- dovecot - dovecot.org

Re: [Dovecot] LDAP encryption
by James Devine 09 Oct '12

09 Oct '12

I don't think I understand. Right now the problem is the password retrieved from LDAP cannot be hashed to compare against what the user sent because it is encrypted. I have to perform my AES decryption before it can be hashed and compared. On Tue, Oct 9, 2012 at 1:03 PM, btb <btb(a)bitrate.net> wrote: > On 2012.10.09 14.41, James Devine wrote: > >> We have an LDAP server that contains AES encrypted passwords. So far I've >> been able to use this by adding a passdb module that encrypts the user's >> password prior to ldap comparison. Now I am looking at supporting >> client-side encrypted passwords. To do this I need to decrypt the >> password >> returned by LDAP. Is there a way to insert a module to do this decryption >> between ldap returning and the auth mechanism? >> >> that would be unwise, generally speaking. as a rule of thumb, in terms > of security fundamentals, only the rootdn [or equiv] should be able to read > the values in an ldap entry's password attribute. certainly the service > account used by dovecot should not. > > in the context of ldap, authentication should be accomplished by binding > as the user, not by retrieving attribute values and performing string > comparisons. among other things, this decouples the two components and > allows applications [e.g. dovecot] to be unconcerned with whatever password > hashing scheme the directory server might be using. > > -ben >

2 2

[Dovecot] LDAP encryption
by James Devine 09 Oct '12

09 Oct '12

We have an LDAP server that contains AES encrypted passwords. So far I've been able to use this by adding a passdb module that encrypts the user's password prior to ldap comparison. Now I am looking at supporting client-side encrypted passwords. To do this I need to decrypt the password returned by LDAP. Is there a way to insert a module to do this decryption between ldap returning and the auth mechanism?

1 0

[Dovecot] Quota - usage counting.
by wamp＠promax.media.pl 09 Oct '12

09 Oct '12

Hello, I use dovecot 1.2 version with postfix virtual users and mysql. All information about quota for every user is in mysql table. How dovecot compare if quota in database is over quota in /var/vmail/exampleuser directory ? It uses something like du command ? regards, Wamp

2 2

[Dovecot] some questions on dovecot or rather a mail system setup
by Christoph Anton Mitterer 09 Oct '12

09 Oct '12

Hi folks. Perhaps you find some time to look into this,... if you think I should better direct this do some dovecot mailing list,.. just tell :) I'm trying to plan my mail system and would have some questions. The overall idea is about the following: - There is a (internet) server, which is the MTA (which will be postfix) and imap and/or pop3 server (which shall be, guess, dovecot!). - Any spam filtering, virus-scanning, mail filtering happens on that server. - I have not yet decided on whether to use maildrop for this or Sieve. Maildrop is nice, but has one major deficiency which I don't know how to work around. - A few clients (that means I won't serve 100 of users) connect to that server via imap and should see all mails, etc. already in some fancy sorted hierarchy (that means filtered into different directories). So far nothing complicated. But now... - Apart from spam, I never delete mail; and because I'm subscribed to many lists, I get a lot of mail. - Storage on my server is limited and it's located somewhere at my ISP, so I generally do not trust it with respect to safety... For both reasons, I want the canonical archive of all mail to be at home at some local server. - The local server should also be an imap server, so that I can access the archive from may computers at home. - The local server won't be available from the internet. - The local archive should have the same folder hierarchy as the internet server (I'd prefer not to filter twice). Mail Flow: - I generally want to have _all_ mail (which is not sorted out because of being spam) to be archived at the local server. - But(!) I want to selectively keep (in addition) mail at the internet server. For example I may want to select the folder that contains all mail form some friend to be kept online completely. But I may want to decide that mailinglists keep only the last 10 days and/or 1000 messages of mail. - The idea is, that the local server regularly (when it is online/running) catches new mail from the internet server... and stores it in the archive. - So apart from new mail that has not yet been read, that local archive contains always all mails that are also on the internet server... the later may contain (for specific directories) the same, or just parts of. - The MUAs will then have two imap accounts, one to the internet server and one to the local archive,... each one being usable, depending on where I am. 1) This is where my first problem arises: How can I implement that mail flow, especially: - How do I secure that all mail is read from the internet server (i.e. that nothing is "forgotten"? - How do I make sure that no mails are retrieved twice (or more)? A problem which I often had with pop, when the mail client crashed during sync? - Further it must be secured, that when I delete something on the internet server, it is NOT deleted on the local server (on the next mail-fetching).... this is why I don't use the word "sync". a) One stupid solution would be, that I duplicate all mail on the online server,... one part is for staying online, one part is for being fetched to the local archive. As soon as it was fetched... that copy gets removed (always). That solution would give a clean and secured separation of both? b) I don't think offlineimap or any other caching-like solution is the right thing... especially as one must always fear that such a cache may be accidentally wiped. Are there better solutions than (a)? 2) Problem would be already a refinement of a working solution for (1) (but obviously not when using (1).(a) ). When e.g. reply to or forward a mail using the online server,... and that mail had already been fetched,... can I make the flag synced? 3) Is dovecot suitable for the local server? - Ideally of course, I would use dovecot there, too... because that would mean one piece of software less to understand. - I couldn't sue maildir locally, because I loose just to much space to the block fragmentation. - I'd prefer not to use dbox (the thing that the indices are crucial scares me a bit off). a) When using mbox... is dovecot able to manage a really big folder hierarchy that basically ever keeps growing... with easily several 100k mails per folder... and that is in total already over 100GB? - I would prefer to have fast full text search. Does dovecot provide this? I was looking into database backed mail systems (again,... just for the local archive)... namely dbmail and archiveopteryx (are there other open source solutions?)... Not sure which of the two... or whether it's a good idea at all. I remember some dovecot wiki page that showed a comparison which said that both do not perfectly implement imap. Any suggestions with respect to that? Or is there even some SQL backend planned for dovecot? Thanks a lot, Chris.

