- dovecot - dovecot.org

[Dovecot] read only users's mailboxes
by Frank Bonnet 22 May '13

22 May '13

Hello for internal purpose I need to put some users's mailboxes in readonly mode during few days. We use MBOX format and UNIX user mode on a FreeBSD 9.1 box I tried to read-only mount the partition but dovecot does not work this way Any infos welcome

2 2

[Dovecot] Dovecot 2.2.1 LDA and sieve (lack of) errors
by Jim McNamara 22 May '13

22 May '13

Hello again, all. Of course after posting yesterday that all was well with my setup, turns out all is not well. The problem I'm having is with dovecot-lda functioning and making deliveries to my mailbox, but the sieve scripts don't seem to have any effect. Attempts at logging what is/isn't happening have been total failures. Managesieve seems to work fine, port 4190 is open on the server and it allows the tunderbird plugin to function, I can create and edit scripts with the plugin. For some reason it doesn't seem to auto-compile the scripts to binary form, but if I just need to do that manually I can live with it. I only mention the lack of auto-compiling in case that sheds light on what is wrong with the LDA or sieve. I'm running the current dovecot, 2.2.1 along with pigeonhole 0.4.0. Here is the config: root@hostname:/usr/local/dovecot-2.2.1# doveconf -n # 2.2.1: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.0 auth_cache_size = 10 M auth_default_realm = mail.domain.com auth_mechanisms = plain login auth_socket_path = /usr/local/var/run/dovecot/auth-userdb debug_log_path = /dev/stderr default_internal_user = vpopmail default_login_user = vpopmail first_valid_gid = 89 first_valid_uid = 89 hostname = mail.domain.com last_valid_gid = 89 last_valid_uid = 89 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes log_path = /dev/stderr mail_access_groups = 89 mail_debug = yes mail_gid = 89 mail_location = maildir:%h/Maildir mail_plugins = " quota" mail_privileged_group = 89 mail_uid = 89 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave spamtest spamtestplus vnd.dovecot.debug namespace inbox { inbox = yes location = prefix = separator = . } passdb { driver = vpopmail } plugin { quota = maildir:User quota quota_rule = *:storage=2G quota_warning = storage=95%% quota-warning 95 %u sieve = ~/.sieve/dovecot.sieve sieve_dir = ~/.sieve sieve_extensions = +spamtest +spamtestplus +relational +comparator-i;ascii-numeric +vnd.dovecot.debug } postmaster_address = postmaster(a)mail.domain.com protocols = imap pop3 lmtp sieve sendmail_path = /var/qmail/bin/sendmail service auth-worker { user = $default_internal_user } service auth { unix_listener auth-userdb { group = vchkpw mode = 0600 user = vpopmail } user = $default_internal_user } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 64 M } ssl = required ssl_cert = </var/qmail/control/servercert.pem ssl_key = </var/qmail/control/servercert.priv userdb { args = quota_template=quota_rule=*:backend=%q driver = vpopmail } protocol lda { info_log_path = /dev/stderr log_path = /dev/stderr mail_plugins = " quota sieve" } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { mail_plugins = " quota quota" } I've set the lda specific logs to /dev/stderr because I'm running dovecot through daemontools, and that is what it logs. Daemontools redirects /dev/stderr to /var/log/qmail/qmail-dovecot/current. I had tried logging to /var/log/dovecot/lda.log, that file exists, the directory is 775 dovecot:dovecot, but the file size remained 0. Very little appears in the dovecot logs with lda - root@hostname:/home/vpopmail/domains/domain.com/jim/.sieve# grep lda /var/log/qmail/qmail-dovecot/current |tai64nlocal 2013-05-16 11:05:49.432026500 May 16 11:05:49 auth: Debug: master in: USER 1jim(a)domain.com service=lda 2013-05-16 11:29:32.386361500 May 16 11:29:32 auth: Debug: master in: USER 1jim(a)domain.com service=lda 2013-05-16 11:54:03.145741500 May 16 11:54:03 auth: Debug: master in: USER 1jim(a)domain.com service=lda 2013-05-16 12:33:40.274543500 May 16 12:33:40 auth: Debug: master in: USER 1jim(a)domain.com service=lda 2013-05-16 12:47:07.202036500 May 16 12:47:07 auth: Debug: master in: USER 1jim(a)domain.com service=lda 2013-05-16 13:40:44.548948500 May 16 13:40:44 auth: Debug: master in: USER 1jim(a)domain.com service=lda 2013-05-17 11:50:31.073410500 May 17 11:50:31 auth: Debug: master in: USER 1jim(a)domain.com service=lda The sieve issue is as follows: I have a very simple sieve script. the managaesieve utility accepts the script, here is the contents of the $HOME/.sieve directory: root@hostname:/home/vpopmail/domains/domain.com/jim/.sieve# ls -al total 20 drwx------ 3 vpopmail vchkpw 4096 May 18 02:24 . drwx------ 5 vpopmail vchkpw 4096 May 18 09:39 .. lrwxrwxrwx 1 vpopmail vchkpw 16 May 18 02:22 dovecot.sieve -> night-test.sieve -rw------- 1 vpopmail vchkpw 303 May 18 02:22 dovecot.svbin -rw------- 1 vpopmail vchkpw 315 May 18 02:24 night-test.sieve drwx------ 2 vpopmail vchkpw 4096 May 18 02:24 tmp The contents of dovecot.sieve itself are: root@hostname:/home/vpopmail/domains/domain.com/jim/.sieve# cat dovecot.sieve # # 2013-5-17 # require ["fileinto", "envelope", "vnd.dovecot.debug"]; if header :contains ["from"] "sub1.domain.com" { debug_log "match happened and syntax changed for testing purposes"; fileinto "INBOX.folder2"; } else { debug_log "can't catch a cold when wet snowy and cold"; keep; } The compile of the script works fine as user vpopmail: vpopmail@hostname:~/domains/domain.com/jim/.sieve$ sievec dovecot.sieve /tmp/dovecot.svbin sievec(vpopmail): Debug: Loading modules from directory: /usr/local/lib/dovecot sievec(vpopmail): Debug: Module loaded: /usr/local/lib/dovecot/lib10_quota_plugin.so sievec(vpopmail): Debug: Effective uid=89, gid=89, home=/home/vpopmail sievec(vpopmail): Debug: Quota root: name=User quota backend=maildir args= sievec(vpopmail): Debug: Quota rule: root=User quota mailbox=* bytes=2147483648 messages=0 sievec(vpopmail): Debug: Quota warning: bytes=2040109465 (95%) messages=0 reverse=no command=quota-warning 95 vpopmail sievec(vpopmail): Debug: Quota grace: root=User quota bytes=214748364 (10%) A diff between dovecot.svbin and /tmp/dovecot.svbin shows no difference. Neither of the debug lines show up anywhere in the logs. When I send an email from sub1.domain.com to this server, it ends up in the main inbox rather than INBOX.folder2. Interestingly, if I run sieve-test on the mail, it tells me it should have been moved to INBOX.folder2: vpopmail@hostname:~/domains/domain.com/jim/Maildir/cur$ sieve-test ../../.sieve/dovecot.sieve 1368888104.11471.hostname\,S\=1235\:2\,a sieve-test(vpopmail): Debug: Loading modules from directory: /usr/local/lib/dovecot sieve-test(vpopmail): Debug: Module loaded: /usr/local/lib/dovecot/lib10_quota_plugin.so sieve-test(vpopmail): Debug: Effective uid=89, gid=89, home=/home/vpopmail sieve-test(vpopmail): Debug: Quota root: name=User quota backend=maildir args= sieve-test(vpopmail): Debug: Quota rule: root=User quota mailbox=* bytes=2147483648 messages=0 sieve-test(vpopmail): Debug: Quota warning: bytes=2040109465 (95%) messages=0 reverse=no command=quota-warning 95 vpopmail sieve-test(vpopmail): Debug: Quota grace: root=User quota bytes=214748364 (10%) sieve-test(vpopmail): Debug: Quota root: name=User quota backend=maildir args= sieve-test(vpopmail): Debug: Quota rule: root=User quota mailbox=* bytes=2147483648 messages=0 sieve-test(vpopmail): Debug: Quota warning: bytes=2040109465 (95%) messages=0 reverse=no command=quota-warning 95 raw mail user sieve-test(vpopmail): Debug: Quota grace: root=User quota bytes=214748364 (10%) sieve-test(vpopmail): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= dovecot: line 6: info: DEBUG: match happened and syntax changed for testing purposes. Performed actions: * store message in folder: INBOX.folder2 Implicit keep: (none) sieve-test(vpopmail): Info: final result: success And yes, INBOX.folder exists: vpopmail@hostname:~/domains/domain.com/jim/Maildir/cur$ ls -al ../.INBOX.folder2/ total 28 drwx------ 5 vpopmail vchkpw 4096 May 14 10:33 . drwx------ 15 vpopmail vchkpw 4096 May 18 10:42 .. drwx------ 2 vpopmail vchkpw 4096 May 14 10:20 cur -rw------- 1 vpopmail vchkpw 232 May 17 08:07 dovecot.index.log -rw------- 1 vpopmail vchkpw 17 May 14 10:33 dovecot-uidlist -rw------- 1 vpopmail vchkpw 0 May 14 10:20 maildirfolder drwx------ 2 vpopmail vchkpw 4096 May 14 10:20 new drwx------ 2 vpopmail vchkpw 4096 May 14 10:20 tmp Here's the file that calls dovecot-lda for user jim: vpopmail@hostname:~/domains/domain.com/jim$ cat .qmail-default |/var/qmail/bin/preline -f /usr/local/libexec/dovecot/dovecot-lda -d $EXT@$USER Both /var/qmail/bin/preline and /usr/local/libexec/dovecot/dovecot-lda exist. Any idea why my sieve doesn't seem to take effect? Thanks for reading.

