- dovecot - dovecot.org

[Dovecot] unsebscribe
by Aziz KNINA 07 Mar '14

07 Mar '14

*unsebscribe*

2 1

[Dovecot] How to run a program with mail_filter plugin
by Stanislas SABATIER 07 Mar '14

07 Mar '14

Hi, I'm using mail_filter plugin but I don't want it to launch a script but a program I wrote instead. In 10-master, if I put the absolute path to my program in the plugin settings ie : (…) service mail-filter { executable = /usr/local/bin/mail/my_email_filter (…) But I've got the following error from Dovecot : dovecot: master: Error: service(mail-filter): Initial status notification not received in 30 seconds, killing the process h ow do I need to configure the service to launch my program ? Thanks, Regards, Stan. --------------------------------------------------------------- Stanislas SABATIER s.sabatier(a)pobox.com ---------------------------------------------------------------

1 0

[Dovecot] no sieve with lmtp_save_to_detail_mailbox=yes
by Dennis Kuhn 06 Mar '14

06 Mar '14

i have a problem with sieve and lmtp_save_to_detail_mailbox = yes. If the mailbox "detail" exists everything works fine, but if the mailbox detail does not exist then sieve does not work. The .dovecot.sieve.log file says sieve: info: started log at Mar 06 14:28:47. error: msgid=<531877EE.7070806(a)heinlein-support.de>: failed to store into mailbox 'test2': Mailbox doesn't exist: test2. I think this is the reason why no sieve script is executed, but why is sieve here involved? Is there any relation between lmtp_save_to_detail_mailbox=yes and sieve or is this a bug? The same sieve file works with the same mailaddress without mailextension, so the sieve script is not the reason for the failure. I am using dovecot version 2.2.12 Dennis Kuhn -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-57 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 1

[Dovecot] Public Namespace and INBOX
by Dieter Knopf 06 Mar '14

06 Mar '14

Hello, i added a existing MAILDIR as a Public Namespace and i can subscribe to this Namespace without a problem. I can access every folder except the INBOX. Thunderbird just shows a GREY "INBOX". Is there any way to access the INBOX of a maildir? Thanks Dieter Knopf

4 6

[Dovecot] Still no emails since Feb. 6
by Steve Campbell 06 Mar '14

06 Mar '14

I checked my settings on the dovecot mailman page, and although my account was set to "disable" email, after changing it and attempting to have the list resend my password, I'm still not seeing emails. The last time I received emails, the outgoing server for the list was sent from the IP 193.210.130.67. Is that still correct? I've checked my logs to see if there's anything blocked, and I don't see anything. I've checked my access file and firewall, and nothing is blocked there. I'm not sure why my account settings showed "disabled", but it sounds like email was either bounced back to the list or my server is in some type of outgoing list to prevent sending to me. I'm at a loss. Is there any way an admin can check for me, please, to see if there's a problem they might spot? Thanks, steve

4 6

[Dovecot] Pigeonhole Sieve Extprograms Plugin
by dovecot＠voidptr.de 06 Mar '14

06 Mar '14

Hi, I upgraded to Dovecot 2.2.9 from Debian's wheezy-backports today (which should contain the "sieve_extprograms" plugin and thus also the vnd.dovecot.{pipe,filter,execute} capabilities. However when I add require "vnd.dovecot.filter"; to my sieve script via managesieve, the server reports error: require command: unknown Sieve capability: 'vnd.dovecot.filter' What am I missing and what should I do to get pipe/filter/execute to work? postconf -n attached. Nils

2 2

[Dovecot] whole user mailbox read only
by Francesco 06 Mar '14

06 Mar '14

Hello, i was browsing the dovecot wiki for some documentation related to the use of ACLs but i couldn't find an answer. i'm in the need to prevent users from deleting emails, yet being able to add new content via imap, what i mean is that a user should be able to create an email in its mailbox (maildir actually is used), but once the email is there the user shouldn't be able to delete it. do you know if there is a way to accomplish this for each subfolder on a Maildir environment? Thanks in advance Francesco

