- dovecot - dovecot.org

Dovecot imap
by Nick Lekkas 19 Jul '17

19 Jul '17

Hello there ! Is there anything wrong in the config i have sent earlier ..? __________ Information from ESET Endpoint Antivirus, version of detection engine 15774 (20170719) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

1 0

Re: under some kind of attack
by Joseph Tam 19 Jul '17

19 Jul '17

On Tue, 18 Jul 2017, dovecot-request(a)dovecot.org wrote: > Thanks for the quick follow-ups! Much appreciated. After posting this, I > immediately started working on fail2ban. And between my initial posting > and now, fail2ban already blocked 114 IPs. > > I have fail2ban with maxretry=1 and bantime=1800 > > However, it seems almost all IPs are different, and I don't think I can > keep the above settings permanently. Why not? Limited by firewall rules overload? You could probably use a persistent DB, can't you? You can also use a third party RBL that specialized in brute forcers like blocklist.de. You can also feed back fail2ban data and crowdsource BFD data to them. Joseph Tam <jtam.home(a)gmail.com>

2 1

Dovecot imap
by Nick Lekkas 19 Jul '17

19 Jul '17

Hello to all !!! I have some issues with some users that login to the same account through imap from many devices like: mobile,desktop/tablet !!! Issues like: 1. When a new email is arrived is not appearing to all devices... 2. New email is arriving to some other devices after a long period of time ... Generally issues like that .... Does anyone have an idea of how to solve this ..? thanks in advance for your time ... __________ Information from ESET Endpoint Antivirus, version of virus signature database 14893 (20170206) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14911 (20170209) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14939 (20170215) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14964 (20170220) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 15008 (20170228) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 15037 (20170305) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of detection engine 15767 (20170718) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of detection engine 15767 (20170718) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

4 9

Re: passwd-file, getting invalid uid 0
by Larry Rosenman 19 Jul '17

19 Jul '17

The alias works fine. It's just an auth request. I'll live with it. Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Bill Shirley <bill(a)KnoxvilleChristian.org> Date: 7/18/17 11:24 PM (GMT-06:00) To: dovecot(a)dovecot.org Subject: Re: passwd-file, getting invalid uid 0 Unless your userid is also zero, my guess is that Exim isn't using the alias. This message (to me) says "I can't deliver to 'root' because that userid is zero". On Postfix, you have to run 'newaliases' after changing /etc/aliases. Bill On 7/13/2017 3:42 PM, Larry Rosenman wrote: > Per my earlier post about system and virtual users, I have everything working, but I'm seeing the > following message, and wondering: > 1) does it matter? > 2) is there a way to suppress it? > > I have an Exim /etc/aliases entry that sends root to me. > > Jul 13 14:38:47 thebighonker dovecot: auth-worker(13055): Error: passwd-file /etc/passwd: User root has invalid UID '0' > > doveconf -n: > > # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.19 (e5c7051) > # OS: FreeBSD 11.1-PRERELEASE amd64 > auth_mechanisms = plain login > auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org thejonesonair.com thejonesonair.net > default_vsz_limit = 1 G > deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) > doveadm_password = # hidden, use -P to show it > lda_mailbox_autocreate = yes > listen = 192.147.25.65, :: > lmtp_save_to_detail_mailbox = yes > login_access_sockets = tcpwrap > mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes > mail_location = mbox:~/mail:INBOX=~/mail/INBOX > mail_log_prefix = "%s(%u/%p): " > mail_plugins = " fts fts_solr notify stats virtual" > mail_privileged_group = mail > mail_server_admin = mailto:ler@lerctr.org > mail_server_comment = LERCTR Mail Server > mailbox_list_index = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve > namespace archive { > hidden = no > list = no > location = mbox:~/MAIL-ARCHIVE > prefix = ARCHIVE/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox INBOX { > auto = create > } > mailbox SENT { > special_use = \Sent > } > mailbox SPAM { > special_use = \Junk > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > mailbox virtual/Flagged { > special_use = \Flagged > } > mailbox virtual/all { > special_use = \All > } > prefix = > } > namespace virtual { > hidden = no > list = yes > location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY > prefix = Virtual/ > separator = / > } > passdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > passdb { > args = user=%Ln noauthenticate > driver = static > skip = authenticated > } > passdb { > args = failure_show_msg=yes session=yes max_requests=20 > driver = pam > skip = authenticated > } > plugin { > fts = solr > fts_autoindex = yes > fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ > fts_tika = http://localhost:9998/tika/ > imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY > imapsieve_mailbox1_name = SPAM > imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY > imapsieve_mailbox2_from = SPAM > imapsieve_mailbox2_name = * > imapsieve_url = sieve://thebighonker.lerctr.org > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append > mail_log_fields = uid box msgid size from subject vsize flags > recipient_delimiter = + > sieve = ~/.dovecot.sieve > sieve_dir = ~/sieve > sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve > sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute > sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > stats_command_min_time = 1 mins > stats_domain_min_time = 12 hours > stats_ip_min_time = 12 hours > stats_memory_limit = 16 M > stats_refresh = 5s > stats_session_min_time = 15 mins > stats_track_cmds = yes > stats_user_min_time = 1 hours > } > protocols = imap pop3 lmtp sieve > service auth { > unix_listener auth-client { > mode = 0666 > } > unix_listener auth-master { > mode = 0666 > } > } > service doveadm { > inet_listener http { > port = 8080 > ssl = yes > } > } > service indexer-worker { > drop_priv_before_exec = yes > } > service lmtp { > inet_listener lmtp { > address = 127.0.0.1 > port = 24 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > inet_listener sieve_deprecated { > port = 2000 > } > } > service stats { > chroot = empty > client_limit = 0 > drop_priv_before_exec = no > executable = stats > extra_groups = > fifo_listener stats-mail { > group = > mode = 0666 > user = > } > fifo_listener stats-user { > group = > mode = 0666 > user = > } > group = > idle_kill = 4294967295 secs > privileged_group = > process_limit = 1 > process_min_avail = 0 > protocol = > service_count = 0 > type = > unix_listener stats { > group = > mode = 0666 > user = > } > user = $default_internal_user > vsz_limit = 18446744073709551615 B > } > service tcpwrap { > unix_listener login/tcpwrap { > group = $default_login_user > mode = 0600 > user = $default_login_user > } > } > ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer > ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS > ssl_key = # hidden, use -P to show it > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > userdb { > args = username_format=%Ln /etc/passwd > driver = passwd-file > } > verbose_proctitle = yes > protocol lmtp { > mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" > } > protocol lda { > mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" > } > protocol pop3 { > mail_plugins = " fts fts_solr notify stats virtual mail_log" > } > protocol !doveadm { > mail_plugins = " fts fts_solr notify stats virtual mail_log" > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags > imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} > imap_metadata = yes > mail_max_userip_connections = 50 > mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve imap_stats stats" > } >