2 3

Re: [Dovecot] Outlook 2013 - mounting folders with XLIST
by Hajo Locke 21 May '13

21 May '13

Hello, >> i do some tests with dovecot 2.1.7 and activated a default special-use >> config. To get it work with outlook 2013, i also added XLIST to imap >> capability string. basically this is working. >> >> is somebody also using special-use folders successful with outlook 2013? > yes, testet a few times, works fine, without Junk folder , cause > outlook wants this handled by it own, but i ve seen reg patches to > change this My serverside setup now is completed. I did a lot of tests last weeks and experienced some strange behaviour of some clients. Outlook 2013 is only working when adding XLIST manually to imap_capability imap_capability = +XLIST This is because outlook 2013 not supports rfc 6154 but the deprecated XLIST standard invented by google. So the problem with junkfolder is not a bug in Outlook 2013, in rfc 6154 spamfolder is tagged by \Junk, in XLIST standard \Spam is used. I did see that when using a gmailaccount in outlook 2013. Adding XLIST capability to dovecot seems to be a problem for other Clients. k9 is able to work with rfc 6154 servers. But if k9 finds XLIST and SPECIAL-USE together in capabilitystring it seems to prefer XLIST requests. Because of dovecot is accepting XLIST requests, but outputs rfc 6154 details, k9 seems to be confused and dont finds special Folders. rfc 6154 is similar but not identical to XLIST. If you dont test with really individual foldernames, you get tricked by clients behaviour. I looked around and the most imap-servers of hosting companies etc. provide XLIST feature, Special-USE unfortunately only a few. So i did now some changes to dovecot sources on my own. I added \Spam as allowed special-use attribute and created a new function for XLIST Requests. So if XLIST is requested, Clients gets lines of output with XLIST and \Junk is replaced with \Spam. So all is done in the code and i dont need to change my userdb-config. Testing this server with different clients was successful. All of them did find their special folders and worked fine, outlook 2013 also finds spamfolder now. So this changes contribute to consolidate a deprecated standard but i have to find a way where all users can benefit from new features. This is not a request to change something in dovecot, this is a call to decision makers to support one rfc Standard. Hajo