3 3

[Dovecot] Master User Question
by Marc Perkel 08 Oct '12

08 Oct '12

OK - I'm trying to do weird stuff so rather not answer why I'm doing this. Trying to log in using a master user: user@example.com*master@master.com When debugging the master authenticates - but then it tries to authenticate user(a)example.com and it's not found. And - it is true that the user doesn't actually exist. What I want to do is allow it to log in without checking if the user exists, just on the credentials of the master. I'm not quite understanding what the login attempt for user(a)example.com is trying to do. Is it looking for more necessary information? Hope I asked this clearly enough. Thanks in advance.

2 5

[Dovecot] Namespace Prefix Tutorial?
by Marc Perkel 08 Oct '12

08 Oct '12

I'm trying to grasp the namespace and prefix stuff and looking for a good tutorial page that explains what it is and how to use it. Thanks in advance

3 6

[Dovecot] another mysql quota problem
by Tibby 08 Oct '12

08 Oct '12

Hello! I am using dovecot 1.2.15 on Debian 6 I have Postfix configured with mysql, and also dovecot is auth-ing form mysql users table. The users table has username password quota stored. When I set qouta to whatever number, it doesnt even show in dovecot. telnet localhost 143 a login username(a)domain.tld password a getquotaroot inbox * QUOTAROOT "INBOX" a OK Getquotaroot completed. Basicly it doesn't show any kind of quota. in the /etc/dovecot/dovecot-sql.conf: driver = mysql connect = host=127.0.0.1 dbname=mail user=USERNAME password=PASSWORD default_pass_scheme = CRYPT password_query = SELECT email as user, password FROM users WHERE email='%u'; user_query = SELECT CONCAT(('/home/vmail/'), SUBSTRING_INDEX(email,'@',-1),'/',SUBSTRING_INDEX(email,'@',1),'/') AS home, 5000 AS uid, 5000 AS gid, CONCAT('maildir:storage=', floor(quota/1024)) AS quota FROM users WHERE email='%u'; Why it doesn't get the quota out from the mail DB's users table?

