- dovecot - dovecot.org

[Dovecot] Strange behaivour with extended characters
by Armando Soto Baeza 20 Apr '09

20 Apr '09

Hi there. I am using dovecot in almost all the mail servers I configure, but I have not noticed some problems till now, when I configured a server for a japanese language based customer. Now I know, the problem is not about this customer, but it seems to be a constant in all my servers (for some reason we did not noticed that before). The situation is like this. When receving mail with extended (not only japanese) characters in the subject, Outlook Express does not recognize them. Most of our users do not use OE, but most of the japanese do. This is not all. When extended chars are also in the body, they look well when the maqil still arrives, but if forwarded to another account, or when mail is an answer to another, extended characters are not well displayed. In some tests we have done, I found more or less the same is happening when using squirrelmail. The funny thing is that the problem dos not appear when using Evolution or Outlook (the MS Office component). I move some pamrs in dovecot.conf and get some results (before moving them, the problem extended to attachements), but still remains as described. Somebody has seen such a behaivour and solved it? I was thinking to change dovecot for another agent, but will be happier using dovecot. Any suggestion? Thanks in advice.

2 1

[Dovecot] [SIEVE: Redirect] Double ">" in forwarded envelop sender address => Gmail syntax error
by Toorop 20 Apr '09

20 Apr '09

Hi, Plateform: gentoo + qmail My deliver line is in a .qmail-USER file: |/var/qmail/bin/preline /usr/libexec/dovecot/deliver -f ${SENDER:-<>} -d user(a)domain.tld I notice that sieve implementation in Dovecot use double ">" for the envelop sender when there is a redirect command in sieve script. (i've tried preline -f, without -f ${SENDER:-<>},... but nothing change for the the envelop sender syntax, alway the double ">") And that fact breaks forwardin to Gmail. Gmail reply that there is a syntax error probably due to the double "<<" (<<address>> and not <address>) as we can see in the log behind: Dovecot logs: deliver(stephane@XXXX): Apr 20 16:06:44 Info: Sending a forward to <XXXX(a)gmail.com> with return path <<stephane@XXXXXX>> deliver(stephane@XXXXX: Apr 20 16:06:44 Info: msgid=<49EC816D.9090403(a)XXXXX.com>: forwarded to <XXXXX(a)gmail.com> qmail-send logs: 2009-04-20 16:06:44.877793500 info msg 14815541: bytes 1290 from <<stephane(a)XXXXX.com>> qp 17780 uid 89 2009-04-20 16:06:44.892303500 starting delivery 6356: msg 14815541 to remote XXXXX(a)gmail.com 2009-04-20 16:06:44.982424500 delivery 6356: failure: Connected_to_209.85.219.1_but_sender_was_rejected./Remote_host_said:_555_5.5.2_Syntax_error._1si7169155ewy.101/ 2009-04-20 16:06:44.982502500 status: local 0/10 remote 0/80 Is there something to do to fix that probleme ? Thanks. -- Toorop <O> http://www.flickr.com/photos/toorop/

3 3

[Dovecot] 0 mails available even if mails in mailbox
by Raphael Thoma 20 Apr '09

20 Apr '09

Hello We are currently facing the problem, that dovecot doesn't return any messages (Pop3: +OK 0 messages) even if there are messages in the cur and new directory (maildir format). The logfile does not contain any information other than login/logout. After I deleted the dovecot.index file, all messages are available and everything works as expected. According to the wiki page [1] the main index file should be synchronized when the cur and new timestamps changed. I suppose this synchronization doesn't work correctly because the problem still existed after I changed the timestamps manually. Dovecot version: 10.0.14 Operating System: FreeBSD 7.0-RELEASE-p1 CPU Arch: amd64 Filesystem: NFS Clients: The problem exists on Pop3 and IMAP. It doesn't matter which client. I could reproduce the problem on outlook, thunderbird and even on telnet. Reproduced: +OK Dovecot ready. user user(a)domain.com +OK pass password +OK Logged in. list +OK 0 messages: After deleting dovecot.index: +OK Dovecot ready. user user(a)domain.com +OK pass password +OK Logged in. list +OK 20 messages: It seems to be a problem with the index-file from dovecot which doesn't seem to be synchronized. What could be the reason for this behaviour? How can we fix this issue for all customers? Kind regards Raphael Thoma [1] http://wiki.dovecot.org/IndexFiles

3 5

[Dovecot] Quota not being dispayed correctly in 1.2rc2 (with proof)
by Ralf Hildebrandt 20 Apr '09

20 Apr '09

User reports: 0% of 640MB -- which cannot be true. I logged in as masteruser and was able to confirm this. I'm getting "0.0% von 640.0MB" == "0.0% of 640.0MB" His maildirsize file is attached. His mailbox is nearly full. Manual login: # telnet localhost 143 Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. . LOGIN user*masteruser topsecretpassword . OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH QUOTA] Logged in . SELECT INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 3261 EXISTS * 0 RECENT * OK [UIDVALIDITY 1179137269] UIDs valid * OK [UIDNEXT 8900] Predicted next UID * OK [HIGHESTMODSEQ 1] . OK [READ-WRITE] Select completed. . GETQUOTA "" * QUOTA "" (STORAGE 0 655360) . OK Getquota completed. WTF? -- Ralf Hildebrandt Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450 570-155 http://www.computerbeschimpfung.de If you spend more on coffee than on IT security, then you will be hacked -- what's more, you deserve to be hacked.

