- dovecot - dovecot.org

Re: [Dovecot] AUTH_USER variable has invalid value in checkpassword Script
by dovecot.pkoch＠dfgh.net 26 Feb '14

26 Feb '14

answering my own questions: > This has somehow changed and now AUTH_USER always > contains the username. This has fatal consequences as no > every owner of a valid certificate can logon as any user. I now use auth_ssl_username_from_cert = yes and this temporarily fixes my problem. Now if user A authenticates with his certificate and claims to be user B he will be logged on as user A. With ssl_username_from_cert = no (default) he was logged in as User B. > I'm absolutely sure that the value of the x500UniqueIdentifier > was stored into the AUTH_USER when I tested my setup > last year. If one looks at the source code, in particular routine env_put_auth_vars() in src/auth/db-checkpassword.c and routine auth_request_get_var_expand_table() in src/auth/auth-request.c it is clear, that this has never worked. The environemnt variable AUTH_USER always contais the username (in all Dovecot versions). It dows NOT contain the Dovecot auth_user-variable. Comparing AUTH_USER with the username makes no sense in a checkpassword-script So here's my next question: How do I find out the original username from within a chackpassword script after it has been replaced by the x500UniqueIdentifier value from a client certificate? Why is request->requested_login_user == NULL in env_put_auth_vars(). request->user contains the x500UniqueIdentifier value from the clients certificate so the original username was replaced and therefore should have been moved into request->requested_login_user. Kind regards Peter Koch

1 0

[Dovecot] Oldies but Goldies - Dovecot 1.2 and Sieve
by Götz Reinicke - IT Koordinator 25 Feb '14

25 Feb '14

Hi, we still run dovecot 1.2.17 and upgrading is not planed for some time. But I'm asked to install a sieve system to be used with SOGo soon. What do I have to install / configure? Is installing/configuring the dovecot-sieve-0.1.19 and dovecot-managesieve-0.11.13 enough? We still use mostly the default settings for imaps/pop3s. And of course configure SOGo. Thanks for any feedback. Regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 82 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

4 3

Re: [Dovecot] Error - zlib & fts
by Daniel L. Miller 25 Feb '14

25 Feb '14

On 2/25/2014 10:50 AM, Daniel L. Miller wrote: > Just upgraded to a new Solr, so I did a full re-index. Saw some of > these friendly messages: > > doveadm(csmith(a)amfes.com): Error: > zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): gz trailer > has wrong CRC value at 28579617 > doveadm(csmith(a)amfes.com): Error: > read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: > Invalid argument > doveadm(csmith(a)amfes.com): Error: > read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: > Invalid argument (uid=5251) > Also some of these: doveadm(csmith(a)amfes.com): Error: zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): missing gz header at 27877205 Running 2.2.12. -- Daniel

1 0

[Dovecot] Error - zlib & fts
by Daniel L. Miller 25 Feb '14

25 Feb '14

Just upgraded to a new Solr, so I did a full re-index. Saw some of these friendly messages: doveadm(csmith(a)amfes.com): Error: zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): gz trailer has wrong CRC value at 28579617 doveadm(csmith(a)amfes.com): Error: read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: Invalid argument doveadm(csmith(a)amfes.com): Error: read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: Invalid argument (uid=5251) -- Daniel

1 0

[Dovecot] AUTH_USER variable has invalid value in checkpassword Script
by dovecot.pkoch＠dfgh.net 25 Feb '14