1 0

[Dovecot] Configure dovecot to provide SASL authentication
by Peter Skensved 21 May '13

21 May '13

Hi, I'm trying to get dovecot to provide SASL authentication for postfix My setup appears to be working but I'm not 100% certain I've got it right. I've come across several examples for dovecot version 1 but I'm running 2.0.9. The output of doveconf -n is here : 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-279.2.1.el6.x86_64 x86_64 CentOS release 6.3 (Final) auth_debug = yes auth_verbose = yes disable_plaintext_auth = no mbox_write_locks = fcntl passdb { driver = pam } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } Specifically : are the "service auth", userdb and passdb sections correct ? And the mode ? Or is it too permissive ? For completeness the postfix setup is here : smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous # smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit # smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit # smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, permit # peter ---- Peter Skensved Dept. of Physics, Queen's University, Kingston, Ontario, Canada

3 2

[Dovecot] How to configure ssl cert chain in dovecot 10-ssl.conf file
by Bu Xiaobing 21 May '13

21 May '13

Hi there, Does anyone know how to do this: "Put all the certificates in the ssl_cert file. For example when using a certificate signed by TDC the correct order is: Dovecot's public certificate TDC SSL Server CA TDC Internet Root CA Globalsign Partners CA " I try to set these parameters in the conf.d/10-ssl.conf as below, but it seems doesn't work. --- ssl_cert = </etc/pki/dovecot/certs/mail.mymailserver.com.crt ssl_cert = </etc/ssl/certs/dovecot/sub.class1.server.ca.pem ssl_cert = </etc/ssl/certs/dovecot/ca.pem ---- I even cat mail.mymailserver.com.crt sub.class1.server.ca.pem certs/dovecot/ca.pem into one singe file, and define ssl_cert = < /path/to/the/singcertfile.pem, but it doesn't work too. In my apache httpd server httpd.conf file I can define: -- SSLCertificateChainFile /etc/pki/dovecot/certs/sub.class1.server.ca.pem SSLCACertificateFile /etc/pki/dovecot/certs/ca.pem -- And it well work fine. Thinks for any suggest. Bu Xiaobing

2 3

[Dovecot] Pigeonhole: extprograms - pipe
by Anes Mukhametov 20 May '13

20 May '13

Hello! I've tried to use extprograms pipe feature but stuck with "Broken pipe" errors in mail log: May 17 15:18:57 backend1 dovecot: lmtp(20338, user(a)domain.tld) Debug: 3VMVFWFKllFyTwAArRg8UA: sieve: action pipe: running program: learn May 17 15:18:57 backend1 dovecot: script: Error: write(response) failed: Broken pipe May 17 15:18:57 backend1 dovecot: lmtp(20338, user(a)domain.tld) 3VMVFWFKllFyTwAArRg8UA: sieve: execution of script /data/mail/storage/domain/user(a)domain.tld/.dovecot.sieve;name=main script failed, but implicit keep was successful (user logfile /data/mail/storage/domain/buser(a)domain.tld/.dovecot.sieve.log should reveal additional details) /data/mail/storage/domain/buser(a)domain.tld/.dovecot.sieve.log: error: msgid=<c7cd36f19be8164addf091a646b8b284(a)domain.tld>: pipe action: failed to pipe message to program `learn': refer to server log for more information. [2013-05-17 15:18:57] ham user(a)domain.tld 50796. Sieve script contents: require ["fileinto","copy","mailbox","vnd.dovecot.pipe"]; if anyof (header :is "Subject" "ham") { pipe :try "learn" ["ham"]; fileinto "INBOX/ham"; stop; } Sieve plugin config uncommented conents: sieve_plugins = sieve_extprograms *sieve_pipe_socket_dir = sieve-pipe* # Define the executed script as parameter to the sieve service executable = script /etc/dovecot/scripts/spam.sh # Use some unprivileged user for executing the program user = nobody # The unix socket located in the sieve_pipe_socket_dir (as defined in the # plugin {} section above) unix_listener sieve-pipe/learn { # LDA/LMTP must have access user = nobody mode = 0777 } } spam.sh is message processing script which interacts with spamassassin. I've tested pipe with spam.sh that redirects stdin to /dev/null and returns 0 but errors were logged anyway. Note that spam.sh runs, getting the message from sieve and processing it to spamassassin without a problem, but "broken pipe" is being logged.

3 4

Re: [Dovecot] Configure dovecot to provide SASL
by Peter Skensved 20 May '13

20 May '13

> > > Am 19.05.2013 17:51, schrieb Peter Skensved: > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > mode = 0666 > > } > > chmod 666 is always a very bad idea > > > service auth { > unix_listener /var/spool/postfix/private/auth { > mode = 0660 > user = postfix > group = postfix > } > } > Thanks for the reply - - all the other sockets in /var/spool/postfix/private have mode 666 ( and the directory itself mode 700 ) but that is probably a question for the postfix list.... peter

1 0

[Dovecot] v2.2.2 + dsync version incompatibility
by Timo Sirainen 20 May '13

20 May '13

Looks like dsync v2.2.2 isn't fully compatible with earlier dsync versions, unless you add: http://hg.dovecot.org/dovecot-2.2/rev/e0156c479a12