3 5

[Dovecot] dovecot deliver with sieve: Corrupted index cache file (in-memory index).cache: Broken fields for mail UID
by Mathias Gug 19 Apr '09

19 Apr '09

Hi, Running dovecot deliver 1.1.11 with a sieve script (dovecot-sieve 1.1.6 + changeset b9567e94b897) the following messages started to show up in the mail logs for some (spam) messages: deliver(mathiaz): Apr 18 19:03:06 Error: Corrupted index cache file (in-memory index).cache: Broken fields for mail UID 1 deliver(mathiaz): Apr 18 19:03:06 Error: Couldn't fix broken header unfolding deliver(mathiaz): Apr 18 19:03:06 Info: msgid=<01c9548a$f1666dfe$6c822ecf@pillarsx6>: saved mail to INBOX How serious are these? Without changeset b9567e94b897 applied deliver would actually crash and the message would be lost. More information can be found in the Ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/dovecot/+bug/264306 -- Mathias Gug Ubuntu Developer http://www.ubuntu.com

1 0

[Dovecot] Suggestion: deliver should honor mail_log_prefix
by Mike Abbott 19 Apr '09

19 Apr '09

I can set the log prefix for imap/pop3 processes using mail_log_prefix but the log prefix for deliver is hard-coded. (I'm using 1.1.13.) Deliver should either honor mail_log_prefix or have its own setting (deliver_log_prefix?). What do you think?

2 1

[Dovecot] Released Sieve v0.1.5 and ManageSieve v0.11.4 for Dovecot v1.2.rc3 and ManageSieve v0.10.6 for Dovecot v1.1.14
by Stephan Bosch 18 Apr '09

18 Apr '09

Hello Dovecot users, This is a simultaneous release of new versions of Sieve-related software for Dovecot v1.1 and v1.2. Only the Sieve implementation itself has seen significant development. The ManageSieve packages only have small fixes and the ManageSieve patches are updated as usual to match the new Dovecot releases. Changelog Sieve v0.1.5: * Ported the implementation of the Sieve include extension to the latest draft. This means that the import and export commands are replaced by a new command called global. The import and export commands are now DEPRICATED and are mere aliases for the global command. The new specification also adds the :once modifier to the include command. The also newly specified global.* variable namespace is not implemented yet as support for variable namespaces is currently missing. * Did a major rework of the multiscript support for better error handling and made sure that persistent global scripts (sieve_before/sieve_after) are always executed, even when the user does not have a script of his own and a global default is missing. + Provided basic support for the environment extension. Currenly, the name, version and host items are useful. Others are pending. + Improved error message that is presented when an unknown Sieve extension is provided as argument to the require command. It now notifies the user that Sieve core commands do not need to be specified in require. - Fixed bug in includes at levels deeper than one. - Fixed bug in address matching that was caused by the failure to handle group specifications. In Dovecot, these are marked by address items with NULL elements, which causes a segfault if not considered. The group 'undisclosed-recipients:;' in particular triggered this bug. Bug reported by Bernhard Schmidt. Changelog ManageSieve v0.11.4 (Dovecot v1.2.rc3): * Adjusted to changes in the Dovecot signal handler API. Changelog ManageSieve v0.10.6 (Dovecot v1.1.14): - Fixed small problems in the login proxy support. -- The releases are available as follows: Sieve for Dovecot 1.2: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.5.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.5.tar.gz.sig ManageSieve for Dovecot v1.2 (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.4.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.4.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.rc3-managesieve-0.11.4.diff… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.rc3-managesieve-0.11.4.diff… ManageSieve + patch for Dovecot v1.1 (package + patch): http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.6.tar.gz http://www.rename-it.nl/dovecot/1.1/dovecot-1.1-managesieve-0.10.6.tar.gz.s… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1.14-managesieve-0.10.6.diff.… http://www.rename-it.nl/dovecot/1.1/dovecot-1.1.14-managesieve-0.10.6.diff.… -- Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

[Dovecot] Mail replication
by Renaud Allard 18 Apr '09

18 Apr '09

Hello, I am running an asynchronously replicated mail setup. 2 servers are each running an smtp server which uses dovecot as the LDA. I am using unison to replicate mail files between servers. Before, I was using Maildir format and after reading so much good papers about the very good performance of dbox format, I decided to switch to dbox. However, I now have a very annoying problem, as mails are created with names like u.1234 and numbers are following each others. So, if there is for example a mail stored as u.1001 on both servers, and now 2 mails arrive at about the same time, 1 on each server. Then, they will both be created as u.1002, that means unison will encounter a conflict as both files are different. So my question would be, is there a way to tell the servers to increment by 2 instead of 1 and have each an offset (like you can do with mysql with auto incrementing tables for example)? That way, with former example, one mail would be stored as u.1002 and the other as u.1003. Thanks

