- dovecot - dovecot.org

Re: remote | local blocks in protocol settings
by Joseph Tam 19 Jan '16

19 Jan '16

Nikolaos Milas <nmilas(a)noa.gr> wrote: >> ... >> Pragmatically, I set it high enough so that it meets the need of most >> clients, then deal with problems on a case by case basis >> ... > > Thank you very much Joseph for your quite useful advice and experience. > Are you monitoring using "doveadm who"? No, I occasionally look at log entries for "Maximum number of connections from user+IP exceeded" errors. I may look at the output of "doveadm who" if I want to see a breakdown of how many clients a user is using, or just getting an overall view of how my users are spread out. >>> 4. How can we set a different value to this directive for webmail >>> connections (coming from 127.0.0.1, ::1)? >> >> I don't know if there is another method, but at the very least, you >> can start another dovecot instance with another config file that does >> specific things for 127.0.0.1. > > I tried using a remote block for webmail, but without success yet. If you can get that working, that would be the better method. Running 2 different instances with 2 different config files might come in handy for cases where you have very different policies between localhost/remote networks. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Increasing mail_max_userip_connections and sys resources
by Joseph Tam 19 Jan '16

19 Jan '16

> In our low-traffic server we have always kept the default value for IMAP > mail_max_userip_connections (10). > > The server has been working fine! (Thank you Timo for this!) > > However, recently we have been having: > > Maximum number of connections from user+IP exceeded > > errors both for IMAP and webmail users. > > Thus, we have now changed the value to 100. > > The questions: > > 1.Might this lead to overloading the server? > 2. Could another dovecot setting prevent the above setting from being > applied (e.g. due to connections exhaustion), i.e. should we also change > other setting(s)? > 3. What should we take into account when deciding the value for > mail_max_userip_connections? It depends on how many users you have, the number of simultaneous clients they use, and the #connections each client opens. Potentially, you could exhaust connection limits -- they usually don't max out memory or CPU or disk since most of the connections are idle. (There is a new IDLE hibernate feature that might help to minimize memory use by idle imap worker processes.) I haven't found a value that gets rid of users running into connection limits. If I set it to n, the next day someone will choke on n+1. This is a snapshot connections (count : #connections) which shows the typical decay: 25 1 14 2 14 3 7 4 9 5 1 6 2 7 1 8 1 10 Occasionally, some user's connection demand will spike and exceed the limit because - they started yat another client - they started global operation like searching - they're using a network that support roaming IP (I've tracked some users across the city on their bus ride.) Pragmatically, I set it high enough so that it meets the need of most clients, then deal with problems on a case by case basis (e.g. get them to lower their mail client's idle connection setting, or asking them to reduce the number of active clients by logging out). It also prevents what this setting was designed for: connection starvation by busy/buggy clients. Usually, hitting the limit doesn't produce problems as mail clients are smart enough to close idle connections or reuse them. If you only got a dozen users, setting it to 100 is feasible. If you got 1000 users, probably not. > 4. How can we set a different value to this directive for webmail > connections (coming from 127.0.0.1, ::1)? I don't know if there is another method, but at the very least, you can start another dovecot instance with another config file that does specific things for 127.0.0.1. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: [BUG] 2.2.21 Panic: file imap-client.c: line 841 (client_check_command_hangs): assertion failed: (!have_wait_unfinished || unfinished_count > 0)
by Timo Sirainen 19 Jan '16

19 Jan '16

> On 04 Jan 2016, at 09:58, Florian Pritz <bluewind(a)xinu.at> wrote: > > On 04.01.2016 15:49, Timo Sirainen wrote: >> What about: >> >>>> #5 0x000000000041dde6 in client_check_command_hangs (client=0x2363450) at imap-client.c:841 >>>> cmd = 0x0 >>>> unfinished_count = 0 >>>> have_wait_unfinished = true >>>> __FUNCTION__ = "client_check_command_hangs" >> >> Either the new code that's detecting hanging-bugs is somehow broken or it's actually preventing a hang by crashing instead, in which case the bug is elsewhere.. > > Output below. > > Sending a private mail because I don't know what that session ID in the > output can be used for. The session ID is harmless. Anyway, I'm having trouble figuring out how the crash could happen or how to reproduce it. According to the backtrace it seems like the client is running IDLE and then it sends "DONE\r\nNOOP\r\n" in same IP packet. But when doing that, I don't see a crash. Although during testing I did find several other bugs. Could you try patching and seeing if you still get the same crash after them? Or have you seen the crash after the initial few times? https://github.com/dovecot/core/commit/1ddf959a750f3860feff4ab3f0e908f32740… https://github.com/dovecot/core/commit/c8e9fa2ffa2566e75f0500808b1bc9bf5d9d… https://github.com/dovecot/core/commit/15307c2c91854e766bd9fb095d611a29b3f7… https://github.com/dovecot/core/commit/c7801f830c7d2e7d340065cdd5a5c795b172…

