- dovecot - dovecot.org

[Dovecot] Dsync replication with LDAP and auth_bind=yes
by Michał Franczak 02 Mar '14

02 Mar '14

Hello, I have working dovecot configuration with LDAP based authentication in Active Directory. I'd like to use dsync replication but dovecot can't do user lookups. Is it possible to configure replication in such architecture? doveadm user '*' Returns only one local dovecot user. dovecot --version 2.2.10 My dovecot-ldap.conf look as follows: hosts = ad.domain.com:389 ldap_version = 3 auth_bind = yes dn = src_mail_ldap dnpass = somePass base = OU=users,DC=domain,DC=com scope = subtree deref = never user_filter = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_filter = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_attrs = userPassword=password default_pass_scheme = CRYPT user_attrs = =home=/var/vmail/vmail1/%Ld/%Ln/Maildir/,=mail=maildir:/var/vmail/vmail1/%Ld/%Ln/Maildir/ Best Regards -- Michal

1 0

[Dovecot] Pluggable mailstore
by Jesus Cea 02 Mar '14

02 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Reading the archives I see messages from a long (years) time ago discussing pluggable mailstores. No recent news, though. Any progress?. Current status? Regards - -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJTEruXAAoJEGjgN61Khv5D0hMIAK8fH6Qu+fvliQXjpTFutJ9r nw86mVM5OjPtNKw3O4/0/SfiM+/36rrT53rThbb/guDAIkNwt05NgfIbjdd74jRw 8U+CzoG/fVDe9jV2tzy5UThogVALKSxj1+EQrTk3PwepF68NZYb+s1ZDrfga7LKG F0+wt+XGTga4hIIkPGHoEDCQHX5Z2VpZwItsPXIta1Dv+ObeJtVcv11xL6raf3R2 0FFF1fj0OcKuGFBNH9cKiFTq5jvHb3QzK2205VDpsv5rnNnYZT9pbFHrtZ3Qk6O9 nxKSQVjRjf2pGMo9mjD/qxq/LUQFUVkJFdeueN/Z9KWeqm6MC/n16GCYBYgWpXU= =LrP4 -----END PGP SIGNATURE-----

1 0

[Dovecot] + prefix in dovecot-virtual
by Nicholas Riley 01 Mar '14

01 Mar '14

Hi, The "+" prefix in dovecot-virtual does not seem to be documented. only discovered it because I tried to include a mailbox whose name began with + and Dovecot gave me an error when I tried to copy to it. I see it was added here: http://hg.dovecot.org/dovecot-2.2/rev/be0f0de75e34 My dovecot-virtual file looked like this: !+/2014-03 +/2014-02 all I just added another + to the second line and it seems to work. I don't care about \Recent thankfully but is there a better way to specify a mailbox whose name begins with +? Thanks. -- Nicholas Riley <njriley(a)illinois.edu>

1 0

[Dovecot] Force SSL authentication per user basis
by Urban Loesch 28 Feb '14

28 Feb '14

Hi, I'm searching a way to force encrypted connections for POP3/IMAP on a per user basis. To not break clients which still connect in plaintext (there are still many of it) I must implement a mechanism to force encrypted connections on a per user basis. The users and passwords are stored in a mysql database. So there would be no problem to expand the database with a column like "ssl_tls" -> yes/no. The problem now: how can I get dovecot to process this field in the right way? I searched the list and googled about such a way, but I can't find any solution. My Dovecot version is 2.2.12. Many thanks and regards Urban Loesch

1 1

Re: [Dovecot] Logging authentication failures when Dovecot's auth service used to authenticate postfix smtpd
by MV 28 Feb '14