2 3

[Dovecot] Logging to see exactly all IMAP commands?
by Johan Persson 18 Apr '09

18 Apr '09

I was wondering if there is some additional logging that can be enabled to make it possible to have Dovecot print all actual IMAP commands it receives in a conversation? /Johan

2 2

[Dovecot] Feature Request: Control over IMP IDLE 'OK Still Here' message timings
by Robert Goldsmith 18 Apr '09

18 Apr '09

Hi all, I would like to make a feature request regarding IMAP Idle support. Currently when a client triggers Idle support, Dovecot then sends 'OK Still Here' messages every 2 minutes. This is apparently to prevent NAT systems killing the tcp connection and disconnecting the client. However, while this may be fine for desktop clients, this rapidly drains the battery life of mobile clients such as phones. Unfortunately, the timing control on this behaviour is a c define at the top of cmd-idle.c and is only adjustable at compile-time. I have experimented with this define and find a timeout of 20 minutes between 'OK' messages is perfectly adequate for my system setup and results in a significant battery saving for my Nokia 6120c (increasing from ~ 6 hours to ~ 55 hours from full charge to low battery warning). Therefore, can you please make the timeout changeable from the config file, even if it defaults to the current 2min timing, so admins supporting mobile users can balance battery life with a need to prevent killed tcp connections. Thanks Robert Goldsmith --- GnuPG public key: http://www.Far-Blue.co.uk

3 2

[Dovecot] Shared folders and subscriptions
by Markus Werner 18 Apr '09

18 Apr '09

Hi, I've got a problem with user shared folders and subscriptions. When I try to subscribe a folder, dovecot returns "OK Subscribe completed", but the newly subscribed folder is not listed with LSUB: a1 login test(a)example.com ******* a1 OK [CAP..... a2 list "" "*" * LIST (\HasChildren) "/" "INBOX" * LIST (\Noselect \HasChildren) "/" "#User" * LIST (\Noselect \HasChildren) "/" "#User/markus(a)example.com" * LIST (\HasNoChildren) "/" "#User/markus(a)example.com/ForTest" a3 subscribe "#User/markus(a)example.com/ForTest" a3 OK Subscribe completed. a4 lsub "" "*" * LSUB (\Noselect) "/" "#User/markus(a)example.com" Dovecot is 1.2-rc3, namespace configuration as follows: namespace private { separator = / prefix = INBOX/ inbox = yes subscriptions = yes } namespace public { separator = / prefix = "#Shared/" location = maildir:/var/spool/dovecot/sharedfolders:INDEX=~/Maildir/index/public:CONTROL=~/Maildir/control/public subscriptions = yes } namespace shared { separator = / prefix = "#User/%%u/" location = maildir:%%h/Maildir:INDEX=~/Maildir/index/shared/%%u:CONTROL=~/Maildir/control/shared subscriptions = yes list = yes } I tried without CONTROL= directory in the shared namespace, but that made no difference. Contents of the subscriptions (with CONTROL=) file after subscribing: ForTestUser Regards, Markus

2 6

[Dovecot] Sieve "redirect"
by James Butler 18 Apr '09

18 Apr '09

Is there an alternative to the "redirect" Sieve capability? For example: if header :contains "Subject" "Listserv" { redirect "list-user1(a)example.com"; redirect "list-user2(a)example.com"; redirect "list-user3(a)example.com"; stop; } How can I do the above without using "redirect"? Unfortunately, "redirect" seems to be unsupported by Dovecot. Thank you. James

3 3

[Dovecot] Address Extensions with System Users
by Jeff Grossman 18 Apr '09

18 Apr '09

I am using Dovecot 1.2RC2 with Postfix 2.5.5. Everything is running fine. I would like to start using address extensions and have e-mail automatically filtered into folders based on the folder name after the "+" in the e-mail address. I only use system users, no virtual users. I have Deliver configured in main.cf as: mailbox_command = /usr/local/libexec/dovecot/deliver Everything I can find about setting this up applies to virtual users which I do not have. How do I get Deliver to recognize the address extension. I am sure it is easy, and I apologize for not finding the answer out myself. Here is a copy of my dovecot -n output: # 1.2.rc2: /usr/local/etc/dovecot.conf # OS: Linux 2.6.29-1-amd64 x86_64 Debian squeeze/sid base_dir: /var/run/dovecot/ protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/certs/stikman-godaddy.crt ssl_key_file: /etc/ssl/private/stikman-godaddy.key ssl_cipher_list: ALL:!LOW:!SSLv2 disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_location: maildir:~/Maildir mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd plugin: sieve: sieve

