- dovecot - dovecot.org

[Dovecot] Multiple SSL certificates
by Martin Fuxa 22 Mar '10

22 Mar '10

Hi guys, with reference to http://wiki.dovecot.org/SSL/DovecotConfiguration Multiple SSL certificates (v2.0+) where I can type ? local imap.example.org { ssl_cert = </etc/ssl/certs/imap.example.org.crt ssl_key = </etc/ssl/private/imap.example.org.key } at the end file dovecot.conf I got Starting Dovecot: Error: Error in configuration file /etc/dovecot/dovecot.conf line 1261: Unknown section type (section changed in /etc/dovecot/dovecot.conf at line 1259) Fatal: Invalid configuration in /etc/dovecot/dovecot.conf line 1261 corresponds to local mail.test.my { dovecot --version 1.2.11 compiled as ./configure --sysconfdir=/etc/dovecot --with-mysql --without-vpopmail --without-bsdauth --without-checkpassword --without-pam --without-shadow --without-passwd --without-passwd-file --without-nss CentOS 5.4 And last question - is it possible use wild host? for example "local *.example.org { ... }" - or is it possible use more hosts within one line? for example "local imap.example.org pop3.example.org { ... }" Thanks in advance Martin

2 1

[Dovecot] Public Folder for mailinglist with deliver
by Sebastian Heil 21 Mar '10

21 Mar '10

Hello Everybody, I'm looking for a nice way to implement the following: We are running a mail server for system users who are having their own mailbox. Now there's the idea to subscribe for a few mailinglists which are then available for the user per shared/public folder. So they can simply subscribe and unsubscribe with their MUA. For every mailinglist subscription there should exist an own email account with own mail directory. The namespaces are already working (in a test environment). But I haven't found any implementation to realize this nicely with deliver. The possiblities I'm thinking about are: -create a somewhere in userdb a passwd entry for each mailinglist email address with the corresponding directory -create a static userdb entry, but then deliver cannot check if an email address/mailbox exists. I think both ideas aren't a good implementation. So I'm asking you for help. Has someone a similar setup or a little idea how to make this work with deliver. Thanks in advance Sebastian

1 0

[Dovecot] Dovecot 2.0beta3 and dovecot.conf
by Axel Luttgens 21 Mar '10

21 Mar '10

Le 17 mars 2010 à 21:25:38, Timo Sirainen a écrit : > On Wed, 2010-03-17 at 21:21 +0100, Renaud Allard wrote: >>>> dovecot_delivery transport output: lda: Fatal: User lookup failed: >>>> net_connect_unix(/opt/dovecot/etc/dovecot/dovecot.conf) failed: No such >>>> file or directory >>> >>> Yeah, I broke this yesterday. Fixed it today. >>> >> >> Thanks Timo, so I suppose the daily snapshot should be better for me. > > So do you mean you really tried beta3 release, not the nightly > snapshot / hg version? Because I thought that error didn't happen with > beta3. Hello Timo, Yes, it was already there with beta3: downloaded it yesterday for initial trials, and faced the problem too. Since I haven't had the opportunity to update my hg handling setup yet, I just created a symlink; for those looking for a quick workaround until a beta4 or a rc1 gets issued, and assuming --sysconfdir=/usr/local/etc: /usr/local/etc/dovecot/dovecot.conf -> ../dovecot.conf No great info of course. ;-) Axel

2 1

[Dovecot] 2.0 beta: LMTP + Sieve fileinto broken
by Bernhard Schmidt 21 Mar '10

21 Mar '10

Hoi, somewhere between Hg revisions 10945 and 10962 filing into a subfolder using sieve Scripts (like fileinto "fwd.sixxs" here) broke Mar 20 18:14:24 mail dovecot: lmtp(27326, berni(a)vmail.mail.mucip.net) ojJwL3ACpUu+agAA/GZUZg: msgid=<tickets-tickets.1418885.1419129(a)noc.sixxs.net>: save failed to fwd.sixxs: Mailbox doesn't exist: fwd.sixxs Used to work fine before. Bernhard

