- dovecot - dovecot.org

Questions on supporting Shared Mailboxes using imapc://
by Nathan Coulson 06 Nov '15

06 Nov '15

I was not able to get a shared mailbox setup working using imapc. Tested using mailboxes on the same server, as well as other servers. We are using dovecot 2.2.10 from Centos 7, following the guide at http://wiki2.dovecot.org/SharedMailboxes/ClusterSetup imapc_host=192.168.5.5 #(Local dovecot server) imapc_master_user= %u imapc_password=TempPass #imapc_user=test2(a)example.com # Added for testing. namespace { type = shared separator = / prefix = shared/%%u/ list = children location = imapc:~/shared/%%u/ } namespace { # used as a control to verify that shared mailboxes work type = shared separator = / prefix = shared2/%%u/ list = children location = sdbox:%%h:INDEXPVT=~/shared2/%%u } dict { acl = mysql:/etc/dovecot/dovecot-sql_aggelos_shares.conf.ext } plugin { acl = vfile acl_shared_dict = proxy::acl } mail_plugins = acl protocol imap { mail_plugins = acl imap_acl } passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } passdb { # for master user logins driver = sql args = /etc/dovecot/dovecot-sql_aggelos_aclmaster.conf.ext master = yes pass = yes } userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } I can login using test2@example.com*test@example.com (and see all of test2's email), and it looks like it authenticates ok via imap, but shared never shows up. No issues using shared2 which uses direct access to the mailbox doveadm acl debug -u test(a)example.com shared/test2(a)example.com (Fails, uses imapc) doveadm(test(a)example.com): Info: Mailbox 'INBOX' is in namespace 'shared/test2(a)example.com/' doveadm(test(a)example.com): Info: Mailbox path: /misc/1/2/mail/test@example.com-4/shared/test2@example.com/.INBOX doveadm(test(a)example.com): Info: All message flags are shared across users in mailbox doveadm(test(a)example.com): Info: User test(a)example.com has no rights for mailbox doveadm(test(a)example.com): Error: User test(a)example.com is missing 'lookup' right doveadm(test(a)example.com): Info: Mailbox shared/test2(a)example.com is NOT visible in LIST doveadm acl debug -u test(a)example.com shared/test2(a)example.com/Junk (Fails, contains a folder that exists) doveadm(test(a)example.com): Info: Mailbox 'Junk' is in namespace 'shared/test2(a)example.com/' doveadm(test(a)example.com): Info: Mailbox path: /misc/1/2/mail/test@example.com-4/shared/test2@example.com/.Junk doveadm(test(a)example.com): Info: All message flags are shared across users in mailbox doveadm(test(a)example.com): Info: User test(a)example.com has no rights for mailbox doveadm(test(a)example.com): Error: User test(a)example.com is missing 'lookup' right doveadm(test(a)example.com): Info: Mailbox shared/test2(a)example.com/Junk is NOT visible in LIST doveadm acl debug -u test(a)example.com shared/test2(a)example.com/z (Fails, contains a folder that does not exist. Expected result) doveadm(test(a)example.com): Error: Mailbox 'z' in namespace 'shared/test2(a)example.com/' doesn't exist in /misc/1/2/mail/test@example.com-4/shared/test2@example.com/.z doveadm acl debug -u test(a)example.com shared2/test2(a)example.com (Works, using direct storage) doveadm(test(a)example.com): Info: Mailbox 'INBOX' is in namespace 'shared2/test2(a)example.com/' doveadm(test(a)example.com): Info: Mailbox path: /misc/1/2/mail/test2(a)example.com-87/mailboxes/INBOX/dbox-Mails doveadm(test(a)example.com): Info: Per-user private flags in mailbox: \Seen doveadm(test(a)example.com): Info: User test(a)example.com has rights: lookup read write-seen doveadm(test(a)example.com): Info: Mailbox found from dovecot-acl-list doveadm(test(a)example.com): Info: User test2(a)example.com found from ACL shared dict doveadm(test(a)example.com): Info: Mailbox shared2/test2(a)example.com is visible in LIST It feels like the acl information in the vfiles is not available when using imapc. Our setup is as follows: (Currently does not use Dovecot Director, but has the same issues where shared mailboxes may not be local on the server) * Front servers, that are running dovecot (proxy to backend servers) * Backend Servers, each handle their own local users. Thank you -- Nathan Coulson System Administrator for Bravenet www.bravenet.com nathan(a)bravenet.com

