- dovecot - dovecot.org

[Dovecot] Odd error from deliver
by Ralf Hildebrandt 19 Jun '07

19 Jun '07

I found these errors in my log today: Jun 18 01:02:11 postamt deliver(cpxxxsch): msgid=<FSL%200706180000356580.6412(a)JISCMAIL.AC.UK>: save failed to INBOX: Unknown error Jun 18 01:02:11 postamt deliver(cpxxxsch): msgid=<FSL%200706180000356580.6412(a)JISCMAIL.AC.UK>: Rejected: Unknown error Jun 18 15:37:22 postamt deliver(roxxxmy): msgid=<E1I0HPz-0002OZ-00(a)p15110889.pureserver.info>: save failed to INBOX: Unknown error Jun 18 15:37:22 postamt deliver(roxxxmy): msgid=<E1I0HPz-0002OZ-00(a)p15110889.pureserver.info>: Rejected: Unknown error This is deliver from dovecot-1.0.1 What exactly IS "Unknown error"? -- Ralf Hildebrandt (Ralf.Hildebrandt(a)charite.de) plonk(a)charite.de Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450 570-155 http://www.arschkrebs.de Ballmer should step down in favour of Mr T, because he pity the fool who don't got high-end video cards and 4GB RAM for Vista Aero!

3 12

[Dovecot] parameters to deliver
by Bruce Bodger 19 Jun '07

19 Jun '07

Read this in the dovecot sieve wiki: "The envelope sender is taken from a Return-Path: header in the message. The envelope recipient is taken from -d option passed to deliver." Is "-d" still a valid deliver switch? When I configure postfix's main.cf like so... mailbox_command = /usr/local/libexec/dovecot/deliver -d -e ..it sqwaks with, "Jun 18 18:44:50 G518X2 deliver(-e): net_connect(/ usr/local/var/run/dovecot/auth-master) failed: No such file or directory" when configured like so... mailbox_command = /usr/local/libexec/ dovecot/deliver -e -d ${recipient} ..it burps with, "Jun 18 18:56:40 G518X2 postfix/local[19766]: 3BBC16C96E0: to=<me(a)mydomain.com>, relay=local, delay=0, status=bounced (command line usage error. Command output: Fatal: Missing destination argument )" It doesn't like... mailbox_command = /usr/local/libexec/dovecot/ deliver -e -d "$recipient" either! Is -d required any longer... and if so, how, please. B. Bodger

3 4

[Dovecot] Problem with deliver
by David Favor 19 Jun '07

19 Jun '07

Per the wiki page: http://wiki.dovecot.org/LDA Doing the following should create a Maildir directory structure in an arbitrary directory, deposit a message and create/update any dovecot indexes: mkdir /common/foo export HOME=/common/foo export PATH=/usr/libexec/dovecot:$PATH cat 1180102308.88215.4145.davidfavor.com:2,RS | deliver -f doda(a)foobar.com This gives an error "(-d user) not given" and when '-d user' given an exit code of 75 is silently returned. Let me know the correct way to test how the deliver program works. Thanks. - David -- Like feeling your best ever, all day, every day? Here's how... Your simple secrets are here - http://RadicalHealth.com

2 1

[Dovecot] Outlook 2003 - Disappearing favorite folders
by Phillip T. George 18 Jun '07

18 Jun '07

Hello all, I'm having an issue with Outlook 2003, where favorite folders seem to disappear. Specifically, they are subfolders of the Inbox. The Inbox favorite folder stays there without a problem. Any clues as to what the problem may be? With the previous IMAP server (courier I believe) this wasn't a problem...so it leads me to believe that Dovecot might be the problem. I'm working with Dovecot 1.0.rc28 Thanks, Phillip

5 10

[Dovecot] v1.0.1 released
by Timo Sirainen 17 Jun '07

17 Jun '07

http://dovecot.org/releases/dovecot-1.0.1.tar.gz http://dovecot.org/releases/dovecot-1.0.1.tar.gz.sig Lots of small fixes. * deliver: If Return-Path doesn't contain user and domain, don't try to bounce the mail (this is how it was supposed to work earlier too) * deliver: %variables in mail setting coming from userdb aren't expanded anymore (again how it should have worked). The expansion could have caused problems if paths contained any '%' characters. + Print Dovecot version number with dovecot -n and -a + deliver: Added -e parameter to write rejection error to stderr and exit with EX_NOPERM instead of sending the rejection by executing sendmail. + dovecot --log-error logs now a warning, an error and a fatal - Trying to start Dovecot while it's already running doesn't anymore wipe out login_dir and break the running Dovecot. - maildir: Fixed "UID larger than next_uid" errors which happened sometimes when dovecot-uidlist file didn't exist but index files did (usually because mailbox didn't have any messages when it was selected for the first time) - maildir: We violated maildir spec a bit by not having keyword characters sorted in the filename. - maildir: If we don't have write access to cur/ directory, treat the mailbox as read-only. This fixes some internal error problems with trying to use read-only maildirs. - maildir: Deleting a symlinked maildir failed with internal error. - mbox: pop3_uidl_format=%m wasn't working right - mbox: If non-filesystem quota was enabled, we could have failed with "Unexpectedly lost From-line" errors while saving new messages - mysql auth: %c didn't work. Patch by Andrey Panin - APPEND / SEARCH: If internaldate was outside valid value for time_t, we returned BAD error for APPEND and SEARCH never matched. With 64bit systems this shouldn't have happened. With 32bit systems the valid range is usually for years 1902..2037. - COPY: We sent "Hang in there.." too early sometimes and checked it too often (didn't break anything, but was slower than needed). - deliver: Postfix's sendmail binary wasn't working with mail_debug=yes - Don't corrupt ssl-parameters.dat files when running multiple Dovecot instances. - Cache compression caused dovecot.index.cache to be completely deleted with big endian CPUs if 64bit file offsets were used (default) - Fixed "(index_mail_parse_header): assertion failed" crash