1 0

[Dovecot] Large subjects increase memory-usage and enlarge index-files
by Peer Heinlein 08 Oct '12

08 Oct '12

Several times we already had the problems, that accounts with more the 1.3 or 1.7 billion e-mails in one folder run out-of-memory, even if vsize_limit of 750 MB is set. In this case, the lmtpd-process haven't been able to allocate more memory to read/write/update the index-files and crashed (and the index-files become corrupted at the end.) [Please -- don't discuss about the need of INBOXes with 1.7 million (unread) e-mails (don't discuss that with ME. Personally, I agree, that there's NO need for that...).] But: We also noticed accounts with ~ 300.000 e-Mails running out of memory in the same situations. This happends, if the subject is very large (subject or some other header attributes). And: We've been able to reproduce out-of-memory-Problems with just 13.000 e-mails with VERY long subjects (e.g.: network monitoring status informations), even with a vsize_limit of 750 MB (which is already very much). 13.000 e-mails isn't very much. And it's easy to inject several thousands of prepared e-mails. Having many mails for accounts with huge (and broken) index-files slows down the delivery rate VERY much and increases the need for memory and cpu resources and I/O very much. So: This could be used for a very easy to do denial-of-service attac against Dovecot-based mailservers. I don't have a clear solution for that, Dovecot needs the subject information in its index files. But it looks like, it isn't a good idea to put the whole subject into the index. Maybe it's better/necessary to use just the first 50-70 characters for that and to keep the rest away from the index? I think I would prefer that even if that means, that accessing those folders with "special" e-mails will become slower because Dovecot has to get those informations directly from the e-mail. This performance issue is just a problem for the user. But crashing lmtpd-processes and lowering the delivery rate is a *real* problem for the whole IMAP-cluster. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

4 4

[Dovecot] [OT] How do I convert maildir to bsmtp format?
by Marc Perkel 08 Oct '12

08 Oct '12

Here's what I'm trying to do. I have a spam filtering operation as a front end for other servers. I've created a virtual server for spam storage where the user will be able to log in using squirrelmail/dovecot to review and release their spam. The email is stored in maildir format. Piecing it together I can use squirrelmail to pipe the email into something so that if a use finds a false positive they can hit the "release" button and the message is sent on to the recipient. Squirrelmail sends the message as you would receive it as stored in maildir format. I need to take this format and translate it to send it on to the user. Wondering what is the best way to do that. Something that translated it into bsmtp format would be great. I'm sure thare must be something out there. I just haven't found it yet. Thanks in advance.

3 2

[Dovecot] Dovecot configuration and question about IP trusted
by Mik J 07 Oct '12

07 Oct '12

Hello list, I've just finished to install Dovecot and things seems to work so far. After some little efforts though. My version is 2.0.20 Question 1: I'm trying to tighten the security a little bit and added in dovecot.conf login_trusted_networks = 192.168.1.0/30 Then restarted Dovecot My client has the IP 192.168.1.20 and it's still able to retrieve emails. I expected it to be forbidden. Am I missing something ? # dovecot -n | grep trust login_trusted_networks = 192.168.1.0/30 Question 2: I feel that Dovecot is slow. I'm doing my test with my iphone as an imap client. Test 1: I retrieve a mail on a remote server provided by a hosting company, it takes 2 seconds Test 2: I retrieve a mail on my server which is on my LAN, the mail includes a few letters in the subject and a few letters in the body. The action takes about 8 seconds. It's quite subtule to measure so first I would like to know if Dovecot tries to do a dns reverse lookup or something like that. And it would explain the overhead. Thank you

2 4

[Dovecot] Getting rid of the subscription file
by Marc Perkel 06 Oct '12

06 Oct '12

I'd like to eliminate the subscription file and have it just list the folders that are there. How do I do that? Thanks in advance.

4 5

[Dovecot] doveadm purge -A via doveadm-proxy director fails after some users
by Daniel Parthey 06 Oct '12