1 1

Re: Problem with permissions of the logfile
by Andreas Meyer 06 Nov '15

06 Nov '15

Hello! To stay on the list. "S. Muthu Kumar" <ksmutthu(a)gmail.com> schrieb am 06.11.15 um 21:49:32 Uhr: > log_path here means the logging channel path. It refers to the logger > daemon to use to generate logs. > > Most of the linux/unix based applications prefer to use common system > logger to take care of writing the logs preferably under /var/log/ as > there are other structures(like rotating those logs periodically). > > do refer to man pages of syslog.conf or rsyslog.conf and see how you > can generate individual log files for devecot via (r)syslog daemon > while you have delegated dovecot logging responsibility to (r)syslog. I must admit I don't understand what is going on. I am running rsyslog on two servers and on both servers version 2.2.13 of dovecot. On the first I set log_path = /var/log/dovecot1 with -rw------- 1 root root 1093533 6. Nov 17:24 dovecot1 in /var/log and everthing is fine. If I do this on the newly set up server, dovecot does not start. Ofcourse I could set it up to log to syslog and prepare rsyslog.conf but why is it so? Regards Andreas

1 0

Problem with permissions of the logfile
by Andreas Meyer 06 Nov '15

06 Nov '15

Hello! I want to have dovecot log into a separate file and set log_path = /var/log/dovecot instead of log_path = syslog Dovecot does not start if I do this. Tried to change permissions and overschip of the file, no luck, ha. Deleted it in the hope dovecot creates it but no. If I set log_path = syslog dovecot starts and I see it is running as # ps aux |grep dove root 2429 0.2 0.0 3416 2568 ? Ss 16:42 0:00 /usr/sbin/dovecot -F dovecot 2431 0.0 0.0 3100 2080 ? S 16:42 0:00 dovecot/anvil root 2432 0.0 0.0 3228 2316 ? S 16:42 0:00 dovecot/log root 2434 0.0 0.0 4220 3300 ? S 16:42 0:00 dovecot/config What must be done to have doveot log into the specified file? Greetings Andreas

1 0

Patch for Dovecot 2.2.19 compilation failure
by Hammer, Adam 06 Nov '15

06 Nov '15

I’m almost embarrassed to submit the following patch. ==== cut here ==== --- dovecot-2.2.19/src/lib/bits.h.orig Thu Mar 19 08:42:32 2015 +++ dovecot-2.2.19/src/lib/bits.h Thu Nov 5 15:10:35 2015 @@ -10,7 +10,9 @@ #include <limits.h> #include <stddef.h> -#include <stdint.h> +#ifdef HAVE_STDINT_H +# include <stdint.h> +#endif #define UINT64_SUM_OVERFLOWS(a, b) \ (a > (uint64_t)-1 - b)