3 6

[Dovecot] Sendmail + deliver; silent errors.
by Daryl Tester 20 Mar '10

20 Mar '10

Hi all. I've got a bit of a peculiar issue here. I'm running dovecot 1.2.9 on an Ubuntu 9.10 box using Sendmail 8.14.3. I've set up Sendmail similar to <http://wiki.dovecot.org/LDA/Sendmail> except that *) dovecot's deliver is configured as my default local mailer, so some of the flags for the Mailer definition had to be adjusted accordingly. *) The setuid users listed in the wiki kept result in setgid() failures from deliver, so I've changed it to root:mail (mail being sendmail's MDA group), with permissions as u+s,g+rx,o-rwx When sendmail attempts delivery, I'm getting "deferred: deliver failed with EX_TEMP", but nothing recorded in the log files. I've embarrassingly widened the permissions of /var/log/dovecot and the files contained within to read/write everyone, just to ensure that whomever it's running as has access, but the log files aren't updated. The peculiar thing kicks in when I attempt to debug this. So far I have (amongst other things): *) Run deliver from the command line logged in as "mail". *) written a shell wrapper script to be able to confirm things like the user ID that was invoking deliver. *) both in the shell script, and as an mailer definition in sendmail, strace'd (using a setuid root binary) deliver to capture what it was doing. Whenever I do any of the above, deliver works perfectly, and appears to log correctly. It only appears to bork when no-one is watching it, which is quite frustrating when trying to fix it. Help? Configuration of dovecot follows: # 1.2.9: /etc/opt/dovecot-1.2.9/dovecot.conf # OS: Linux 2.6.31-14-server x86_64 Ubuntu 9.10 ext3 base_dir: /var/run/dovecot-1.2.9/ log_path: /var/log/dovecot/dovecot.log info_log_path: /var/log/dovecot/dovecot-info.log protocols: pop3 imap imaps ssl: no disable_plaintext_auth: no login_dir: /var/run/dovecot-1.2.9//login login_executable(default): /opt/dovecot-1.2.9/libexec/dovecot/imap-login login_executable(imap): /opt/dovecot-1.2.9/libexec/dovecot/imap-login login_executable(pop3): /opt/dovecot-1.2.9/libexec/dovecot/pop3-login mail_uid: vmail mail_gid: vmail mail_location: maildir:/vmail/spool/%u:LAYOUT=fs mail_executable(default): /opt/dovecot-1.2.9/libexec/dovecot/imap mail_executable(imap): /opt/dovecot-1.2.9/libexec/dovecot/imap mail_executable(pop3): /opt/dovecot-1.2.9/libexec/dovecot/pop3 mail_plugin_dir(default): /opt/dovecot-1.2.9/lib/dovecot/imap mail_plugin_dir(imap): /opt/dovecot-1.2.9/lib/dovecot/imap mail_plugin_dir(pop3): /opt/dovecot-1.2.9/lib/dovecot/pop3 lda: postmaster_address: postmaster(a)handcraftedcomputers.com.au auth_socket_path: /var/run/dovecot-1.2.9/auth-master auth default: verbose: yes passdb: driver: passwd-file args: /vmail/auth/passwd userdb: driver: static args: uid=vmail gid=vmail socket: type: listen master: path: /var/run/dovecot-1.2.9/auth-master mode: 384 user: vmail group: vmail -- Regards, Daryl Tester Member of the Amalgamated Australian Association Against Apostrophe Abuse. (formerly the 6A's - no, wait ...).

4 7

[Dovecot] Dovecot v2.0.beta3 quota using userdb
by e-frog 20 Mar '10

20 Mar '10

Hello Timo, I'm playing around with the new Dovecot v2.0.beta3 and don't seem to be able to get quotas working from userdb. I didn't change the SQL query which was working for 1.2.10. Feb 20 19:34:06 ubuntu-test dovecot: auth: sql(test,192.168.156.99): SELECT home, mail, uid, gid, concat('*:storage=', quota_limit, 'MB') AS quota_rule FROM users WHERE username = 'test' ... Feb 20 19:34:06 ubuntu-test dovecot: imap(test): Quota root: name=user backend=dict args=:proxy::dictionary Feb 20 19:34:06 ubuntu-test dovecot: imap(test): dict quota: user=test, uri=proxy::dictionary, noenforcing=0 ... Note there is no "Quota rule". However it seems to work by adding "quota_rule = *:storage=1024MB" directly to plugin.conf: ... Feb 20 19:39:15 ubuntu-test dovecot: imap(test): Quota root: name=user backend=dict args=:proxy::dictionary Feb 20 19:39:15 ubuntu-test dovecot: imap(test): Quota rule: root=user mailbox=* bytes=1073741824 messages=0 Feb 20 19:39:15 ubuntu-test dovecot: imap(test): dict quota: user=test, uri=proxy::dictionary, noenforcing=0 ... Has there anything changed in dovecot 2.0 in this perspective? Thanks, e-frog ------------------------------------------------------------------------------------------ # 2.0.beta3: /etc/dovecot/dovecot.conf # OS: Linux 2.6.31-19-generic-pae i686 Ubuntu 9.10 auth_debug = yes auth_socket_path = /var/run/dovecot/auth-userdb deliver_log_format = msgid=%m: from=%f: %$ dict { dictionary = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_debug = yes namespace { hidden = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace { location = virtual:/etc/dovecot/virtual:INDEX=~/.maildir/control prefix = virtual/ separator = / subscriptions = no type = private } passdb { args = /etc/dovecot/dovecot-sql.conf deny = no driver = sql master = no pass = no } plugin { fts = squat fts_squat = partial=4 full=10 quota = dict:user::proxy::dictionary sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve-global/ sieve_dir = ~/.sieve } postmaster_address = postmaster@ubuntu-test protocols = imap lmtp managesieve quota_full_tempfail = yes service managesieve-login { inet_listener sieve_deprecated { port = 2000 } } service dict { unix_listener dict { mode = 0666 } } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/lmtp-server { group = postfix mode = 0660 user = postfix } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes

3 7

[Dovecot] INBOX of a shared namespace appears to be always subscribed
by Holger Richter 20 Mar '10