3 3

Temporary Lookup Failure
by Brad 18 Jan '16

18 Jan '16

Hi All, Have a CentOS 7, dovecot and postfix setup. Can get mail via 995 SSL/TLS Can send mail to virtual users and auto creation works using /etc/dovecot/passwd file via mail command. Using the dovecot lmtp and can login via 465 but the user lookup fails via postfix. in postfix main.cf have virtual_transport = lmtp:unix:private/dovecot-lmtp in dovecot.log I am seeing no errors in dovecot-info.log no errors either in maillog I am seeing: postfix/smtps/smtpd warning hash:/etc/postfix/virtual is unavailable open database /etc/postfix/virtual.db No such file. Note: I did go through creating the virtual.db and associated files but figured that it cant be correct as I want lmtp to handle it and it didn't work anyways, so I removed it. NOQUEUE reject RCPT from unknown[x.x.x.x] 451 4.3.0 <user@domain> Temporary lookup failure from=<user@domain> to=<user@domain> proto=ESMTP helo=<localhost.localdomain> -- obfuscated Tried every article I could find on the Internet to resolve this with out much luck. Any pointers would be greatly appreciated or if you need specific config details just let me know. Thanks, Brad

4 6

Dovecot doesn't listen on port 143, 993 in SSL
by 남설 18 Jan '16

18 Jan '16

Dear Dovecot Team First of all, I always appreciated your contribution & effort. Dovecot is very good tool for me for a while since my 2 years Linux start. But, 3 days ago, I upgraded my ubuntu 15.04 to 15.10 Then, I realized that my dovecot mail sever didn't work. So I simply terminated all the packages and reinstall it. It means I can't remeber what my previous setting was in my memory. So, dovecot in run is ver 2.2.18 now. Dovecot -n shows below and there is no "SSL" option. then all the port 143, 993 opens(It's not accesible somehow from clients but it's next matter) ----------------------No SSL version------------------------ auth_mechanisms = plain login mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } userdb { driver = passwd } ----------------------------------------------------------- But, If I turn on SSL option with encrypt key and certicate, all port 143, 993 just disappeared. I treaded this issue in ubuntu ASK but still no proper answer so far http://askubuntu.com/questions/722072/dovecot-doesnt-listen-on-993imaps --------------------------SSL option version---------------- auth_mechanisms = plain login mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } *ssl_cert = </etc/dovecot/dovecot.csr>** **ssl_key = </etc/dovecot/private/dovecot.key>* userdb { driver = passwd } -------------------------------------------------------------- Looing forward your reply Thanks in advance

3 2

mmap failed
by ＠lbutlr 18 Jan '16

18 Jan '16

Error: mmap() failed with file /home/user/Maildir/.Archive/dovecot.index.cache: Cannot allocate memory I have default_vsz_limit = 512 M in my conf file. (This error only occurs with a single user’s .Archive index, but that user has over 400,000 files int eh Archive mailbox) -- Let him who desires peace, prepare for war.

2 1

doveconf syntax question
by A. Schulze 18 Jan '16

18 Jan '16

Hello, I have one sieve extension enabled: /etc/dovecot/conf.d/20-sieve.conf: plugin { sieve_extensions = +vacation-seconds } now (months later) we want to enable an other extension. no big deal: /etc/dovecot/local.conf: plugin { sieve_extensions = +editheaders ... } This was wrong. We ASSUMED the plus would add the extension to the list. But at the end only +editheaders was activ. What's the right way to /add/ sieve_extensions from different config files? our guess "sieve_extensions = $sieve_extensions +editheaders" do not work: doveconf -a | grep sieve_extensions doveconf: Fatal: Error in configuration file /etc/dovecot/local.conf line 22: Unknown variable: $sieve_extensions doveconf: Error: managesieve-login: dump-capability process returned 89 doveconf: Fatal: Error in configuration file /etc/dovecot/local.conf line 22: Unknown variable: $sieve_extensions Andreas

2 2

Running without anvil?
by Dave Abrahams 18 Jan '16

18 Jan '16

Hi, I'm using dovecot as a local mail store on my laptop using preauth tunneling. It turns out I almost don't even need to start dovecot at all; the only reason it needs to be running is so that FTS indexing can be invoked. And because I don't want it to run any services, I can run it as an unprivileged user, so long as I turn them all off: # We don't want to serve any protocols, so we don't bind to any ports. # We can run everything as me. protocols = default_login_user = dave default_internal_user = dave The only thing is, I keep getting these in var/log/mail.log: anvil: Fatal: chroot(/Users/dave/brew/var/run/dovecot/empty) failed: Operation not permitted master: Error: service(anvil): command startup failed, throttling for 60 secs auth: Error: read(anvil-auth-penalty) failed: EOF Any suggestions? TIA, Dave