1 0

passwd-file, getting invalid uid 0
by Larry Rosenman 19 Jul '17

19 Jul '17

Per my earlier post about system and virtual users, I have everything working, but I'm seeing the following message, and wondering: 1) does it matter? 2) is there a way to suppress it? I have an Exim /etc/aliases entry that sends root to me. Jul 13 14:38:47 thebighonker dovecot: auth-worker(13055): Error: passwd-file /etc/passwd: User root has invalid UID '0' doveconf -n: # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-PRERELEASE amd64 auth_mechanisms = plain login auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org thejonesonair.com thejonesonair.net default_vsz_limit = 1 G deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes listen = 192.147.25.65, :: lmtp_save_to_detail_mailbox = yes login_access_sockets = tcpwrap mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes mail_location = mbox:~/mail:INBOX=~/mail/INBOX mail_log_prefix = "%s(%u/%p): " mail_plugins = " fts fts_solr notify stats virtual" mail_privileged_group = mail mail_server_admin = mailto:ler@lerctr.org mail_server_comment = LERCTR Mail Server mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve namespace archive { hidden = no list = no location = mbox:~/MAIL-ARCHIVE prefix = ARCHIVE/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { auto = create } mailbox SENT { special_use = \Sent } mailbox SPAM { special_use = \Junk } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual/Flagged { special_use = \Flagged } mailbox virtual/all { special_use = \All } prefix = } namespace virtual { hidden = no list = yes location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY prefix = Virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = user=%Ln noauthenticate driver = static skip = authenticated } passdb { args = failure_show_msg=yes session=yes max_requests=20 driver = pam skip = authenticated } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ fts_tika = http://localhost:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = SPAM imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = SPAM imapsieve_mailbox2_name = * imapsieve_url = sieve://thebighonker.lerctr.org mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 5s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-client { mode = 0666 } unix_listener auth-master { mode = 0666 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } service indexer-worker { drop_priv_before_exec = yes } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = fifo_listener stats-mail { group = mode = 0666 user = } fifo_listener stats-user { group = mode = 0666 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = username_format=%Ln /etc/passwd driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol lda { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol pop3 { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol !doveadm { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} imap_metadata = yes mail_max_userip_connections = 50 mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve imap_stats stats" } -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