28 Feb '14

> in case of SASL postfix is talking via a unix socket so there is no connection IP dovecot knows about I don't not where Dovecot get the client IP from, but having auth socket in place, below is a redacted extract from my logs. As you can see Dovecot does know the client's IP. Dovecot config: auth_verbose = yes auth_debug = no # Dovecot log after submission/smtpd AUTH successful <nothing> # Dovecot log after submission/smtpd AUTH failure ... auth: Info: passwd-file(joe(a)example.com,46.z.z.z): Password mismatch Dovecot config: auth_verbose = yes auth_debug = yes # Dovecot log after submission/smtpd AUTH successful ... auth: Debug: client in: AUTH 1 PLAIN service=smtp nologin lip=212.x.x.x rip=46.z.z.z secured resp=<hidden> ... auth: Debug: passwd-file(joe(a)example.com,46.z.z.z): lookup: user=joe(a)example.com file=/etc/dovecot/virtual_users ... auth: Debug: client passdb out: OK 1 user=joe(a)example.com # Dovecot log after submission/smtpd AUTH failure ... auth: Debug: client in: AUTH 2 PLAIN service=smtp nologin lip=212.x.x.x rip=46.z.z.z secured resp=<hidden> ... auth: Info: plain(?,46.z.z.z): invalid input ... auth: Debug: client passdb out: FAIL 2 And regardless of Docecot config, postfix always logs the same stuff # Postfix log after submission/smtpd AUTH successful (QUIT after AUTH without sending RCPT TO) ... postfix/smtpd[5678]: connect from host.client.foo.tld[46.z.z.z] ... postfix/smtpd[5678]: disconnect from host.client.foo.tld[46.z.z.z] # Postfix log after submission/smtpd AUTH failure ... postfix/smtpd[1234]: connect from host.client.foo.tld[46.z.z.z] ... postfix/smtpd[1234]: warning: host.client.foo.tld[46.z.z.z]: SASL PLAIN authentication failed: ... postfix/smtpd[1234]: disconnect from host.client.foo.tld[46.z.z.z]

1 0

[Dovecot] Logging authentication failures when Dovecot's auth service used to authenticate postfix smtpd
by MV 28 Feb '14

28 Feb '14

Hello, tl;dr: Is there a way to get dovecot's auth to log failed smtp authentications without having to switch on "auth_verbose"? postfix version 2.11.0 and dovecot version 2.2.12 I'm currently migrating my postfix+courier to postfix+dovecot and so far it's working as expected. Except for logging smtp login failures. Despite Postfix logging successful authentications (see sample below), it doesn't log failed smtp logins. Feb 25 22:28:53 mailer2 postfix/submission[20274]: C981B20198: client=A-B-C-D.*****.net[A.B.C.D]:63107, sasl_method=PLAIN, sasl_username=joe(a)example.net And since my postfix setup authenticates virtual users through Dovecot's auth, I thought maybe dovecot could report smtp login failures the same way it reports imap and pop3 login failures. Below is a sample extracted from "info_log_path" after several imap and pop3 login failures. (Obviously the IP 255.... is made up and irrelevant for this mater). # begin extract "/var/log/dovecot-info.log" 2014-02-27 21:14:26 auth: Info: passwd-file(joe(a)example.net,255.255.255.255,<Y0lbzmnzfwAuQV80>): Password mismatch 2014-02-27 21:16:46 auth: Info: passwd-file(foobar,255.255.255.255,<Y0lbzmnzfwAuQV80>): unknown user 2014-02-27 21:52:00 auth: Info: passwd-file(foo(a)example.net,255.255.255.255,<0Su6VGrzGwAuQV80>): unknown user 2014-02-27 21:53:35 auth: Info: plain(?,255.255.255.255,<0Su6VGrzGwAuQV80>): Empty username 2014-02-27 21:53:55 auth: Info: plain(?,255.255.255.255,<0Su6VGrzGwAuQV80>): Username character disallowed by auth_username_chars: 0x5c (username: \0) 2014-02-27 22:08:05 auth: Info: plain(?,255.255.255.255): invalid input 2014-02-27 22:09:36 auth: Info: passwd-file(joe(a)example.net,255.255.255.255): Password mismatch 2014-02-27 22:09:53 auth: Info: login(?,255.255.255.255): Empty username # end extract I've tried adding "-L -o info_log_path=/var/log/dovecot-info.log" to the both auth and auth-worker services but that yield nothing. ----------------------%<-------------------------------- auth_mechanisms = plain login auth_verbose = yes base_dir = /var/run/dovecot/ info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/virtual_users driver = passwd-file } userdb { args = username_format=%u /etc/dovecot/virtual_users default_fields = uid=vmail gid=vmail driver = passwd-file override_fields = home=/home/vmail/%d/%u result_failure = return-fail result_internalfail = return-fail } service auth-worker { executable = auth -w -L -o info_log_path=/var/log/dovecot-info.log } service auth { executable = auth -L -o info_log_path=/var/log/dovecot-info.log unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix user = postfix mode = 0660 } } service lmtp { executable = lmtp -L -o info_log_path=/var/log/dovecot-info.log unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix user = postfix mode = 0660 } } ---------------------->%-------------------------------- The relevant postfix config is ... smtpd_sasl_type = dovecot smtpd_sasl_path = private/dovecot-auth virtual_transport = lmtp:unix:private/dovecot-lmtp