06 Oct '12

Hi, we have configured userdb and passdb in the director and try to iterate all users and pass the "purge" command via doveadm proxy to port 19000 on the correct director backend host. A single purge -u username(a)example.org via doveadm-proxy works correctly, but iterating over some users with -A fails. Note: users/domains have been anonymized in output: ------------------------------------------------------------------------ mail04:~# /usr/bin/doveadm -c /etc/dovecot-director/dovecot-director.conf -D purge -A 2>&1 doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_lookup (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_zlib_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_zlib_plugin.so: undefined symbol: i_stream_create_deflate (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_list_backend (this is usually intentional, so just ignore this message) doveadm(user01(a)domain1.example.org): Debug: auth input: user=user01(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user02(a)domain1.example.org): Debug: auth input: user=user02(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user03(a)domain1.example.org): Debug: auth input: user=user03(a)domain1.example.org proxy host=10.129.3.192 proxy_refresh=86400 doveadm(user04(a)domain1.example.org): Debug: auth input: user=user04(a)domain1.example.org proxy host=10.129.3.192 proxy_refresh=86400 doveadm(user05(a)domain1.example.org): Debug: auth input: user=user05(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user06(a)domain1.example.org): Debug: auth input: user=user06(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user07(a)domain1.example.org): Debug: auth input: user=user07(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user08(a)domain1.example.org): Debug: auth input: user=user08(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user01(a)domain2.example.org): Debug: auth input: user=user01(a)domain2.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user09(a)domain1.example.org): Debug: auth input: user=user09(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 10 / 94doveadm(user10(a)domain1.example.org): Debug: auth input: user=user10(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user11(a)domain1.example.org): Debug: auth input: user=user11(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user12(a)domain1.example.org): Debug: auth input: user=user12(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user13(a)domain1.example.org): Debug: auth input: user=user13(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user14(a)domain1.example.org): Debug: auth input: user=user14(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user15(a)domain1.example.org): Debug: auth input: user=user15(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user16(a)domain1.example.org): Debug: auth input: user=user16(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user17(a)domain1.example.org): Debug: auth input: user=user17(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user18(a)domain1.example.org): Debug: auth input: user=user18(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user19(a)domain1.example.org): Debug: auth input: user=user19(a)domain1.example.org proxy host=10.129.3.192 proxy_refresh=86400 20 / 94doveadm(user20(a)domain1.example.org): Debug: auth input: user=user20(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user21(a)domain1.example.org): Debug: auth input: user=user21(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user22(a)domain1.example.org): Debug: auth input: user=user22(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user02(a)domain2.example.org): Debug: auth input: user=user02(a)domain2.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user23(a)domain1.example.org): Debug: auth input: user=user23(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user24(a)domain1.example.org): Debug: auth input: user=user24(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user01(a)domain3.example.org): Debug: auth input: user=user01(a)domain3.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user25(a)domain1.example.org): Debug: auth input: user=user25(a)domain1.example.org proxy host=10.129.3.192 proxy_refresh=86400 doveadm(user26(a)domain1.example.org): Debug: auth input: user=user26(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user27(a)domain1.example.org): Debug: auth input: user=user27(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 30 / 94doveadm(user28(a)domain1.example.org): Debug: auth input: user=user28(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user29(a)domain1.example.org): Debug: auth input: user=user29(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user30(a)domain1.example.org): Debug: auth input: user=user30(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user31(a)domain1.example.org): Debug: auth input: user=user31(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user31(a)domain1.example.org): Error: doveadm server failure doveadm: Error: Failed to iterate through some users ------------------------------------------------------------------------ The user "user31(a)domain1.example.org" is proxied to the correct backend host according to director status, but the dovecot.log on the doveadm service backend host shows the following error: Jun 29 15:40:31 10.129.3.249 dovecot: doveadm(user31(a)domain1.example.org): Error: user user31(a)domain1.example.org: Error reading configuration: net_connect_unix(/var/run/dovecot/config) failed: Permission denied Jun 29 15:40:31 10.129.3.249 dovecot: doveadm(user31(a)domain1.example.org): Error: purge: User lookup failed: Internal error occurred. Refer to server log for more information. The wiki http://wiki2.dovecot.org/Services#doveadm states that the privileges are (temporarily) dropped to the mail user's privileges after userdb lookup. It seems that from the second purge on which is passed over a single doveadm connection, the user lookup fails. It also seems a bit strange, that the "-A" parameter can be observed in the doveadm tcp stream to the backend, since iteration should be already done in the director and the backend should purge only a single user: D username(a)example.org purge -A Is there a bug or have I misconfigured/overlooked something? Configs of mailbox backend and director are attached. Kind regards Daniel