3 4

Re: passwd-file, getting invalid uid 0
by Larry Rosenman 19 Jul '17

19 Jul '17

On Tue, Jul 18, 2017 at 3:31 PM, Larry Rosenman <larryrtx(a)gmail.com> wrote: > That didn't change it :( > Jul 18 15:28:14 thebighonker dovecot: auth-worker(77908): Error: > passwd-file /etc/passwd: User root has invalid UID '0' > Jul 18 15:28:14 thebighonker dovecot: auth-worker(77908): Error: > passwd-file /etc/passwd: User toor has invalid UID '0' > > doveconf -n: > lrosenman:~ lrosenman$ ssh tbh.lerctr.org doveconf -n > # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.19 (e5c7051) > # OS: FreeBSD 11.1-PRERELEASE amd64 > auth_mechanisms = plain login > auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org > thejonesonair.com thejonesonair.net > default_vsz_limit = 1 G > deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) > doveadm_password = # hidden, use -P to show it > first_valid_gid = 0 > first_valid_uid = 0 > lda_mailbox_autocreate = yes > listen = 192.147.25.65, :: > lmtp_save_to_detail_mailbox = yes > login_access_sockets = tcpwrap > mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes > mail_location = mbox:~/mail:INBOX=~/mail/INBOX > mail_log_prefix = "%s(%u/%p): " > mail_plugins = " fts fts_solr notify stats virtual" > mail_privileged_group = mail > mail_server_admin = mailto:ler@lerctr.org > mail_server_comment = LERCTR Mail Server > mailbox_list_index = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character > vacation subaddress comparator-i;ascii-numeric relational regex imap4flags > copy include variables body enotify environment mailbox date index ihave > duplicate mime foreverypart extracttext vacation-seconds editheader > mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve > namespace archive { > hidden = no > list = no > location = mbox:~/MAIL-ARCHIVE > prefix = ARCHIVE/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox INBOX { > auto = create > } > mailbox SENT { > special_use = \Sent > } > mailbox SPAM { > special_use = \Junk > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > mailbox virtual/Flagged { > special_use = \Flagged > } > mailbox virtual/all { > special_use = \All > } > prefix = > } > namespace virtual { > hidden = no > list = yes > location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY > prefix = Virtual/ > separator = / > } > passdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > passdb { > args = user=%Ln noauthenticate > driver = static > skip = authenticated > } > passdb { > args = failure_show_msg=yes session=yes max_requests=20 > driver = pam > skip = authenticated > } > plugin { > fts = solr > fts_autoindex = yes > fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ > fts_tika = http://localhost:9998/tika/ > imapsieve_mailbox1_before = file:/usr/local/share/dovecot- > pigeonhole/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY > imapsieve_mailbox1_name = SPAM > imapsieve_mailbox2_before = file:/usr/local/share/dovecot- > pigeonhole/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY > imapsieve_mailbox2_from = SPAM > imapsieve_mailbox2_name = * > imapsieve_url = sieve://thebighonker.lerctr.org > mail_log_events = delete undelete expunge copy mailbox_delete > mailbox_rename flag_change append > mail_log_fields = uid box msgid size from subject vsize flags > recipient_delimiter = + > sieve = ~/.dovecot.sieve > sieve_dir = ~/sieve > sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve > sieve_extensions = +editheader +vacation-seconds +mboxmetadata > +servermetadata > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute > sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > stats_command_min_time = 1 mins > stats_domain_min_time = 12 hours > stats_ip_min_time = 12 hours > stats_memory_limit = 16 M > stats_refresh = 5s > stats_session_min_time = 15 mins > stats_track_cmds = yes > stats_user_min_time = 1 hours > } > protocols = imap pop3 lmtp sieve > service auth { > unix_listener auth-client { > mode = 0666 > } > unix_listener auth-master { > mode = 0666 > } > } > service doveadm { > inet_listener http { > port = 8080 > ssl = yes > } > } > service indexer-worker { > drop_priv_before_exec = yes > } > service lmtp { > inet_listener lmtp { > address = 127.0.0.1 > port = 24 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > inet_listener sieve_deprecated { > port = 2000 > } > } > service stats { > chroot = empty > client_limit = 0 > drop_priv_before_exec = no > executable = stats > extra_groups = > fifo_listener stats-mail { > group = > mode = 0666 > user = > } > fifo_listener stats-user { > group = > mode = 0666 > user = > } > group = > idle_kill = 4294967295 secs > privileged_group = > process_limit = 1 > process_min_avail = 0 > protocol = > service_count = 0 > type = > unix_listener stats { > group = > mode = 0666 > user = > } > user = $default_internal_user > vsz_limit = 18446744073709551615 B > } > service tcpwrap { > unix_listener login/tcpwrap { > group = $default_login_user > mode = 0600 > user = $default_login_user > } > } > ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer > ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384: > EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256: > EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:! > aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS > ssl_key = # hidden, use -P to show it > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > userdb { > args = username_format=%Ln /etc/passwd > driver = passwd-file > } > verbose_proctitle = yes > protocol lmtp { > mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" > } > protocol lda { > mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" > } > protocol pop3 { > mail_plugins = " fts fts_solr notify stats virtual mail_log" > } > protocol !doveadm { > mail_plugins = " fts fts_solr notify stats virtual mail_log" > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags > imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} > fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} > del=%{deleted} exp=%{expunged} trash=%{trashed} > imap_metadata = yes > mail_max_userip_connections = 50 > mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve > imap_stats stats" > } > lrosenman:~ lrosenman$ >