2 2

[Dovecot] Dovecot2 vs. AD, "Inactivity during authentication"
by Jeroen Scheerder 28 Feb '14

28 Feb '14

Hi, I'm trying to setup Dovecot2 for o IMAP client access o LDA for postfix mail delivery (with SIEVE) ... on a FreeBSD host. The FreeBSD server has no users (by intention), so I've set up a virtual mail domain, using LDAP lookups in Postfix. So far so good. Mail delivers into the proper mailbox. But I'm stuck getting Dovecot to authenticate. User- and passwd DB's are set up for LDAP lookups to AD, using an authenticated bind (the AD server offers no anonymous binds, yet). I've enabled all the debugging I can find, but my logs have little information to offer. Any help in getting me a step further would be much appreciated. In particular, I'd like to learn how do diagnose these userdb/passdb issues properly. Here's what I see in the logs: Feb 27 12:25:49 <mail.info> ponyboy dovecot: imap-login: Disconnected: Inactivity during authentication (disconnected while authenticating, waited 172 secs): user=<>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<r/ERi2HzQAB/AAAB> Feb 27 12:26:42 <mail.err> ponyboy dovecot: auth: Error: PLAIN(js,127.0.0.1,<r/ERi2HzQAB/AAAB>): Request 74099.1 timed out after 225 secs, state=1 This logging is related to the folloging IMAP session: ponyboy% telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login js suppressed * OK Waiting for authentication process to respond.. * BYE Disconnected for inactivity during authentication. Connection closed by foreign host. Here's my config: $ dovecot -n # 2.2.10: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-RELEASE amd64 ufs auth_debug = yes auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes first_valid_gid = 1000 first_valid_uid = 1000 imap_client_workarounds = delay-newmail last_valid_gid = 1000 last_valid_uid = 1000 mail_gid = 1000 mail_location = maildir:/var/mail/on2it/%Ln mail_uid = 1000 maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/on2it-ldap-users.cfg driver = ldap } protocols = imap service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } } shutdown_clients = no ssl = no userdb { args = /usr/local/etc/dovecot/on2it-ldap-users-userdb.cfg driver = ldap } valid_chroot_dirs = /var/mail/on2it $ cat /usr/local/etc/dovecot/on2it-ldap-users.cfg hosts = dc2.office.on2it.net ldap_version = 3 base = dc=office,dc=on2it,dc=net scope=subtree auth_bind = yes dn = [suppressed] dnpass = [suppressed] pass_attrs = sAMAccountName=user user_attrs = \ =home=/var/mail/on2it/%{ldap:sAMAccountName}, \ =mail=maildir:/var/mail/on2it/%{ldap:sAMAccountName} user_filter = (&(ObjectClass=person)(sAMAccountName=%u)) pass_filter = (&(ObjectClass=person)(sAMAccountName=%u)) iterate_attrs = sAMAccountName=user iterate_filter = (objectClass=person) $ ls -l /usr/local/etc/dovecot/on2it-ldap-users-userdb.cfg lrwxr-xr-x 1 root wheel 20 Feb 27 12:07 /usr/local/etc/dovecot/on2it-ldap-users-userdb.cfg -> on2it-ldap-users.cfg

3 5

Re: [Dovecot] Error "Initializing mail storage ..." after upgrading to 2.2.10
by Joseph Tam 28 Feb '14

28 Feb '14

G?tz Reinicke writes: > mail_location = mbox:~/:INBOX=/var/mail/%u > ... > Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, > list=yes, subscriptions=yes > location=mbox:~/:INBOX=/var/mail/rechnungseingang-animationsinstitut > Feb 27 17:02:11 imap(rechnungseingang-animationsinstitut): Error: user > rechnungseingang-animationsinstitut: Initialization failed: Namespace > '': Home directory not set for user. Can't expand ~/ for mail root dir > in: ~/:INBOX=/var/mail/rechnungseingang-animationsinstitut Hmm, I don't have a trialing '/' in my mail_location, so maybe you can try leaving it off too just to check. mbox:~:INBOX=/var/mail/%u Also, is your home directory well defined in your userdb? Check output of doveadm user rechnungseingang-animationsinstitut Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] Quota-Status issue
by Cyberonic Turbo 27 Feb '14