4 10

[Dovecot] Setup Question
by Jeff Grossman 17 Apr '09

17 Apr '09

I really want to try and get this plus addressing working correctly with Dovecot and Postfix. After doing some reading I think I am going to change my Postfix setup from mailbox_command to mailbox_transport. I have a few questions to make sure I am thinking correctly. All of my users are system users. Their mail is delivered directly to their "/home/<user>/Maildir" directory. Everything works great and I have no problems. Here is what I am thinking of doing. 1. Create a new vmail user and group. 2. Have all mail delivered for each user to the "/home/vmail/<user>/" directory. All mail will be owned by vmail, but that is okay since Dovecot is the only thing touching the mail files anyway. 3. Change the mail_location setting in dovecot.conf to "mail_location = /home/vmail/%u 4. Uncomment the auth_socket_path = /var/run/dovecot/auth-master setting in dovecot.conf 5. Switch Postfix's main.cf to use "mailbox_transport = dovecot" and put the following line in master.cf: 1. dovecot unix - n n - - pipe flags=DR user=vmail:vmail argv=/usr/local/libexec/dovecot/deliver -f ${sender} -d ${recipient} -n -m ${extension} 6. Copy the current users mail to the new vmail location. What is the best way to copy it preserving date and time stamps on the mail? Did I cover all of the steps are am I missing something? Here is a copy of my current dovecot -n output. Thanks for any help you can offer me. # 1.2.rc3: /usr/local/etc/dovecot.conf # OS: Linux 2.6.29-1-amd64 x86_64 Debian squeeze/sid base_dir: /var/run/dovecot/ protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/certs/ssl.crt ssl_key_file: /etc/ssl/private/ssl.key ssl_cipher_list: ALL:!LOW:!SSLv2 disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_location: maildir:~/Maildir mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd plugin: sieve: sieve

3 10

[Dovecot] Active Directory LDAP authentication fails after a time
by noahisaac 17 Apr '09

17 Apr '09

Hi - I've got Dovecot version 1.0.7 running on a CentOS 5.2 machine. It's serving pop, imap and imaps and authenticating against an Active Directory machine. This all works fine at first, but after about two weeks or so, dovecot's authentication against AD starts to fail. All of dovecot's authentication attempts time out. I also have postfix on the same machine authenticating against the same AD, and it does not seem to experience this issue. If I restart dovecot, the authentication starts working again. I've gone over /var/log/maillog, but I don't see anything particularly useful. The only thing I really see is: dovecot: IMAP(noah): Disconnected for inactivity Here's some of the relevant portions of my configs: dovecot.conf auth default { mechanisms = plain passdb ldap { args = /etc/dovecot-ldap.conf } passdb passwd-file { args = /etc/dovecot/passdb master = yes } userdb static { args = uid=vmail gid=vmail home=/home/vmail/%u } user = root } dovecot-ldap.conf hosts = admachine.domain.com base = dc=domain,dc=com ldap_version = 3 auth_bind = yes auth_bind_userdn = DOMAIN\%u Does anybody have any ideas about why this is happening, or maybe just an idea about how to better troubleshoot it? If you need any more info, I'll be happy to provide it. Can I tell dovecot to be a little more verbose with it's log entries (I've already got auth_debug set to yes, but I'm not getting very much info)? Thanks! Noah -- View this message in context: http://www.nabble.com/Active-Directory-LDAP-authentication-fails-after-a-ti… Sent from the Dovecot mailing list archive at Nabble.com.

4 3

[Dovecot] SELinux and "i_stream_read() failed: Permission denied"
by James Butler 17 Apr '09