2 2

observium graphs
by Thomas Reifferscheid 18 Jul '17

18 Jul '17

Hello dovecot list, I'm in the middle of creating a plugin for observium[1] and would like to have it create[2] statistical graphs of my dovecot server [3]. The current state can be found here: https://image.ibb.co/efOO9a/dovecot.png However for visibility purposes it doesnt make sense and have observium plot two data sources with different orders of magnitudes right into one graph. So I'd like to ask for your valuable recommendations as for: - What kind of data should be graphed? Global stats or on a per domain level? - What data types to graph? (e.g. stats, getrusage, io, storage, auth check https://wiki2.dovecot.org/Statistics#line-65 for details) - What values should be combined into a single graph? - How often would you reset stats (cronjob calling doveadm stats reset)? Thanks Thomas [1]: http://www.observium.org/ [2]: http://docs.observium.org/apps/ [3]: http://docs.observium.org/developing/add_app/

3 4

Re: SQLite user database
by Joseph Tam 17 Jul '17

17 Jul '17

Lev <leventelist(a)gmail.com> wrote: > Yes, that was a bit odd. Same password, different hash. Even with > verify tool, there was mismatch. So I decided to go for SHA512, > without encryption. Using user@domain as your ID solved your problem, and this side issue of which hash scheme you're using is probably irrelevant. You misunderstand what {SHA512-CRYPT} does compared with {SHA512}. It is normal to get a different hash with the same password when you regenerate the hash because a different random salt was chosen (the part between the '$6$' and the next '$') -- it used as part of the hash computation. {SHA512} is a straight saltless hash -- the same password maps to the same hash. This makes it prone to dictionary attacks (i.e. pre-generated tables of plaintext/hash values). If you support both schemes, SHA512-CRYPT is much stronger. Joseph Tam <jtam.home(a)gmail.com>

2 1

tagged director -
by Matt Bryant 17 Jul '17

17 Jul '17

Hey, Does anyone know how the new(ish) director tags work in respect to which one is select for a user ?? Is there a query or field returned on userdb lookup to specify the director tag to use ??? rgds Matt

2 1

Dovecot Statistics
by Doug Hardie 16 Jul '17

16 Jul '17

I tried to setup statistics as shown on the Statistics wiki page. I encountered a problem with the mail_plugins for imap. in the protocol imap configuration the wiki shows adding imap_stats to mail_plugins. When I do that, dovecot stops authenticating and throwing error messages: Jul 15 12:47:46 mail dovecot: imap(doug)[10.0.1.251]<osGhcGBUmsgKAAH7>: Error: Couldn't load required plugin /usr/local/lib/dovecot/lib95_imap_stats_plugin.so: Plugin stats must be loaded also (you must set: mail_plugins=$mail_plugins stats) Jul 15 12:47:46 mail dovecot: imap(doug): Error: Internal error occurred. Refer to server log for more information. Changing that line to just add stats to mail_plugins resolves the problem. Hopefully that is an error in the wiki... However, in looking at the stats, I don't ever see any values for any of the auth_ values. They all show zero even though there have been numerous authentications by dovecot and postfix. I also notice that there is a new statistics output about every 3 minutes. It appears that the numbers are only for that 3 minute window. Is there a way to set the statistics so that I can see the last 24 hours, or the previous day? -- Doug

2 1

Post-login script on proxy side
by azurit＠pobox.sk 15 Jul '17

15 Jul '17

Hi, is it possible to run a post-login script on proxy side? When a user is 'proxied' away, the standard post-login script seems to be skipped. I want to update last login datetime but only proxy has access to user database (so i cannot run it on backends). azur

3 8

Re: SQLite user database
by Joseph Tam 15 Jul '17

15 Jul '17

Levente Kovacs writes: > I continuously get user authentication errors. I suspect that the problem is > with a password hashing. I used > > # doveadm pw -s SHA512-CRYPT > Enter new password: > Retype new password: > {SHA512-CRYPT}$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/ Looks OK. > I have this at the database: > > sqlite> SELECT * from users; > lev|logonex.eu|$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/|/home/lev|1001|1001 I'm not too hip about SQLite and schemas so I don't know about all the other fields you have and whether you're parsing it correctly. Need doveconf -n to see your SQL query. > I've tried adding this to the database, but still no luck. :-( > {SHA512-CRYPT}$6$kbUEfz/Mcgpctv/s$uNQGOL/2F01Br.vx0twozVi6v.KJAHZV0OQ7yOFwD9YCloh7UJmeFe7WrgUez9Q5xXdrNOU5q9H8fE3FU2ok9. How does it relate to the previous hash? Same password but another salt and prepended with {SHA512-CRYPT}? > The other thing I want to avoid is the home directory and UID and GID. Is > there any way for dovecot to use logical, non UNIX users so there's no need to > have a user database and an sqlite database? Yes, you want a virtual user setup. https://wiki.dovecot.org/VirtualUsers You still need a user/password database of some sort unless you're contemtemplating some wild free-for-all access with a single shared password. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: Cannot Authenticate user with Kerberos/GSSAPI
by Joseph Tam 15 Jul '17

15 Jul '17

mark(a)ohprs.org > My last message probably contained too much information. This one is more succient. "Succint" may not be the right adjective, because I think this is the third copy I've seen. > Here is the dovecot log when user dsmith attempts to connect to dovecot > from the Tbird client: What I see is ... > Jul 11 19:29:46 imap-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<jR0sExNUTADAqAA5> ... a failed authentication with no real mention of Kerberos stuff, followed soon after with SSL/Kerberos yackety-yack, and ... > Jul 11 19:30:18 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=3150, TLS, session=<iDUNFRNUUgDAqAA5> ... successful authentication via GSSAPI! From the log files you've shown, you were able to authenticate "dsmith". Your mail reader tells you otherwise? Joseph Tam <jtam.home(a)gmail.com>