27 Feb '14

Following this guide: http://sys4.de/en/blog/2013/04/08/postfix-dovecot-mailbox-quota/ I can't seem to get it to work, as soon as I add the smtpd_recipient_restrictions setting to postfix I can no longer send mail at all. I get the message SMTP Error (450): Failed to add recipient "postmaster(a)example.com" (4.7.1 : Recipient address rejected: Internal error occurred. Refer to server log for more information.). I googled around and found this command to test the quota-status service: printf "recipient=postmaster at example.com\nsize=1234\n\n" | nc 127.0.0.1 12340 It seems to always return the quota_status_nouser message. I'm really stumped here. What logs do I need to check for errors and does anyone have any experience with this? I'm running Dovect 2.2.10 with Postfix 2.6.6 Here's my dovecot -n result: # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.5.1.el6.x86_64 x86_64 CentOS release 6.5 (Final) auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } first_valid_uid = 2000 last_valid_uid = 2000 listen = * log_path = /var/log/dovecot.log mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = quota mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-master-users-password driver = passwd-file master = yes } plugin { acl = vfile acl_shared_dict = proxy::acl auth_socket_path = /var/run/dovecot/auth-master autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk quota = dict:user::proxy::quotadict quota_grace = 10%% quota_rule = *:storage=1G quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = /%Lh/sieve/dovecot.sieve sieve_dir = /%Lh/sieve sieve_global_dir = /var/vmail/sieve sieve_global_path = /var/vmail/sieve/dovecot.sieve } protocols = pop3 imap sieve service auth { unix_listener /var/spool/postfix/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { process_limit = 500 service_count = 1 } service pop3-login { service_count = 1 } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/pki/tls/certs/iRedMail_CA.pem ssl_key = </etc/pki/tls/private/iRedMail.key userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/sieve.log mail_plugins = quota sieve autocreate postmaster_address = root } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota autocreate } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } For my postfix/main.cf I have this relevant setting: smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, check_policy_service inet:127.0.0.1:12340, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

2 2

Re: [Dovecot] Error "Initializing mail storage ..." after upgrading to 2.2.10
by Joseph Tam 27 Feb '14

27 Feb '14

G?tz Reinicke - IT Koordinator <goetz.reinicke(a)filmakademie.de> wrote: > But on one mailbox I do get an error: > > Error: user rechnnugseingang-animationsinstitut: Initialization failed: > Initializing mail storage from mail_location setting failed > > Error: Invalid user settings. Refer to server log for more information. And the server logs says ...? Maybe the '-' is not one of the allowed characters (is there a missing 'e' at the end?) Joseph Tam <jtam.home(a)gmail.com>

2 1

[Dovecot] dsync mirror to mailstores in director setup
by Murray Trainer 27 Feb '14

27 Feb '14

Hi All, I have dsync mirror command working between a standalone dovecot server and a backend mailstore in a Dovecot Director setup. Is it safe to do the dsync directly to the backend mailstore in this setup? It doesn't seem to work via the director proxy. Thanks Murray

1 0

Re: [Dovecot] Removing Mount Points
by Jeff Geiger 26 Feb '14

26 Feb '14

That's exactly where I pulled that information from. Are you saying that my assumption is correct and I can run that without ending the world as I know it? :) Thanks! Jeff Geiger jeff.geiger(a)firespring.com On Wed, Feb 26, 2014 at 1:03 AM, Steffen Kaiser < skdovecot(a)smail.inf.fh-brs.de> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > On Tue, 25 Feb 2014, Jeff Geiger wrote: > > dsync(sales(a)foo.com): Error: Couldn't create index dir >> /mnt/ssd/indexes/6/a/ >> sales(a)foo.com/mailboxes: Can't create mailbox root dir >> /mnt/ssd/indexes/6/a/ >> sales(a)foo.com/mailboxes: Mountpoint /mnt/ssd isn't mounted. Mount it or >> remove it with doveadm mount remove >> >> Would doing a `doveadm mount remove /mnt/ssd` fix my issue, or cause some >> type of catastrophe? >> > > ;-) http://wiki2.dovecot.org/Tools/Doveadm/Mount > > - -- Steffen Kaiser > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.11 (GNU/Linux) > > iQEVAwUBUw2R3XD1/YhP6VMHAQLoRQf+LBey9f2o1+MLRSgJB+Sptp0aC746kAz6 > 8cddo6qfNGMogQ7ilfflqCpm1YA/iD29d+8/TL10616cDKZ0Tb1a4M+w8pNnImUa > ViUSBlf59QA6k9b7dshB6f191NPmFT5/lHusDZJywDcS1kal+D/lIsOPToy+Hfon > zkEslqh3Gksjj60yYrBbOBw0a2lesy7eSYunBcabTfumwFHJofWSlWuvQdxfBXKW > IMQ4yzKL1bv+UgfnJpfo6qzReV++sKS9IehGEygqEU7gCE/jhRZyZIICfXRqQAnC > 0jrboJwtfDdY7BX7LrjhaFYtQNCgNF3VqTPnHbyH+eT2KhlLkgMMMA== > =xo3d > -----END PGP SIGNATURE----- >