17 Apr '09

Not a problem ... sharing a solution (this time)! Please correct my understanding of the process, if required. "i_stream_read() failed: Permission denied" is an error message generated when a large-ish file (>128kb in my case) is attached to a message that has been passed to Dovecot's deliver program when SELinux is being enforced. In my case, these messages are first run through Spamassassin, then passed to deliver, however the SELinux policy that is being violated relates to deliver, and not to Spamassassin, even though I do NOT generate the errors WITHOUT running Spamassassin. I'm not going to guess as to why that is. The policies below resolve the issue, and now large-ish (even LARGE) attachments come through without a whimper with Postfix+Spamassassin+Dovecot. The problem is that deliver is not running with the correct SELinux policy to be able to write to the global /tmp directory (in my case, after receiving the big attachment from SA), even if that directory's permissions allow it. (Bless you, SELinux!) Small-ish file attachments do not trigger this deliver functionality. Here's a complete error message, and its subsequent errors in the course of delivering a large-ish message+attachment: =================================================== deliver(user): unlink(/tmp/dovecot.deliver.. \ 1239836047.9469.46242b1037005551) failed: Permission denied deliver(user): copy: i_stream_read() failed: Permission denied deliver(user): read(mail, uid=1) failed: Permission denied deliver(user): read(mail, uid=1) failed: Permission denied deliver(user): msgid=: save failed to INBOX: Internal error occurred. \ Refer to server log for more information. [2009-04-15 17:54:07] =================================================== This is the final error series received before the policies were finally updated, and shows an error during deliver's attempt to "unlink()" (remove) the temporary file. Previous errors occurred during attempts to "stat()" and "creat()" (sic) the temporary files. Basically, the "dovecot_deliver_t" context needs to be able to create, read, write and remove files in the /tmp directory ("tmp_t" context). Below, I am pasting my "local_postfix.te" SELinux policy file. It includes instructions for using it, and for figuring out how to do other SELinux policy adjustments on your own. This is my COMPLETE Postfix+Dovecot SELinux policy group. I also have policies for Spamassassin, if anyone wants them. If you are running Sendmail or another MTA instead of Postfix, you can build on what you find below and establish your own policies. I hope this proves useful. Again, please feel free to correct any misunderstandings I may be promoting with this message. Use at your own risk, please! No guarantees ... it just worked, for me. James ## NOTE: I have broken lines in the following using the standard "\" notation to fix the email format better. However the local_postfix.te file should NOT have ANY lines broken. Remove my "\" notation and keep the lines together and you should be okay. ## ####### HOW TO USE THIS #################################################### # SELinux, Postfix, Dovecot # # SELinux needs help resolving Postfix+Dovecot context issues. # # This file + the following instructions should get you # # on your way to resolving the policies between those contexts. # # # # 1) Create this file with the data shown below: # # local_postfix.te # # 2) Compile this file: # # checkmodule -M -m -o local_postfix.mod local_postfix.te # # 3) Create SELinux policy package: # # semodule_package -o local_postfix.pp -m local_postfix.mod # # 4) Move policy package to normal SELinux modules directory: # # mv local_postfix.pp /etc/selinux/targeted/modules/active/modules/ # # 5) Update kernel with new policy package: # # semodule -i \ # # /etc/selinux/targeted/modules/active/modules/local_postfix.pp # # # # Test: Send mail from remote to this system. # # Check /var/log/maillog for mail errors and # # /var/log/messages & /var/log/audit/audit.log for more specific # # SELinux errors # # Also, SELinux will provide the command (sealert...) for more details # # Use the error info you see in messages (or sealert...) to create # # new entries in local_postfix.te, then re-compile, package # # and update the kernel. # # # # Alternately, you can use this to generate a .te file automatically # # from the SELinux errors displayed in /var/log/audit/audit.log (or # # from /var/log/messages IF you do NOT have audit installed): # # # # audit2allow -m local -l -i /var/log/audit/audit.log > local_postfix.te # # # # (This is also helpful if you can't guess the correct domain/policy to # # use from reading the error messages.) Take the new stuff from what # # audit2allow creates and add it to this file, then re-compile, package # # and update the kernel. # ############################################################################ module local_postfix 1.0; require { type admin_home_t; type bin_t; type default_t; type dovecot_t; type dovecot_deliver_t; type dovecot_deliver_exec_t; type dovecot_var_log_t; type etc_runtime_t; type fs_t; type home_root_t; type httpd_config_t; type httpd_t; type initrc_t; type postfix_etc_t; type postfix_local_t; type postfix_master_t; type postfix_postdrop_t; type postfix_postqueue_exec_t; type postfix_public_t; type postfix_pipe_t; type sendmail_t; type sendmail_exec_t; type src_t; type tmp_t; type usr_t; type user_home_dir_t; type user_home_t; type var_log_t; class capability { sys_nice chown }; class file { append create execute execute_no_trans \ getattr ioctl link lock read rename setattr write unlink }; class dir { add_name getattr create read remove_name \ rename write search setattr rmdir }; class fifo_file { getattr write }; class filesystem getattr; class sock_file write; class unix_stream_socket { connectto getattr read write }; } #============= dovecot_t =============== allow dovecot_t home_root_t:file { create getattr link lock \ read rename setattr unlink write }; allow dovecot_t home_root_t:dir { add_name create remove_name write }; #============= dovecot_deliver_t ============== allow dovecot_deliver_t tmp_t:dir getattr; allow dovecot_deliver_t fs_t:filesystem getattr; allow dovecot_deliver_t dovecot_var_log_t:file append; allow dovecot_deliver_t initrc_t:unix_stream_socket connectto; allow dovecot_deliver_t tmp_t:dir { add_name remove_name search write }; allow dovecot_deliver_t tmp_t:file { create read unlink write }; allow dovecot_deliver_t var_log_t:dir search; allow dovecot_deliver_t var_log_t:file append; #============ httpd_t ================= allow httpd_t postfix_etc_t:dir search; #============= postfix_local_t ============== allow postfix_local_t home_root_t:file { create getattr link unlink write }; allow postfix_local_t admin_home_t:dir { create read write }; allow postfix_local_t home_root_t:dir { add_name create remove_name write }; allow postfix_local_t clamd_var_lib_t:dir { add_name create remove_name \ rename setattr write read }; allow postfix_local_t clamd_var_lib_t:file { create link lock read rename \ getattr setattr unlink write }; allow postfix_local_t home_root_t:dir { rename setattr }; allow postfix_local_t self:capability { sys_nice chown }; allow postfix_local_t sendmail_exec_t:file { read execute ioctl \ execute_no_trans }; allow postfix_local_t spamc_exec_t:file { execute execute_no_trans \ getattr read }; allow postfix_local_t usr_t:file { append execute execute_no_trans \ read getattr write }; allow postfix_local_t default_t:file { create getattr read write }; allow postfix_local_t default_t:dir { add_name remove_name search write }; allow postfix_local_t user_home_dir_t:file { read write getattr rename }; #============= postfix_master_t =============== allow postfix_master_t src_t:dir search; #============= postfix_pipe_t ============== allow postfix_pipe_t bin_t:file { execute execute_no_trans read }; allow postfix_pipe_t postfix_public_t:sock_file write; #============= postfix_postdrop_t =============== allow postfix_postdrop_t initrc_t:fifo_file { write getattr }; allow postfix_postdrop_t postfix_local_t:unix_stream_socket { getattr \ read write }; allow postfix_postdrop_t user_home_t:file append; #============= sendmail_t ============== allow sendmail_t postfix_local_t:fifo_file { getattr write }; allow sendmail_t postfix_postqueue_exec_t:file { execute \ execute_no_trans read };