1 1

SQLite user database
by Levente Kovacs 14 Jul '17

14 Jul '17

Dear Dovecot users/developers, I installed dovecot, and want to use a sqlite database for users, and passwords. I continuously get user authentication errors. I suspect that the problem is with a password hashing. I used # doveadm pw -s SHA512-CRYPT Enter new password: Retype new password: {SHA512-CRYPT}$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/ to get a password hash. I have this at the database: sqlite> SELECT * from users; lev|logonex.eu|$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/|/home/lev|1001|1001 I've tried adding this to the database, but still no luck. :-( {SHA512-CRYPT}$6$kbUEfz/Mcgpctv/s$uNQGOL/2F01Br.vx0twozVi6v.KJAHZV0OQ7yOFwD9YCloh7UJmeFe7WrgUez9Q5xXdrNOU5q9H8fE3FU2ok9. Could you please help me out what I'm doing wrong? I'm using dovecot version: 2.2.13 The other thing I want to avoid is the home directory and UID and GID. Is there any way for dovecot to use logical, non UNIX users so there's no need to have a user database and an sqlite database? Thank you for your help. Levente

1 0

Can Dovecot replace fetchmail?
by Kenneth Porter 14 Jul '17

14 Jul '17

I'm using fetchmail to grab mail for multiple accounts from an external IMAP server and drop it into local mailboxes via SMTP. It polls the remote server every two minutes. Can Dovecot replace this functionality more elegantly, using IDLE to avoid the polling necessary with fetchmail? I'd like to designate that mail for specific accounts on the external server be moved to specific local mailboxes. --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

3 2

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Ok,, I was half awake when I typed that 😀 Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 6:19 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? No it's intentionally %Ln to convert user1@domain into user1 for PAM. Aki > On July 13, 2017 at 2:03 PM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > Is the %Ln on the 2nd passdb supposed to be a %Lu? > > > Sent from my Sprint Samsung Galaxy S8+. > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 4:43 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > No. > > It's just a placeholder, like %u or %d. > > Aki > > > On July 13, 2017 at 10:57 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > Will %{original_username} set %d as well? > > > > > > Sent from my Sprint Samsung Galaxy S8+. > > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > > > > > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > > > > I have a need for the following: > > > > > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > > > > > Virtual Users in SQL (with full user@domain in the DB) > > > > > > > > > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > > > > > > > > > Is there a compromise somewhere? > > > > > > > > > > You could try using %{original_username} in SQL. > > > > Or you can try removing the auth_username_format and instead > > > > passdb { > > driver = sql > > args = ... > > } > > passdb { > > driver = static > > args = user=%Ln noauthenticate > > # you can remove next line if you want to always normalize your usernames > > skip = authenticated > > } > > passdb { > > driver = pam > > args = ... > > skip = authenticated > > } > > > > Aki

1 1

passwd-file unknown user even if known
by Ricardo Branco 13 Jul '17

13 Jul '17

I am seeing lots of passwd-file unknown user messages even when they are known and they can login. I have several passwd files that are looked up with a deny file first, could the first check on the deny.%Ls file be generating this message then when it checks the next passdb driver it is found? If so is there a way to suppress the error message until all drivers have been checked?

1 0

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Is the %Ln on the 2nd passdb supposed to be a %Lu? Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 4:43 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? No. It's just a placeholder, like %u or %d. Aki > On July 13, 2017 at 10:57 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > Will %{original_username} set %d as well? > > > Sent from my Sprint Samsung Galaxy S8+. > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > > > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > I have a need for the following: > > > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > > > Virtual Users in SQL (with full user@domain in the DB) > > > > > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > > > > > Is there a compromise somewhere? > > > > > > You could try using %{original_username} in SQL. > > Or you can try removing the auth_username_format and instead > > passdb { > driver = sql > args = ... > } > passdb { > driver = static > args = user=%Ln noauthenticate > # you can remove next line if you want to always normalize your usernames > skip = authenticated > } > passdb { > driver = pam > args = ... > skip = authenticated > } > > Aki

2 1

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Will %{original_username} set %d as well? Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > I have a need for the following: > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > Virtual Users in SQL (with full user@domain in the DB) > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > Is there a compromise somewhere? > > You could try using %{original_username} in SQL. Or you can try removing the auth_username_format and instead passdb { driver = sql args = ... } passdb { driver = static args = user=%Ln noauthenticate # you can remove next line if you want to always normalize your usernames skip = authenticated } passdb { driver = pam args = ... skip = authenticated } Aki