2 8

[Dovecot] IPv6 & SSL
by Luigi Rosa 06 Oct '12

06 Oct '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I have a dual stack server with Dovecot 2.1.10 listening on v4 and v6 Dovecot has a Comodo SSL certificate issued via NameCheap that works as expected with IPv4 in 10-ssl.conf I have enabled these configuraction directives: ssl = yes ssl_cert = < /path/to/file.crt ssl_key = < /path/to/file.key ssl_parameters_regenerate = 202 hours If I connect to Dovecot using the IPv6 address of the server with Thunderbird 15.0.1 uising CRAM-MD5 averything is ok. If I enable SSL _and_ IPv6 on Thunderbird I get this error: Oct 5 20:05:04 mail dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=2001:470:1f09:203:fdbf:508e:4a29:56c5, lip=2001:470:1f09:203::badd:ecaf, TLS: SSL_read() failed: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca: SSL alert number 48, session=<ZcMRtlPLqgAgAQRwHwkCA/2/UI5KKVbF> Ciao, luigi - -- / +--[Luigi Rosa]-- \ I will tell you a great secret, Captain. Perhaps the greatest of all time. The molecules of your body are the same molecules that make up this station and the nebula outside, that burn inside the stars themselves. We are star stuff, we are the universe made manifest, trying to figure itself out. As we have both learned, sometimes the universe requires a change of perspective." --Delenn, "Distant Star", Babylon 5 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlBvI50ACgkQ3kWu7Tfl6ZRBSACfRkp4FYpWaEZUQhIh0t6Vfs/I JbcAoKGZ769yogYS7faCXKvPTuhQiHA8 =jxCB -----END PGP SIGNATURE-----

5 8

[Dovecot] horde sync status ?
by Spyros Tsiolis 05 Oct '12

05 Oct '12

Hello all, I had a quick look at the horde site and noticed that horde is being advertised as, let's say, "smartphone friendly". Does anyone know if the newest horde version can "talk" to smart phones in regards to e-mails ? In other words, can a user owning a smartphone get his/her e-mails on it apart from the webpage ? Thank you, spyros ---- "I merely function as a channel that filters music through the chaos of noise" - Vangelis

5 5

[Dovecot] bug formatting results when using doveadm-server
by Angel L. Mateo 04 Oct '12

04 Oct '12

Hello, I have a infrastructure using director in front of backend servers. So I normally run doveadm commands in director servers, not the backends. The problem I have is when I try to concatenate commands like this: doveadm search -S /var/run/dovecot/auth-userdb -u ${user} SAVEDSINCE 5w | while read guid uid; do doveadm fetch -S /var/run/dovecot/auth-userdb -u ${user} size.physical mailbox-guid $guid uid $uid; done The problem is that although when I run doveadm search command in the backend server I correctly get the list of mails, each line with the mailbox-guid and the uid of the message, when I run the same command in the director server, format of the list is corrupted and there are lines that contains just the mailbox-guid and the next the uid (of the previous) and the mailbox-guid of next, and so on. Like: e62e0d3834ed094e5c7900007efb8a67 66 e62e0d3834ed094e5c7900007efb8a67 71 e62e0d3834ed094e5c7900007efb8a67 74 e62e0d3834ed094e5c7900007efb8a67 75 e62e0d3834ed094e5c7900007efb8a67 77 e62e0d3834ed094e5c7900007efb8a67 78 e62e0d3834ed094e5c7900007efb8a67 so I can't postprocess correctly the output. I think it could be a bug in the communication between the doveadm client and server. PS: As the time of writing this email, I have realized that I could use fetch command directly. But, anyway, I want to report the problem/bug so it can be fixed.