3 5

sieve - configuration problem
by Hajo Locke 18 Jan '16

18 Jan '16

Hello List, first thanks for previous hints, you helped me a lot. Unfortunately i have new problem with sieve and executing multiple scripts sequentially. This is current conf which is complete working : #CONF1 plugin { sieve = ~/sieve/.dovecot.sieve sieve_plugins = sieve_extprograms sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute +editheader sieve_pipe_bin_dir = /usr/local/bin/ sieve_filter_bin_dir = /usr/local/bin/ sieve_dir = ~/sieve sieve_global_dir = /etc/dovecot/sieve/ } i also activated managesieve which is working as well. Now iam looking for a way to run individual scripts for users. My idea is to have a system generated script which may run before or after the personal script. Additional the system scripts should not be viewed or changed by mailusers. So i tried with directives sieve_before and sieve_after: #CONF2 plugin { sieve = ~/sieve/.dovecot.sieve sieve_before = ~/sieve_before/.dovecot.sieve sieve_after = ~/sieve_after/.dovecot.sieve sieve_plugins = sieve_extprograms sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute +editheader sieve_pipe_bin_dir = /usr/local/bin/ sieve_filter_bin_dir = /usr/local/bin/ sieve_dir = ~/sieve sieve_global_dir = /etc/dovecot/sieve/ } every single script "~/sieve/.dovecot.sieve", "~/sieve_before/.dovecot.sieve" and "~/sieve_after/.dovecot.sieve" contains a small rule to add a new mailheader (X-Before, X-After, X-Middle) so i can watch what happens. The problem is: Every single script is working, but only when this directive is the only one which is activated in conf. As soon as i enable another directive absolut nothing is happen. It does not matter which combination of directives (sieve|sieve_before_sieve_after) is enabled or disabled. Just as a second one is enabled sieve seems to do nothing. Mail is delivered by lda but no songle one headerentry is added. What happens here and how to solve this? Currently i use dovecot 2.2.21 and sieve 0.4.11 Thanks, Hajo

2 2

Dockerfile for building latest github version
by KT Walrus 16 Jan '16

16 Jan '16

Is there a Dockerfile for building/installing the latest Dovecot version in a Docker Image? I don't see Dovecot in the Official Repositories on the Docker Hub like almost all the other popular open source software packages that I use. Why no Official Docker repo for Dovecot? All the user contributed repos containing Dovecot in the Docker Hub seem to just install from a distribution’s repo (like Ubuntu 14.04) but these packages seem to lag the most recent version of Dovecot that I see in GitHub. Kevin

1 0

Corrupted index cache file - migration with zlib
by Leon Kyneur 15 Jan '16

15 Jan '16

Hi I'm migrating some mailboxes from an old dovecot system where mailboxes are stored maildir uncompressed. I enabled zlib on the new system and migrated an account: doveadm -o mail_fsync=never backup -R -u tonyg imapc: when the account connects to the new system after a while i'm seeing the following error and the mailbox is no longer functioning: Jan 15 13:58:06 S611 dovecot: imap(tonyg): Error: read(/srv/vmail/532868/tonyg/mdbox/storage/m.1): FETCH BODY[] for mailbox INBOX UID 61 got too little data: 4106341 vs 6054268 Jan 15 13:58:06 S611 dovecot: imap(tonyg): Error: unlink(/srv/vmail/532868/tonyg/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: No such file or directory (in mail-cache.c:28) Jan 15 13:58:06 S611 dovecot: imap(tonyg): Error: Corrupted index cache file /srv/vmail/532868/tonyg/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache: Broken virtual size for mail UID 61 Jan 15 13:58:06 S611 dovecot: imap(tonyg): FETCH failed in=181 out=4109653 Jan 15 13:58:06 S611 dovecot: auth-worker(6130): ldap(tonyg,144.132.1.90): unknown user Jan 15 13:58:06 S611 dovecot: imap-login: Login: user=<tonyg>, method=PLAIN, rip=144.132.1.90, lip=203.134.11.127, mpid=6746, secured, session=<7qqWklYpnGjLhgHK> Jan 15 13:58:07 S611 dovecot: imap(tonyg): Error: read(/srv/vmail/532868/tonyg/mdbox/storage/m.1): FETCH BODY[] for mailbox INBOX UID 61 got too little data: 4106341 vs 6054268 Jan 15 13:58:07 S611 dovecot: imap(tonyg): Error: unlink(/srv/vmail/532868/tonyg/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: No such file or directory (in mail-cache.c:28) Jan 15 13:58:07 S611 dovecot: imap(tonyg): Error: Corrupted index cache file /srv/vmail/532868/tonyg/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache: Broken virtual size for mail UID 61 Jan 15 13:58:07 S611 dovecot: imap(tonyg): FETCH failed in=181 out=4109653 If i migrate the account without zlib everthing works fine and the error can't be reproduced. I have tried force-resync and index commands to no avail. Any ideas what's going on here? doveconf -n: [root@S611 532868]# doveconf -n # 2.2.21 (5345f22): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.11 (6ddf62b87f60+) # OS: Linux 3.10.0-327.4.4.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) auth_debug = yes auth_verbose = yes imapc_features = rfc822.size fetch-headers imapc_host = removed imapc_master_user = removed imapc_password = # hidden, use -P to show it imapc_user = %u lmtp_proxy = yes login_trusted_networks = 192.168.10.0/24 mail_debug = yes mail_gid = vmail mail_location = mdbox:%h/mdbox:ALT=/altstorage%h/mdbox mail_plugins = quota zlib mail_prefetch_count = 50 mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart mdbox_rotate_size = 10 M namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-m2core.conf.ext driver = ldap } plugin { quota = dict:User quota::file:%h/dovecot-quota sieve = file:~/sieve;active=~/.dovecot.sieve zlib_save = gz zlib_save_level = 6 } pop3c_host = <removed> pop3c_password = # hidden, use -P to show it service lmtp { inet_listener lmtp { address = <removed> port = 24 } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem verbose_proctitle = yes protocol imap { mail_plugins = quota imap_quota imap_zlib }