20 Mar '10

In dovecot 1.2.10 I run into the following problem: Our users are entitled to share their personal mailboxes. This works. But if user A shares any of its mailboxes with user B, then dovecot always reports the INBOX of user A as subscribed by user B. No matter whether user B really subscribed the INBOX of A, or whether user A permitted user B the access to its INBOX. The problem is caused by the repeated call of LSUB. Starting with the second call LSUB always shows INBOX as subscribed. To reproduce: -> telnet imap.xx.yy 143 1 LOGIN user password 2 LSUB "" shared/* => shows shared/UserB/folderXX 3 LSUB "" shared/* => shows shared/UserB/INBOX shared/UserB/folderXX 4 LSUB "" shared/* => shows shared/UserB/INBOX shared/UserB/folderXX Regards, Holger

5 8

[Dovecot] problem with master db and dovecot-2.0.beta3
by Oliver Eales 19 Mar '10

19 Mar '10

Hello, i am currenty testing dovecot 2.0.beta3 and ran into a problem with the master-db setting. For our webmail access we are sucessfully using the following settings with dovecot-1.2.10 auth_master_user_separator =* auth default { mechanisms = plain passdb passwd-file { args = /etc/dovecot/passwd.masterusers master = yes pass = yes } passdb ldap { args = /etc/dovecot/dovecot-ldap.conf } } when "converting" the settings to version 2.0 i tried the following: auth_mechanisms = plain auth_master_user_separator = * passdb { driver = passwd-file args = /etc/dovecot/passwd.masterusers master = yes pass = yes } passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf } But when i try to login, the auth process gets stalled with the following log entry: auth: Fatal: Master passdb can't have pass=yes if there are no passdbs master: Error: service(auth): command startup failed, throttling Am i doing something wrong or is it problem with the 2.0-beta ? Regards, Oliver Eales

2 3

[Dovecot] Triggering mailbox fetch
by Brian Candler 19 Mar '10

19 Mar '10

Greetings, I would like to migrate mailboxes into a Dovecot system by using an IMAP transfer from the old system - and I'd like this to take place automatically at the time the user first logs into the new system. I have a script which will perform an IMAP fetch and dump it into the local maildir. In courier-imap I could create a '.loginexec' file which is executed when the user logs in, and gets deleted if it completes successfully. I'm trying to find something similar for Dovecot. * fetchmail-wakeup is the right kind of idea, but I need it to stop running once mail has been transferred successfully once. It also needs different parameters for each user (e.g. user/pass used to login to the remote IMAP server) * The convert_mail plugin only works with local mail spools, as far as I can tell. I'm not sure how it determines whether conversion has already taken place (whether the target maildir already exists?) * autocreate only creates empty mailboxes Any of these might be a starting point for developing my own plugin, but does anyone here know of an existing one which would do the job? Thanks, Brian.

3 3

[Dovecot] Problem with quota recreation
by Uroš Gruber 19 Mar '10

19 Mar '10

Hi, I'm migrating from cyrus to dovecot 1.2.10 with cyrus2dovecot. I've setup quota with mysql dict and while testing delivery quota is working fine. The only problem is when i migrate mailbox from cyrus to dovecot and when bytes and messages is set to 0. I tried with x GETQUOTAROOT Inbox but the quota usage is not recalculated and when a new message is delivered quota is calculated only on the new message. Any help would be greatly appreciated. Best regards Uros

2 2

[Dovecot] ACL + shared-imap + nested AD groups
by Martin Ott 19 Mar '10

19 Mar '10

Hi, I'm looking for a solution to use nested AD groups for authorization in shared-imap folders(namespace public). As a simple hack to determine the (primary) groups of a user we use the following setup with a post-login script: in dovecot.conf ... protocol imap { mail_executable = /etc/dovecot/ldap_groups.sh ... ldap_groups.sh ACL_GROUPS=`ldapsearch -h ldapserver -p 3268 -s sub -D "cn=ldap mail, ou=user, ou=global, ou=xxx, dc=xxx, dc=local" -b "ou=xxx, dc=xxx, dc=local" "(&(sAMAccountName=$USER))" -LLL memberOf -w password | grep "memberOf: CN=" | sed 's/memberOf: CN=//' | sed 's/,OU=.*//' | tr "\n" "," | sed 's/, $//'` export ACL_GROUPS exec /usr/libexec/dovecot/imap $* Does anyone know, how to simply get the groups of groups with such a post-login script? Thanks, Martin

1 0

[Dovecot] 2.0beta3 10876:370ee9717a6c broke listen on literal IPv6 address
by Bernhard Schmidt 19 Mar '10

19 Mar '10

Hi, apparently the following change in dovecot hg * New revision (10876:370ee9717a6c) in dovecot Mercurial repository: - config: Forgot to add header file. broke listen = 83.170.6.69, 2001:1b10:1000::110:1:1 mail.svr02.mucip.net:~# dovecot -F -c /etc/dovecot/dovecot.conf doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:29: listen=..:port has been replaced by service { inet_listener { port } } doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: duplicate listener: 1: Is this even possible? That doesn't make sense to me, but Stephan's +29 works fine for me, +30 (with just that change according to changelog) doesn't. Bernhard

2 5

[Dovecot] GlusterFs - Any new progress reports?
by Ed W 18 Mar '10

18 Mar '10

GlusterFs always strikes me as being "the solution" (one day...). It's had a lot of growing pains, but there have been a few on the list had success using it already. Given some time has gone by since I last asked - has anyone got any more recent experience with it and how has it worked out with particular emphasis on Dovecot maildir storage? How has version 3 worked out for you? Anyone had success using some other clustered/HA filestore with dovecot who can share their experience? (OCFS/GFS over DRBD, etc?) My interest is more in bootstrapping a more highly available system from lower quality (commodity) components than very high end use Thanks Ed W