2 6

[Dovecot] possible nfs issue
by Cor Bosman 04 Oct '12

04 Oct '12

Hi all, we've started receiving complaints from users that seemingly use more quota than they actually have. We noticed that these users have (in some cases many) .nfs files in their mailspool. Some of our admins checked their own dirs, and noticed them there as well. This could of course be unrelated to dovecot (kernel issue, netapp issue) but maybe somehow has an idea about if dovecot could cause this. This has been going on for at least a year, not really enough to notice before now. root@userimap1# find . -type f|grep -i .nfs ./cur/.nfs00000000003967ad003c0603 ./cur/.nfs000000000757b44b003be609 ./cur/.nfs00000000035e89bd003be60b ./cur/.nfs000000000796251c003be60c ./cur/.nfs000000000796251f003be60e ./cur/.nfs000000000262f9a1003be33a ./cur/.nfs00000000096513f3003be524 ./cur/.nfs0000000007962525003be60f ./cur/.nfs0000000003e7d8ab003be62b ./cur/.nfs00000000026f4fad003be50d ./cur/.nfs0000000000bdaeab003c0611 ./cur/.nfs0000000005da42c7003be525 ./cur/.nfs0000000003d74729003be526 ./cur/.nfs000000000229769e003be535 ./cur/.nfs000000000440969e003be516 With NFS these files are created when a file gets unlinked, but another process still has it open. It disappears as soon as the other process closes it. For some reason they dont disappear. As far as I can tell we've had no server crashes that could explain this. One possible theory is that a rename happens after an unlink. In that case the file remains. This could possibly be a dovecot issue. Anyone else with NFS mailspools seeing this? Cor

5 7

[Dovecot] LDA vs LMTP index files
by list＠airstreamcomm.net 03 Oct '12

03 Oct '12

In the docs it states that LDA " ...takes mail from anMTAand delivers it to a user's mailbox, while keeping Dovecot index files up to date." I am wondering if LMTP also interacts with the Dovecot index files and keeps them up to date?

3 3

[Dovecot] [PATCH] Add SCRAM-SHA-1 password scheme
by Florian Zeitz 03 Oct '12

03 Oct '12

Hello, attached is an hg export on top of the current dovecot-2.2 branch, which adds support for a SCRAM-SHA-1 password scheme. Ideally I'd want doveadm pw's rounds flag to apply to this, but that's currently specific to the crypt password scheme, so I left it out for now. Regards, Florian Zeitz

2 9

[Dovecot] Syntax for doveadm auth cache
by Angel L. Mateo 03 Oct '12

03 Oct '12

Hello, What is the correct syntax of doveadm auth cache command? According to command line help: usage: doveadm [-Dv] [-f <formatter>] <command> [<args>] altmove [-u <user>|-A] [-S <socket_path>] [-r] <search query> auth [-a <auth socket path>] [-x <auth info>] <user> [<password>] auth cache but when I try to run doveadm auth cache, then I'm asked for a password, so I think the command is trying to authenticate cache user. Moreover... according to previous mails (thread http://www.dovecot.org/list/dovecot/2012-June/066691.html) there is a patch to remove a specific user entry from cache. This patch I think is included in dovecot 2.1.9 (which I'm running) and the syntax is (I think): doveadm auth cache flush <user> 4 cache entries flushed So I'm running this command. Whenever I run it, I get the message that 3 (sometimes, is 4) entries are removed, but user information isn't really reloaded and I doubt it is really removed from cache (I have the user in a passwd-file and information used by imap processes is still the old one, no the new one, changed before the flush) -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 9

Re: [Dovecot] Logging IP address for failed login
by Joseph Tam 03 Oct '12

03 Oct '12

Scott Neville <dovecot-in(a)keystealth.org> writes: > I am trying to use the logs to show the IP that brute force activity > comes from, but Im not succeeding. I have read the archives and seen > the advice others have had. I can see logs for repeated bad logins, > but I need the IP address from the attempts. > > ... > but only for successful logins. The brute force attempts dont log like that: > > Sep 16 00:02:58 olive dovecot: auth: pam(backup): unknown user This was similar to another complaint several months ago. I conjectured that these attempts are SMTP AUTH, not IMAP, brute forcing. Are you using the dovecot's SASL feature to authenticate outgoing Email (i.e. via Postfix?). Maybe you verify this hypothesis by checking the Postfix logs. Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] segfault in Debian Squeeze + Dovecot 2.1.10
by Joe Auty 03 Oct '12

03 Oct '12

Hello, I'm seeing a lot of these in my /var/log/messages in Debian Squeeze, I suspect this might be causing performance issues. Any suggestions what I can try to fix this? > [7236671.301179] imap-login[9306]: segfault at 28 ip 00007f9ff83c7e14 > sp 00007fff49d385c0 error 4 in libdovecot.so.0.0.0[7f9ff837c000+8b000] I'm using the 2.1.10 packages obtained with the following in my sources.list: deb http://xi.rename-it.nl/debian/ stable-auto/dovecot-2.1 main I need to use Dovecot 2.1.x because I need to support handling multiple SSL certs.