5 6

Re: [Dovecot] index
by Timo Sirainen 17 Jun '07

17 Jun '07

(Ccing again the list in case someone else has similar problems) On Sun, 2007-06-17 at 20:14 +0200, Lucas -LandM- wrote: > Hi Timo, > > I patched the source and same result. We think the problem is because > everytime user access to his mailbox, dovecot do the index again. And it > consume near the 80% in iowait because, as strace shows, read all mails. The problem isn't that Dovecot indexes it. The problem is that Dovecot ISN'T indexing it. Dovecot commits changes to cache file only after a FETCH command finished successfully. So if the client is disconnected in the middle of doing the FETCH, all of the work that Dovecot did so far gets lost on Dovecot's side. And apparently your client also starts everything from the beginning, even though it already knew some of the messages' sizes.. So the previous patch I sent was supposed to prevent this because originally Dovecot was the one that disconnected the client. It logged "Disconnected for inactivity in reading our output" as the disconnect reason. This shouldn't happen anymore after you patched it, so why did the client still get disconnected? Anyway, here's another patch that makes Dovecot not forget all of its work if the client gets disconnected in the middle of FETCH: http://hg.dovecot.org/dovecot-1.0/rev/e1cd11c5e00a If the client is still disconnecting, it probably takes a couple of tries to get everything read and cached, but after that it should all work nicely. Here's a similar patch for POP3: http://hg.dovecot.org/dovecot-1.0/rev/86766f448e50

1 0

[Dovecot] subdir disappeared
by Luigi Rosa 17 Jun '07

17 Jun '07

I have an installation that sometimes acts strangely: Jun 12 11:28:00 mail dovecot: imap-login: Login: user=<nadia>, method=PLAIN, rip=10.10.10.103, lip=10.10.10.254 Jun 12 11:53:59 mail dovecot: IMAP(nadia): inotify_add_watch(/var/spool/mail/nadia/new) failed: No such file or directory Jun 12 11:53:59 mail dovecot: IMAP(nadia): stat(/var/spool/mail/nadia/new) failed: No such file or directory Jun 12 11:56:14 mail last message repeated 5 times Jun 12 11:58:14 mail last message repeated 2 times Jun 12 12:00:14 mail last message repeated 2 times Jun 12 12:02:14 mail last message repeated 2 times Jun 12 12:02:14 mail dovecot: IMAP(nadia): stat(/var/spool/mail/nadia/new) failed: No such file or directory Jun 12 12:03:23 mail dovecot: IMAP(nadia): Disconnected: Logged out ..... Jun 13 12:08:01 mail dovecot: IMAP(nadia): unlink(/var/spool/mail/nadia/cur/:2,ST) failed: Is a directory Needless to say that no modification has been made to the server for many days and the user did not complain until that time. Could it be Dovecot? Is there a way to trace this error? The MTS is Postfix and in that period the user did not receive any mail The system is a Fedora 6 2.6.20-1.2952.fc6 #1 SMP Wed May 16 17:59:13 EDT 2007 i686 i686 i386 GNU/Linux Ciao, luigi -- / +--[Luigi Rosa]-- \ You cannot achieve the impossible without attempting the absurd.

2 4

[Dovecot] 60 seconds problem
by Waheed Rahuman 17 Jun '07

17 Jun '07

I am using Dovecot-1.0-0_27.rc10.e14. And when try to login with outlook there is an error saying "You server did not respond do u want to try again in 60 seconds" Any solutions please help regards Waheed

2 1

Re: [Dovecot] Per user based protocol access and pause after failed login?
by Mart Pirita 17 Jun '07

17 Jun '07

Tere. > %c expands to "secured" or empty. So you could use eg. > passdb pam { > args = %s%c > } > > and create imap, imapsecured, pop3, pop3secured > > More better, so for example user1 can access only imaps, using Yous suggestion, I have to list all users, except user1 in imap, pop3, pop3secured. But it should works also in other way, that by default all users are allowed to use all protocols and then I exclude user1 from imap, pop3, pop3secured. So I tried: passdb pam { args = %s%c } /etc/pam.d/ includes imap, imapsecured, pop3, pop3secured files which includes: auth required pam_nologin.so auth required pam_stack.so service=system-auth account required pam_stack.so service=system-auth session required pam_stack.so service=system-auth and only imapsecured has this line: auth required pam_listfile.so item=user sense=deny file=/etc/imapsusers onerr=succeed and /etc/imapsusers includes user1 But now even pop user can't login:(. -- Mart

2 1

[Dovecot] using 'socat' to relay Dovecot SASL's auth socket over TCP?
by snowcrash 17 Jun '07

17 Jun '07

hi, i've been running Exim & Dovecot together on the same box. Exim's been sharing Dovecot/SASL auth info over a local unix socket. works great. i'm now splitting Exim & Dovecot onto two different boxes. iiuc, Dovecot ONLY provides a UNIX (local) socket; *not* a TCP socket for over-the-network access. SUre, I could mount the Dovecot socket's volume over NFS ... but just don't want to go there. i've just discovered, socat - Multipurpose relay http://www.dest-unreach.org/socat/ "Socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them. Because the streams can be constructed from a large set of different types of data sinks and sources (see address types), and because lots of address options may be applied to the streams, socat can be used for many different purposes. It might be one of the tools that one `has already needed'." which, iiuc (?), can bidirectionally bridge the Dovecot unix-socket to a TCP socket that Exim can talk/listen to. reading further, "address types" (http://www.dest-unreach.org/socat/doc/socat.html#ADDRESS_TYPES) seem to include BOTH unix & tcp sockets ... can anyone here comment further on this? known to work? possible? no way? etc etc thanks!