1 0

[Dovecot] Bounce messages
by Thanh Long DANG 06 Mar '14

06 Mar '14

Hi, I just set up my mail server using postfix / dovecot / mysql and it works well. I just have a problem : I'm a trying to have a overquota notification and the server sends nothing (mail server rejects incoming mail). Could you tell me if there is a problem with dovecot or postfix configuration? Kind regards,Long My conf : # 2.1.7: /etc/dovecot/dovecot.conf# OS: Linux 2.6.32-26-pve x86_64 Debian 7.2 simfsauth_mechanisms = plain logindebug_log_path = /var/log/dovecot-debug.logdict { quotadict = mysql:/etc/dovecot/dovecot-dict-sql.conf}disable_plaintext_auth = noinfo_log_path = /var/log/dovecot-info.loglog_path = /var/log/dovecot.logmail_location = maildir:/home/vmail/%d/%n:INDEX=/home/vmail/%d/%n/indexesnamespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix =}passdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql}plugin { quota = maildir:User quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_rule = *:storage=1G quota_rule2 = Trash:storage=+30%% quota_rule3 = Sent:storage=+30%% quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve}postmaster_address = postmaster(a)multidist.euprotocols = " imap lmtp pop3"quota_full_tempfail = yesrejection_subject = Rejet: %sservice auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 }}service dict { unix_listener dict { mode = 0777 }}service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix }}service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0777 }}ssl_cert = </etc/dovecot/dovecot.pemssl_key = </etc/dovecot/private/dovecot.pemuserdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql}verbose_proctitle = yesprotocol lmtp { mail_plugins = " quota"}protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log mail_plugins = " quota"}protocol imap { mail_max_userip_connections = 10 mail_plugins = quota imap_quota}protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv}

3 3

[Dovecot] Shared Namespace and correct location
by Dieter Knopf 05 Mar '14

05 Mar '14

Hello again, i still have problems using a Shared Namespace in my configuration. I'm using Dovecot 2.2.9. mail_location = maildir:/home/vmail/%d/%n/MAILDIR:INDEX=/home/vmail/%d/%n/INDEX/ namespace inbox { type = private separator = / prefix = inbox = yes } This works create. But: namespace { type = shared separator = / prefix = shared/%%u/ location = maildir:/home/vmail/%%d/%%u/MAILDIR/shared:INDEX=/home/vmail/%d/%u/INDEXS/%%u subscriptions = no list = children } I'm still not sure how i can see a shared mailbox on a different account. I can add ACL rules and dovecot is adding SQL-Entries to the user-shares table. The dovecot-acl-list file is created too, hope this is okay (vfile + SQL) But i can't see the shared folder on the target account. I tried many location-pathes, but not sure how i can add the right folder. There must be a problem with %%d and %%u. Thank you very much, Dieter

2 1

[Dovecot] Dovecot Migration: Retrieving/Logging POP/IMAP Passwords in Plaintext
by Traiano Welcome 05 Mar '14

05 Mar '14

Hi List I'm currently in the process of migrating my dovecot imap/pop users to a new server and have to extract their passwords in order to import them into the new system (different password encryption schemes). I've tried enabling auth_* debug parameters in my dovecot.conf in the hope that this would result in logging plaintext passwords to the dovecot log. However dovecot does not log the passwords in plaintext under any debugging configuration. My question: Is there any other configuration of dovecot that would allow me to capture POP/IMAP passwords at a successful login time? Dovecot version: 1.0.7 (from dovecot-1.0.7-7.el5_7.1 rpm) The output of dovecot -n is: --- # 1.0.7: /etc/dovecot.conf info_log_path: /var/log/dovecot.debug verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~:INBOX=~/Mailbox mail_debug: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib64/dovecot/imap mail_plugin_dir(imap): /usr/lib64/dovecot/imap mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3 auth default: mechanisms: plain login verbose: yes debug: yes debug_passwords: yes passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/run/dovecot/auth-client mode: 438 --- My dovecot.conf is as follows: ------ info_log_path = /var/log/dovecot.debug verbose_ssl = yes mail_location = mbox:~:INBOX=~/Mailbox mail_debug = yes protocol imap { } protocol pop3 { } protocol lda { postmaster_address = postmaster(a)example.com } auth_verbose = yes auth_debug = yes auth_debug_passwords = yes auth default { mechanisms = plain login passdb pam { } userdb passwd { } user = root socket listen { client { path = /var/run/dovecot/auth-client mode = 0666 } } } dict { } plugin { } --- Many thanks in advance! Traiano