2 1

[Dovecot] 2 users database on same LDAP with different mail location
by Francesco 26 Feb '14

26 Feb '14

Hello, i know i know, i'm getting annoying but appearently i always come up with weird ideas and i cant seem to accomplish such a task. the scenario is that i have an LDAP server with a bunch of users. some of them are in a specific OU, and i'd like to define for all these users belonging to this OU an alternative mail location/storage. in details for all the users i'd like to use maildir storage in a directory, while for the users belonging to a specific OU i'd like to use dbox with an alternative storage attached. so i created 2 userdb like this: userdb { driver = ldap args = /etc/dovecot/dovecot-ldap-maildir.conf.ext } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap-dbox.conf.ext } and then defined these 2 args files: maildir: hosts = localhost dn = CN=ldapadmin,OU=administrators,DC=plutone,DC=local dnpass = <password> auth_bind = yes ldap_version = 3 base = DC=plutone,DC=local user_attrs = sAMAccountName=home=/var/vmail/%$ dbox: hosts = localhost dn = CN=ldapadmin,OU=administrators,DC=plutone,DC=local dnpass = <password> auth_bind = yes ldap_version = 3 base = OU=dboxusers,OU=lowpriority,DC=plutone,DC=local user_attrs = sAMAccountName=home=/var/local_dbox/%$, =mail=dbox:/var/local_dbox/%$:ALT=/var/iscsi_dbox/%$ user_filter = (&(ObjectClass=person)(mail=%u)) yet it doesn't matter how hard i try if i send an email to a user belonging to the dboxusers OU i still have the user to be addressed to the maildir storage in /var/vmail am i missing something? Thanks Francesco

4 7

[Dovecot] Dovecot upgrade 1 to 2 on Debian Squeeze : broken /var/run/dovecot
by Si L 26 Feb '14

26 Feb '14

Hi, I just upgraded from version 1 to version on Debian Squeeze using their backports. Like I expected my dovecot1 config had to be converted using doveconf and this I did. However, I see problems with files inside directory: drwxr-xr-x 4 dovenull root 4096 Feb 25 20:35 /var/run/dovecot All of them were created owned by root:root rw. I tried to changed, for example : chown postfix:dovecot /var/run/dovecot/auth-master but noticed when I restarted dovecot it reset the permissions back to root:root rw. Here's the version: # dovecot --version 2.1.7 Here's my slightly redacted conf. # grep -v ^# dovecot.conf|grep -v ^$ auth_mechanisms = plain login auth_verbose = yes dict { quotadict = mysql:/etc/dovecot/dovecot-dict-quota.conf } disable_plaintext_auth = no first_valid_uid = 106 log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/var/xx/%d/%u/ mail_plugins = quota mail_privileged_group = mail maildir_very_dirty_syncs = yes passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } plugin { quota_rule = *:storage=262144:messages=20000 quota_rule2 = Trash:storage=282144:messages=23000 } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } user = root } service imap-login { chroot = login inet_listener imap { address = 127.0.0.1 port = 3993 } inet_listener imaps { address = * port = 993 } process_limit = 256 process_min_avail = 24 service_count = 1 vsz_limit = 48 M } service pop3-login { chroot = login process_limit = 256 process_min_avail = 24 service_count = 1 vsz_limit = 48 M } ssl = required ssl_ca = </etc/ssl/certs/xxx.combined_for_dovecot.pem ssl_cert = </etc/ssl/private/xx.xx.xx.crt ssl_cipher_list = TLSv1+HIGH:!SSLv2:RC4+MEDIUM:!aNULL:!eNULL:!3DES:@STRENGTH ssl_key = </etc/ssl/private/xx.xx.xx.key ssl_verify_client_cert = yes userdb { args = uid=5000 gid=5000 home=/var/xx/%d/%u allow_all_users=yes driver = static } userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } valid_chroot_dirs = /var/xx protocol imap { mail_max_userip_connections = 96 mail_plugins = quota imap_quota } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master log_path = mail_plugins = sieve quota postmaster_address = xxxx@xxxxx } I really don't understand how I should make this work, and the after I read the docs on dovecot.org and googled I realised I was really lost getting this back up and runing :( I should be really grateful if somebody would give me some advice. Thanks, Soph'