8 18

Re: [Dovecot] sieve vacation
by Martin F. Foster 18 Mar '10

18 Mar '10

Following from Steffen Kaiser's response, RFC5230 explains the conditions necessary for the Sieve Vacation extension to trigger a response. This says: "Vacation" MUST NOT respond to a message unless the recipient user's email address is in a "To", "Cc", "Bcc", "Resent-To", "Resent-Cc", or "Resent-Bcc" line of the original message. So your scenario 4 happens when the sender is only in the envelope, and not in the headers. For example: this transaction will get a response because the mailbox address is in the To: header ehlo there.com mail from: <dude(a)there.com> rcpt to: <user(a)domain.tld> << envelope recipient, mailsystem routes with this information data To: "Some User" <user(a)domain.tld> << header recipient must be correlated for Sieve Vacation to send a response From: "Dude" <dude(a)there.com> Subject: message Hi there . This transaction will not get a response, and will trigger the "discarding vacation response for message implicitly delivered to <user(a)domain.tld> " log: ehlo there.com mail from: <dude(a)there.com> rcpt to: <user(a)domain.tld> data Subject: message Hi there . Cheers, -Martin Foster Le 12-Feb-10 21:00, dovecot-request(a)dovecot.org a écrit : > Message: 9 > Date: Fri, 12 Feb 2010 09:18:23 +0100 > From: Lampa<lampacz(a)gmail.com> > Subject: [Dovecot] sieve vacation > To: Dovecot Mailing List<dovecot(a)dovecot.org> > Message-ID: > <9aef75b11002120018v69f185b5hb0a9e0f7dad1e5c5(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hello, > > scenario: > > OK 1. created vacation script (see below) > OK 2. send message fromuser(a)anotherdomain.tld touser(a)domain.tld => > got auto vacation response (2010-02-11T19:42:13) > OK 3. send message fromuser(a)anotherdomain.tld touser(a)domain.tld => > no response (is ok because ":days 1" settings) (2010-02-11T19:47:46) > BAD 4. send message fromanotheruser(a)anotherdomain.tld to > user(a)domain.tld => no response (2010-02-11T19:48:04) > > > Why is discarding vacation response for message implicitly delivered > to<user(a)domain.tld> ? > > log: > 2010-02-11T19:42:13.669321+01:00 hermes dovecot: > deliver(user(a)domain.tld): sieve: > msgid=<052a01caab49$ec4752e0$c4d5f8a0$@tld>: sent vacation response to > <user(a)anotherdomain.tld> > 2010-02-11T19:42:13.732541+01:00 hermes dovecot: > deliver(user(a)domain.tld): sieve: > msgid=<052a01caab49$ec4752e0$c4d5f8a0$@tld>: stored mail into mailbox > 'INBOX' > 2010-02-11T19:47:46.271534+01:00 hermes dovecot: > deliver(user(a)domain.tld): sieve: > msgid=<053201caab4a$b295ece0$17c1c6a0$@tld>: discarded duplicate > vacation response to<user(a)anotherdomain.tld> > 2010-02-11T19:47:46.275891+01:00 hermes dovecot: > deliver(user(a)domain.tld): sieve: > msgid=<053201caab4a$b295ece0$17c1c6a0$@tld>: stored mail into mailbox > 'INBOX' > 2010-02-11T19:48:04.958622+01:00 hermes dovecot: > deliver(user(a)domain.tld): sieve: > msgid=<053701caab4a$bda90220$38fb0660$@tld>: discarding vacation > response for message implicitly delivered to<user(a)domain.tld> > 2010-02-11T19:48:04.965875+01:00 hermes dovecot: > deliver(user(a)domain.tld): sieve: > msgid=<053701caab4a$bda90220$38fb0660$@tld>: stored mail into mailbox > 'INBOX' > > vacation script: > ----------- > require "vacation"; > > vacation > :days 1 > :subject "Auto reply" > > "auto reply message"; > -------------- > > Thank you > -- Lampa ------------------------------

3 4

[Dovecot] Dovecot 2.0 b13e01d82083
by Renaud Allard 18 Mar '10

18 Mar '10

Hello, I was trying to compile Dovecot 2.0 b13e01d82083, and I found this when doing make: Making all in lib test -f UnicodeData.txt || wget http://www.unicode.org/Public/UNIDATA/UnicodeData.txt /bin/sh: wget: not found I think it's probably not the best idea to assume everyone has wget installed. Perhaps it is installed by default on linux, but probably not on all other platforms. Why not just include the UnicodeData.txt file? Best Regards

2 1

[Dovecot] quota usage
by Papp Tamás 18 Mar '10

18 Mar '10

hi All! Dovecot's version is 1.2.11-0~auto+0 from http://xi.rename-it.nl/debian/ . dovecot.conf: dict { quota = mysql:/data/apps/dovecot/dict-sql.conf #expire = db:/var/lib/dovecot/expire.db } /data/apps/dovecot/dict-sql.conf: connect = host=127.0.0.1 dbname=db user=user password=pw map { pattern = priv/quota/storage table = quota username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota username_field = username value_field = messages } The problem is that the mailbox is almost empty: $ du -sh . 228K . But the quota usage show something else: mysql> select bytes,messages from quota where username='<user>'; +-----------+----------+ | bytes | messages | +-----------+----------+ | 217699358 | 987 | +-----------+----------+ What could be a problem, how can I fix this? Thank you very much, tamas