2 6

[Dovecot] UW-IMAP migration to namespaces
by Jernej Porenta 17 Apr '09

17 Apr '09

Hello, I am trying to migrate existing UW-IMAP installation to dovecot 1.1.14 and I am having troubles with namespaces. As you know UW-IMAP allows full system access to home directory of a user and you can set up dovecot to do that as well, but I would like to use namespaces. If I set my namespaces like this: namespace private { separator = / prefix = inbox = yes location = mbox:~/:INBOX=~/.mailbox hidden = yes list = yes } namespace private { separator = / prefix = mail/ location = mbox:~/mail prefix = mail/ hidden = yes } Everything is working fine, but I am seeing also all other files in home directory of a user, but this is annoying if you have users with public_html folder with millions of files in it. Dovecot indexing makes index.log file for every file seen in namespace, so you have several million index files for files that are not mailboxes. So I was wondering is there a way to skip certain directories in namespaces or a way to setup namespaces in a way, that you would have: - INBOX in home directory - some folders in home directory (via .subscriptions) - some folders in %h/mail/ directory - and not seeing all other files/directories in home dir Thanks in advance, regards, Jernej

2 1

[Dovecot] Multiple instances and/or separate certificates per email address
by Simon L Jackson 17 Apr '09

17 Apr '09

Hi, We have a mail server with multiple instances of Postfix each listening on a different IP address to create a set of virtual mail servers. There are various reasons why separate instances of Postfix seems to work best to achieve this goal, but I wont divert into that discussion here. I would like so match this with Dovecot. The listening side isn't a problem as Dovecot can listen on multiple explicit IP addresses. However, we would prefer a separate SSL certificate for each virtual mail server i.e. for each IP address. Would it be better to have multiple instances of Dovecot on the server (not sure what the issues might be with this) or would it be better/easier to be able to specify separate SSL certificates for each listen address, since there isn't any other reason I can see to have multiple instances. Any thought? Is there a way to do this now or would this be a new feature request? Cheers -- Simon L Jackson Carringbush.Net +- Carringbush.Net Hosting * Development * Advice Web: www.carringbush.net <http://www.carringbush.net/> Email: simon.jackson(a)carringbush.net <mailto:simon.jackson@carringbush.net> Office: +61 3 9411 4400 Support: +61 3 9411 4444 Fax: +61 3 9411 4499 Level 1 15 Bedford Street Collingwood VIC 3066 Australia P.O. Box 1464 Collingwood VIC 3066 Australia +-

2 1

Re: [Dovecot] v1.1.14 and v1.2.rc3 released
by Wolfgang.Friebel＠desy.de 17 Apr '09

17 Apr '09

I was already going to report a bug with rc2 where the server crashed when a client tried to access a Maildir folder with wrong permissions. After installation of rc3 the server correctly reports the wrong permissions and keeps running: IMAP(user1): stat(/var/spool/mail/user1/Maildir/tmp) failed: Permission denied (euid=12807(user1) egid=200(grp1) missing +x perm: /var/spool/mail/user1/Maildir) Great work, thanks Timo! -- Wolfgang Friebel Deutsches Elektronen-Synchrotron DESY Phone/Fax: +49 33762 77372/216 Platanenallee 6 Mail: Wolfgang.Friebel AT desy.de D-15738 Zeuthen Germany