3 5

[Dovecot] Using AD, one more try - "successfol auth" and crashing auth process
by Jeroen Scheerder 05 Mar '14

05 Mar '14

Hi, I have no success in using AD with dovecot. The little checkpassword script I cooked up that uses ldapsearch to lookup a user DN (with an authenticated bind) and then ldapsearch with an authenticated bind for that DN again works well. * Approach 1: use a service account to bind to AD, lookup the user DN, and bind to that DN. It fails. The LDAP config looks like: hosts = dc2.office.on2it.net ldap_version = 3 base = dc=office,dc=on2it,dc=net scope=subtree auth_bind = yes dn = CN=DovecotSvc,OU=Svcs,DC=office,DC=on2it,DC=net dnpass = suppressed pass_attrs = sAMAccountName=user pass_filter = (&(objectClass=person)(sAMAccountName=%u)) user_attrs = sAMAccountName=user user_filter = (&(objectClass=person)(sAMAccountName=%u)) What happens in this case is best shown in the packet capture as displayed by tshark: $ tshark -o tcp.check_checksum:FALSE -tr -r dc2.pcap 1 0.000000 172.17.50.13 -> 172.17.10.2 LDAP 197 bindRequest(7) "CN=DovecotSvc,OU=Svcs,DC=office,DC=on2it,DC=net" simple 2 0.001879 172.17.10.2 -> 172.17.50.13 LDAP 88 bindResponse(7) success Yay! The service account binds just fine. 3 0.001967 172.17.50.13 -> 172.17.10.2 LDAP 180 searchRequest(8) "dc=office,dc=on2it,dc=net" wholeSubtree 4 0.002772 172.17.10.2 -> 172.17.50.13 LDAP 502 searchResEntry(8) "CN=Jeroen Scheerder,OU=Users,DC=office,DC=on2it,DC=net" \ | searchResRef(8) | searchResRef(8) | searchResRef(8) | searchResDone(8) success 5 0.098367 172.17.50.13 -> 172.17.10.2 TCP 66 49416 > 389 [ACK] Seq=246 Ack=459 Win=1037 Len=0 TSval=602425599 TSecr=124473537 Yay! The user DN is found successfully. 6 225.149885 172.17.50.13 -> 172.17.10.2 LDAP 166 bindRequest(12) "CN=Jeroen Scheerder,OU=Users,DC=office,DC=on2it,DC=net" simple 7 225.152323 172.17.10.2 -> 172.17.50.13 LDAP 88 bindResponse(12) success 8 225.248387 172.17.50.13 -> 172.17.10.2 TCP 66 49416 > 389 [ACK] Seq=346 Ack=481 Win=1040 Len=0 TSval=602650749 TSecr=124496053 Yay! The user DN bind works. But wait, why is it taking dovecot 225 seconds to get around to trying it? The auth process has already given up. * Approach 2: A template defines the user DN. Bind to that DN. AD DNs don't contain usernames, but AD allows all kinds of non-LDAP shorthands for DNs, inclusing %user%@domain. I've verified this to work using ldapsearch: $ ldapsearch -o ldif-wrap=no -x -LLL -E pr=200/noprompt -H ldap://dc2.office.on2it.net \ -b dc=office,dc=on2it,dc=net -s sub \ -D js(a)office.on2it.net -W \ '(&(ObjectClass=person)(sAMAccountName=js))' DN Enter LDAP Password: dn: CN=Jeroen Scheerder,DC=office,DC=on2it,DC=net The config looks like: hosts = dc2.office.on2it.net ldap_version = 3 base = dc=office,dc=on2it,dc=net scope=subtree auth_bind = yes auth_bind_userdn = "%u(a)office.on2it.net" pass_attrs = sAMAccountName=user user_attrs = sAMAccountName=user What happens in this case is best shown by a snippet of dovecot logging: Mar 5 09:57:36 <mail.err> ponyboy dovecot: auth: Error: ldap(js,127.0.0.1,<z1dLNtjzJwB/AAAB>): ldap_search(base=dc=office,dc=on2it,dc=net filter=(&(objectClass=posixAccount)(uid=js))) failed: Operations error Mar 5 09:57:36 <mail.err> ponyboy dovecot: imap: Error: Disconnected from auth server, aborting (client-pid=7247 client-id=1) Mar 5 09:57:36 <mail.crit> ponyboy dovecot: auth: Fatal: master: service(auth): child 7245 killed with signal 11 (core not dumped - set service auth { drop_priv_before_exec=yes }) Mar 5 09:57:36 <mail.info> ponyboy dovecot: imap-login: Internal login failure (pid=7247 id=1) (internal failure, 1 successful auths): user=<js>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=7248, secured, session=<z1dLNtjzJwB/AAAB> I find this intriguing -- "1 successful auths", so says imap-login, with auth dying horribly. I smell a rat. Something's wrong here...