2 2

Courier generates new UIDVALIDITY
by Peer Heinlein 15 Jan '16

15 Jan '16

We just detected, that under some circumstances Courier-IMAP will generate a new UIDVALIDITY for every access to an IMAP-folder, if the folder had been created by a simple "mkdir" and not with maildirmake. Courier doesn't save his uidvalidity-file in this case. Courier DOES generate a sticky UIDVALIDITY after the first "real" access by a User through the IMAP-SELECT-command. That's why this problem isn't a "real" problem in the world. Courier does NOT create this IMAP-UIDVALIDITY if the user just uses POP3-access, because there the UIDVALIDITY isn't used. We have a migration scenario where we have many users with POP3-only access (so that they DO have many mails in der INBOX) and an incremental migration trough doveadm/dsync/imapc fails (caused by consequently changing UIDVALIDITYs). doveadm just uses the IMAP EXAMINE command to open the source IMAP-folder on the Courier's side readonly. Courier DOES handle this access "readonly" and doesn't consequently doesn't generate a UIDVALIDITY-file. Instead Courier uses random UIDVALIDITYS by every access and doveadm always has to copy all mails (and duplicates them if "-1 -R" is used!). To fix this problem and to make a migration and/or doveadm backup/sync much more reliable Dovecot should open the source folder with a SELECT command instead. (Maybe one SELECT and then change to EXAMINE, if you think EXAMINE would be more safe.) Maybe this is also relevant for a real permanent imapc-situation, where Dovecot/imapc is used to fix broken IMAP-implementations from an older backend. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 1

doveadm/dsync/imapc loose folder subscriptions
by Peer Heinlein 15 Jan '16

15 Jan '16

As I already wrote some days ago we're actually running a huge migration using doveadm/dsync-backup/imapc: doveadm -o imapc_user="$UNAME1" -o imapc_password="$PWORD1" -o imapc_host=$SERVER1 -o pop3c_user="$UNAME1" -o pop3c_password="$PWORD1" -o pop3c_host=$SERVER1 -D -v backup -R -u "$UNAME2" imapc: We just noticed that doveadm looses changes in folder subscriptions if a folder is copied again. a) Copy a mdbox-home of a user (using doveadm backup...) b) Change his subscriptions on the source-side OR change his subscripts on the destination-side OR delete his subscriptions-file. c) Copy that mdbox-home from that user again (using doveadm backup...) doveadm will copy & merge his mails, but he does NOT check for changes in folder subscriptions. As you can see in the attached logs, doveadm nitices changes in subscriptions: dsync(p100490p11): Debug: brain S: Local mailbox tree: INBOX.Trash guid=b36f688eae08506001091708006abe5a uid_validity=1368084367 uid_next=1206 subs=yes last_change=0 last_subs=0 dsync(p100490p11): Debug: brain M: Local mailbox tree: INBOX.Trash guid=b36f688eae08506001091708006abe5a uid_validity=1368084367 uid_next=1206 subs=no last_change=1448903088 last_subs=1448177531 but doesn't fix the subscriptions list: dsync(p100490p11): Debug: brain M: Mailbox INBOX.Trash: local=b36f688eae08506001091708006abe5a/1448903088/1, remote=b36f688eae08506001091708006abe5a/0/1: Mailboxes are equal Even a deletion of the subscriptions file doesn't work. doveadm does not create a new subscription file. This bug is heavy, because incremental backups made by doveadm backup aren't complete and reliable any more. Our biggest problem ist, that we changed the folder prefix and doveadm does change the folder names, but not the subscriptions. So we have several hundred thousand users with broken subscriptions (yes, sed can fix this, I know, but also we'd kill changes made by users during migration period). Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 2

Increasing mail_max_userip_connections and sys resources
by Nikolaos Milas 15 Jan '16

15 Jan '16

In our low-traffic server we have always kept the default value for IMAP mail_max_userip_connections (10). The server has been working fine! (Thank you Timo for this!) However, recently we have been having: Maximum number of connections from user+IP exceeded errors both for IMAP and webmail users. Thus, we have now changed the value to 100. The questions: 1.Might this lead to overloading the server? 2. Could another dovecot setting prevent the above setting from being applied (e.g. due to connections exhaustion), i.e. should we also change other setting(s)? 3. What should we take into account when deciding the value for mail_max_userip_connections? 4. How can we set a different value to this directive for webmail connections (coming from 127.0.0.1, ::1)? The config follows for your reference (I've only changed the real domain name). Thanks in advance for your help. Nick ----------------------------------------------------------------------------- # doveconf -n # 2.2.18: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 # OS: Linux 2.6.18-407.el5 x86_64 CentOS release 5.11 (Final) auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no dsync_remote_cmd = ssh -l root vmail1.example.com doveadm dsync-server -u%u mail_gid = 500 mail_location = maildir:~/Maildir/ mail_plugins = quota mail_log notify replication mail_uid = 500 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = remote:vmail@vmail1.example.com quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } protocols = imap pop3 service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M } service imap { executable = imap postlogin } service pop3-login { service_count = 1 vsz_limit = 64 M } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog } service quota-warning { executable = script /opt/mail1.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } ssl_ca = </etc/pki/tls/certs/chain-1552.pem ssl_cert = </etc/pki/tls/certs/cert-1552.pem ssl_key = </etc/pki/tls/private/key-1552.pem ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local1 userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 100 mail_plugins = quota imap_quota notify replication } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify replication pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify replication postmaster_address = sysadmin(a)example.com sendmail_path = /usr/lib/sendmail } ------------------------------------------------------------------------------------