1 0

[Dovecot] v1.1.14 and v1.2.rc3 released
by Timo Sirainen 17 Apr '09

17 Apr '09

http://dovecot.org/releases/1.1/dovecot-1.1.14.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.14.tar.gz.sig http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc3.tar.gz http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc3.tar.gz.sig Fixed lots of bugs in v1.2 related to shared mailboxes and virtual mailboxes. Keep on testing and sending bug reports and hopefully we'll get v1.2.0 release out soon. :) Also v1.3 branch has started and it's coming along nicely. Multi-dbox is working and looks like its performance is very nice. LMTP server is basically implemented, except master process doesn't start it. Adding the master code started becoming so annoying that I think I'll finally finish the master process rewrite, or at least the most important parts of it. So looks like v1.3 might become v2.0 after all. v1.1.14 2009-04-16 Timo Sirainen <tss(a)iki.fi> * IMAP: Don't allow APPEND to specify INTERNALDATE more than 2 hours into future. With Maildir future INTERNALDATEs may mess up incremental backups. - Date: header was always being added to cache file when saving messages, even if clients didn't really want it. This caused POP3-only users to have dovecot.index.cache file unneededly. - Character set conversion in specific mails may have caused Dovecot to allocate all the available memory (in default configuration dying after having allocated 256 MB). This happened only while searching messages. - Message address parser didn't handle empty group:; correctly. - imap/pop3-login: Don't crash when shutting down and destroying clients. - deliver wasn't using mail_access_groups setting. - mbox: When doing autodetection, if mbox didn't find an existing mail directory it just went and created it anyway, instead of failing the storage creation. - Fixed some error handling in maildir and index code. v1.2.rc3 2009-04-16 Timo Sirainen <tss(a)iki.fi> * IMAP proxy no longer simply forwards tagged reply from remote authentication command. It's now done only if the remote server sent a [resp-code], otherwise all failure strings are converted to Dovecot's "Authentication failed." to make sure that if remote isn't using Dovecot it won't reveal user's existence. + Quota roots can now specify which namespace's quota they're tracking. This is probably the most useful for giving public namespaces a quota. + Added imap_idle_notify_interval setting. - Fixes to shared mailbox handling - Fixes to virtual mailboxes - Fixed compiling with some FreeBSD and NetBSD versions - THREAD REFS still might have returned one (0) at the beginning. - deliver wasn't using mail_access_groups setting. - Fixed some error handling in maildir and index code.

2 1

[Dovecot] Postfix, Dovecot SASL and Entourage smtps authentication fails.
by Mart Pirita 17 Apr '09

17 Apr '09

Tere. Recently just migrated from Sendmail 8.14.3 to Postfix 2.5.6 and switched from Cyrus-sasl 2.1.22 to Dovecot 1.1.13 sasl, all are compiled from source and I have used Dovecot for a long time, since alpha versions. Everything worked well for Outlook Express, Outlook and Thunderbird clients, but Microsoft Entourage 2004 or 2008 clients smtps fails - "Authentication failed because Entourage doesn't support any of the available authentication methods." Similar case like - http://archives.neohapsis.com/archives/postfix/2008-09/thread.html#145 I tried everything, the config is like described in Postfix and Dovecot sites - http://wiki.dovecot.org/HowTo/PostfixAndDovecotSASL I also tried in main.cf smtpd_sasl_security_options =forward_secrecy like described in http://www.postfix.org/postconf.5.html#smtpd_sasl_security_options But none helped. So I switched back to Cyrus-sasl and Entourage works well like before with sendmail. I started to search what may be the reason, and seems with Dovecot sasl Postfix wont advertise needed stuff in ehlo: With Cyrus: telnet localhost 25 Trying 127.0.0.1... Connected to localdomain.localhost. Escape character is '^]'. 220 my.host.ee ESMTP EHLO example.com 250-my.host.ee 250-PIPELINING 250-SIZE 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN starttls 220 2.0.0 Ready to start TLS With dovecot: telnet localhost 25 Trying 127.0.0.1... Connected to localdomain.localhost. Escape character is '^]'. 220 my.host.ee ESMTP EHLO example.com starttls 220 2.0.0 Ready to start TLS Setting with Cyrus in main.cf smtpd_tls_auth_only = no gives even more but still nothing with Dovecot: telnet localhost 25 Trying 127.0.0.1... Connected to localdomain.localhost. Escape character is '^]'. 220 my.host.eeESMTP EHLO example.com 250-my.host.ee 250-PIPELINING 250-SIZE 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN So is this a Entourage or Dovecot or Postfix bug? I really like to drop the Cyrus and use only Dovecot sasl. Any hint is welcome. -- Mart

3 15

[Dovecot] public folders question
by Xueron Nee 17 Apr '09

17 Apr '09

Hi, Shared folders is ok now. and when I create a public folder follow the doc http://wiki.dovecot.org/SharedMailboxes/Public, I can not get the boxes listed. namespace: type: public separator: / prefix: public/ location: maildir:/home/data/public:INDEX=~/Maildir/public list: children # ls /home/data/public/ -a . .. dovecot-shared .test1 .test2 .test3 And then, I checked the shared folders created by 'setacl' command, and add a dovecot-acl-list file in the root public folder, ok, I got it. # cat /home/data/public/dovecot-acl-list 1239108915 test1 so, 'dovecot-acl-list' should be created manually or any other methods? Thanks! -- Xueron Nee http://www.xueron.com