2 1

[Dovecot] .mailboxlist location
by Dave Brenner 18 Mar '10

18 Mar '10

Greetings. On our 1.2.9 setup, we are finding that .mailboxlist (we recompiled to use this name rather than .subscriptions) ends up in the user's ~/mail folder. We'd like this file to be stored in ~/ instead. Is this possible without changing namespaces (for UW compatibility) and/or userdb mail location? Thanks! -- Dave Brenner - david(a)toledotel.com The Toledo Telephone Company, Inc.

2 4

[Dovecot] v1.2.11 released
by Timo Sirainen 18 Mar '10

18 Mar '10

http://dovecot.org/releases/1.2/dovecot-1.2.11.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.11.tar.gz.sig mbox users really should upgrade, because by sending a message with a huge header you could basically cause a DoS (this problem exists only with v1.2.x, not with v1.0 or v1.1). - mbox: Message header reading was unnecessarily slow. Fetching a huge header could have resulted in Dovecot eating a lot of CPU. Also searching messages was much slower than necessary. - mbox, dbox, cydir: Mail root directory was created with 0770 permissions, instead of 0700. - maildir: Reading uidlist could have ended up in an infinite loop. - IMAP IDLE: v1.2.7+ caused extra load by checking changes every 0.5 seconds after a change had occurred in mailbox

2 2

Re: [Dovecot] I stream read - stale NFS file handle (reboot of server)
by Damon Atkins 18 Mar '10

18 Mar '10

In the old days NFS Shared Path had a static handle (ie a number), normal based on some number pulled out of the file system/inode. To fix (well work around) a security issue, for about 10+ years now, when a NFS server reboots, it generates a new random handle for the NFS Share. (sever may generate a new random handle per mount request) The NFS Stale Handle happens when the client is still using the old NFS handle, the only fix is a remount Some NFSv3 server let you fix the handle id for NFS share so it does not change over reboots. (this is how NFS clustering works, sometimes you need to install cluster software if the exportfs/share command does not let you hard code the fsid by hand. The other option is to use NFSv4 which is design to handle reboots by servers.

4 6

[Dovecot] dovecot 2.0beta3 installation
by Renaud Allard 17 Mar '10

17 Mar '10

Hello, I tried to install dovecot 2.0 beta3 and deliver seems to look for its config file in unusual places. In my exim logs, I get: 010-03-17 13:39:24 [31257] 1NrsWt-0004T0-1K <email(a)example.com>: dovecot_delivery transport output: lda: Fatal: User lookup failed: net_connect_unix(/opt/dovecot/etc/dovecot/dovecot.conf) failed: No such file or directory 2010-03-17 13:39:24 [31257] 1NrsWt-0004T0-1K == email(a)example.com (email(a)example.com) <email(a)example.com> R=local_user T=dovecot_delivery defer (0): Child process of dovecot_delivery transport returned 75 (could mean temporary error) from command: /opt/dovecot/libexec/dovecot/deliver Dovecot have been started with the following command: /opt/dovecot/sbin/dovecot -F -c /etc/dovecot/dovecot2.conf Furthermore, it has been compiled with: --prefix=/opt/dovecot --sysconfdir=/etc I don't see why it searches for /opt/dovecot/etc/dovecot/dovecot.conf Also, I didn't really find out how to convert the v1.2 config snippet: auth default { mechanisms = digest-md5 cram-md5 ntlm login plain passdb passwd-file { args = /etc/cram.pwd } userdb passwd { } userdb passwd-file { args = /etc/passwd } socket listen { client { path = /var/run/dovecot/auth-client mode = 0666 } } user = exim } I tried the following, but it does not seem to work as I get an authentication socket protocol error service auth { unix_listener /var/run/dovecot/auth-client { mode = 0666 } } Thanks for you help