1 0

[Dovecot] Send and Bounced mail not appearing, depending on mail client
by Dominique 05 Mar '14

05 Mar '14

Hi, I just installed Dovecot2 on Ubuntu 12.04 server with postfix and postfixadmin. I am using virtual users and virutal domains. When using Thunderbird, Roundcubemail,iOS mail application on an iPad2 or Kmail n Android, all mail sent and bounce shows up. However, when using vTigerCRM to send mails, nothing shows up - anywhere. I know the mail are being send - as per the mail.log and the various postfix log lines. But none of that is being captured by Dovecot... What am I missing? Thanks for any hints you can provide. Dominique --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

2 1

Re: [Dovecot] Can't get authentication for masterusers on Mac OS X Server 10.6.8
by Joseph Tam 05 Mar '14

05 Mar '14

On Tue, 4 Mar 2014, dovecot-request(a)dovecot.org wrote: > #telnet mailserv.example.com 143 > Connected to mailserv.example.com. > Escape character is '^]'. > * OK Dovecot ready. > 1 login myusername myPassword > 1 OK Logged in. > 1 logout > * BYE Logging out > 1 OK Logout completed. > Connection closed by foreign host. This does not test what you want, which is trying to authenticate the master user, not the regular user. From what I remember of your config, you have another passdb which holds the credentials of your master user: you need to check that file to make sure the master user's password (hash) matches what you think the master password ought to be. Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] Hidden virtual folder
by Moritz Augsburger 04 Mar '14

04 Mar '14

Hi, I wanted to create a virtual folder containing all unread messages and the threads they belong to, and this config works really fine: > dovecot.conf: namespace { type = private prefix = virtual/ separator = / location = virtual:~/Maildir/virtual:INDEX=MEMORY list = children subscriptions = no } > virtual/All/dovecot-virtual: * -Trash -Trash/* -Junk -Junk/* -Drafts -Drafts/* -virtual -virtual/* all > virtual/New/dovecot-virtual: virtual/All inthread refs or unseen recent The only problem I got is that scanning all files for the virtual/All mailbox takes too long, and I would like to keep them cached (no INDEX=MEMORY), so I thought I'll just put virtual/All inside a second virtual namespace. As it's a bad idea to open the All directory manually, I could also hide the complete namespace to the user. So I added the following to my config: namespace { type = private prefix = virtual-all/ separator = / location = virtual:~/Maildir/virtual-all/ hidden = yes list = no subscriptions = no } But sadly it didn't work, a directory virtual-all/ pops up inside my client (thunderbird/icedove). Is hidden=yes/list=no unsupported for virtual locations, or is it me misconfiguring dovecot? If it should matter, it's version 2.2.9, or more specific debian 1:2.2.9-1~bpo70+1. Thanks Moritz

1 0

[Dovecot] No email since Feb 6
by Steve Campbell 04 Mar '14

04 Mar '14

Is the list down or have I been blocked.