2 3

doveadm/dsync/imapc and foldernames including a "%"
by Peer Heinlein 14 Jan '16

14 Jan '16

We're using doveadm/dsync/imapc to migrate accounts from Courier to Dovecot 2.2.20. On the source-server some user have folder names including a "%" in their name. Looks like doveadm isn't able to handle that folder names. I always stops with: dsync(testtest): Error: Failed to access mailbox INBOX.Test%TEST: Mailbox does not exist, or must be subscribed to. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 2

Problem! Dovecot 2.2.9 does not send the information on ending the quota to user
by Serge Spinoza 13 Jan '16

13 Jan '16

Hi. I have Dovecot + Postfix + MySQL. Version of Postix: postfix_2.11.3-1ubuntu1_amd64 Version of Dovecot: 2.2.9 Operations system is: Ubuntu 15.04 x64 Postfix have patched (patch VDA - http://vda.sourceforge.net) for using with quota, it means that file "maildirsize" in mail directory already exists and changed when add/delete mail. Quota for virtual box take in MySQL db. ########################## Problem: Dovecot does not send the information on ending the quota to user. ########################## # dovecot -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-042stab112.15 x86_64 Ubuntu 15.04 ext4 auth_debug = yes auth_default_realm = mydomain.ru auth_mechanisms = plain login auth_realms = znak-corp.ru debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot.log lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes log_path = /var/log/dovecot.log login_greeting = Welcome to OOO "Corporation ZNAK" mail_gid = 1000 mail_location = maildir:/var/vmail/%n@%d mail_plugins = " quota" mail_uid = 1000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { autocreate = INBOX autosubscribe = INBOX quota = maildir:User quota quota_rule = *:storage=10M #(this derective takes from mysql, but i wrote it just in case) quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=80%% quota-warning 80 %u } protocols = pop3 imap quota_full_tempfail = yes service auth { unix_listener /var/spool/postfix/private/dovecot-smtp-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = /usr/lib/dovecot/quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl_cert = </etc/ssl/mydomain.ru.crt ssl_key = </etc/ssl/mydomain.ru.key userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_plugins = " quota imap_quota autocreate" } protocol pop3 { mail_plugins = quota } protocol lda { mail_plugins = " quota autocreate" } ##### quota-warning.sh ##### #!/bin/sh PERCENT=$1 USER=$2 cat << EOF | /usr/lib/dovecot/dovecot-lda -d $USER -o "plugin/quota=maildir:User quota:noenforcing" From: aaa(a)mydomain.ru Subject: Quota warning $PERCENT% Your mailbox is now $PERCENT% full. Please remove unnecessary emails to avoid new mail loosing. EOF ##### Script has chmod 777 ##### root@mx:~# ls -la /usr/local/bin/quota-warning.sh -rwxrwxrwx 1 vmail vmail 285 Dec 17 11:09 /usr/local/bin/quota-warning.sh Check the script this command is successful: # /usr/local/bin/quota-warning.sh 82 rrr(a)mydomain.ru (a letter is sent to rrr(a)mydomain.ru that box is filled to 82%) ##### dovecot-sql.conf.ext ##### driver = mysql connect = host=localhost dbname=postfix user=postfix password=xxxxxxx default_pass_scheme = MD5-CRYPT user_query = SELECT '/var/vmail/%n@%d' as home, 'maildir:/var/vmail/%n@%d'as mail, 1000 AS uid, 1000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND active = '1' password_query = SELECT username as user, password, '/var/vmail/%n@%d' as userdb_home, 'maildir:/var/vmail/%n@%d' as userdb_mail, 1000 as userdb_uid, 1000 as userdb_gid, concat('*:bytes=', quota) AS userdb_quota_rule FROM mailbox WHERE username = '%u' AND active = '1' ##### Check that the socket has a quota-warning: # lsof |grep quota-warning dovecot 17277 root 57u unix 0xffff8802d7845b80 0t0 62354154 /var/run/dovecot/quota-warning ##### Verify that the plugin quota is running I doing like this: # doveadm -D -v quota get -u rrr(a)mydomain.ru Conclusion: doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) doveadm(rrr(a)mydomain.ru): Debug: Added userdb setting: mail=maildir:/var/vmail/rrr@mydomain.ru doveadm(rrr(a)mydomain.ru): Debug: Added userdb setting: plugin/quota_rule=*:bytes=10240000 doveadm(rrr(a)mydomain.ru): Debug: Effective uid=1000, gid=1000, home=/var/vmail/rrr(a)mydomain.ru doveadm(rrr(a)mydomain.ru): Debug: Quota root: name=User quota backend=maildir args= doveadm(rrr(a)mydomain.ru): Debug: Quota rule: root=User quota mailbox=* bytes=10240000 messages=0 doveadm(rrr(a)mydomain.ru): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(rrr(a)mydomain.ru): Debug: Quota rule: root=User quota mailbox=SPAM ignored doveadm(rrr(a)mydomain.ru): Debug: Quota warning: bytes=9216000 (90%) messages=0 reverse=no command=quota-warning 90 rrr(a)mydomain.ru doveadm(rrr(a)mydomain.ru): Debug: Quota warning: bytes=8192000 (80%) messages=0 reverse=no command=quota-warning 80 rrr(a)mydomain.ru doveadm(rrr(a)mydomain.ru): Debug: Quota grace: root=User quota bytes=1024000 (10%) doveadm(rrr(a)mydomain.ru): Debug: maildir++: root=/var/vmail/rrr(a)mydomain.ru, index=, indexpvt=, control=, inbox=/var/vmail/rrr(a)mydomain.ru, alt= Quota name Type Value Limit % User quota STORAGE 9008 10000 90 User quota MESSAGE 6 - 0 ##### Those plugin is successfully loaded and checked. When removing/receiving emails percent of employment, respectively changes. I read in dovecot manual, that the notification send only when the quota border crossing - then I tested like this: Clears the box up to 60% and then send letters, which occupy about 5% more of allocated quota. And so the lead up to 95%. But reports of ending the quota not be sent. In what may be another problem? Thanks. ------------------ Serge