1 0

[Dovecot] Linking mdbox directories
by Alex Crow 20 May '13

20 May '13

Hi Timo/list, We have a scenario in which some email accounts on dovecot (stored in mdbox, separate paths for indexes, email, ALT storage and also using SIS for attachments, LDAP directory) need their names changed. I know we could just change the mail LDAP attribute (and leave mailMessageStore alone) so they keep the same directories on disk, but this would throw a spanner in the works for our backups. Would it be possible to create a hard link of the user's directories under the new name, and change the LDAP mailMessageStore attribute to point to these without stopping and starting dovecot? And after a while unlink the original locations? Or would this mess up dovecot's internal state? Thanks Alex -- This message is intended only for the addressee and may contain confidential information. Unless you are that person, you may not disclose its contents or use it in any way and are requested to delete the message along with any attachments and notify us immediately. "Transact" is operated by Integrated Financial Arrangements plc. 29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608 5300. (Registered office: as above; Registered in England and Wales under number: 3727592). Authorised and regulated by the Financial Conduct Authority (entered on the Financial Services Register; no. 190856).

2 2

[Dovecot] doveadm altmove to gzipped-mdbox
by Claus 20 May '13

20 May '13

Hi, im wondering if it's possible to store old messages in a compressed mdbox on alternate storage. The main storage is uncompressed mdbox. I tried something like: doveadm -Dv -o "plugin/zlib_save=gz" altmove -u testuser sentbefore 8d Could someone tell me if it's possible and give me a hint how this can be done? I tried this with dovecot-2.2 Claus

2 2

[Dovecot] Empty file in maildirs
by Roel Wagenaar 20 May '13

20 May '13

I am cleaning up some old users, and found that in every maildir folder there is an empty file called maildirfolder, created at the time the original dovecot was installed. Is this empty file necessary for dovecot, or is it left there in an upgrade proces and can it be removed? Dovecot 2.1.7, on Debian wheezy. -- Roel Wagenaar, Linux-User #469851 with the Linux Counter; http://linuxcounter.net/ Antw.: Omdat het de volgorde verstoord waarin mensen tekst lezen. Vraag: Waarom is top-posting een slechte gewoonte? Antw.: Top-posting. Vraag: Wat is het meest ergerlijke in e-mail? If we aren't supposed to eat amimals, why are they made with meat?

2 1

[Dovecot] v2.2.2 released
by Timo Sirainen 20 May '13

20 May '13

http://dovecot.org/releases/2.2/dovecot-2.2.2.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.2.tar.gz.sig It's been a while since v2.2.1. I think all of the bad bugs in v2.2 series should be fixed by now, so here's a new release. I think there are still some small URLAUTH bugs left though, so you might want to wait before enabling it in production (imap_urlauth_host is empty by default, which disables it). + zlib: Keep the last mail cached uncompressed in a temp file. This fixes performance when doing small partial fetches from a large mail. + acl: If plugin { acl_defaults_from_inbox = yes } is set, get the default ACLs for private and shared namespaces from the user's INBOX. (This probably will become default in v2.3.) + pop3: Added pop3_deleted_flag setting to switch POP3 deletions to only hide the messages from POP3, but still be visible via IMAP. - ACL plugin: Mailbox creation wasn't actually checking any ACLs and always succeeded (due to some v2.2 API changes). The created mailbox couldn't have been accessed though, so this couldn't have caused any data leak. - IMAP: Various URLAUTH fixes. - IMAP: Fixed a hang with invalid APPEND parameters. - IMAP LIST-EXTENDED: INBOX was never listed with \Subscribed flag. - mailbox_list_index=yes still caused crashes. - maildir: Fixed a crash after dovecot-keywords file was re-read. - maildir: If files had reappeared unexpectedly to a Maildir, they were ignored until index files were deleted. - Maildir: Fixed handling over 26 keywords in a mailbox. - Maildir++: Fixed mail_shared_explicit_inbox=no - namespace { prefix="" list=no } was listing mailboxes. - imap/pop3-login proxying: Fixed a crash if TCP connection succeeded, but the remote login timed out. - Case-insensitive search/sort didn't work correctly for all unicode characters, as specified by i;unicode-casemap comparator. If full text search indexes were used, they need to be rebuilt for old mails to be handled correctly. (This bug has existed always in Dovecot.)