2 1

[Dovecot] cyrus2dovecot and doveadm search,expunge
by Lanore Ronan 04 Mar '14

04 Mar '14

hi list, i'am doing a migration from cyrus ( 2.1.17 ) to dovecot ( 2.1.7). for mailbox migration i'am using this script : http://cyrus2dovecot.sw.fu-berlin.de/ To migrate a mailbox : /usr/local/sbin/cyrus2dovecot.pl -C /data/migration/spool/%h/user/%u -D /data/mail/foo.bar/%u(a)foo.bar -U /data/migration/flags/%h/%u.sub -S /data/migration/flags/%h/%u.seen test Directories /data/migration/spool /data/migration/flags are rsynced with rsync -av --delete ... .... .... After mailbox end to migrate, i want to search all message savedbefore some days but this don't work doveadm search -u test(a)foo.bar mailbox inbox savedbefore 1d i'm sure this mailbox have mail before this days. ls into mailbox dir: -rw-r--r-- 1 siadmin siadmin 21662 Mar 3 15:54 1393858496.R2cdf6e55Q2902.server.foo.bar,S=21662,W=22160:2,a I don't understand why this message isn't printer by savedbefore 1d what i'm doing wrong thanks -- Ronan Lanore

1 0

[Dovecot] IMAP native METADATA already implemented?
by Aleve Sicofante 04 Mar '14

04 Mar '14

A year ago, more or less, I was told "Dovecot is getting close to having native METADATA support." How's this going? Thanks.

3 2

[Dovecot] Error "Initializing mail storage ..." after upgrading to 2.2.10
by Götz Reinicke - IT Koordinator 04 Mar '14

04 Mar '14

Hi, I did the upgrade frpom 1.2.x to 2.2.10 and had some warnings/errors on a very few accounts/mailboxes. All of them where permission related and solved. Dovecot rocks again. But on one mailbox I do get an error: Error: user rechnnugseingang-animationsinstitut: Initialization failed: Initializing mail storage from mail_location setting failed Error: Invalid user settings. Refer to server log for more information. There is a homedirectory and the permissions are set like on all other accounts. The username is quite long (35 characters) but an other one with 34 is working fine. And before the upgrade there was no error. Thnaks for any help or hint. Regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 82 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

5 11

Re: [Dovecot] Windows 8 issues (using Live/Outlook)
by Eriberto 04 Mar '14

04 Mar '14

Yes, I imported the cacert. This not solved the problem. Thanks, Eriberto 2014-03-04 4:18 GMT-03:00 Steffen Kaiser <skdovecot(a)smail.inf.fh-brs.de>: > > > Does Windows trust your CA? >

1 0

[Dovecot] Windows 8 issues (using Live/Outlook)
by Eriberto 04 Mar '14

04 Mar '14

Hi! I am trying to make Windows 8 using Live 2012 and Outlook 2010 login in Dovecot POP3s. However, I receive this message in log: Feb 28 07:32:05 ipanema dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=10.0.0.10, lip=10.0.0.1, TLS handshaking: Disconnected, session=<joP78nTz9ACsFQAF> Note that user is sent as blank and this is the only log line. I used debug mode too: Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Feb 28 09:07:07 ipanema dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Feb 28 09:07:07 ipanema dovecot: auth: Debug: auth client connected (pid=8138) Feb 28 09:07:07 ipanema dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=10.0.0.10, lip=10.0.0.1, TLS handshaking: Disconnected, session=<QDraRnbzMwCsFQAF> Analysing the traffic with tshark, I can see: 0.007163 10.0.0.10 -> 10.0.0.1 TLSv1.2 331 Certificate, Server Hello Done I am using Dovecot 2.2.9 and I think it is TLS compatible. External (non-MS) clients, as Mozilla Thunderbird and Sylpheed, are working fine. Can someone point me a light? # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.4 ext4 Thanks in advanced. Regards, Eriberto