2 1

[Dovecot] index
by Lucas -LandM- 17 Jun '07

17 Jun '07

Hi, First of all congratulations for you development. It´s really good. We have a customer that has a copy of all inbound and outbound mail in an account. When he tries to open the mail, the process of index all mail consume all cpu and memory. How can we avoid this kinds of things? Thank you in advance, Lucas

4 7

Re: [Dovecot] dovecot under attack
by Dani 16 Jun '07

16 Jun '07

A Dissabte 16 Juny 2007 16:10, Jon Slater va escriure: > Hi, > > I’ve posted this before but no one was able to help. I can’t figure > out what they are trying to do, and if I should be concerned. > I am running dovecot version 0.99.14 on Fedora Core 4. It appears > that my dovecot server is under attack. This morning in my system > e-mail I saw this: Hi Jon, just my 5 cents, eventually you can figure out if they are trying to login directly to you imap/pop3 ports or maybe through a webmail? In every case why don't you give a try to a fail2ban program to block automatically login failures through iptables and of course upgrade your dovecot's installation? http://drees76.blogspot.com/2006/08/fail2ban-dovecot-and-brute-force.html greetings, dani

1 0

[Dovecot] 1st DOVECOT installation automatically quitting on login
by Benton Haynes 16 Jun '07

16 Jun '07

Hi there. I have just installed DOVECOT 1.0.1 for the first time. After launching it, I can verify that ps -ax | grep -i dovecot 1052 ?? Ss 0:00.03 /usr/local/dovecot/sbin/dovecot -c /etc/dovecot/dovecot.conf 1053 ?? S 0:00.06 dovecot-auth 1058 p2 R+ 0:00.01 grep -i dovecot ps -ax | grep -i imap 1054 ?? S 0:00.08 imap-login 1055 ?? S 0:00.08 imap-login 1056 ?? S 0:00.08 imap-login 1060 p2 R+ 0:00.01 grep -i imap Then, if I telnet to DOVECOT/IMAP & login telnet 192.168.1.30 143 Trying 192.168.1.30... Connected to 192.168.1.30. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE LOGIN-REFERRALS QUOTA STARTTLS AUTH=PLAIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] haynes.name IMAP4 server ready x login ben(a)haynes.name benpass x OK Logged in. Connection closed by foreign host. ^^^^^^^^^^^^^^^^^^^ It disconnects automatically. In my dovecot.conf, I currently have defined verbose_ssl = no auth_verbose = no auth_debug = yes mail_debug = no And, in dovecot.log, I get only, dovecot: Jun 15 18:51:10 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP lip=192.168.1.30 rip=192.168.1.3resp=<hidden> dovecot: Jun 15 18:51:10 Info: auth(default): passwd-file(user= ben(a)haynes.name,192.168.1.3) lookup: user=ben(a)haynes.namefile=/etc/dovecot/user.file dovecot: Jun 15 18:51:10 Info: auth(default): client out: OK 1 user=ben(a)haynes.name dovecot: Jun 15 18:51:10 Info: auth(default): master in: REQUEST 11054 1 dovecot: Jun 15 18:51:10 Info: auth(default): master out: USER 1 ben(a)haynes.name static uid=500 gid=500 home=/var/mail/imap/haynes.name/accounts/ben nice=10 dovecot: Jun 15 18:51:10 Info: imap-login: Login: user=<user=ben(a)haynes.name>, method=PLAIN, rip=192.168.1.3, lip=192.168.1.30 dovecot: Jun 15 18:51:14 Error: child 1064 (imap) killed with signal 4 Ihaven't been able to figure out why this is happening. Is there some more detailed debugging I should turn on? Any ideas why this is going on? -- Ben

2 4

Re: [Dovecot] dovecot under attack
by Mart Pirita 16 Jun '07

16 Jun '07

Tere. > > > Does anyone know what this is? Or someone I could ask? > > Normal dictionary attack? -- Mart