2 2

sieve - compile error
by Hajo Locke 13 Jan '16

13 Jan '16

Hello, try to upgrade my dovecot 2.2.18 installation from sieve 0.4.6 to newest sieve 0.4.11 I got this error at packaging: make[4]: Verzeichnis »/home/test/dovecot-2.2.18/pigeonhole/src/sieve-tools« wird betreten gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib-sieve -I../../src/lib-sieve-tool -I./debug -I/home/test/dovecot-2.2.18 -I/home/test/dovecot-2.2.18/src/lib -I/home/test/dovecot-2.2.18/src/lib-dict -I/home/test/dovecot-2.2.18/src/lib-dns -I/home/test/dovecot-2.2.18/src/lib-http -I/home/test/dovecot-2.2.18/src/lib-mail -I/home/test/dovecot-2.2.18/src/lib-imap -I/home/test/dovecot-2.2.18/src/lib-fs -I/home/test/dovecot-2.2.18/src/lib-charset -I/home/test/dovecot-2.2.18/src/lib-auth -I/home/test/dovecot-2.2.18/src/lib-master -I/home/test/dovecot-2.2.18/src/lib-ssl-iostream -I/home/test/dovecot-2.2.18/src/lib-compression -I/home/test/dovecot-2.2.18/src/lib-settings -I/home/test/dovecot-2.2.18/src/lib-test -I/home/test/dovecot-2.2.18/src/lib-sasl -I/home/test/dovecot-2.2.18/src/lib-stats -I/home/test/dovecot-2.2.18/src/lib-index -I/home/test/dovecot-2.2.18/src/lib-storage -I/home/test/dovecot-2.2.18/src/lib-storage/list -I/home/test/dovecot-2.2.18/src/lib-storage/index -I/home/test/dovecot-2.2.18/src/lib-storage/index/raw -I/home/test/dovecot-2.2.18/src/lib-imap-storage -I/home/test/dovecot-2.2.18/src/plugins/quota -D_FORTIFY_SOURCE=2 -std=gnu99 -g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I../.. -MT sievec.o -MD -MP -MF .deps/sievec.Tpo -c -o sievec.o sievec.c sievec.c: In function ‘main’: sievec.c:48:20: error: ‘EXIT_SUCCESS’ undeclared (first use in this function) int exit_status = EXIT_SUCCESS; ^ sievec.c:48:20: note: each undeclared identifier is reported only once for each function it appears in sievec.c:150:18: error: ‘EXIT_FAILURE’ undeclared (first use in this function) exit_status = EXIT_FAILURE; ^ make[4]: *** [sievec.o] Fehler 1 make[4]: Verzeichnis »/home/test/dovecot-2.2.18/pigeonhole/src/sieve-tools« wird verlassen make[3]: *** [all-recursive] Fehler 1 make[3]: Verzeichnis »/home/test/dovecot-2.2.18/pigeonhole/src« wird verlassen make[2]: *** [all-recursive] Fehler 1 make[2]: Verzeichnis »/home/test/dovecot-2.2.18/pigeonhole« wird verlassen make[1]: *** [all] Fehler 2 make[1]: Verzeichnis »/home/test/dovecot-2.2.18/pigeonhole« wird verlassen make: *** [build-stamp] Fehler 2 dpkg-buildpackage: Fehler: Fehler-Exitstatus von debian/rules build war 2 Is sieve bundled to dovecotversion? i try it with dovecot 2.2.18. System is Ubuntu14, gcc 4.8.4 Thanks, Hajo