2 3

[Dovecot] Sieve was installed but doesn't work or log
by Jim McNamara 18 May '13

18 May '13

Hello everyone. I have dovecot version 1.2.8 installed from source. This morning I installed the sieve plugin to sort emails, and though the install reported no errors, the plugin doesn't seem to function, and no mention of it is made in the logs when I turn on verbose logging. dovecot --version 1.2.8 dovecot -n # 1.2.8: /usr/local/etc/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.0 base_dir: /usr/local/var/run/dovecot/ log_path: /dev/stderr info_log_path: /dev/stderr log_timestamp: protocols: imap imaps pop3s listen(default): 127.0.0.1:143 listen(imap): 127.0.0.1:143 listen(pop3): * ssl_listen(default): 192.168.1.1:993 ssl_listen(imap): 192.168.1.1:993 ssl_listen(pop3): 192.168.1.1:995 ssl_cert_file: /var/qmail/control/servercert.pem ssl_key_file: /var/qmail/control/servercert.pem ssl_cipher_list: ALL:!LOW verbose_ssl: yes login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login verbose_proctitle: yes first_valid_uid: 89 last_valid_uid: 89 mail_location: maildir:~/Maildir mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %v-%u namespace: type: private separator: . prefix: INBOX. inbox: yes list: yes subscriptions: yes lda: postmaster_address: postmaster(a)mail.domain.com hostname: mail.domain.com mail_plugins: sieve mail_plugin_dir: /usr/local/lib/dovecot/lda deliver_log_format: msgid=%m: %$ sieve: /home/vpopmail/domains/%d/%n/sieve sieve_global_path: /usr/local/etc/default.sieve log_path: /var/log/qmail/sieve/dovecot.log info_log_path: /var/log/qmail/sieve/dovecot.log auth default: user: vpopmail passdb: driver: vpopmail userdb: driver: vpopmail plugin: quota: maildir Here is the config.log from sieve root@myplace:/usr/local# head dovecot-1.2-sieve-0.1.19/config.log This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by Dovecot Sieve configure 0.1.19, which was generated by GNU Autoconf 2.67. Invocation command line was $ ./configure --with-dovecot=../dovecot-1.2.8/ That compiled cleanly, then make and make install also proceeded without error. With verbose logging enabled, the only times "sieve" appeared in the logs was when I tried to load it as a plugin for imap - grep sieve /var/log/qmail/qmail-dovecot/current |tai64nlocal 2013-05-14 09:20:05.091635500 FPlugin sieve not found from directory /usr/local/lib/dovecot/imap 2013-05-14 09:20:06.120848500 FPlugin sieve not found from directory /usr/local/lib/dovecot/imap 2013-05-14 09:20:07.142465500 FPlugin sieve not found from directory /usr/local/lib/dovecot/imap 2013-05-14 09:20:08.164247500 FPlugin sieve not found from directory /usr/local/lib/dovecot/imap Once I removed it from being loaded as an imap plugin and used it only as an lda plugin, it hasn't appeared in the dovecot logs. It also isn't logging where I asked it to in the config file (log_path: /var/log/qmail/sieve/dovecot.log, or info_log_path: /var/log/qmail/sieve/dovecot.log), but that files was touched and all directories below /var/log/qmail/sieve have the correct permissions for dovecot to write there: ls -al /var/log/qmail/sieve/ total 16 drwxr-xr-x 2 dovecot dovecot 4096 May 14 11:04 . drwxr-xr-x 7 qmaill root 12288 May 14 11:04 .. -rw-r--r-- 1 dovecot dovecot 0 May 14 11:04 dovecot.log Can anyone suggest an error they see or what I can do to get my errors with the sieve config logged somewhere? Thanks for your help and insight.

2 4

[Dovecot] (no subject)
by Anes Mukhametov 17 May '13

17 May '13

Hello! I've tried to use extprograms pipe feature but stuck with "Broken pipe" errors in mail log: May 17 15:18:57 backend1 dovecot: lmtp(20338, user(a)domain.tld) Debug: 3VMVFWFKllFyTwAArRg8UA: sieve: action pipe: running program: learn May 17 15:18:57 backend1 dovecot: script: Error: write(response) failed: Broken pipe May 17 15:18:57 backend1 dovecot: lmtp(20338, user(a)domain.tld) 3VMVFWFKllFyTwAArRg8UA: sieve: execution of script /data/mail/storage/domain/user(a)domain.tld/.dovecot.sieve;name=main script failed, but implicit keep was successful (user logfile /data/mail/storage/domain/buser(a)domain.tld/.dovecot.sieve.log should reveal additional details) /data/mail/storage/domain/buser(a)domain.tld/.dovecot.sieve.log: error: msgid=<c7cd36f19be8164addf091a646b8b284(a)domain.tld>: pipe action: failed to pipe message to program `learn': refer to server log for more information. [2013-05-17 15:18:57] ham user(a)domain.tld 50796. Sieve script contents: require ["fileinto","copy","mailbox","vnd.dovecot.pipe"]; if anyof (header :is "Subject" "ham") { pipe :try "learn" ["ham"]; fileinto "INBOX/ham"; stop; } Sieve plugin config uncommented conents: sieve_plugins = sieve_extprograms *sieve_pipe_socket_dir = sieve-pipe* # Define the executed script as parameter to the sieve service executable = script /etc/dovecot/scripts/spam.sh # Use some unprivileged user for executing the program user = nobody # The unix socket located in the sieve_pipe_socket_dir (as defined in the # plugin {} section above) unix_listener sieve-pipe/learn { # LDA/LMTP must have access user = nobody mode = 0777 } } spam.sh is message processing script which interacts with spamassassin. I've tested pipe with spam.sh that redirects stdin to /dev/null and returns 0 but errors were logged anyway. Note that spam.sh runs, getting the message from sieve and processing it to spamassassin without a problem, but "broken pipe" is being logged.

1 0

[Dovecot] Ubuntu-12.04-LTS repos with Dovecot-2.2 and Pigeonhole
by listas＠adminlinux.com.br 17 May '13

17 May '13

Hi, I would like to take advantage of new features in Dovecot 2.2 on my servers. But I'm having difficulties to build packages for Ubuntu-12.04-LTS. Does anyone know a repository that has new stable versions for Dovecot and Pigeonhole ? Thanks ! --  Thiago Henrique adminlinux.com.br

4 4

Re: [Dovecot] question about /var/spool/mail/xxx
by Joseph Tam 17 May '13

17 May '13

Richard Feng@eBay writes: > this is Redhat 6.3 > I installed sendmail and dovecot. > but sendmail can continue send mail as MTA > all mails go to /var/spool/mail OK. > this is problem for dovecot. dovecot cannot get it goto dovecot inbox. > > if setup mailbox poing to /var/spool/mail/%u, it is workable I'm guessing that you're sending new mail to mbox formatted files in /var/spool/mail/%u (using dovecot LDA?). > but if set up maildir to somewhere else ,I cannot receive mail by dovecot. You lost me. How did you "set up maildir to somewhere else"? You ought to supply configurations (output of dovecot -n), and log entries of the problem. Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] Quota not working with dict proxy
by Chris Richards 16 May '13