1 0

Re: [Dovecot] dovecot under attack
by Charles Marcus 16 Jun '07

16 Jun '07

Hi Jon, I cannot help with the specific question, but in my opinion, your first and primary goal should be to get that server updated to 1.0.1 asap... 0.99.x is no longer supported - and *very* dated... Jon Slater wrote: > Hi, > > > > I’ve posted this before but no one was able to help. I can’t figure out > what they are trying to do, and if I should be concerned. > > > > I am running dovecot version 0.99.14 on Fedora Core 4. It appears that my > dovecot server is under attack. This morning in my system e-mail I saw > this: > > > > dovecot: > > Authentication Failures: > > rhost= : 23431 Time(s) > > adm: 33 Time(s) > > bin: 33 Time(s) > > mail: 33 Time(s) > > mysql: 21 Time(s) > > nobody: 15 Time(s) > > news: 14 Time(s) > > operator: 8 Time(s) > > sshd: 2 Time(s) > > Unknown Entries: > > check pass; user unknown: 23431 Time(s) > > > > But, when I check my log files I can’t find an IP address for the attacker. > So, for example, if I search my logs for “operator” I see: > > ./messages:Jun 15 23:30:56 lambdacenter dovecot(pam_unix)[15512]: > authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= > user=operator > > ./messages:Jun 15 23:31:00 lambdacenter dovecot(pam_unix)[15670]: > authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= > user=operator > > ./messages:Jun 15 23:31:16 lambdacenter dovecot(pam_unix)[16332]: > authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= > user=operator > > ./messages:Jun 15 23:31:20 lambdacenter dovecot(pam_unix)[16480]: > authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= > user=operator > > ./messages:Jun 15 23:31:27 lambdacenter dovecot(pam_unix)[16695]: > authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= > user=operator > > ./messages:Jun 15 23:31:38 lambdacenter dovecot(pam_unix)[16884]: > authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= > user=operator > > ./messages:Jun 15 23:31:55 lambdacenter dovecot(pam_unix)[17080]: > authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= > user=operator > > ./messages:Jun 15 23:32:11 lambdacenter dovecot(pam_unix)[17182]: > authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= > user=operator > > ./audit/audit.log:type=USER_AUTH msg=audit(1181971858.967:156312): user > pid=15512 uid=0 auid=4294967295 msg='PAM authentication: user=operator > exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? > result=Authentication failure)' > > ./audit/audit.log:type=USER_AUTH msg=audit(1181971862.772:156382): user > pid=15670 uid=0 auid=4294967295 msg='PAM authentication: user=operator > exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? > result=Authentication failure)' > > ./audit/audit.log:type=USER_AUTH msg=audit(1181971878.710:156707): user > pid=16332 uid=0 auid=4294967295 msg='PAM authentication: user=operator > exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? > result=Authentication failure)' > > ./audit/audit.log:type=USER_AUTH msg=audit(1181971882.379:156775): user > pid=16480 uid=0 auid=4294967295 msg='PAM authentication: user=operator > exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? > result=Authentication failure)' > > ./audit/audit.log:type=USER_AUTH msg=audit(1181971908.712:156879): user > pid=16695 uid=0 auid=4294967295 msg='PAM authentication: user=operator > exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? > result=Authentication failure)' > > ./audit/audit.log:type=USER_AUTH msg=audit(1181972032.080:156904): user > pid=16884 uid=0 auid=4294967295 msg='PAM authentication: user=operator > exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? > result=Authentication failure)' > > ./audit/audit.log:type=USER_AUTH msg=audit(1181972047.607:156917): user > pid=17080 uid=0 auid=4294967295 msg='PAM authentication: user=operator > exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? > result=Authentication failure)' > > ./audit/audit.log:type=USER_AUTH msg=audit(1181972066.325:156928): user > pid=17182 uid=0 auid=4294967295 msg='PAM authentication: user=operator > exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? > result=Authentication failure)' > > > > I’ve checked my snmplog for port activity on port 110 (for POP3) and 143 > (for IMAP), but I don’t see anything unusual. I also systematically > filtered out everything I knew was okay (ssh, and httpd) . > > > > Does anyone know what this is? Or someone I could ask? > > > > Thanks!!!!!!!!!!!!!!!!!!!! > > > > Jon > > > No virus found in this outgoing message. > Checked by AVG Free Edition. > Version: 7.5.472 / Virus Database: 269.8.17/850 - Release Date: 6/15/2007 > 11:31 AM > >