2 1

[Dovecot] Is there any more detailed docs about dict configuration
by Xueron Nee 17 Apr '09

17 Apr '09

Hi, I am looking for some help on dict configration. I'm trying to config shared and public mailbox, and use sql as acl backend. Here is my config: table: CREATE TABLE `shared_dict` ( `id` int(10) NOT NULL AUTO_INCREMENT, `from_user` char(50) NOT NULL, `to_user` char(50) NOT NULL, `status` int(10) NOT NULL DEFAULT '1', PRIMARY KEY (`id`), KEY `from_user` (`from_user`), KEY `to_user` (`to_user`) ) dovecot-dict-sql.conf map { pattern = shared/shared-boxes/user/$from/$to table = shared_dict value_field = status fields { from_user = $from to_user = $to } } dovecot.conf acl_shared_dict = proxy::shared_dict It works, and when i use 'setacl', it can add a record. All I want are some more detailed docs about the `pattern' line, and such as how to add a `group' function. :) Detailed on quota/expire dict configration are welcome, too. :) Thanks! -- Xueron Nee http://www.xueron.com

3 8

[Dovecot] Public mailboxes configuration to receive mails
by Didier Faugeron 17 Apr '09

17 Apr '09

Hello, I would like to know how to use Public mailboxes in my Dovecot environment (dovecot 1.2.beta4) Currently my dovecot server is only used for mailbox user. The Postfix master.cf is configured with the following line: "dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -d ${user}" Both dovecot and postfix use LDAP requests for authentication and users data retrieving. However I don't use userdb database to get the users home directory but an userdb static instruction : "args = uid=vmail gid=vmail home=/data/maildir/%1Lu/%Lu allow_all_users=yes" I have configured my dovecot.conf to create a namespace Public, and it works fine: an user who have read/write access(ACL) to a public mailbox can subscribe to it and read/copy mails. My problem is to deliver mails in this public mailbox. I don't know how to do it. Therefore, first question: is it possible to deliver mails to a public mailbox through the LDA/Postfix ? If yes, please could you tell me how to configure LDA/Postfix and Dovecot in order to accept and deliver mails to users mailboxes and to public mailboxes ? I assume that the main modifications should be done in the master.cf of Postfix. Could you please specify and clarify what modifications are required ? Find below my dovecot -n output and dovecot-ldap.conf. Thank you in advance for your help and your feedback. Regards Didier F. dovecot -n: # 1.2.beta4: /etc/dovecot.conf # OS: Linux 2.6.18-92.el5xen x86_64 CentOS release 5.2 (Final) ext3 syslog_facility: local2 protocols: imaps pop3s imap listen: *, [::] ssl_cert_file: /etc/openssl/certs/xxx.crt ssl_key_file: /etc/openssl/certs/xxx.key disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_greeting: XXX mail server - Dovecot ready. login_processes_count: 1 login_max_processes_count: 512 max_mail_processes: 800 mail_max_userip_connections(default): 30 mail_max_userip_connections(imap): 30 mail_max_userip_connections(pop3): 10 first_valid_uid: 5000 last_valid_uid: 5000 first_valid_gid: 5000 last_valid_gid: 5000 mail_uid: vmail mail_gid: vmail mail_location: maildir:/data/maildir/%1Lu/%Lu:INDEX=/data/index/%1Lu/%Lu mail_debug: yes mmap_disable: yes mail_nfs_storage: yes mail_drop_priv_before_exec: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugins(default): acl imap_acl mail_plugins(imap): acl imap_acl mail_plugins(pop3): mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 namespace: type: private separator: . inbox: yes list: yes subscriptions: yes namespace: type: public separator: . prefix: Public. location: maildir:/data/maildir/public:INDEX=/data/index/public list: yes subscriptions: yes auth default: verbose: yes debug: yes passdb: driver: ldap args: /etc/dovecot-ldap.conf userdb: driver: static args: uid=vmail gid=vmail home=/data/maildir/%1Lu/%Lu allow_all_users=yes socket: type: listen master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail plugin: acl: vfile dovecot-ldap.conf: hosts = xxx tls = yes auth_bind = yes ldap_version = 3 base = xxx scope = subtree user_attrs = inriaLogin=user user_filter = (&(objectClass=inriaperson)(inriaentrystatus=valid)(inrialogin=%u)) pass_attrs = inriaLogin=user,userPassword=password pass_filter = (&(objectClass=inriaPerson)(inriaEntryStatus=valid)(inriaLogin=%u))

2 1

[Dovecot] Could sharing a folder with other users cause a loss of emails?
by Alfred Nutile 17 Apr '09

17 Apr '09

we are trying to figure out how and email box is not empty. All we did was /mail/user1 /mail/user2 /mail/shared ln -s /mail/shared /mail/user1/shared ln -s /mail/shared /mail/user2/shared Perms are fine and people where dropping emails in here fine. We added a third one and the user also right clicked in their IMAP client and added a subfolder. It was around that time they where gone. Could any of these actions cause that? PS it is not a mbox layout. Thanks!

2 1