2 1

[Dovecot] Dovecot, AD and authenticated binds...
by Jeroen Scheerder 03 Mar '14

03 Mar '14

I posted earlier with reports of less than stellar success in using Active Directory for dovecot authentication. My approach is to using the two-step approach of - obtaining the user DN by a search using an authenticated bind (using a service account) - then binding as that DN, and returning the relevant user attributes This hasn't been succesful. Dovecot's authentication process does perform the (first) authenticated bind successfully, it does obtain the right DN, than just sits there doing nothing as far as I can tell, and after a long delay concludes authentication failure - shortly before deciding to perform the bind with the user-supplied credentials, successfully. Source inspection has not resulted in a glorious eureka yet. So I thought, why not handle it myself? And I wrote a little script, using the checkpassword interface. I've enclosed it. The script is based on <http://wiki2.dovecot.org/AuthDatabase/CheckPassword>, but somehow the userdb_uid and userdb_gid I've passed back in the "EXTRA" environment variable get lost along the way. It syslogs, and the syslogs show that the LDAP parts working as expected: Mar 3 14:49:09 <mail.info> ponyboy checkpassword: successful authenticated bind and DN(js) lookup Mar 3 14:49:09 <mail.info> ponyboy checkpassword: DN(js) is CN=Jeroen Scheerder,OU=Users,OU=Netherlands,OU=ON2IT,DC=office,DC=on2it,DC=net Mar 3 14:49:09 <mail.info> ponyboy checkpassword: js authenticated In dovecot's log, simultaneously, I see basically a successful login, except that the (user_)uid and (userdb_)gid work - unless I disable prefetch, and use a static userdb: Mar 03 14:49:04 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Mar 03 14:49:04 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Mar 03 14:49:04 auth: Debug: auth client connected (pid=90856) Mar 03 14:49:09 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=+qFODbTzDgB/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=63246 resp=<hidden> Mar 03 14:49:09 auth: Debug: checkpassword(js,127.0.0.1,<+qFODbTzDgB/AAAB>): execute: /usr/local/etc/dovecot/checkpassword-on2it /usr/local/libexec/dovecot/checkpassword-reply Mar 03 14:49:09 auth: Debug: checkpassword(js,127.0.0.1,<+qFODbTzDgB/AAAB>): Received input: userdb_uid=143 userdb_gid=143 Mar 03 14:49:09 auth: Debug: checkpassword(js,127.0.0.1,<+qFODbTzDgB/AAAB>): exit_status=0 Mar 03 14:49:09 auth: Debug: client passdb out: OK 1 user=js Mar 03 14:49:09 auth: Debug: master in: REQUEST 4007395329 90856 1 29571963894e557ab643d2e51872ba55 session_pid=90899 request_auth_token Mar 03 14:49:09 auth: Debug: prefetch(js,127.0.0.1,<+qFODbTzDgB/AAAB>): success Mar 03 14:49:09 auth: Debug: master userdb out: USER 4007395329 js uid=143 gid=143 auth_token=e2d7c2463dd4c039010e904afb4ea45214cb7de5 Mar 03 14:49:09 imap-login: Info: Login: user=<js>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=90899, secured, session=<+qFODbTzDgB/AAAB> Mar 03 14:49:09 imap: Error: user js: Mail access for users with UID 143 not permitted (see first_valid_uid in config file, uid from userdb lookup). Mar 03 14:49:09 imap: Error: Invalid user settings. Refer to server log for more information. With a static userdb (as shown in the config below): behold, everything works: Mar 03 14:52:49 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=R0plGrTzGAB/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=40984 resp=<hidden> Mar 03 14:52:49 auth: Debug: checkpassword(js,127.0.0.1,<R0plGrTzGAB/AAAB>): execute: /usr/local/etc/dovecot/checkpassword-on2it /usr/local/libexec/dovecot/checkpassword-reply Mar 03 14:52:49 auth: Debug: checkpassword(js,127.0.0.1,<R0plGrTzGAB/AAAB>): Received input: userdb_uid=143 userdb_gid=143 Mar 03 14:52:49 auth: Debug: checkpassword(js,127.0.0.1,<R0plGrTzGAB/AAAB>): exit_status=0 Mar 03 14:52:49 auth: Debug: client passdb out: OK 1 user=js Mar 03 14:52:49 auth: Debug: master in: REQUEST 2818310145 90960 1 1b6ea6c4e6b90fd49a87195c35fa34ef session_pid=91002 request_auth_token Mar 03 14:52:49 auth: Debug: master userdb out: USER 2818310145 js uid=1000 gid=1000 home=/var/mail/on2it/js auth_token=21609f5f149bf80dec701dce9f288824cdf52c60 Mar 03 14:52:49 imap-login: Info: Login: user=<js>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=91002, secured, session=<R0plGrTzGAB/AAAB> Mar 03 14:53:04 imap(js): Info: Connection closed in=0 out=352 So it's working for me now. This is clearly not the way things ought to work... but the stock LDAP interaction seems broken to my limited mind. So who would be so friendly as to point out the fallacies I've been pursuing? Regards, Jeroen. $ dovecot -n # 2.2.10: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-RELEASE amd64 ufs auth_debug = yes auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes first_valid_gid = 1000 first_valid_uid = 1000 imap_client_workarounds = delay-newmail last_valid_gid = 1000 last_valid_uid = 1000 log_path = /tmp/dovecot mail_gid = 1000 mail_location = maildir:/var/mail/on2it/%Ln mail_uid = 1000 maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/checkpassword-on2it driver = checkpassword } protocols = imap service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } } shutdown_clients = no ssl = no userdb { args = uid=1000 gid=1000 home=/var/mail/on2it/%Ln driver = static } valid_chroot_dirs = /var/mail/on2itn2it