2 1

Global create ACL allows out of boundaries mailbox
by Loïc Gomez 13 Jul '17

13 Jul '17

Hello Dovecot Team, During my tests I setup a global ACL allowing mailbox create for all authenticated users. Then, I made a mistake in Thunderbird, tried to create a mailbox directly on the "/shared/" special folder. Dovecot created a folder in the global root path of our mail store. Since I use maildir:/var/vmail/%d/%n/mail as mail_location, it created the mailbox in /var/vmail (where my domains are). It was just a test and I can imagine allowing create permission to all users whatever the path is not a good idea nor a common use case but still, it's probably worth reporting. Keep up the good work Cheers Loïc Gomez

1 0

Master auth only
by azurit＠pobox.sk 13 Jul '17

13 Jul '17

Hi, i'm trying to configure Dovecot proxy with user authentication on proxy side only, so backends will authenticate using master password (proxy is configured to send it). The problem is that Dovecot, on backends, is telling me that i need to configure at least one auth mechanism: auth: Fatal: No passdbs specified in configuration file. LOGIN mechanism needs one The master auth is correctly configured. I want to accomplished to have user database only on one place (=proxy). Any hints? azur

4 11

System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

I have a need for the following: Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd Virtual Users in SQL (with full user@domain in the DB) When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. Is there a compromise somewhere? Current doveconf –n with %Ln thebighonker.lerctr.org /usr/local/etc/dovecot/conf.d $ doveconf -n # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-PRERELEASE amd64 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org jonesonair.com jonesonair.net auth_username_format = %Ln default_vsz_limit = 1 G deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes listen = 192.147.25.65, :: lmtp_save_to_detail_mailbox = yes login_access_sockets = tcpwrap mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes mail_location = mbox:~/mail:INBOX=~/mail/INBOX mail_log_prefix = "%s(%u/%p): " mail_plugins = " fts fts_solr notify stats virtual" mail_privileged_group = mail mail_server_admin = mailto:ler@lerctr.org mail_server_comment = LERCTR Mail Server mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve namespace archive { hidden = no list = no location = mbox:~/MAIL-ARCHIVE prefix = ARCHIVE/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { auto = create } mailbox SENT { special_use = \Sent } mailbox SPAM { special_use = \Junk } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual/Flagged { special_use = \Flagged } mailbox virtual/all { special_use = \All } prefix = } namespace virtual { hidden = no list = yes location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY prefix = Virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = failure_show_msg=yes session=yes max_requests=20 driver = pam } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ fts_tika = http://localhost:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = SPAM imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = SPAM imapsieve_mailbox2_name = * imapsieve_url = sieve://thebighonker.lerctr.org mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 5s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-client { mode = 0666 } unix_listener auth-master { mode = 0666 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } service indexer-worker { drop_priv_before_exec = yes } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = fifo_listener stats-mail { group = mode = 0666 user = } fifo_listener stats-user { group = mode = 0666 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol lda { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol pop3 { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol !doveadm { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} imap_metadata = yes mail_max_userip_connections = 50 mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve imap_stats stats" } thebighonker.lerctr.org /usr/local/etc/dovecot/conf.d $ -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

2 1

Unable to Kerberos/GSSAPI an existing user on new workstation
by Mark Foley 13 Jul '17

13 Jul '17

My last message probably contained too much information. This one is more succient. I have a user, 'mark', who has been running a Thunderbird client on Windows to Dovecot server with Kerberos/GSSAPI authentication for over a year. I created a new Tbird account on a new Linux workstation for 'mark', also with Kerberos/GSSAPI and that worked just fine. I have another user, 'dsmith', who has been running a Thunderbird client on Windows to Dovecot server with Kerberos/GSSAPI authentication for over a year as well, no problems. I created a new Tbird account on the same new Linux workstation as above for 'dsmith', also with KerberosGSSAPI and that DID NOT WORK! I get the message in Thunderbird: "The Kerberos/GSSAPI ticket was not accepted by the IMAP server ... please check that you are logged into the Kerberos/GSSAPI realm." I created/recreated the smith account numerous time with slightly different settings hoping something will work, but I always get the same message. Why? I need to figure this out ASAP. Here is the dovecot log when user dsmith attempts to connect to dovecot from the Tbird client: Jul 11 19:29:43 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:29:43 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:29:43 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 19:29:43 auth: Debug: Read auth token secret from /usr/local/var/run/dovecot/auth-token-secret.dat Jul 11 19:29:43 auth: Debug: auth client connected (pid=1578) Jul 11 19:29:46 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL alert: close notify [192.168.0.57] Jul 11 19:29:46 imap-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<jR0sExNUTADAqAA5> Jul 11 19:30:17 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:30:17 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:30:17 auth: Debug: auth client connected (pid=3148) Jul 11 19:30:17 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:30:17 auth: Debug: client in: AUTH 1 GSSAPI service=imap secured session=iDUNFRNUUgDAqAA5 lip=192.168.0.2 rip=192.168.0.57 lport=143 rport=58962 Jul 11 19:30:17 auth: Debug: gssapi(?,192.168.0.57,<iDUNFRNUUgDAqAA5>): Using all keytab entries Jul 11 19:30:17 auth: Debug: client passdb out: CONT 1 Jul 11 19:30:17 auth: Debug: client in: CONT 1 YIIE+ [deleted] Jul 11 19:30:18 auth: Debug: gssapi(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): security context state completed. Jul 11 19:30:18 auth: Debug: client passdb out: CONT 1 YIGVB [deleted] Jul 11 19:30:18 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Jul 11 19:30:18 auth: Debug: gssapi(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): Negotiated security layer Jul 11 19:30:18 auth: Debug: client passdb out: CONT 1 BQQF/wAMAAAAAAAAFxWx/AH///9xheyHOAR4oKi3t3M= Jul 11 19:30:18 auth: Debug: client in: CONT 1 BQQE/wAMAAAAAAAANRcNbgEAAABkc21pdGjS3NSV6TWvt53rOLY= (previous base64 data may contain sensitive data) Jul 11 19:30:18 auth-worker(3149): Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 19:30:18 auth-worker(3149): Info: shadow(dsmith,192.168.0.57): unknown user Jul 11 19:30:18 auth: Debug: shadow(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): Credentials: Jul 11 19:30:18 auth: Debug: client passdb out: OK 1 user=dsmith original_user=dsmith(a)HPRS.LOCAL Jul 11 19:30:18 auth: Debug: master in: REQUEST 432275457 3148 1 3f58f611e9a6450ad7291105a93bbe1f session_pid=3150 request_auth_token Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): username changed dsmith -> HPRS\dsmith Jul 11 19:30:18 auth: Debug: master userdb out: USER 432275457 dsmith system_groups_user=HPRS\dsmithuid=3000036 gid=10000 home=/home/HPRS/dsmith auth_token=9ad7ad520ac8da70d07b3353b1c9c4e6ef394004 auth_user=dsmith(a)HPRS.LOCAL Jul 11 19:30:18 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=3150, TLS, session=<iDUNFRNUUgDAqAA5> Thanks, Mark