1 0

[Dovecot] dovecot under attack
by Jon Slater 16 Jun '07

16 Jun '07

Hi, I’ve posted this before but no one was able to help. I can’t figure out what they are trying to do, and if I should be concerned. I am running dovecot version 0.99.14 on Fedora Core 4. It appears that my dovecot server is under attack. This morning in my system e-mail I saw this: dovecot: Authentication Failures: rhost= : 23431 Time(s) adm: 33 Time(s) bin: 33 Time(s) mail: 33 Time(s) mysql: 21 Time(s) nobody: 15 Time(s) news: 14 Time(s) operator: 8 Time(s) sshd: 2 Time(s) Unknown Entries: check pass; user unknown: 23431 Time(s) But, when I check my log files I can’t find an IP address for the attacker. So, for example, if I search my logs for “operator” I see: ./messages:Jun 15 23:30:56 lambdacenter dovecot(pam_unix)[15512]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=operator ./messages:Jun 15 23:31:00 lambdacenter dovecot(pam_unix)[15670]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=operator ./messages:Jun 15 23:31:16 lambdacenter dovecot(pam_unix)[16332]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=operator ./messages:Jun 15 23:31:20 lambdacenter dovecot(pam_unix)[16480]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=operator ./messages:Jun 15 23:31:27 lambdacenter dovecot(pam_unix)[16695]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=operator ./messages:Jun 15 23:31:38 lambdacenter dovecot(pam_unix)[16884]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=operator ./messages:Jun 15 23:31:55 lambdacenter dovecot(pam_unix)[17080]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=operator ./messages:Jun 15 23:32:11 lambdacenter dovecot(pam_unix)[17182]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=operator ./audit/audit.log:type=USER_AUTH msg=audit(1181971858.967:156312): user pid=15512 uid=0 auid=4294967295 msg='PAM authentication: user=operator exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? result=Authentication failure)' ./audit/audit.log:type=USER_AUTH msg=audit(1181971862.772:156382): user pid=15670 uid=0 auid=4294967295 msg='PAM authentication: user=operator exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? result=Authentication failure)' ./audit/audit.log:type=USER_AUTH msg=audit(1181971878.710:156707): user pid=16332 uid=0 auid=4294967295 msg='PAM authentication: user=operator exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? result=Authentication failure)' ./audit/audit.log:type=USER_AUTH msg=audit(1181971882.379:156775): user pid=16480 uid=0 auid=4294967295 msg='PAM authentication: user=operator exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? result=Authentication failure)' ./audit/audit.log:type=USER_AUTH msg=audit(1181971908.712:156879): user pid=16695 uid=0 auid=4294967295 msg='PAM authentication: user=operator exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? result=Authentication failure)' ./audit/audit.log:type=USER_AUTH msg=audit(1181972032.080:156904): user pid=16884 uid=0 auid=4294967295 msg='PAM authentication: user=operator exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? result=Authentication failure)' ./audit/audit.log:type=USER_AUTH msg=audit(1181972047.607:156917): user pid=17080 uid=0 auid=4294967295 msg='PAM authentication: user=operator exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? result=Authentication failure)' ./audit/audit.log:type=USER_AUTH msg=audit(1181972066.325:156928): user pid=17182 uid=0 auid=4294967295 msg='PAM authentication: user=operator exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?, terminal=? result=Authentication failure)' I’ve checked my snmplog for port activity on port 110 (for POP3) and 143 (for IMAP), but I don’t see anything unusual. I also systematically filtered out everything I knew was okay (ssh, and httpd) . Does anyone know what this is? Or someone I could ask? Thanks!!!!!!!!!!!!!!!!!!!! Jon No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.8.17/850 - Release Date: 6/15/2007 11:31 AM

1 0

[Dovecot] Per user based protocol access and pause after failed login?
by Mart Pirita 16 Jun '07

16 Jun '07

Hello. Tried search, no luck, sorry, if this is already answered, but I'm still looking a solution using pam_auth how to define in dovecot which user can access which protocol, for example, default is: protocols = pop3 pop3s imap imaps I'd like to use something like this: exclude_using_pop = user1, user2, @group exclude_using_pops = user1, user2, @group exclude_using_imap = user1, user2, @group exclude_using_imaps = user1, user2, @group The idea is security and also preventing imap user by accident logging in using pop3 and downloading (clearing inbox for imap) all inbox. And also some throttling, for example the adjustable time to pause access after failed login etc would be great. -- Mart

