of a user as specified by dovecot's configuration. > I was surprised by the pickiness of the group ownership/permissions > issues, though reflecting on things, I can see why you'd at least want > some logging by default for those conditions. This is a consequence of writing secure software: it employs least privilege so that a fault will not result in someone being able to mess around with someone else's mail (or indices). GID can also govern access to shared mailboxes. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: namespace and folders
by Joseph Tam 12 Jun '17

12 Jun '17

Gregory Sloop <gregs(a)sloop.net> writes: > Using mbox format and this namespace > > namespace { > inbox = yes > hidden = yes > prefix = INBOX/ > } > ... > This is not a terrible problem, but it's cosmetically ugly and confusing for users. > I'd prefer to only see these folders as subscribed as sub-folders [or sub-items] under inbox. Pardon my naievty, but couldn't you just remove this namespace altogether and get rid of at least one set of duplicates (although it probably keep the non-preferred one). Joseph Tam <jtam.home(a)gmail.com>

1 0

service(auth): command startup failed?
by HL1234 12 Jun '17

12 Jun '17

Hello, I need help because since some days I can not figure out what error this is and where it come from. I have used dovecot since years. Know after an update it is broken. First I like to give you some data: It's a FreeBSD 11.0 Server with sendmail (SMTP) and dovecot for IMAP with SSL. #dovecot --build-options Build options: ioloop=kqueue notify=kqueue ipv6 openssl io_block_size=8192 Mail storages: shared mdbox sdbox maildir mbox cydir imapc pop3c raw fail SQL drivers: mysql Passdb: checkpassword ldap pam passwd passwd-file sql Userdb: checkpassword ldap nss passwd prefetch passwd-file sql #dovecot --version 2.2.30.2 (c0c463e) I install the update with the FreeBSD ports. Before the update all was running fine. The state know is: form my client Outlook I can send eMail above SMTP. When I try to get my eMails by the IMAP-Server it is blocked. I have look around in the config files but I see nothing what has could be changed. I have tried to make new *.pem files with using the script in /usr/local/share/examples/dovecot/ but this havn't bring a solution. I need help for this error i see in the logs: dovecot.log master: Error: service(auth): command startup failed, throttling for 2 secs auth: Error: auth: environment corrupt; missing value for DOVECOT_ auth: Fatal: unsetenv(RESTRICT_SETUID) failed: Bad address auth: Error: auth: environment corrupt; missing value for DOVECOT_ auth: Fatal: unsetenv(RESTRICT_SETUID) failed: Bad address ..... dovecot-info.log imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 1 secs): user=<>, rip=77.178.105.78, lip=88.74.25.120, TLS Jun 12 23:01:15 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 8 secs): user=<>, rip=58.218.194.81, lip=88.74.25.120, TLS handshaking .... dovecot-debug.log imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [77.178.105.78] imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [77.178.105.78] imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [77.178.105.78] auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth auth: Debug: Module loaded: /usr/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so auth: Debug: Read auth token secret from /var/run/dovecot//auth-token-secret.dat Have anyone an idea what is going wrong and how to fix it? Harald -- View this message in context: http://dovecot.2317879.n4.nabble.com/service-auth-command-startup-failed-tp… Sent from the Dovecot mailing list archive at Nabble.com.

1 0

Redis auth?
by Mark Moseley 12 Jun '17

12 Jun '17

I was curious what the status of this redis auth patch is: https://dovecot.org/list/dovecot/2016-June/104763.html

1 0

Re: Log authentication attempts
by j.emerlik 12 Jun '17

12 Jun '17

We alse have same problem, now we are running Dovecot 2.2.30.2 and also use Dovecot SASL for SMTP authentication (postfix 2.11). We need to save all failed login attempts to database as source IP address, username and date and time but post-login script can do this but only after successful login. Failed login attempts information may be useful in the fight with bruteforce attacks. It's possible to execude some script after failed login ("Password mismatch") ? Regards, Jacek

4 5