2 6

[Dovecot] Testing EXTERNAL AUTHENTICATION
by Stephen Feyrer 17 Mar '10

17 Mar '10

Hi. I'm trying to test EXTERNAL AUTHENTICATION in Dovecot. To do this I first configured Thunderbird and Opera to use my server, neither of them were successful. As a result I contacted both organisations to enquire if they supported EXTERNAL AUTHENTICATION in their products. Thunderbird responded and said yes. However, on closer inspection my contact at Thunderbird identified that support for EXTERNAL AUTHENTICATION was poor at best and then only in SMTP. From that point on, my contact has been trying to implement support in Thunderbird. I've also try to test using openssl s_client which is detailed below. As far as I can tell my problems appear after the authentication. I don't know what the problem is only that there is one. [~] # dovecot -n # 1.2.10: /opt/etc/dovecot/dovecot.conf # OS: Linux 2.6.12.6-arm1 armv5tejl ext3 base_dir: /opt/var/run/dovecot/ log_path: /opt/var/log/dovecot/messages info_log_path: /opt/var/log/dovecot/info protocols: imaps listen: [::] ssl_ca_file: /opt/etc/domain.ca/cacrl.pem ssl_cert_file: /opt/etc/domain.ca/newcerts/mail.cer ssl_key_file: /opt/etc/domain.ca/private/mail.key ssl_cipher_list: ALL:!LOW:!SSLv2 ssl_verify_client_cert: yes verbose_ssl: yes login_dir: /opt/var/run/dovecot//login login_executable: /opt/libexec/dovecot/imap-login login_process_size: 32 mail_location: dbox:/share/MD0_DATA/mail/%u mail_debug: yes dbox_rotate_days: 0 imap_id_send: * imap_id_log: * lda: postmaster_address: postmaster(a)ksudra.net auth default: mechanisms: EXTERNAL realms: ksudra.net default_realm: ksudra.net user: admin verbose: yes debug: yes ssl_require_client_cert: yes ssl_username_from_cert: yes passdb: driver: passwd-file args: /opt/etc/dovecot/passwd userdb: driver: passwd [~] # openssl s_client -cert Stephen.pem -connect 10.1.1.245:993 <-- snip --> SSL handshake has read 4460 bytes and written 2451 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 4096 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA Session-ID: [...] Session-ID-ctx: Master-Key: [...] Key-Arg : None Krb5 Principal: None Start Time: 1268756439 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain) --- * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=EXTERNAL] Dovecot ready. 01 AUTHENTICATE EXTERNAL + 01 list "" * 01 NO [ALERT] Invalid base64 data in continued response 01 select inbox 01 BAD Error in IMAP command received by server. 02 select inbox 02 BAD Error in IMAP command received by server. DONE [~] # tail -f /opt/var/log/dovecot/info Mar 16 16:51:14 auth(default): Info: new auth connection: pid=9176 Mar 16 16:51:16 imap-login: Info: Valid certificate: /O=ksudra.net/OU=Ksudra CA/emailAddress=certs(a)ksudra.net/L=Wilmslow/ST=Cheshire/C=GB/CN=ksudra.net Mar 16 16:51:16 imap-login: Info: Valid certificate: /C=GB/ST=Cheshire/O=ksudra.net/OU=Stephen Feyrer/CN=Stephen Mar 16 16:52:06 auth(default): Info: client in: AUTH 1 EXTERNAL service=imap secured valid-client-cert cert_username=Stephen lip=10.1.1.245 rip=10.1.1.4 lport=993 rport=45379 Mar 16 16:52:06 auth(default): Info: client out: CONT 1 Mar 16 16:52:42 imap-login: Info: Valid certificate: /O=ksudra.net/OU=Ksudra CA/emailAddress=certs(a)ksudra.net/L=Wilmslow/ST=Cheshire/C=GB/CN=ksudra.net Mar 16 16:52:42 imap-login: Info: Valid certificate: /C=GB/ST=Cheshire/O=ksudra.net/OU=Stephen Feyrer/CN=Stephen Mar 16 16:52:42 auth(default): Info: client in: AUTH 1 EXTERNAL service=imap secured valid-client-cert cert_username=Stephen lip=10.1.1.245 rip=10.1.1.4 lport=993 rport=45381 Mar 16 16:52:42 auth(default): Info: client out: CONT 1 Mar 16 16:52:42 auth(default): Info: client in: CONT<hidden> Mar 16 16:52:42 auth(default): Info: EXTERNAL(Stephen,10.1.1.4): Invalid base64 data in continued response Mar 16 16:52:42 auth(default): Info: client out: FAIL 1 reason=Invalid base64 data in continued response Mar 16 16:52:42 auth(default): Info: new auth connection: pid=9182 Mar 16 16:52:45 auth(default): Info: client in: CONT<hidden> Mar 16 16:52:45 auth(default): Info: EXTERNAL(Stephen,10.1.1.4): Invalid base64 data in continued response Mar 16 16:52:45 auth(default): Info: client out: FAIL 1 reason=Invalid base64 data in continued response Mar 16 16:52:47 imap-login: Info: Aborted login (cert required, client didn't start TLS): method=EXTERNAL, rip=10.1.1.4, lip=10.1.1.245, TLS Mar 16 16:54:36 imap-login: Info: Valid certificate: /C=GB/ST=Cheshire/O=ksudra.net/OU=Stephen Feyrer/CN=Stephen Mar 16 16:54:36 auth(default): Info: new auth connection: pid=9188 Mar 16 16:54:37 auth(default): Info: client in: AUTH 1 EXTERNAL service=imap secured valid-client-cert cert_username=Stephen lip=10.1.1.245 rip=10.1.1.4 lport=993 rport=49113 Mar 16 16:54:37 auth(default): Info: client out: CONT 1 Mar 16 16:54:37 auth(default): Info: client in: CONT<hidden> Mar 16 16:54:37 auth(default): Info: EXTERNAL(Stephen,10.1.1.4): Invalid base64 data in continued response Mar 16 16:54:37 auth(default): Info: client out: FAIL 1 reason=Invalid base64 data in continued response Mar 16 16:54:42 imap-login: Info: Aborted login (cert required, client didn't start TLS): method=EXTERNAL, rip=10.1.1.4, lip=10.1.1.245, TLS Mar 16 16:54:49 imap-login: Info: Valid certificate: /O=ksudra.net/OU=Ksudra CA/emailAddress=certs(a)ksudra.net/L=Wilmslow/ST=Cheshire/C=GB/CN=ksudra.net Mar 16 16:54:49 imap-login: Info: Valid certificate: /C=GB/ST=Cheshire/O=ksudra.net/OU=Stephen Feyrer/CN=Stephen -- kind regards Stephen Feyrer.