2 1

replication delays
by djk 05 Nov '15

05 Nov '15

I have two dovecot instances that replicate to each other. Mail arrives into "post" and it is generally accessed via IMAP on "france". Changes (moves/expunge etc) on "france" seem to replicate back to "post" more or less immediately. But this seems to happen only for this user. (Some) other users' (e.g. me) mail generally replicates more or less immediately in both directions. Nov 5 17:40:55 post dovecot: lmtp(willem@xxx): xF9mK6eUO1YsFQAAdYyp2A: sieve: msgid=<20151105173923.14970.95605@ssa-app-xxx>: stored mail into mailbox 'SSA' Nov 5 17:41:00 post dovecot: lmtp(willem@xxx): yV9mK6eUO1YsFQAAdYyp2A: sieve: msgid=<20151105173924.14970.91073@ssa-app-xxx>: stored mail into mailbox 'SSA' Nov 5 20:39:09 france dovecot: dsync-server(willem): save: box=SSA, uid=3130, msgid=<20151105173923.14970.95605@ssa-app-xxx>, size=9724 Nov 5 20:39:09 france dovecot: dsync-server(willem): save: box=SSA, uid=3131, msgid=<20151105173924.14970.91073@ssa-app-xxx>, size=9197 Any suggestions as to where to start looking? As you can see I am using 2.2.18 with mdbox and a simple all vmail based system with not many users. I am not seeing any error messages in my mail logs that suggest there any delays happening. Although I have seen a few things like this happening from time to time a busier account: Nov 5 12:12:07 france dovecot: dsync-server(djk): Error: Couldn't lock /home/imap/djk/.dovecot-sync.lock: Timed out after 30 seconds Nov 5 12:12:13 france dovecot: dsync-server(djk(a)tobit.co.uk): Error: Couldn't lock /home/imap/djk/.dovecot-sync.lock: Timed out after 30 seconds Nov 5 12:16:49 france dovecot: dsync-server(djk): Error: Couldn't lock /home/imap/djk/.dovecot-sync.lock: Timed out after 30 seconds root@france:/var/log# dovecot -n # 2.2.18: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: Linux 3.13.0-66-generic x86_64 Ubuntu 14.04.3 LTS auth_verbose = yes doveadm_password = <some secret string or other> first_valid_uid = 2000 imapc_features = rfc822.size fetch-headers imapc_host = <imap hostname> imapc_port = 993 imapc_ssl = imaps imapc_ssl_verify = no imapc_user = %n lda_mailbox_autocreate = yes login_greeting = IMAP ready. mail_attachment_dir = %h/attachments mail_attachment_min_size = 64 k mail_location = mdbox:%h:INBOX=%h/mail mail_plugins = " fts fts_lucene mail_log notify notify replication" mail_prefetch_count = 20 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mdbox_rotate_size = 10 M namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { fts = lucene fts_lucene = whitespace_chars=@. mail_log_events = delete undelete expunge copy save mailbox_delete mailbox_rename mailbox_create mail_log_fields = uid box msgid size mail_replica = tcps:post:<same port as doveadm port> sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)tobit.co.uk protocols = " imap lmtp sieve sieve" service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener exim-auth { group = Debian-exim mode = 0660 user = Debian-exim } } service config { unix_listener config { mode = 0666 user = vmail } } service doveadm { inet_listener { port = <some port or other> ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = <another port> } unix_listener lmtp { mode = 0666 } user = vmail } service managesieve-login { inet_listener sieve { port = <sieve port> } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 100 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl_cert = </etc/dovecot/tobit.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = </etc/dovecot/private/tobit.key ssl_protocols = !SSLv3 !SSLv2 userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = sieve }

1 0

Re: ssl-params: slow startup (patch for consideration)
by Joseph Tam 05 Nov '15

05 Nov '15

A. Schulze writes: > precomputing ssl-params is also possible without patching but it's a > little bit tricky > ... > Long version in german: https://andreasschulze.de/dovecot/ssl-params Nice. (You should probably point out to ensure ssl_parameters_regenerate is zero, otherwise all this work will get wiped out!) Joseph Tam <jtam.home(a)gmail.com>

2 1

Fw: new message
by Doug Wierenga 05 Nov '15

05 Nov '15

Hello! New message, please read <http://battersandco.com/meeting.php?e> Doug Wierenga

1 0

Fw: new message
by terry＠dop.com 05 Nov '15

05 Nov '15

Hello! New message, please read <http://profi2w.com.br/forget.php?80> terry(a)dop.com