2 2

[Dovecot] SHA256 password patch
by Jasper Slits 16 Jun '07

16 Jun '07

Hi, I made a patch against branch-1.0 for SHA256 password hashing support for Dovecot. Courier Authlib supports this hashing scheme and in order to migrate from Courier to Dovecot, I've added SHA256 support to Dovecot. The attached patch is based on BSD licensed code from Olivier Gay (http://www.ouah.org/ogay/sha2/) Changes made by me in Olivier's sha2{.h,.c} code: - Prototype for sha256_transf is added to sha2.h - sha256_get_digest() is added to sha2{.h,.c} - Code for UNROLL_LOOPS is removed - Support for SHA224,SHA384,SHA512 was removed - Functions are renamed to match those in sha1{.h,.c} - SHA256_DIGEST_SIZE is renamed to SHA256_RESULTLEN I can add safe_memset calls if requested. Patch is attached and can also be found at http://www.malochia.nl/dovecot/sha256.patch Kind regards, Jasper diff -r -u -N --exclude=Makefile.in --exclude=.deps --exclude=Makefile src/auth/password-scheme.c auth/password-scheme.c --- src/auth/password-scheme.c 2007-02-21 13:30:38.756711250 +0100 +++ auth/password-scheme.c 2007-02-21 14:18:49.645380500 +0100 @@ -10,6 +10,7 @@ #include "mycrypt.h" #include "randgen.h" #include "sha1.h" +#include "sha2.h" #include "str.h" #include "password-scheme.h" @@ -153,6 +154,17 @@ return str_c(str); } +static const char *sha256_generate(const char *plaintext, + const char *user __attr_unused__) +{ + unsigned char digest[SHA256_RESULTLEN]; + string_t *str; + sha256_get_digest(plaintext, strlen(plaintext), digest); + str = t_str_new(MAX_BASE64_ENCODED_SIZE(sizeof(digest)+1)); + base64_encode(digest, sizeof(digest), str); + return str_c(str); +} + static const void * password_decode(const char *password, unsigned int result_len) { @@ -196,6 +208,23 @@ return memcmp(sha1_digest, data, SHA1_RESULTLEN) == 0; } +static bool sha256_verify(const char *plaintext, const char *password, + const char *user) +{ + unsigned char sha256_digest[SHA256_RESULTLEN]; + const char *data; + + sha256_get_digest(plaintext, strlen(plaintext), sha256_digest); + + data = password_decode(password, SHA256_RESULTLEN); + if (data == NULL) { + i_error("sha256_verify(%s): Invalid password encoding", user); + return 0; + } + + return memcmp(sha256_digest, data, SHA256_RESULTLEN) == 0; +} + static const char *ssha_generate(const char *plaintext, const char *user __attr_unused__) { @@ -466,6 +495,7 @@ { "MD5-CRYPT", md5_crypt_verify, md5_crypt_generate }, { "SHA", sha1_verify, sha1_generate }, { "SHA1", sha1_verify, sha1_generate }, + { "SHA256", sha256_verify, sha256_generate }, { "SMD5", smd5_verify, smd5_generate }, { "SSHA", ssha_verify, ssha_generate }, { "PLAIN", plain_verify, plain_generate }, diff -r -u -N --exclude=Makefile.in --exclude=.deps --exclude=Makefile src/lib/Makefile.am lib/Makefile.am --- src/lib/Makefile.am 2007-02-21 13:30:38.792713500 +0100 +++ lib/Makefile.am 2007-02-21 14:21:59.437241750 +0100 @@ -73,6 +73,7 @@ sendfile-util.c \ seq-range-array.c \ sha1.c \ + sha2.c \ str.c \ str-sanitize.c \ strescape.c \ @@ -146,6 +147,7 @@ sendfile-util.h \ seq-range-array.h \ sha1.h \ + sha2.h \ str.h \ str-sanitize.h \ strescape.h \ diff -r -u -N --exclude=Makefile.in --exclude=.deps --exclude=Makefile src/lib/sha2.c lib/sha2.c --- src/lib/sha2.c 1970-01-01 01:00:00.000000000 +0100 +++ lib/sha2.c 2007-02-23 14:03:46.857739818 +0100 @@ -0,0 +1,257 @@ +/* + * FIPS 180-2 SHA-224/256/384/512 implementation + * Last update: 02/02/2007 + * Issue date: 04/30/2005 + * + * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay(a)a3.epfl.ch> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include <string.h> + +#include "sha2.h" + +#define SHFR(x, n) (x >> n) +#define ROTR(x, n) ((x >> n) | (x << ((sizeof(x) << 3) - n))) +#define ROTL(x, n) ((x << n) | (x >> ((sizeof(x) << 3) - n))) +#define CH(x, y, z) ((x & y) ^ (~x & z)) +#define MAJ(x, y, z) ((x & y) ^ (x & z) ^ (y & z)) + +#define SHA256_F1(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22)) +#define SHA256_F2(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25)) +#define SHA256_F3(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHFR(x, 3)) +#define SHA256_F4(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHFR(x, 10)) + +#define UNPACK32(x, str) \ +{ \ + *((str) + 3) = (uint8) ((x) ); \ + *((str) + 2) = (uint8) ((x) >> 8); \ + *((str) + 1) = (uint8) ((x) >> 16); \ + *((str) + 0) = (uint8) ((x) >> 24); \ +} + +#define PACK32(str, x) \ +{ \ + *(x) = ((uint32) *((str) + 3) ) \ + | ((uint32) *((str) + 2) << 8) \ + | ((uint32) *((str) + 1) << 16) \ + | ((uint32) *((str) + 0) << 24); \ +} + +#define UNPACK64(x, str) \ +{ \ + *((str) + 7) = (uint8) ((x) ); \ + *((str) + 6) = (uint8) ((x) >> 8); \ + *((str) + 5) = (uint8) ((x) >> 16); \ + *((str) + 4) = (uint8) ((x) >> 24); \ + *((str) + 3) = (uint8) ((x) >> 32); \ + *((str) + 2) = (uint8) ((x) >> 40); \ + *((str) + 1) = (uint8) ((x) >> 48); \ + *((str) + 0) = (uint8) ((x) >> 56); \ +} + +#define PACK64(str, x) \ +{ \ + *(x) = ((uint64) *((str) + 7) ) \ + | ((uint64) *((str) + 6) << 8) \ + | ((uint64) *((str) + 5) << 16) \ + | ((uint64) *((str) + 4) << 24) \ + | ((uint64) *((str) + 3) << 32) \ + | ((uint64) *((str) + 2) << 40) \ + | ((uint64) *((str) + 1) << 48) \ + | ((uint64) *((str) + 0) << 56); \ +} + +/* Macros used for loops unrolling */ + +#define SHA256_SCR(i) \ +{ \ + w[i] = SHA256_F4(w[i - 2]) + w[i - 7] \ + + SHA256_F3(w[i - 15]) + w[i - 16]; \ +} + + + +uint32 sha256_h0[8] = + {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, + 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19}; + + +uint32 sha256_k[64] = + {0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, + 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, + 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, + 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, + 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, + 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, + 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, + 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, + 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, + 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, + 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, + 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, + 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, + 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, + 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, + 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2}; + + +/* SHA-256 functions */ + +void sha256_transf(sha256_ctx *ctx, const unsigned char *message, + unsigned int block_nb) +{ + uint32 w[64]; + uint32 wv[8]; + uint32 t1, t2; + const unsigned char *sub_block; + int i,j; + + + for (i = 0; i < (int) block_nb; i++) { + sub_block = message + (i << 6); + + for (j = 0; j < 16; j++) { + PACK32(&sub_block[j << 2], &w[j]); + } + + for (j = 16; j < 64; j++) { + SHA256_SCR(j); + } + + for (j = 0; j < 8; j++) { + wv[j] = ctx->h[j]; + } + + for (j = 0; j < 64; j++) { + t1 = wv[7] + SHA256_F2(wv[4]) + CH(wv[4], wv[5], wv[6]) + + sha256_k[j] + w[j]; + t2 = SHA256_F1(wv[0]) + MAJ(wv[0], wv[1], wv[2]); + wv[7] = wv[6]; + wv[6] = wv[5]; + wv[5] = wv[4]; + wv[4] = wv[3] + t1; + wv[3] = wv[2]; + wv[2] = wv[1]; + wv[1] = wv[0]; + wv[0] = t1 + t2; + } + + for (j = 0; j < 8; j++) { + ctx->h[j] += wv[j]; + } + } +} + +void sha256(const unsigned char *message, unsigned int len, unsigned char *digest) +{ + sha256_ctx ctx; + + sha256_init(&ctx); + sha256_loop(&ctx, message, len); + sha256_result(&ctx, digest); +} + +void sha256_init(sha256_ctx *ctx) +{ + int i; + for (i = 0; i < 8; i++) { + ctx->h[i] = sha256_h0[i]; + } + + ctx->len = 0; + ctx->tot_len = 0; +} + +void sha256_loop(sha256_ctx *ctx, const unsigned char *message, + unsigned int len) +{ + unsigned int block_nb; + unsigned int new_len, rem_len, tmp_len; + const unsigned char *shifted_message; + + tmp_len = SHA256_BLOCK_SIZE - ctx->len; + rem_len = len < tmp_len ? len : tmp_len; + + memcpy(&ctx->block[ctx->len], message, rem_len); + + if (ctx->len + len < SHA256_BLOCK_SIZE) { + ctx->len += len; + return; + } + + new_len = len - rem_len; + block_nb = new_len / SHA256_BLOCK_SIZE; + + shifted_message = message + rem_len; + + sha256_transf(ctx, ctx->block, 1); + sha256_transf(ctx, shifted_message, block_nb); + + rem_len = new_len % SHA256_BLOCK_SIZE; + + memcpy(ctx->block, &shifted_message[block_nb << 6], + rem_len); + + ctx->len = rem_len; + ctx->tot_len += (block_nb + 1) << 6; +} + +void sha256_result(sha256_ctx *ctx, unsigned char *digest) +{ + unsigned int block_nb; + unsigned int pm_len; + unsigned int len_b; + int i; + + block_nb = (1 + ((SHA256_BLOCK_SIZE - 9) + < (ctx->len % SHA256_BLOCK_SIZE))); + + len_b = (ctx->tot_len + ctx->len) << 3; + pm_len = block_nb << 6; + + memset(ctx->block + ctx->len, 0, pm_len - ctx->len); + ctx->block[ctx->len] = 0x80; + UNPACK32(len_b, ctx->block + pm_len - 4); + + sha256_transf(ctx, ctx->block, block_nb); + + for (i = 0 ; i < 8; i++) { + UNPACK32(ctx->h[i], &digest[i << 2]); + } +} + +void sha256_get_digest(const void *data, size_t size, + unsigned char result[SHA256_RESULTLEN]) +{ + sha256_ctx ctx; + + sha256_init(&ctx); + sha256_loop(&ctx, data, size); + sha256_result(&ctx, result); +} + diff -r -u -N --exclude=Makefile.in --exclude=.deps --exclude=Makefile src/lib/sha2.h lib/sha2.h --- src/lib/sha2.h 1970-01-01 01:00:00.000000000 +0100 +++ lib/sha2.h 2007-02-23 14:22:32.952116316 +0100 @@ -0,0 +1,72 @@ +/* + * FIPS 180-2 SHA-224/256/384/512 implementation + * Last update: 02/02/2007 + * Issue date: 04/30/2005 + * + * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay(a)a3.epfl.ch> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifndef SHA2_H +#define SHA2_H + +#define SHA256_RESULTLEN ( 256 / 8) + +#define SHA256_BLOCK_SIZE ( 512 / 8) + +#ifndef SHA2_TYPES +#define SHA2_TYPES +typedef unsigned char uint8; +typedef unsigned int uint32; +typedef unsigned long long uint64; +#endif + + +typedef struct { + unsigned int tot_len; + unsigned int len; + unsigned char block[2 * SHA256_BLOCK_SIZE]; + uint32 h[8]; +} sha256_ctx; + +void sha256_transf(sha256_ctx *ctx, const unsigned char *message, + unsigned int block_nb); + + +void sha256_init(sha256_ctx * ctx); +void sha256_loop(sha256_ctx *ctx, const unsigned char *message, + unsigned int len); +void sha256_result(sha256_ctx *ctx, unsigned char *digest); +void sha256(const unsigned char *message, unsigned int len, + unsigned char *digest); +void sha256_get_digest(const void *data, size_t size, + unsigned char result[SHA256_RESULTLEN]); + + + +#endif /* !SHA2_H */ +