3 12

[Dovecot] sieve fileinto rule (pigeonhole)
by Oliver Eales 17 Mar '10

17 Mar '10

Hello, i discovered that when a sieve rule "fileinto drawer;" tries to deliver a mail into a non existent drawer, the drawer gets created. This is neat, but is there also a way to automatically subcribe to the created folder ? Regards, Oliver Eales

2 4

[Dovecot] qmail-secretary plugin for dovecot deliver
by Rajkumar S 17 Mar '10

17 Mar '10

Hi, I have been using qmail-ldap for quite some time and now moved to postfix/dovecot. One feature that I miss is that provided by qmail-secretary. qmail-secretary basically is a mail list manager with following features: 1 no limit, just explode to all members 2 members only, as the name says; only members are allowed (based on envelope sender, so not very secure, everybody can fake that) 3 sender confirm, sender has to confirm submission and return address like DJBs qmail-secretary 4 moderated, moderator(s) have to accept every message; there are DN and RFC822 moderators All configuration (name, members, moderated etc...) are taken from LDAP. I had gone through the code and from what I understand for each 4 delivery types it works as follows: 1. Just deliver to all recipients (say, inject it via sendmail). 2. verify if envelope sender is in allowed list and proceed as above. 3. 1. create a random hash 2. save the mail in new/ with hash as filename 3. create a new mail with listname-confirm-hash(a)domain.com and send 4. If that mail comes back, deliver the mail to all recipients. 4. 1. as above but using listname-approve-hash and list-name-reject-hash 2. move the msg to cur/ 3. if appropriate reply comes retrieve the mail from cur/ and send to all recipient. qmail-secretary is invoked by qmail-local and thus this is a nice candidate for a deliver plugin. Before I start coding I just want to check if there is any gotchas that I am missing? I assume all these operations can be performed as a deliver plugin and that deliver plugin is the correct place for such functionality. It goes without saying that I would be contributing this plugin back to dovecot. with regards, raj

4 9

Re: [Dovecot] [xmail] XMail + Dovecot
by Sabahattin Gucukoglu 17 Mar '10

17 Mar '10

What, exactly, is the problem? How do you want Dovecot and XMail to work together? I am setting up Dovecot to read from standard Maildirs in user home directories, because I am using a separate delivery agent (TMDA but would work for maildrop, Dovecot's deliver program and others) to deliver mails using mailproc.tab. So, even while XMail runs as root, Dovecot need not and there is no problem getting it to work just like with other MTAs. XMail can't help with delivery to Maildir because it runs as root, and unless you mess about with packet filters to non-root it you'll still end up using for instance XACLs to allow Dovecot to read the mails. For authentication of XMail to Dovecot you would have to write external authentication helpers that use Dovecot's protocol. Or, you can use checkpassword or PAM-POP3 or something else to try getting Dovecot to authenticate against the active XMail list of users. Or you can just do what I do, maintain two databases and keep them in sync. Cheers, Sabahattin

1 0

[Dovecot] Design: Asynchronous I/O for single/multi-dbox
by Timo Sirainen 17 Mar '10