3 6

[Dovecot] Upgrading from 1.2.x -> 2.2.x in one step possible
by Götz Reinicke - IT Koordinator 26 Feb '14

26 Feb '14

Hi, after some off-ML discussions to and some reconsiderations, we might do the "big jump" from our current 1.2.17 to the atrpms 2.2. From googling and reading the dovecot upgrade wiki I don't see any (big) pitfalls. Basically we use the default config options, mbox, pop3s/imaps on RH EL 5. So "just" run the upgrade-config script, fingers crossed and thats it? Ii it possible to do such a big step form 1.2 to 2.2? Thanks for comments and suggestions . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 82 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

3 2

[Dovecot] Removing Mount Points
by Jeff Geiger 26 Feb '14

26 Feb '14

Dovecot version 2.1.7 If a dovecot mount point (drive) dies, and the data is restored into the same path that's no longer a mount point (subfolder), dovecot complains about a missing mount point. Is it safe to do a `doveadm mount remove {path}` to fix the error since it's no longer a legit mount point? Example: We were storing indexes on an SSD drive mounted at /mnt/ssd. That drive died. I was able to put everything back into the /mnt/ssd folder (no longer mounted, just a folder). Everything seems to be working as expected. But, when I just went to dsync an account from another server to this one, I got the following error: dsync(sales(a)foo.com): Error: Couldn't create index dir /mnt/ssd/indexes/6/a/ sales(a)foo.com/mailboxes: Can't create mailbox root dir /mnt/ssd/indexes/6/a/ sales(a)foo.com/mailboxes: Mountpoint /mnt/ssd isn't mounted. Mount it or remove it with doveadm mount remove Would doing a `doveadm mount remove /mnt/ssd` fix my issue, or cause some type of catastrophe? Thanks, Jeff Geiger jeff.geiger(a)firespring.com

2 1

[Dovecot] Auto-response
by Si L 26 Feb '14

26 Feb '14

Dear Sir, Thank-you for your message. I shall not be reading Yahoo Mail for quite some time. You should presume that your message remains unloved and unread. ** If you know who I am (in other words you are not a Bulk Emailer), then you already know how to contact me either on my _normal_ EMail address, or on the telephone. Yours faithfully.

1 0

Re: [Dovecot] AUTH_USER variable has invalid value in checkpassword Script
by dovecot.pkoch＠dfgh.net 26 Feb '14

26 Feb '14

answering my own questions: > This has somehow changed and now AUTH_USER always > contains the username. This has fatal consequences as no > every owner of a valid certificate can logon as any user. I now use auth_ssl_username_from_cert = yes and this temporarily fixes my problem. Now if user A authenticates with his certificate and claims to be user B he will be logged on as user A. With ssl_username_from_cert = no (default) he was logged in as User B. > I'm absolutely sure that the value of the x500UniqueIdentifier > was stored into the AUTH_USER when I tested my setup > last year. If one looks at the source code, in particular routine env_put_auth_vars() in src/auth/db-checkpassword.c and routine auth_request_get_var_expand_table() in src/auth/auth-request.c it is clear, that this has never worked. The environemnt variable AUTH_USER always contais the username (in all Dovecot versions). It dows NOT contain the Dovecot auth_user-variable. Comparing AUTH_USER with the username makes no sense in a checkpassword-script So here's my next question: How do I find out the original username from within a chackpassword script after it has been replaced by the x500UniqueIdentifier value from a client certificate? Why is request->requested_login_user == NULL in env_put_auth_vars(). request->user contains the x500UniqueIdentifier value from the clients certificate so the original username was replaced and therefore should have been moved into request->requested_login_user. Kind regards Peter Koch

1 0

[Dovecot] Oldies but Goldies - Dovecot 1.2 and Sieve
by Götz Reinicke - IT Koordinator 25 Feb '14

25 Feb '14

Hi, we still run dovecot 1.2.17 and upgrading is not planed for some time. But I'm asked to install a sieve system to be used with SOGo soon. What do I have to install / configure? Is installing/configuring the dovecot-sieve-0.1.19 and dovecot-managesieve-0.11.13 enough? We still use mostly the default settings for imaps/pop3s. And of course configure SOGo. Thanks for any feedback. Regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 82 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