1 0

ldap and proxy/proxy_maybe
by jjhoffart 04 Nov '15

04 Nov '15

Hello, I am trying to setup dovecot director and am receiving a lot of "Aborted login (proxy dest auth failed)" and "error proxying loops to itself" messages in the dovecot log. I don't fully understand the dovecot-ldap.conf file config? could someone please let me know if the following is correct. If so what could be causing the errors mentioned above, if not what needs to be corrected? hosts = 127.0.0.1:389 ldap_version = 3 auth_bind = yes dn = cn=vmail,dc=something,dc=somewhere dnpass = hi89Dfnptc55jRWG9oLQJUfWOH0CgV base = o=domains,dc=campus,dc=local scope = subtree deref = never # Below two are required by command 'doveadm mailbox ...' iterate_attrs = mail=user iterate_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)) user_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls%Lc)(|(mail=%u)(&(enabledService=shadowaddress)(shadowAddress=%u)))) user_attrs = mail=user,homeDirectory=home,=mail=maildir:~/Maildir/,mailQuota=quota_rule=*:bytes=%$ # Used for dn lookup pass_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls%Lc)(|(mail=%u)(&(enabledService=shadowaddress)(shadowAddress=%u)))) pass_attrs = mail=user,userPassword=password,someAttribute=proxy,hostName=host default_pass_scheme = CRYPT

1 0

ssl-params: slow startup (patch for consideration)
by Joseph Tam 04 Nov '15

04 Nov '15

Based on the recent found weaknesses in DH key exchange, http://weakdh.org/ I increased ssl_dh_parameters_length to 2048 bits, and found waited for 5+ minutes for dovecot to come back online after a restart. Unless you got a fast machine, the initialization of DH parameters can exceed your patience. Regeneration may not be a problem (if ssl_parameters_regenerate=0 or if Dovecot uses old parameters until regeneration finishes), but for cold starts, the server can be tied up for a few minutes creating DH parameters while clients queue up. I ran "openssl dhparam 2048" and got wildly varying run times of 1m45s, 11m56s, 0.4s, 2m19s, 3h23s. Most of the time was spent testing primality of candidate p *and* (p-1)/2 -- so called "safe prime". If you're unlucky, this can take a long time. However, it appears "safe" primes are not what they're cracked up to be -- they offer some guarantees, but are not safer than non-safe primes. Creating DH parameters without requiring primality of (p-1)/2 (i.e. what "openssl dhparam -dsaparam" does) results in much lower run-time bounds. I cribbed some OpenSSL code to create this (untested) patch. -------------------------------------------------------------------------------- --- iostream-openssl-params.c~ Tue Nov 3 16:08:38 2015 +++ iostream-openssl-params.c Tue Nov 3 15:43:39 2015 @@ -6,5 +6,2 @@ -/* 2 or 5. Haven't seen their difference explained anywhere, but 2 is the - default.. */ -#define DH_GENERATOR 2 @@ -14,2 +11,3 @@ DH *dh; + DSA *dsa; unsigned char *p; @@ -17,3 +15,13 @@ - dh = DH_generate_parameters(bitsize, DH_GENERATOR, NULL, NULL); + dsa = DSA_generate_parameters(bitsize, NULL, 0, NULL, NULL, NULL, NULL); + if (dsa == NULL) { + *error_r = t_strdup_printf( + "DSA_generate_parameters(bits=%d) failed: %s", + bitsize, openssl_iostream_error()); + return -1; + } + + dh = DSA_dup_DH(dsa); + DSA_free(dsa); + if (dh == NULL) { @@ -20,4 +28,4 @@ *error_r = t_strdup_printf( - "DH_generate_parameters(bits=%d, gen=%d) failed: %s", - bitsize, DH_GENERATOR, openssl_iostream_error()); + "DSA_dup_DH() failed: %s", + openssl_iostream_error()); return -1; -------------------------------------------------------------------------------- The other way to prevent long startup times is to pre-compute the DH parameter using "openssl dhparam -out dh2048.pem 2048". I can contribute a patch to do this (read file, convert it into ssl-parameters.dat, then set/behave like ssl_parameters_regenerate=0), but I couldn't figure out the best place to do this. ssl_params_if_unchanged()? Joseph Tam <jtam.home(a)gmail.com>

2 1