2 1

STARTTLS issue with sieve
by Andreas Oster 13 Jul '17

13 Jul '17

Hi all, I am currently struggling with an odd sieve/Pigeonhole issue. Some weeks ago I had to replace our dovecot certificate due to expiration. In the past I did use a self-signed certificate, but because we now have a little openssl based CA I have decided to create signed certificate for imaps. Dovecot is happily accepting the new certificate which has integrated the whole cert-chain. Unfortunately Pigeonhole does not seem to like the certificate: <--snip gnutls-cli --starttls -p4190 mail.novanetwork.local Processed 173 CA certificate(s). Resolving 'mail.novanetwork.loc'... Connecting to '10.2.1.23:4190'... - Simple Client Mode: "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." STARTTLS OK "Begin TLS negotiation now." --> At this point the TLS process does not proceed. When I press CTRL-D I get the following output: *** Starting TLS handshake - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info: - subject `C=DE,ST=Baden-Wuerttemberg,L=Ettlingen,O=NOVA Elektroanlagen GmbH,OU=Mail Server,CN=mail.novanetwork.local', issuer `C=DE,ST=Baden-Wuerttemberg,O=NOVA Elektroanlagen GmbH,OU=NOVA Intermediate CA,CN=NOVA Intermediate CA', RSA key 2048 bits, signed using RSA-SHA256, activated `2017-06-23 06:58:40 UTC', expires `2020-06-22 06:58:40 UTC', SHA-1 fingerprint `51a9b62eaebb6b4a2b8cc9a22740dc689445da0c' Public Key ID: 165eaaa4b36c091ec8f32103da003a1f43b1c57d Public key's random art: +--[ RSA 2048]----+ | .o.. | |. .o. . E | |o.. .. . | |= o . + | |+* o . S | |o==. o o | | .=o+.. | | .ooo | | .o | +-----------------+ - Certificate[1] info: - subject `C=DE,ST=Baden-Wuerttemberg,O=NOVA Elektroanlagen GmbH,OU=NOVA Intermediate CA,CN=NOVA Intermediate CA', issuer `C=DE,ST=Baden-Wuerttemberg,L=Ettlingen,O=NOVA Elektroanlagen GmbH,OU=NOVA Root CA,CN=NOVA Root CA', RSA key 4096 bits, signed using RSA-SHA256, activated `2016-12-05 11:40:29 UTC', expires `2026-12-03 11:40:29 UTC', SHA-1 fingerprint `308870b657dccd4902ca119d18d7ba8d6ad54ec0' - Certificate[2] info: - subject `C=DE,ST=Baden-Wuerttemberg,L=Ettlingen,O=NOVA Elektroanlagen GmbH,OU=NOVA Root CA,CN=NOVA Root CA', issuer `C=DE,ST=Baden-Wuerttemberg,L=Ettlingen,O=NOVA Elektroanlagen GmbH,OU=NOVA Root CA,CN=NOVA Root CA', RSA key 4096 bits, signed using RSA-SHA256, activated `2016-12-05 11:36:47 UTC', expires `2036-11-30 11:36:47 UTC', SHA-1 fingerprint `95326e3ff12683cc40a85874d562d0a6f15dcb37' - Status: The certificate is NOT trusted. The certificate issuer is unknown. *** PKI verification of server certificate failed... *** Fatal error: Error in the certificate. *** Handshake has failed I have checked the certificate with: openssl verify -verbose -CAfile /etc/ssl/certs/ca-chain.cert.pem /etc/ssl/certs/mail.novanetwork.local.cert.pem /etc/ssl/certs/mail.novanetwork.local.cert.pem: OK and also with: openssl verify -verbose -CAfile /etc/ssl/certs/mail.novanetwork.local.cert.pem /etc/ssl/certs/mail.novanetwork.local.cert.pem /etc/ssl/certs/mail.novanetwork.local.cert.pem: OK Does anyone have an idea what could be the cause of the problem and how to fix it ? Thank you for your kind help. best regards Andreas