4 3

Re: [Dovecot] Error - zlib & fts
by Daniel L. Miller 25 Feb '14

25 Feb '14

On 2/25/2014 10:50 AM, Daniel L. Miller wrote: > Just upgraded to a new Solr, so I did a full re-index. Saw some of > these friendly messages: > > doveadm(csmith(a)amfes.com): Error: > zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): gz trailer > has wrong CRC value at 28579617 > doveadm(csmith(a)amfes.com): Error: > read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: > Invalid argument > doveadm(csmith(a)amfes.com): Error: > read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: > Invalid argument (uid=5251) > Also some of these: doveadm(csmith(a)amfes.com): Error: zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): missing gz header at 27877205 Running 2.2.12. -- Daniel

1 0

[Dovecot] Error - zlib & fts
by Daniel L. Miller 25 Feb '14

25 Feb '14

Just upgraded to a new Solr, so I did a full re-index. Saw some of these friendly messages: doveadm(csmith(a)amfes.com): Error: zlib.read(/var/mail/amfes.com/csmith/mdbox/storage/m.20): gz trailer has wrong CRC value at 28579617 doveadm(csmith(a)amfes.com): Error: read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: Invalid argument doveadm(csmith(a)amfes.com): Error: read(zlib(/var/mail/amfes.com/csmith/mdbox/storage/m.20)) failed: Invalid argument (uid=5251) -- Daniel

1 0

[Dovecot] AUTH_USER variable has invalid value in checkpassword Script
by dovecot.pkoch＠dfgh.net 25 Feb '14

25 Feb '14

Dear dovecot experts: We are using client certificates to authenthicate against a Dovecot server. Our certificates contain a x500UniqueIdentifier. I'm absolutely sure that the value of the x500UniqueIdentifier was stored into the AUTH_USER when I tested my setup last year. This has somehow changed and now AUTH_USER always contains the username. This has fatal consequences as now every owner of a valid certificate can logon as any user. Here are some more details of our setup: We are using a checkpassword-Script that does the following: 1. Read Username and Password from file descriptor 3 2. If (AUTH_CERT=="valid") and (AUTH_USER==Username) then user is authenticated 3 If (AUTH_CERT=="valid") and (AUTH_USER<>Username) then authentication is rejected (User a tries to logon as User B) 4 If (AUTH_CERT<>"valid) we calculate the current OATH value for Usernames TOTP-token and compare that with the provided password. The last step is the reason why we are using a checkpassword script. Our smartphone users cannot use a smartcard but enter a password that was created by an OTP generator, so programming my own checkpassword script was my only option. AUTH_USER contains the username even if the x500UniqueIdentifier from the users certificate does not, so step 2 happens when step 3 should happen. I did the initial testing with Dovecot 2.2.6. At that time we were using both port 143 and 993. We now use Dovecot 2.2.7 and port 993 only. This should not make a difference but I will recompile 2.2.6 right after sending this posting. Kind regards and thank you very much for this wonderful IMAP server Peter Koch current dovecot.conf: --------------------------------------------------------- # Dovecot configuration file default_process_limit = 2048 protocols = imap listen = * base_dir = /var/dovecot/ mail_location = maildir:/mail/%u:LAYOUT=fs ssl_cert = </etc/ssl/certs/imap.crt ssl_key = </etc/ssl/private/imap.key ssl_ca = </etc/ssl/certs/imap-ca.crt ssl_verify_client_cert = yes ssl_cert_username_field = x500UniqueIdentifier service imap-login { inet_listener imap { port = 0 } } service auth { client_limit = 4096 } service anvil { client_limit = 5000 } passdb { driver = checkpassword args = /usr/dovecot/bin/checkpassword } userdb { driver = passwd override_fields = home=/mail/%u } protocol imap { mail_max_userip_connections = 1000 }

1 0

[Dovecot] A question regarding doveadm replicator status
by XarHs 25 Feb '14

25 Feb '14

Hello, I am using Dovecot version 2.2.10. I am quite familiar with ssh replication and I managed to set it up correctly. The only problem I see is that when i run the command: doveadm replicator status I get a wrong "Total number of known users" which is a) is different between the two (2) replicated dovecot servers, i.e. in mail1 I get a total of 21 users and in mail2 I get a total of 20 users (it should be the same, correct?) b) is not matching the total number of users I have in each server (mail1, mail2) which I am also getting when counting the total users with "doveadm" service enabled. (the command doveadm user '*' | wc lists a total of 16 users for both mail1, mail2 servers, which is also the total number of users that exist indeed in the LDAP structure with the doveadm service enabled. Is there any way to reset the value of "Total number of known users"? Do I have to delete a file in /var/run/dovecot or something in order to do it? The only way I tried (not successfully though) to reset it is by executing the command: for i in `doveadm user '*'` ;do doveadm replicator remove $i ; done which does empties all existing users (16), but leaves me with Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 5 in mail1 server and Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 4 in mail2 server, i.e. the value is 5 (21-16) for mail1 and 4 (20-16) for mail2 server. After seeing that I tried to restart dovecot service, which again ended in the following numbers: Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 21 in mail1 server and Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 20 in mail2 server thus their values augmented back to +16, meaning dovecot read succesfully my 16 users. I have not found a way to successfully reset the "Total number of known users" numbers back to the valid 16 users, which is also returned by running the command: doveadm user '*' | wc Why do I have those differences? How is the "Total number of known users" being calculated? What should I do to effectively reset to to the normal value (which in my case is 16)? Thanks in advance.