16 May '13

Hello all, I'm sure this has been covered somewhere before, but my googlefu is not up to the challenge. Basically, I'm trying to configure quota plugin to use a dictionary service (specifically proxy with mysql) so that I can store the quota usage in a database and use that information in a lookup for postfix to reject mail if over quota. I'm doing this because postfix+avamis+dovecot setup with amavis re-injecting into postfix results in mail being effectively accepted before dovecot lmtp knows if mailbox is full. I'm currently using quota maildir: quota = maildir:User quota and this works; doveadm -Df tab quota get -u 'user@domain' Quota name Type Value Limit % User quota STORAGE 55388 204800 27 User quota MESSAGE 4883 - 0 When I use quota dict: quota = dict:User quota:%u:proxy::quota I get this: "doveadm -f tab quota get -u user@domain" Quota name Type Value Limit % User quota STORAGE 0 204800 0 User quota MESSAGE 0 - 0 So far so good. But manually setting database entry to values retrieved above with maildir quota results in this: Quota name Type Value Limit % User quota STORAGE 54 204800 0 User quota MESSAGE 4883 - 0 I'm guessing this is returning values in KB, so that makes sense, I guess. Attempting to recalc quota on one account using command: "doveadm -f tab quota recalc -u user@domain" returns with nothing, and when I repeat 'quota get' command, it says: doveadm(user@domain): Fatal: User doesn't exist Err............what?! Indeed, looking in the database shows the account in question was actually DELETED! Obviously, I've got something messed here, but I don't know what. I need some guidance here. Dovecot version is 2.1.12 Here is my config: # 2.1.12: /etc/dovecot/dovecot.conf # OS: Linux 3.7.5-hardened-r1 x86_64 Gentoo Base System release 2.1 ext4 auth_master_user_separator = * auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@& auth_verbose_passwords = plain default_process_limit = 200 dict { quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no login_greeting = Awaiting command... mail_location = maildir:/home/vmail/%d/%n/Maildir mail_plugins = " quota" mail_privileged_group = 100 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { expire = Trash 7 expire2 = Trash/* 7 expire3 = Spam 7 quota = dict:User quota:%u:proxy::quota quota_rule = *:storage=200M quota_warning = storage=99%% quota-warning 99 %n %d quota_warning2 = storage=95%% quota-warning 95 %n %d quota_warning3 = storage=80%% quota-warning 80 %n %d quota_warning4 = -storage=95%% quota-warning 'less than 95' %n %d sieve = ~/.dovecot.sieve sieve_default = /home/vmail/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_global_dir = /home/vmail/dovecot/sieve } protocols = imap pop3 sieve lmtp service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = dovecot mode = 0666 user = dovecot } user = $default_internal_user } service dict { unix_listener dict { mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-warning { executable = script /etc/dovecot/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl_cert = </etc/ssl/dovecot/server.pem ssl_key = </etc/ssl/dovecot/server.key userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = sieve quota postmaster_address = postmaster@domain } protocol lda { mail_plugins = " quota sieve quota" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " quota quota imap_quota" } protocol pop3 { mail_plugins = " quota quota" } >From dovecot-dict-sql.conf.ext: connect = host=localhost dbname=maildb user=dbuser password=dbpass # CREATE TABLE quota ( # username varchar(100) not null, # bytes bigint not null default 0, # messages integer not null default 0, # primary key (username) # ); map { pattern = priv/quota/storage table = email username_field = address value_field = quota_bytes } map { pattern = priv/quota/messages table = email username_field = address value_field = quota_messages } # CREATE TABLE expires ( # username varchar(100) not null, # mailbox varchar(255) not null, # expire_stamp integer not null, # primary key (username, mailbox) # ); map { pattern = shared/expire/$user/$mailbox table = email value_field = expire_stamp fields { address = $user maildir = $mailbox } } Other than some guesswork, I've not got the FOGGIEST idea what the settings in the file actually mean; it doesn't seem to be documented anywhere. Also, the quota plugin settings, at least with respect to using a proxy service, don't seem to be real explanatory either, e.g. the reason I'm using %u for the user is because I stumbled across a post suggesting that leaving it blank would result in just getting the username instead of the username@domain. This is not at all obvious from the documentation, IMO. The docs would benefit greatly from some example use cases (no, I'm not volunteering; I'm TERRIBLE with documentation ;) ). Anyway, if someone could proffer some help or at least guidance here, I'd be very grateful.

2 6

[Dovecot] dovecot 2.2.0 corrupts mailboxes?
by manu＠netbsd.org 16 May '13

16 May '13

Hi On april 17th, I upgraded from dovecot 2.1.13 to 2.2.0. Since that time, I had two different users that reported received three incident of messages that disapeared from their mailboxes. The mailbox format is mbox on local FFS filesystem (no NFS), and I use filesystem quotas (but both users are far from filling their quotas). When the message disapeared, it was always a whole rand of dates. On the last incident reported, the user also saw some message being duplicated many times. There is something interesting in the logs: May 4 20:16:30 volanges dovecot: imap(jdoe): Error: Cached message size smaller than expected (2000 < 8063) May 4 20:16:30 volanges dovecot: imap(jdoe): Error: Corrupted index cache file /mail/indexes/jdoe/.imap/INBOX/dovecot.index.cache: Broken physical size for mail UID 141869 May 4 20:19:48 volanges dovecot: imap(jdoe): Error: Cached message size smaller than expected (9711 < 16248) May 4 20:19:48 volanges dovecot: imap(jdoe): Error: Corrupted index cache file /mail/indexes/jdoe/mail/.imap/Arxiv/dovecot.index.cache: Broken physical size for mail UID 4383 May 4 21:14:35 volanges dovecot: imap(jdoe): Error: Cached message size smaller than expected (1878 < 8066) May 4 21:14:35 volanges dovecot: imap(jdoe): Error: Corrupted index cache file /mail/indexes/jdoe/mail/.imap/CNRS/dovecot.index.cache: Broken physical size for mail UID 290 May 4 21:15:17 volanges dovecot: imap(jdoe): Error: Cached message size smaller than expected (17285 < 24440) May 4 21:15:17 volanges dovecot: imap(jdoe): Error: Corrupted index cache file /mail/indexes/jdoe/mail/.imap/Commandes/dovecot.index.cache: Broken physical size for mail UID 680 Does that ring a bell? I am tempted to downgrade to 2.1.13. Does it makes sense? Is it safe to do so? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