1 1

[Dovecot] Tracking logins
by Alex 03 Mar '14

03 Mar '14

Hi, I'm using dovecot-2.1.17 on fc18 and wondered if there is some mechanism, perhaps a database, that can store the logins/logouts for each user? I realize there's something already logged to syslog, but I'd like more of a history. While lastlog is great for users that actually login, my dovecot users don't login, just check email via pop and imap. Any ideas greatly appreciated. Thanks, Alex

3 5

[Dovecot] maildir quota divergence
by Juan Carlos Sanchez 03 Mar '14

03 Mar '14

Hello; We are using maildir quotas and have found differences in many users in respect to what system command are showing and doveadm quotas. For example, four user test, we have: doveadm quota get -u test Quota name Type Value Limit % STORAGE 98066 102400 95 MESSAGE 883 - 0 But if we check user mail_location with "du" system command we get he is using 70458 Kb. We are running dovecot 2.1.17 ¿any clue? Thanks in advance.

3 5

[Dovecot] running postlogin script result in libgcc_s.so.1 must be installed for pthread_cancel to work
by Kim Johansen 02 Mar '14

02 Mar '14

Hey, I try to run a postlogin script with: service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login /etc/dovecot/popafter.sh user = $default_internal_user unix_listener postlogin { } } In my popafter.sh I call a php script, and that result in: dovecot: postlogin: Error: libgcc_s.so.1 must be installed for pthread_cancel to work dovecot: postlogin: Error: Aborted (core dumped) I have tried google it, but cannot find a solution there works for me, anybody who can help me? mail dovecot $ sudo dovecot -n # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-59-generic x86_64 Ubuntu 12.04.4 LTS ext4 disable_plaintext_auth = no mail_location = maildir:/var/mail/vmail/%d/%n:INDEX=/var/mail/vmail/%d/%n/indexes mail_plugins = quota passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_exceeded_message = The user you are trying to reach is over quota. quota_rule = *:bytes=100M quota_rule2 = INBOX.Trash:storage=+20%% } protocols = " imap lmtp pop3" service imap { executable = imap postlogin } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login /etc/dovecot/popafter.sh user = $default_internal_user } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = prefetch } protocol imap { mail_plugins = quota imap_quota } Thanks, Kim

4 6

[Dovecot] No speed improvement with FTS for iOS 7?
by Nicholas Riley 02 Mar '14

02 Mar '14

Hi, I recompiled Dovecot with Lucene FTS to try to improve iOS 7 IMAP search speed. Unfortunately this does not seem to help. I have 60 mailboxes, totaling 300 MB; lucene-indexes is 30 MB in size. % doveadm mailbox status -t all '*' messages=16335 recent=0 unseen=1736 vsize=280049586 Searching for a single word which is present in two messages of one mailbox takes 40 seconds to return. This is true whether or not fts is enabled. doveadm search takes much less than 1 second to do the same search. % time doveadm search BODY cython d8f09230c97af952b60c0000c1443b93 1 d8f09230c97af952b60c0000c1443b93 2 doveadm search BODY cython 0.18s user 0.05s system 99% cpu 0.230 total With fts disabled, it takes about 6.5 seconds. This is still a long way from 40 seconds. Is there any way I can make dovecot perform better here? Thanks, -- Nicholas Riley <njriley(a)illinois.edu>

3 3