5 11

Cannot Authenticate user with Kerberos/GSSAPI
by mark＠ohprs.org 12 Jul '17

12 Jul '17

My last message probably contained too much information. This one is more succient. I have a user, 'mark', who has been running a Thunderbird client on Windows to Dovecot server with Kerberos/GSSAPI authentication for over a year. I created a new Tbird account on a new Linux workstation for 'mark', also with Kerberos/GSSAPI and that worked just fine. I have another user, 'dsmith', who has been running a Thunderbird client on Windows to Dovecot server with Kerberos/GSSAPI authentication for over a year as well, no problems. I created a new Tbird account on the same new Linux workstation as above for 'dsmith', also with KerberosGSSAPI and that DID NOT WORK! I get the message in Thunderbird: "The Kerberos/GSSAPI ticket was not accepted by the IMAP server ... please check that you are logged into the Kerberos/GSSAPI realm." I created/recreated the smith account numerous time with slightly different settings hoping something will work, but I always get the same message. Why? I need to figure this out ASAP. Here is the dovecot log when user dsmith attempts to connect to dovecot from the Tbird client: Jul 11 19:29:43 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:29:43 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:29:43 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 19:29:43 auth: Debug: Read auth token secret from /usr/local/var/run/dovecot/auth-token-secret.dat Jul 11 19:29:43 auth: Debug: auth client connected (pid=1578) Jul 11 19:29:46 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:29:46 imap-login: Debug: SSL alert: close notify [192.168.0.57] Jul 11 19:29:46 imap-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<jR0sExNUTADAqAA5> Jul 11 19:30:17 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:30:17 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Jul 11 19:30:17 auth: Debug: auth client connected (pid=3148) Jul 11 19:30:17 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:30:17 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.57] Jul 11 19:30:17 auth: Debug: client in: AUTH 1 GSSAPI service=imap secured session=iDUNFRNUUgDAqAA5 lip=192.168.0.2 rip=192.168.0.57 lport=143 rport=58962 Jul 11 19:30:17 auth: Debug: gssapi(?,192.168.0.57,<iDUNFRNUUgDAqAA5>): Using all keytab entries Jul 11 19:30:17 auth: Debug: client passdb out: CONT 1 Jul 11 19:30:17 auth: Debug: client in: CONT 1 YIIE+ [deleted] Jul 11 19:30:18 auth: Debug: gssapi(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): security context state completed. Jul 11 19:30:18 auth: Debug: client passdb out: CONT 1 YIGVB [deleted] Jul 11 19:30:18 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Jul 11 19:30:18 auth: Debug: gssapi(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): Negotiated security layer Jul 11 19:30:18 auth: Debug: client passdb out: CONT 1 BQQF/wAMAAAAAAAAFxWx/AH///9xheyHOAR4oKi3t3M= Jul 11 19:30:18 auth: Debug: client in: CONT 1 BQQE/wAMAAAAAAAANRcNbgEAAABkc21pdGjS3NSV6TWvt53rOLY= (previous base64 data may contain sensitive data) Jul 11 19:30:18 auth-worker(3149): Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 19:30:18 auth-worker(3149): Info: shadow(dsmith,192.168.0.57): unknown user Jul 11 19:30:18 auth: Debug: shadow(dsmith,192.168.0.57,<iDUNFRNUUgDAqAA5>): Credentials: Jul 11 19:30:18 auth: Debug: client passdb out: OK 1 user=dsmith original_user=dsmith(a)HPRS.LOCAL Jul 11 19:30:18 auth: Debug: master in: REQUEST 432275457 3148 1 3f58f611e9a6450ad7291105a93bbe1f session_pid=3150 request_auth_token Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): lookup Jul 11 19:30:18 auth-worker(3149): Debug: shadow(dsmith,192.168.0.57): username changed dsmith -> HPRS\dsmith Jul 11 19:30:18 auth: Debug: master userdb out: USER 432275457 dsmith system_groups_user=HPRS\dsmithuid=3000036 gid=10000 home=/home/HPRS/dsmith auth_token=9ad7ad520ac8da70d07b3353b1c9c4e6ef394004 auth_user=dsmith(a)HPRS.LOCAL Jul 11 19:30:18 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=3150, TLS, session=<iDUNFRNUUgDAqAA5> Thanks, Mark

1 0