25 Feb '14

Dear dovecot experts: We are using client certificates to authenthicate against a Dovecot server. Our certificates contain a x500UniqueIdentifier. I'm absolutely sure that the value of the x500UniqueIdentifier was stored into the AUTH_USER when I tested my setup last year. This has somehow changed and now AUTH_USER always contains the username. This has fatal consequences as now every owner of a valid certificate can logon as any user. Here are some more details of our setup: We are using a checkpassword-Script that does the following: 1. Read Username and Password from file descriptor 3 2. If (AUTH_CERT=="valid") and (AUTH_USER==Username) then user is authenticated 3 If (AUTH_CERT=="valid") and (AUTH_USER<>Username) then authentication is rejected (User a tries to logon as User B) 4 If (AUTH_CERT<>"valid) we calculate the current OATH value for Usernames TOTP-token and compare that with the provided password. The last step is the reason why we are using a checkpassword script. Our smartphone users cannot use a smartcard but enter a password that was created by an OTP generator, so programming my own checkpassword script was my only option. AUTH_USER contains the username even if the x500UniqueIdentifier from the users certificate does not, so step 2 happens when step 3 should happen. I did the initial testing with Dovecot 2.2.6. At that time we were using both port 143 and 993. We now use Dovecot 2.2.7 and port 993 only. This should not make a difference but I will recompile 2.2.6 right after sending this posting. Kind regards and thank you very much for this wonderful IMAP server Peter Koch current dovecot.conf: --------------------------------------------------------- # Dovecot configuration file default_process_limit = 2048 protocols = imap listen = * base_dir = /var/dovecot/ mail_location = maildir:/mail/%u:LAYOUT=fs ssl_cert = </etc/ssl/certs/imap.crt ssl_key = </etc/ssl/private/imap.key ssl_ca = </etc/ssl/certs/imap-ca.crt ssl_verify_client_cert = yes ssl_cert_username_field = x500UniqueIdentifier service imap-login { inet_listener imap { port = 0 } } service auth { client_limit = 4096 } service anvil { client_limit = 5000 } passdb { driver = checkpassword args = /usr/dovecot/bin/checkpassword } userdb { driver = passwd override_fields = home=/mail/%u } protocol imap { mail_max_userip_connections = 1000 }

1 0

[Dovecot] A question regarding doveadm replicator status
by XarHs 25 Feb '14

25 Feb '14

Hello, I am using Dovecot version 2.2.10. I am quite familiar with ssh replication and I managed to set it up correctly. The only problem I see is that when i run the command: doveadm replicator status I get a wrong "Total number of known users" which is a) is different between the two (2) replicated dovecot servers, i.e. in mail1 I get a total of 21 users and in mail2 I get a total of 20 users (it should be the same, correct?) b) is not matching the total number of users I have in each server (mail1, mail2) which I am also getting when counting the total users with "doveadm" service enabled. (the command doveadm user '*' | wc lists a total of 16 users for both mail1, mail2 servers, which is also the total number of users that exist indeed in the LDAP structure with the doveadm service enabled. Is there any way to reset the value of "Total number of known users"? Do I have to delete a file in /var/run/dovecot or something in order to do it? The only way I tried (not successfully though) to reset it is by executing the command: for i in `doveadm user '*'` ;do doveadm replicator remove $i ; done which does empties all existing users (16), but leaves me with Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 5 in mail1 server and Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 4 in mail2 server, i.e. the value is 5 (21-16) for mail1 and 4 (20-16) for mail2 server. After seeing that I tried to restart dovecot service, which again ended in the following numbers: Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 21 in mail1 server and Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 20 in mail2 server thus their values augmented back to +16, meaning dovecot read succesfully my 16 users. I have not found a way to successfully reset the "Total number of known users" numbers back to the valid 16 users, which is also returned by running the command: doveadm user '*' | wc Why do I have those differences? How is the "Total number of known users" being calculated? What should I do to effectively reset to to the normal value (which in my case is 16)? Thanks in advance.