1 1

[Dovecot] tests with metadata module
by Mihai Badici 25 Feb '14

25 Feb '14

--Repost after subscription as list member --- I made some tests with metadata support in dovecot 2.2.10. Previously I had dovecot 2.2.4 with external metadata plugin who work well. I use dovecot with roundcube and roundcube plugins from kolab project . First, the feature activation was tricky and rather undocumented. I spent about half hour googling, after that I set: imap_metadata = yes and mail_attribute_dict = file:%h/shared_metadata I think you cold put those lines in the 20-imap.conf example file commented; that way will be easy for us to activate. Because I changed the location of shared_metadata, all folders was unannotated . I went in folder manager in roundcube and set folder "calendar" as calendar type and so on. That worked and i have: cat shared_metadata: shared/c4268a04da44bb527c5b0000193e0904/vendor/kolab/folder-type event shared/cd5792367fc9cd5196170000193e0904/vendor/kolab/folder-type event shared/33f55d2e8912195209290000193e0904/vendor/kolab/folder-type event shared/32f55d2e8912195209290000193e0904/vendor/kolab/folder-type contact However, it looks like the metadata is not properly read after. Calendar and Contacts folders don't appear in roundcube. I have this crash in dovecot's log: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x67d81) [0xb7625d81] -> /usr/lib/dovecot/libdovecot.so.0(+0x67e11) [0xb7625e11] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0xb75d6af9] -> dovecot/imap() [0x805d3b2] -> dovecot/imap() [0x805d5bc] -> dovecot/imap() [0x805d6c9] -> dovecot/imap(client_handle_input+0x56) [0x805d836] -> dovecot/imap(client_input+0x72) [0x805dcc2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x38) [0xb7638d98] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x10e) [0xb7639d6e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x48) [0xb7638818] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x28) [0xb75dcb68] -> dovecot/imap(main+0x284) [0x8050f34] -> /lib/libc.so.6(__libc_start_main+0xf5) [0xb743f5a5] -> dovecot/imap() [0x80510a5] Dec 26 09:28:49 imap(mihai.badici): Fatal: master: service(imap): child 4919 killed with signal 6 (core dumps disabled) I logged imap sessions in roundcube and I have: A0003 GETMETADATA "*" (/private/vendor/kolab/folder-type /shared/vendor/kolab/folder-type) On a similar server with the "old" metadata plugin, I have here listed all folders with coresponding annotations. How I can debug further? This is a test server so I can stress it. -- Mihai Bădici http://mihai.badici.ro -----------------------------------------

3 6

[Dovecot] Detail improvement: %c variable
by Hadmut Danisch 25 Feb '14

25 Feb '14

Hi, although dovecot is great and almost exactly solving my problems and fitting my requirements, there is an odd detail that causes me problems: The %c variable. (See http://wiki2.dovecot.org/Variables ) I'm managing an IMAP server for an association, which is connected to an LDAP server. Users can connect in three ways: IMAPS from the internet, IMAP from local acccounts, and IMAP through a Web->IMAP interface, which is protected through additional one-time-passwords. The web gateway is intended to be used from untrusted computers as well, so the IMAP password entered through the Web site must not be the same as the password used on IMAPS. I have solved this problem by using %s%c as part of the LDAP user_filter. When people connect over IMAPS, this becomes imapsecured (%s=imap, %c=secured), while an unencrypted connect becomes imap (%s=imap, %c=) Unfortunately, this works only, if the web interface and the IMAP server are located on different (virtual) machines. But if the web gateway and dovecot are no the /same/ machine, this does not work anymore, since %c becomes "secured" on localhost, even if unencrypted. It causes a lot of trouble and headache. Please add a configuration variable to configure, whether %c should become "secured" for unencrypted traffic on the loopback device (localhost). regards Hadmut

5 9