6 12

[Dovecot] [PATCH] example-config: fix to also distribute auth-dict.conf.ext in
by Christian Wiese 16 May '13

16 May '13

Hi, When trying to patch the dovecot 2.2.1 release with latest upstream patches I generated out of the repository, the patch fails to apply, because 'doc/example-config/conf.d/auth-dict.conf.ext' is not distributed within the release tarball. Attached patch should fix the issue. Cheers, Chris

1 0

[Dovecot] quota with imapc
by pvsuja 16 May '13

16 May '13

Dear dovecot team, I have set up my mail system with a mail gateway connecting to mail server using imapc. Now I need my web mail client to show up the quota info. I enabled quota plugins in dovecot.conf. The problem is since all mails reside in the server, the web mail which is in mail gateway always shows the quota as 0. Is there any way the plugin will get quota info from the mail server? I am attaching my conf ## Dovecot configuration file in mail_uid = imapproxy mail_gid = imapproxy mail_home = /home/imapproxy/%u mail_location = imapc:~/imapc protocols = imap ## ## imapc settings ## imapc_host = mailserver.example.com imapc_port = 143 imapc_ssl = starttls imapc_ssl_ca_dir = /etc/postfix/certs ## ## auth settings ## auth_mechanisms = plain login passdb { driver = imap args = host=mailserver.example.com ssl=starttls ssl_ca_dir=/etc/postfix/certs default_fields = userdb_imapc_user=%u userdb_imapc_password=%w ssl=starttls } userdb { driver = prefetch } mail_plugins = $mail_plugins quota plugin { quota = maildir:User quota quota_rule = *:storage=200M } protocol imap { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins imap_quota } ## ## SSL settings ## ssl = required disable_plaintext_auth = yes #verbose_ssl = yes ssl_cert = </etc/postfix/certs/public_cert.pem ssl_key = </etc/postfix/certs/private_key.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL Greetings. -- View this message in context: http://dovecot.2317879.n4.nabble.com/quota-with-imapc-tp42280.html Sent from the Dovecot mailing list archive at Nabble.com.

2 2

[Dovecot] question about /var/spool/mail/xxx
by Richard Feng＠eBay 16 May '13

16 May '13

this is Redhat 6.3 I installed sendmail and dovecot. but sendmail can continue send mail as MTA all mails go to /var/spool/mail this is problem for dovecot. dovecot cannot get it goto dovecot inbox. if setup mailbox poing to /var/spool/mail/%u, it is workable but if set up maildir to somewhere else ,I cannot receive mail by dovecot.

1 0

[Dovecot] Looking for a good way to manage passwords for CRAM-MD5
by Steinar Bang 15 May '13

15 May '13

I prefer not to use clear text passwords, even over an encrypted connection. With IMAP, the only such mechanism with widespread client support is CRAM-MD5 (please correct my if I'm wrong... I'd love to be corrected here...). On the dovecot 2 wiki, the only way I've found to implement CRAM-MD5 support, is to use a passwd-like file: http://wiki2.dovecot.org/HowTo/CRAM-MD5 I am running a small IMAP server used by my family. As long as I was the single user on the IMAPd, manually managing the passwd file as doable (if a bit cumbersome). With 2-5 users, I'm looking for a more elegant solution. Does anyone have a similar situation, and a solution they would like to share (config/HOWTO)? Here are the possibilities that comes to mind: 1. Create a web interface to change the password (does anyone know of a ready-made solution for this that they could recommend?) 2. Convince PAM to update the dovecot HMAC-MD5 password file as well as the regular system password file (my dovecot runs on a debian stable "wheezy" system. In theory this should be possible, but it is very hard to find documentation on what PAM modules exist, and how to write a new one, and if it is possible to chain modules in PAM, ie. use one module to update-this-passwd-file and then use a different module to update a different passwd file) 3. Use LDAP, which I think can also support CRAM-MD5 when using password lookups http://wiki2.dovecot.org/AuthDatabase/LDAP/PasswordLookups (learning how to set up LDAP is something I have avoided for years, because it looks awfully complex and time consuming) I haven't looked into using databases, SQL, or key-value store, because they seem like a more cumbersome way to do the same thing as passwd files. But I am aware that this assumption could be wrong. It could e.g. be easier to make the web interface idea work with a database manager, than messing around with setuid bits to safely update a passwd file owned and touchable only by the dovecot user. Thanks for any and all responses! - Steinar

8 12

[Dovecot] dovecot 2.0 -> 2.1 sieve problem
by Trever L. Adams 15 May '13

15 May '13

I had a completely working setup before. I upgraded, now I get: Error: 7LUaNYqHklG6EAAApwKjnA: sieve: execution of script (null) failed, but implicit keep was successful sieve = /home/vmail/%Ld/%Ln/.dovecot.sieve sieve_dir = /home/vmail/%Ld/%Ln/sieve (this was ~/sieve) I am not quite sure what is going on. Is anyone else seeing this? Any idea on what has changed? (I am not readily seeing it in changelogs or mailing lists.) Thank you, Trever -- "A right is not what someone gives you; it's what no one can take from you." -- Ramsey Clark