1 1

[Dovecot] tests with metadata module
by Mihai Badici 25 Feb '14

25 Feb '14

--Repost after subscription as list member --- I made some tests with metadata support in dovecot 2.2.10. Previously I had dovecot 2.2.4 with external metadata plugin who work well. I use dovecot with roundcube and roundcube plugins from kolab project . First, the feature activation was tricky and rather undocumented. I spent about half hour googling, after that I set: imap_metadata = yes and mail_attribute_dict = file:%h/shared_metadata I think you cold put those lines in the 20-imap.conf example file commented; that way will be easy for us to activate. Because I changed the location of shared_metadata, all folders was unannotated . I went in folder manager in roundcube and set folder "calendar" as calendar type and so on. That worked and i have: cat shared_metadata: shared/c4268a04da44bb527c5b0000193e0904/vendor/kolab/folder-type event shared/cd5792367fc9cd5196170000193e0904/vendor/kolab/folder-type event shared/33f55d2e8912195209290000193e0904/vendor/kolab/folder-type event shared/32f55d2e8912195209290000193e0904/vendor/kolab/folder-type contact However, it looks like the metadata is not properly read after. Calendar and Contacts folders don't appear in roundcube. I have this crash in dovecot's log: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x67d81) [0xb7625d81] -> /usr/lib/dovecot/libdovecot.so.0(+0x67e11) [0xb7625e11] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0xb75d6af9] -> dovecot/imap() [0x805d3b2] -> dovecot/imap() [0x805d5bc] -> dovecot/imap() [0x805d6c9] -> dovecot/imap(client_handle_input+0x56) [0x805d836] -> dovecot/imap(client_input+0x72) [0x805dcc2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x38) [0xb7638d98] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x10e) [0xb7639d6e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x48) [0xb7638818] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x28) [0xb75dcb68] -> dovecot/imap(main+0x284) [0x8050f34] -> /lib/libc.so.6(__libc_start_main+0xf5) [0xb743f5a5] -> dovecot/imap() [0x80510a5] Dec 26 09:28:49 imap(mihai.badici): Fatal: master: service(imap): child 4919 killed with signal 6 (core dumps disabled) I logged imap sessions in roundcube and I have: A0003 GETMETADATA "*" (/private/vendor/kolab/folder-type /shared/vendor/kolab/folder-type) On a similar server with the "old" metadata plugin, I have here listed all folders with coresponding annotations. How I can debug further? This is a test server so I can stress it. -- Mihai Bădici http://mihai.badici.ro -----------------------------------------

3 6

[Dovecot] Detail improvement: %c variable
by Hadmut Danisch 25 Feb '14

25 Feb '14

Hi, although dovecot is great and almost exactly solving my problems and fitting my requirements, there is an odd detail that causes me problems: The %c variable. (See http://wiki2.dovecot.org/Variables ) I'm managing an IMAP server for an association, which is connected to an LDAP server. Users can connect in three ways: IMAPS from the internet, IMAP from local acccounts, and IMAP through a Web->IMAP interface, which is protected through additional one-time-passwords. The web gateway is intended to be used from untrusted computers as well, so the IMAP password entered through the Web site must not be the same as the password used on IMAPS. I have solved this problem by using %s%c as part of the LDAP user_filter. When people connect over IMAPS, this becomes imapsecured (%s=imap, %c=secured), while an unencrypted connect becomes imap (%s=imap, %c=) Unfortunately, this works only, if the web interface and the IMAP server are located on different (virtual) machines. But if the web gateway and dovecot are no the /same/ machine, this does not work anymore, since %c becomes "secured" on localhost, even if unencrypted. It causes a lot of trouble and headache. Please add a configuration variable to configure, whether %c should become "secured" for unencrypted traffic on the loopback device (localhost). regards Hadmut

5 9

[Dovecot] realtime backup with LDA?
by Francesco 25 Feb '14

25 Feb '14

Hello everyone, i was reading the dovecot-lda documentation as i'm using LDA as a delivery agent on my current mailserver configuration. I was curious to know if there are some options for having a message to be delivered to a "twin mailbox" upon delivery. this twin mailbox would work as a backup archive for recovering emails in case the user accidentally deletes them. so if i have a user which is alice i would create a second mailbox named backup_alice or whatever respecting a predictable schema and then every mail delivered to alice would also be delivered to backup_alice. do you know if this can be done? have any example? i was also planning to use shared folders + ACLS to have backup_alice accessible as a read only mailbox directly from the alice imap account. thanks in advance Francesco

6 20

[Dovecot] Dovecot hooks
by rhklinux 25 Feb '14

25 Feb '14

Hello people, I am absolute newbie in the world of Dovecot. Before I start learning configuration and plugin writing I want to ensure that what I am trying to do can be done using Dovecot. I want to have a IMAP proxy setup with a module (written by me) that scans email data for some specific content. Any help appriciated. -- View this message in context: http://dovecot.2317879.n4.nabble.com/Dovecot-hooks-tp46887.html Sent from the Dovecot mailing list archive at Nabble.com.

2 2