2 1

Re: Released Pigeonhole v0.4.11 for Dovecot v2.2.21
by Juan C. Blanco 12 Jan '16

12 Jan '16

Hello Stephan. > The release is available as follows: > > http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.11.ta… > http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.11.ta… http://pigeonhole.dovecot.org/ seems to be down, right? Regards Juan C. > > Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for > more information. Have fun testing this release and don't hesitate to > notify me when there are any problems. > > Regards, > > -- > Stephan Bosch > stephan at rename-it.nl > > > -- +-------------------------------------------------------------------+ | Juan C. Blanco | | | | Centro de Calculo | | | E.T.S. Ingenieros Informáticos | E-mail: jcblanco(a)fi.upm.es | | Universidad Politécnica de Madrid | | | Campus de Montegancedo | | | Boadilla del Monte | Tel.: (+34) 91 336 7466 | | 28660 MADRID (Spain) | Fax : (+34) 91 336 6913 | +-------------------------------------------------------------------+

2 2

No SSL on some users
by Jonas Björklund 12 Jan '16

12 Jan '16

Hello, Is there a way to allow only certain users on IMAP/POP3 without SSL? Im running MySQL backend. /Jonas

2 1

TLS SNI Client Support
by absolutely_free＠libero.it 12 Jan '16

12 Jan '16

Hi,according to this page: http://wiki2.dovecot.org/SSL/SNIClientSupport (last change 2013) I would like to know if this limitation is still valid. # dovecot --version2.0.9 I am trying to configure Android default email client and I am not able at all to use TLS. With other clients I have no problem, so I think my server configuration is ok. Thank you

1 0

Missing Documentation
by Andre Helwig 12 Jan '16

12 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, could someone apply the folowing line to the wiki page at http://wiki2.dovecot.org/Tools/Doveadm/Sync Because it is write protected. - -R Reverse backup direction, so mails in location2 are backed up to default mail location. - -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-0 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJWlN6oAAoJEAoTNwRDnEhRfyAH/RZmdQO4jevf8d6Y/CjW/Lkc H7Ny1tB4W+dZnY/Lap+VY4RER/QWfgVgPDrWm0FG1r73FBpPqxafVlMeh2TM9Daf ARSlBQltDl4GvUu3w+ANByUm/eHe3+3+/HavgJApCpJwaxDfgGBpJoEkTsNQSs6d t2NZYY1k/MJV+5Vk7YWatUnHNdK3H6DPz03e+GLQkh+Np0HScy95ispU1c6rirH0 ROb/4X/HPL2Isut3KHcgJ+f5SkHDueNCgM9kq/O72wq8c1GxAIn/Mwk0wQhdVsw/ VoCrsw/IcJ3k6cTeys8rYmpmBMu4LaNfMHoRXTB0X98KmpLHS99WwJ1fXI2Oegw= =flsG -----END PGP SIGNATURE-----

1 0

autoexpunge problems
by Olaf Hopp 12 Jan '16

12 Jan '16

Hello, I tried to use the new autoexpunge for my Trash folders I had in 15-mailboxes.conf mailbox Trash { special_use = \Trash auto = subscribe } (dovecot -n of the original config is below) and added just the line autoexpunge = 1h Just a short period on my test system. But it failed. In the log I see Dec 18 10:54:07 irams2 dovecot: imap(ms2test): Error: Failed to autoexpunge mailbox 'Trash': Invalid mailbox name 'Trash': Missing namespace prefix 'INBOX.' But in 10-mail.conf I have namespace inbox { prefix = INBOX. separator = . inbox = yes } So I changed the line "mailbox Trash" to "mailbox INBOX.Trash". I now have mailbox INBOX.Trash { special_use = \Trash auto = subscribe autoexpunge = 1h } Now it seems to work (Trash is emptied, log file is fine) but in the mail client I see two Trash folders. Once the normal one below INBOX and another one also called Trash which is under a new created folder named INBOX below the original INBOX Thus I have INBOX INBOX.Trash INBOX.INBOX.Trash autoexpunge seems to work, but this is not what I like to offer to my users. Any glues ? Olaf # 2.2.21 (5345f22): /opt/dovecot/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.10 (d61ff8a5af9e+) doveconf: Warning: service auth { client_limit=2000 } is lower than required under max. load (23192) doveconf: Warning: service anvil { client_limit=2000 } is lower than required under max. load (17195) # OS: Linux 2.6.32-573.12.1.el6.x86_64 x86_64 CentOS release 6.7 (Final) auth_failure_delay = 3 secs auth_master_user_separator = * auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes auth_worker_max_count = 60 default_client_limit = 2000 default_process_limit = 3000 mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox spambox { auto = create special_use = \Junk } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = dovecot driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /etc/dovecot/sieve-master sieve_max_redirects = 20 } protocols = imap pop3 lmtp sieve sieve quota_full_tempfail = yes service imap-login { process_limit = 8192 process_min_avail = 16 service_count = 0 } service imap { process_limit = 8192 } service lmtp { executable = lmtp -L } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3 { process_limit = 8192 } ssl = required ssl_ca = </etc/pki/tls/certs/chain.pem ssl_cert = </etc/pki/tls/certs/imap.pem ssl_key = </etc/pki/tls/private/imap.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local3 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 100 ssl_cert = </etc/pki/tls/certs/imap.pem ssl_key = </etc/pki/tls/private/imap.key } protocol pop3 { ssl_cert = </etc/pki/tls/certs/pop.pem ssl_key = </etc/pki/tls/private/pop.key } -- Karlsruher Institut für Technologie (KIT) ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik Dipl.-Geophys. Olaf Hopp - Leitung IT-Dienste - Am Fasanengarten 5, Gebäude 50.34, Raum 009 76131 Karlsruhe Telefon: +49 721 608-43973 Fax: +49 721 608-46699 E-Mail: Olaf.Hopp(a)kit.edu atis.informatik.kit.edu www.kit.edu KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.