7 25

[Dovecot] Spurious " Renaming not supported across conflicting directory permissions"
by tlhackque 02 Oct '12

02 Oct '12

Dovecot 2.1.10 Client = Thunderbird. Local disks. mbox format. Attempted to rename a folder, failed with: CANNOT Renaming not supported across conflicting directory permissions I don't understand why this should happen. o I was renaming within a directory - the attempt was to rename "Domain Names &- SSL Certificates" to "Domain Names". No directory was specified o The reason the directory has g=s is for dovecot - so that the 'mail' group (12) will stick to any files created. I was getting more understandable permission failures before I added it. Since 's' doesn't apply to files, I don't see why this should be viewed as a conflict. o If I chmod g-s the directory, the command succeeds. But then I'm back to file ownership problems... drwxrws--- 4 4503 12 4096 Sep 22 06:17 F/N/ -rw-rw---- 1 4503 12 81530 Sep 22 06:17 F/N/Domain Names &- SSL Certificates Sequence from TB's trace (crlfs for clarity): 1140[11ebcf00]: 121e8c00:imap.example.com:A:SendData: 66 rename "F/N/Domain Names &- SSL Certificates" "F/N/Domain Names" 1140[11ebcf00]: ReadNextLine [stream=12135a28 nb=80 needmore=0] 1140[11ebcf00]: 121e8c00:imap.example.com:A:CreateNewLineFromSocket: 66 NO [CANNOT] Renaming not supported across conflicting directory permissions 9592[c7d6840]: ReadNextLine [stream=ab687e8 nb=22 needmore=0] Config: # 2.1.10: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.22.14-72.fc6 i686 Fedora Core release 6 (Zod) first_valid_gid = 4000 first_valid_uid = 4000 hostname = smtp.example.com login_greeting = Dovecot ready. Unauthorized access is prohibited. mail_location = mbox:~/mail:INBOX=/var/mail/%n mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { driver = pam } service imap-login { inet_listener imap { address = imap.v4.example.com imap.v6.example.com port = 143 } inet_listener imaps { address = imap.v4.example.com imap.v6.example.com port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { address = pop.v4.example.com pop.v6.example.com port = 110 } inet_listener pop3s { address = pop.v4.example.com pop.v6.example.com port = 995 ssl = yes } } ssl_ca = </etc/pki/tls/certs/example_com_ca-cert-crl.pem ssl_cert = </etc/pki/tls/certs/servers-example-com.pem ssl_key = </etc/pki/tls/private/servers-example-com.pmk userdb { driver = passwd } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } -- --------------------------------------------------------- This communication may not represent my employer's views, if any, on the matters discussed.

2 1

[Dovecot] noisy auth-worker messages in logs (dovecot 2.1.8 FreeBSD)
by Philippe Chevalier 02 Oct '12

02 Oct '12

Hello, I don't know if it's been addressed before, but anyway : In my dovecot setup, I have local and virtual users. So, I need multiple passdb backends. Namely, passwd for the local users and ldap for the virtual users. passdb { driver = passwd } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf driver = ldap } Everything work correctly : when a user logs in (imap/pop3) there's a lookup in passwd and if it fails there's a lookup in ldap (if I understand the process correctly), which eventually succeeds. Except that every time a virtual user logs in, dovecot logs an error, like : dovecot: auth-worker(99126): Error: passwd(xxx(a)domain.org,12.34.254.255): getpwnam() failed: Invalid argument I guess it's because the login is a full email that getpwnam fails. Anyway, the user logs in just fine. But I would like to know if/how I can get rid of the messages filling my logs ? I tried : auth_debug_passwords = no auth_verbose = no But no dice. I used dovecot 1.x before and there was no such messages. Thanks for any advice. K. -- Kyoko Otonashi's shrine / Le temple de Kyoko Otonashi My tribute to Maison Ikkoku / Mon hommage a Maison Ikkoku Visit http://www.kyoko.org/

2 4

[Dovecot] LTMP Proxy fails when backend server connection refused
by Jack Bates 02 Oct '12