3 11

[Dovecot] 2.2.1 and quota-status
by Christian Rößner 15 May '13

15 May '13

Hi, maybe this question already came up and I missed it in my mails, but if not… : I have configured Quota for Dovecot since decades and now with the new policy service, I wanted to include this into Postfix. I have followed Ralf's Blog and there a two Problems: I need to do this: ls -la /var/run/dovecot/config srw------- 1 root root 0 May 14 11:06 /var/run/dovecot/config chown vmail /var/run/dovecot/config ls -la /var/run/dovecot/config srw------- 1 vmail root 0 May 14 11:06 /var/run/dovecot/config Where can I tell Dovecot to set user vmail here? If I do not do this, I get the following error in the logs: May 14 10:54:50 mx0 dovecot: quota-status(c(a)roessner-network-solutions.com): Error: user c(a)roessner-network-solutions.com: Error reading configuration: net_connect_unix(/var/run/dovecot/config) failed: Permission denied Also the following test does not succeed: telnet localhost 12340 Trying ::1... Connected to localhost. Escape character is '^]'. request=smtpd_access_policy sender=foo(a)bar.tld recipient=c(a)roessner-network-solutions.com size=10000000000 action= ^] telnet> quit Connection closed. Nothing in the logs. Just an empty answer. Here is my config: doveconf -n # 2.2.1: /etc/dovecot/dovecot.conf # OS: Linux 3.8.6-hardened x86_64 Gentoo Base System release 2.2 auth_master_user_separator = * auth_mechanisms = plain login cram-md5 digest-md5 ntlm auth_verbose = yes hostname = mail.roessner-net.de lda_mailbox_autosubscribe = yes mail_access_groups = vmail mail_attachment_dir = /var/mail/virtual/copymail/attachments mail_gid = vmail mail_location = mdbox:~/mdbox mail_plugins = quota acl fts fts_solr zlib mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mdbox_rotate_size = 128 M namespace { list = children location = mdbox:%%h/mdbox prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk-E-Mail { special_use = \Junk } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox junkmail { auto = subscribe special_use = \Junk } prefix = separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/mail/virtual/shared-mailboxes.db fts = solr fts_solr = break-imap-search url=http://localhost:8080/solr/ quota = dict:User quota::file:%h/mdbox/dovecot-quota quota_rule = *:storage=300M:messages=20000 quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve service auth-worker { extra_groups = ssl-cert unix_listener auth-worker { mode = 0600 user = vmail } user = vmail } service auth { extra_groups = ssl-cert unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service dict { unix_listener dict { mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/lmtp-dovecot { group = postfix mode = 0666 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl_ca = </etc/ssl/certs/SSL123_CA_Bundle.pem ssl_cert = </etc/ssl/certs/mail.roessner-net.de.pem ssl_key = </etc/ssl/private/mail.roessner-net.de.key.pem userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota acl fts fts_solr zlib sieve } protocol lda { mail_plugins = quota acl fts fts_solr zlib sieve } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags mail_max_userip_connections = 50 mail_plugins = quota acl fts fts_solr zlib imap_quota imap_acl imap_zlib } Thanks for helping me… Kind regards -Christian Rößner -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

2 3

[Dovecot] Crossrealm Kerberos problems
by Jonathan Hanks 15 May '13

15 May '13

I am running dovecot 2.1.7 on Debian Squeeze 64 bit, config information at the end of the email. I am working on a Kerberos/GSSAPI based setup that requires cross-realm authentication. I have regular GSSAPI working, I can log in using pam_krb5 with password based logins or with the GSSAPI support when using a kerberos ticket in the default realm. However when I attempt to authenticate using cross realm authentication the login fails (logs below). After perusing the source code I beleive that the problem is as such: All taking place in mech-gssapi.c 1. mech_gssapi_userok(...) calls mech_gssapi_krb5_userok 2. mech_gssapi_krb5_userok(...) calls krb5_kuserok(...) to verify that the given Kerberos prinicpal can log in as the requested user. 3. The authentication process is running as the Dovecot user so: 3a. krb5_kuserok(...) looks for ~dovecot/.k5login to authorize cross realm logins 3b. There is no ~dovecot/.k5login, thus no cross realm access is allowed 3c. It should be looking at the users .k5login ~poptest/.k5login 3d. This never happens and the login attempt fails I have the server set up to use system users specifically so that I can do cross-realm authentication. Do I have some basic configuration error? How do I change the authentication process to run as the user requesting to login? Should that be allowed? Another thought is to backport some of the patches proposed for 2.2 that remove krb5_kuserok from the loop. Thank you for any insight. This server is not in production use so I can experiment. May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: gssapi(jonathan.hanks(a)SOME.REALM,198.129.xxx.xxx,<qYAkv0zc9wDGgdAT>): Negotiated security layer May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: gssapi(jonathan.hanks(a)SOME.REALM,198.129.xxx.xxx,<qYAkv0zc9wDGgdAT>): Negotiated security layer May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: client out: CONT#0111#011BQQF/wAMAAAAAAAACpxNKQH///+YdY3lGMDBq6TWTfc= May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: client out: CONT#0111#011BQQF/wAMAAAAAAAACpxNKQH///+YdY3lGMDBq6TWTfc= May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: client in: CONT<hidden> May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: client in: CONT<hidden> May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: gssapi(jonathan.hanks(a)SOME.REALM,198.129.xxx.xxx,<qYAkv0zc9wDGgdAT>): User not authorized to log in as poptest May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: gssapi(jonathan.hanks(a)SOME.REALM,198.129.xxx.xxx,<qYAkv0zc9wDGgdAT>): User not authorized to log in as poptest My config is as follows: # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.7 auth_debug = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/mail.keytab auth_mechanisms = plain login gssapi auth_username_format = %u auth_verbose = yes listen = * mail_location = mbox:~/mail:INBOX=/var/spool/mail/inbox/%u mail_privileged_group = mail passdb { args = dovecot driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0666 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/ssl/certs/mail-server.pem ssl_cipher_list = !aNULL:!eNULL:!EXPORT:!DSS:!DES:RC4-SHA:RC4-MD5:ALL ssl_key = </etc/ssl/private/mail-server.pem userdb { driver = passwd } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } -- Jonathan Hanks General Computing Sys Admin LIGO Hanford Observatory

2 2