2 2

Problems with doveadm backup in a dovecot director environment
by Tobi 12 Jan '16

12 Jan '16

Hi list I have configured my dovecot(s) in a frontend-backend setup using the director feature of dovecot. Works like charm, but I'm currently unable to use doveadm backup to "sync" the mailbox to a dovecot system which is not within director_mail_servers settings Before I added the director feature I could fire a simple doveadm backup -u myuser(a)mydomain.tld tcps:otherserver.mydomain.tld:2424 After activating the director the command above fails as the connection is always tried to be established to one of the servers specified in director_mail_servers. Is it possible to use doveadm backup towards a server which is not in director_mail_servers? I tried with the -o option of doveadm to override several settings like host or director_mail_servers but no success: the command still tries to connect to an ip from director_mail_servers and not to the destination given as parameter to the command. Is there anyway to achieve that? Thanks a lot for any help tobi

1 1

client setting "move to trash" in shared mailboxes
by Steffen Kaiser 12 Jan '16

12 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, does somebody run clients with "move to trash" on delete in conjunction with shared mailboxes successfully? When one tries to delete a mailbox in the shared namespace, Dovecot responds with "Can't rename mailboxes across specified storages" OK, the failure stems from the fact that the client (Thunderbird) tries to rename the mailbox into "Trash.mailbox" with the user's private namespace. Does somebody know of an AddOn to have Thunderbird move mailboxes into the shared user's Trash, for example? Does somebody uses "mark as deleted", but use a virtual folder as Trashbin? What option would I have, if the users expect a "trashbin" of some sort? - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEVAwUBVpTAJHz1H7kL/d9rAQI3twgAsmZdUdYzwQ200j2ILE2XhG3Iy7oFSWd4 YrmOdw09Fr8JtrQIcsbu8BZyyBOse9CLNICQFkmfsSBEXSFX1v5IGfH98RcvhgaM pQwdY1SMctkI4nJHWkJFjC+SCQlDZmV6MVZD7pv+7VDjvvvh/jr0b/uQunYvPLle BEbz1hSssY8bFmWhZxddydzsYgQfFIHUR2VsINd/YHPZlUjJQUqkPwbmDZ4XVN+P WHXYaR4uhrn5arpibk0x5PG/9wlnQvMkStN/kZNBS4jfsKLz6RTQhKgeNmKXyoZD mjUK5r57GkU0MdrRNqQqbgOIrU9V0h1oBH7PFjVoaddw0pYECPlbuw== =hwNa -----END PGP SIGNATURE-----

1 0

password schemes when crypt() has no DES
by Stuart Henderson 12 Jan '16

12 Jan '16

https://github.com/dovecot/core/commit/54a1b3574acab5f778843f7f1e04d2d26d61… fixed a 'doveadm pw' crash "when trying to use CRYPT scheme when crypt() doesn't support DES" by testing to see if crypt would generate a DES password and, if not, disabling the scheme. I'm using Dovecot on OpenBSD with bcrypt passwords stored in LDAP as "{CRYPT}$2b$...". OpenLDAP is built with --enable-crypt which takes the same approach as Dovecot of just passing to crypt(), so before the above commit, both programs were able to authenticate. (Changing the scheme value stored in the ldap passdb to BLF-CRYPT would fix Dovecot but break things for other programs including OpenLDAP itself). For now I went with a dirty patch to get things working again, does anyone have an idea for a nicer fix? Thanks. --- src/auth/password-scheme-crypt.c.orig Fri Jan 8 01:04:13 2016 +++ src/auth/password-scheme-crypt.c Fri Jan 8 01:23:35 2016 @@ -111,7 +111,12 @@ static const struct { const char *salt; const char *expected; } sample[] = { +#ifdef __OpenBSD__ + { "08/15!test~4711", "$2a$04$0123456789abcdefABCDEF", + "$2a$04$0123456789abcdefABCDE.N.drYX5yIAL1LkTaaZotW3yI0hQhZru" }, +#else { "08/15!test~4711", "JB", "JBOZ0DgmtucwE" }, +#endif { "08/15!test~4711", "$2a$04$0123456789abcdefABCDEF", "$2a$04$0123456789abcdefABCDE.N.drYX5yIAL1LkTaaZotW3yI0hQhZru" }, { "08/15!test~4711", "$5$rounds=1000$0123456789abcdef", @@ -124,8 +129,13 @@ static const struct { /* keep in sync with the sample struct above */ static const struct password_scheme crypt_schemes[] = { +#ifdef __OpenBSD__ { "CRYPT", PW_ENCODING_NONE, 0, crypt_verify, + crypt_generate_blowfisch }, +#else + { "CRYPT", PW_ENCODING_NONE, 0, crypt_verify, crypt_generate_des }, +#endif { "BLF-CRYPT", PW_ENCODING_NONE, 0, crypt_verify, crypt_generate_blowfisch }, { "SHA256-CRYPT", PW_ENCODING_NONE, 0, crypt_verify,

1 0