02 Oct '12

Version: 2.1.9 Connecting directly to the proxy server on the LMTP port, issue lhlo, mail from, rcpt to, data. After the . closing of data, it just hangs there. The logs on the proxy server show: Sep 27 19:55:12 proxy1 dovecot: lmtp(9398): Connect from 69.8.2.71 Sep 27 19:55:24 proxy1 dovecot: lmtp(9398): Error: lmtp client: connect(lmtp, 7025) failed: Connection refused root 9398 1102 0 19:53 ? 00:00:00 dovecot/lmtp The proxy server is hard coded (not director in this case). I purposefully shut it down to see how the system would handle failures. Unfortunately, it appears that the process just hangs there. For fun, I tried a separate protocol lmtp option in the config to try proxy_timeout. It made no difference. Missing some error handling? protocol lmtp { passdb { driver = static args = proxy=y host=%s nopassword=y proxy_timeout=120 } } Jack

2 5

[Dovecot] Antispam plugin problem (CRM114)
by Davide 02 Oct '12

02 Oct '12

Hi to all, sorry in advance for my poor english, this is the first time that i wrote to a list if i make mistake .... excuseme. My problem is this: i have dovecot 2.1.8 installed and functioning from 2 years one week ago i have installed crm114 for my last spam detection filter "version 20100106-BlameMichelson (TRE 0.8.0 (BSD))" My mail system is qmail that through .qmail default correctly tag with X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-27CA1CFB X-CRM114-CacheID: sfid-20120927_105129_798028_B0035817 X-CRM114-Status: GOOD ( 28.64 ) headers dovecot.conf is as follow: plugin { . . . antispam_signature = X-CRM114-CacheID antispam_verbose_debug = 1 antispam_debug_target = stderr antispam_backend = crm114 antispam_signature_missing = error antispam_trash = Trash antispam_spam = SPAM antispam_unsure = UNSURE antispam_crm_binary = /opt/crm114/mailreaver.crm antispam_crm_args = --fileprefix=/opt/crm114/ . . . } protocol imap { . . . mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = $mail_plugins quota imap_quota mail_log antispam . . . } I have a sieve default compiled script that automatically put mails in SPAM folder or UNSURE folder if respectively in message hedere there is the evaluation of crm114 (UNSURE or SPAM). When i move mails incorrectly tagged by crm (for example from SPAM to my inbox or from UNSURE to SPAM) thunderbird (company official mail client ver 15.01) go in error with the following message: "Operation failed over folder 'UNSURE'. Server for account davide.marchi(a)mail.cgilfe.it said: [CANNOT] Failed to call crm114 binary.." I dont'know where is my mistake if someone can help me is much appreciated Thank you -- */Davide Marchi /Teorema Ferrara Srl /(Tel: /**/+39 0532 783161)/**/ (Fax: +/**/39 0532 783368/**/)/**//**/ /**//**/Davide.Marchi(a)mail.cgilfe.it <mailto:davide.marchi@mail.cgilfe.it?subject=Info> /CONFIDENZIALITA’ *** Questo messaggio, inclusi gli eventuali allegati, è indirizzato solo ai destinatari e può contenere informazioni riservate e confidenziali. Se avete ricevuto il messaggio senza esserne un destinatario, siete pregati di non utilizzare, copiare o distribuire questo messaggio o i suoi allegati. Se avete ricevuto il messaggio per errore, siete pregati di cancellarlo dal vostro sistema, assieme a tutti gli allegati, e di informare immediatamente il mittente,sia ai sensi dell'art. 616 c.p., sia ai sensi del DL n. 196/03. *CONFIDENTIALITY*** This message and any attachments are intended only for the use of the addressee(s) and may contain information that is privileged and/or confidential. If the reader of the message is not the intended recipient(s) or an authorized representative of the intended recipient(s), please do not use, copy, distribute this email or its attachments or take action based on them. If you have received this communication in error, please notify us immediately by email and delete the message and any attachments from your system. *Teorema FerraraSrl - Via Spronello, 7 - 44121 Ferrara Italia - P. IVA 01244490387** P**S**tampa questo messaggio solo se veramente necessario, pensa alla natura! - Please consider whether it is necessary to print this e-mail*

2 17