17 Mar '10

The long term plan is to get all of Dovecot disk I/O asynchronous. The first step to that direction would be to make dbox/mdbox I/O asynchronous. This might also allow mbox/maildir to become partially asynchronous. http://www.dovecot.org/list/dovecot/2009-December/045481.html already started describing how the lib-storage API could be changed to support high-latency storages. Adding support for all of the paralellism would be nice, but probably not necessary as the first step. Then again, the API changes are necessary, so the parallelism optimizations probably aren't a huge task on top of that. Besides the API changes described in the above link, another change that's necessary is to add mail_get_nonblocking_stream(). The returned stream can return EAGAIN whenever it would need to block. Whenever sending message data to client, this stream would have to be used. It would also be used internally by all of message parsing/searching code. Luckily all of that already supports nonblocking input or can be easily modified to support it. Below are some thoughts how to go forward with this. I originally thought about writing a more specific plan, but I think this is good enough now to start coding. The target Dovecot version is v2.1, not v2.0. Filesystem API ============== The idea is to first abstract out all POSIX filesystem accessing in dbox/mdbox code. Non-blocking I/O works pretty nicely for socket I/O, so I thought I'd use a similar API for disk I/O as well: handle = open(path, mode) - this function can't fail. it's executed asynchronously. - mode=read-only: no writing to file - mode=append: appending to file is allowed handle = create(path, mode, permissions) - this function can't fail. it's executed asynchronously. - mode=fail-if-exists: commit() fails if file already exists - mode=replace-if-exists: commit() replaces file if it already exists - permissions: i'm not entirely sure how this works yet. but it should contain mode and gid in some format set_input_callback(handle, callback, context) set_output_callback(handle, callback, context) - call the callback when more data can be read/written ret = pread(handle, buf, size, offset) - just like pread(), but can fail with EAGAIN if there are no bytes already buffered. so the idea is that the backend implementation would buffer/readahead data, which would be returned by this call. this would require memcpy()ing all data, but it might get too complex/fragile if it was asynchronously written to given buffer. ret = write(handle, buf, size) - append data to given file and return how many bytes were actually added to write buffer. works in a similar way than writing to socket. data can only be appended to files, there is no support for overwriting data. - no writes will be visible to reads until commit() is called ret = commit(handle, [filename]) - commit all previous writes to disk. either returns success/EAGAIN. - if filename is given and a new file is being created, the filename is changed to the given one instead of using the original path's filename. this is needed because e.g. mdbox saving can write many temp files in a single transaction and only at commit stage it locks the index files and knows what the filenames will be. rollback(handle) - rollback all previous writes. close(handle) - if file was created and not committed, the temp file will be deleted - does implicit rollback ret = try_lock(handle) - this isn't an asynchronous operation! it assumes that locking state is kept in memory, so that the operation will be fast. if backend doesn't support locking or it's slow, single-dbox should be used (instead of multi-dbox), because it doesn't need locking. - returns success or "already locked" - only exclusive locking is possible Async IO streams ================ Async input streams are created with FS API handle, so it's possible to start reading from them before the file has even been open()ed. The callers must be aware of this and realize that read() can fail with ENOENT, etc. Async input streams' read() would work exactly as file_istream works for non-blocking sockets: It would return data that is already buffered in memory. If there's nothing, it returns EAGAIN. The FS API's set_input_callback() can be used to set a callback function that is called whenever there's more data available in the buffer. Async output streams also work the same as non-blocking file_ostreams: write() returns the number of bytes added to buffer. When buffer becomes full, it starts returning EAGAIN. The ostream handles flushing internally the same way as file_ostreams does, although instead of using io_add(IO_WRITE) it uses FS API's set_output_callback(). If callers need to know when more data can be written or when all of the data has been written, it can override the ostream's flush_callback, just like with file_ostreams. Async IO for FS API backend =========================== So now that all of the APIs have been designed, all that's needed to do is to write a simple FS API implementation using kernel's async IO API, right? Wrong. There is no usable async IO API in Linux, and probably nowhere else either: * POSIX AIO isn't supported by Linux kernel. And even if it was, it only supports async reads/writes, not async open(). * Linux kernel has its own native AIO implementation! ..But it only works with direct IO, which makes it pretty much useless for almost everyone. There have been many different attempts to get buffered AIO support to Linux, but all of them have failed. So for now the only practical way is to implement it with threads. There are several libraries that could make this easier.. But all of them enable (and require) full thread safety for libc calls. I don't really like that. Dovecot isn't using threads, I shouldn't pay the penalty of using extra locking when it's really not necessary. So I was thinking about doing the async IO in two ways: 1) For Linux/x86/x86-64 (and maybe others) implement a version that creates threads with clone() and uses lockless queues for communicating between the async io worker threads. The threads won't use malloc() or any other unsafe calls, so this should be pretty nice. 2) Fallback version that uses pthreads with mutexes. Is 2) going to be noticeably slower than 1)? Probably not.. In both cases there is also the problem of how many worker threads to create. I've really no idea, kernel would be so much better in deciding that.. I guess that also depends on how many processes Dovecot is configured to run on (and how busy they are at the moment). Maybe it could be just a globally configurable number of threads/process, defaulting to something like 10. dbox changes ============ Most of the dbox code shouldn't be too difficult to change to using the FS API. The one exception is writing messages. Currently the format looks like: <dbox header magic (2 bytes)> <dbox message header, which contains message size><lf> <message> <dbox metadata magic (2 bytes)><lf> <dbox metadata> <lf> The problem is that the message size isn't always known before the message is written. So currently the code just pwrite()s the size afterwards, but this is no longer possible with the new FS API. One possibility would be to buffer the message in memory, but that could waste a lot of memory since messages can be large. So the only good solution is to change the dbox file format to contain the message size after the message. At the same time the dbox format could be cleaned up from old broken ideas as well. The reading code could support the old version format as well, because reading isn't a problem. The new dbox format could look like: <dbox header magic (2 bytes)> <dbox unique separator (random 16 bytes or so)><lf> <message> <dbox metadata magic (2 bytes)> <dbox unique separator, same as above><message size><lf> <dbox metadata, last item being metadata size> <lf> The unique separator exists there primarily for fixing corrupted dbox storage, so it can (quite) reliably recognize where a message ends. Multi-dbox's indexes contain already the message offset + size of (message+metadata), i.e. offset+size = offset of next message. The size is primarily used to figure out if more data can be appended to the file (so it won't grow too large). This size could just be changed to become message's size and the check just changed to assume metadata size would be e.g. 512 bytes. It won't really matter in practise. So then the reading code could get the message's size from the index. Single-dbox doesn't have such index. There are two ways to solve the problem there (both actually would work for multi-dbox too): 1) Metadata block can be found by reading backwards from end of file. For example read the last 512 bytes of the file and find the metadata magic block. Get the message's size from there. 2) Create an istream that simply reads until it reaches dbox metadata magic and unique separator. And to be absolutely sure it reached the correct end of message, it can also check that the rest of the data in the stream contains only a valid metadata block.

8 28