3 2

[Dovecot] SEGV with Dovecot v1.0.0 Deliver and cmusieve v1.0.1 and vacation
by Steffen Kaiser 16 Jun '07

16 Jun '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have a small Sieve script that tries to use vacation that segfaults. The script is the one from http://wiki.dovecot.org/LDA/Sieve. When I change the email address (I changed the local part into "skai"), hence, vacation is skipped, the mail is delivered without any problem. ==== script start require ["fileinto", "vacation"]; # Move spam to spam folder if exists "X-Spam-Flag" { fileinto "spam"; # Stop here so that we do not reply on spams stop; } vacation # Reply at most once a day to a same sender :days 1 :subject "Out of office reply" # List of allowed recipient addresses from auto reply should be sent. :addresses ["ska(a)ux-2s11-9.inf.fh-bonn-rhein-sieg.de"] "I'm out of office, please contact Joan Doe instead. Best regards John Doe"; ========== END ========== Out of sieved .dovecot.sievec Sievecode version 3 4: IF (ends at 13)exists{11}X-Spam-Flag 13:JUMP 20 19: FILEINTO {4}spam 19: STOP 20: VACATION {39}ska(a)ux-2s11-9.inf.fh-bonn-rhein-sieg.de 40 SUBJ({19}Out of office reply) 60 MESG({73}I'm out of office, please contact Joan Doe instead. Best regards John Doe) DAYS(1) MIME(0) full len is: 62 ========== END gdb output: Core was generated by `/usr/local/dovecot/libexec/dovecot/deliver'. Program terminated with signal 11, Segmentation fault. #0 0xb7eef3a3 in strlen () from /lib/tls/i686/cmov/libc.so.6 (gdb) bt full #0 0xb7eef3a3 in strlen () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #1 0xb7e2bcf3 in sieve_execute_bytecode (bc=0x80e3eb0, interp=0x80e3de8, script_context=0xbfb57800, message_context=0xbfb577c4) at script.c:398 hash = "\000\000\000\000¸Z0F\000\000\000\000¸Z0F" actions = (action_list_t *) 0x80e3850 notify_list = (notify_list_t *) 0x80e3830 actions_string = "Action(s) taken:\n", '\0' <repeats 4078 times> errmsg = 0x0 imapflags = {flag = 0x0, nflags = 0} #2 0xb7e1eb2c in cmu_sieve_run (storage=0x80d0a20, mail=0x80e03c8, script_path=0x80cbc48 "/home/ska/.dovecot.sieve", username=0x80cb030 "ska", mailbox=0x80bae92 "INBOX") at sieve-cmu.c:573 fd = <value optimized out> interp = (sieve_interp_t *) 0x80e3de8 bytecode = (sieve_bytecode_t *) 0x80e3eb0 sdata = {username = 0x80cb030 "ska", storage = 0x80d0a20, errors = 0x0} mdata = {mail = 0x80e03c8, mailbox = 0x80bae92 "INBOX", id = 0x80e4860 "<200704260754.l3Q7sWdu002894(a)ux-2s11-9.inf.fh-bonn-rhein-sieg.de>", return_path = 0x0, authuser = 0x80cb030 "ska", temp = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}} compiled_path = 0x80cbc68 "/home/ska/.dovecot.sievec" path = 0xb7fb0ff4 "<Í\022" ret = <value optimized out> #3 0xb7e1da72 in cmusieve_deliver_mail (storage=0x80d0a20, mail=0x80e03c8, username=0x80cb030 "ska", mailbox=0x80bae92 "INBOX") at cmusieve-plugin.c:72 script_path = 0x80cbc48 "/home/ska/.dovecot.sieve" #4 0x08057536 in main (argc=Cannot access memory at address 0x0 ) at deliver.c:679 tab = (struct var_expand_table *) 0x80cb068 config_path = 0x80bb79c "/usr/local/dovecot/etc/dovecot.conf" envelope_sender = 0x80bae98 "MAILER-DAEMON" mailbox = 0x80bae92 "INBOX" auth_socket = <value optimized out> home = <value optimized out> destination = 0x80cb030 "ska" user = 0x80cb030 "ska" mail_env = <value optimized out> flags = 1025 lock_method = MAIL_STORAGE_LOCK_FCNTL storage = (struct mail_storage *) 0x80d0a20 mbox_storage = (struct mail_storage *) 0x80d2d48 box = (struct mailbox *) 0x80dcc88 input = (struct istream *) 0x80d4044 t = (struct mailbox_transaction_context *) 0x80de2a0 mail = (struct mail *) 0x80e03c8 process_euid = 30000 i = 63 ret = <value optimized out> (gdb) - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBRjBdji9SORjhbDpvAQICoggAnzLxTlL8mDonntaDvwr/4JN6eWPIAm7o XP6hSw9JlbTsPY55keQMZpN/UNB/FXojcqI6lD4f/2dJqCEHmeB40NQZEMUN+f60 6+BHkE6vb2sMnXa09eQWg2d5zVKp6bHdSsbtzmWIsYX0stUFMncFTJVQgatHstDm DaSGMf6V2SwiPst/0tUbeTMqYhud9LU2YLhU3+T9AuTmcSGztohnJPGnqC1GLP+N m+KLbLF6B7ZMQ2RX+M+arzz8EQRHZ2622aqiLKoT+rVZ8LkLPzp4Whd9HK1MqMld KSjJuZBKgKuJr61SGqPboPOip635DgJH7g2BKgGnOHWvJf6E7U+Q9A== =1M3a -----END PGP SIGNATURE-----

3 3

[Dovecot] auth process(es)
by Thomas Hummel 16 Jun '07

16 Jun '07

Hello Timo, I've got some questions about dovecot-auth processes which I cannot answer just by reading the doc : [ Note : my problem is that I often see dovecot: pop3-login: Can't connect to auth server at default: Connection refused and I'm looking for a way to tweak dovecot.conf parameters to allow more login <-> auth connections ] - I'm not sure I get the auth worker process concept right : is there a master dovecot-auth which listens to new incoming connections from login processes and fork/exec the real job of authenticating against the pass/userdbs to a child, called an auth worker ? - is it safe to increment the number of auth processes (the 'count' parameter in the auth block (auth_default { ...} for instance) ? - my understanding is that login processes communicate with auth processes through a unix type socket (named 'default') : can I create a second auth block in dovecot.conf (for instance 'aut extra {...}') in addition to the existing 'auth default {...}' one ? would it create an second unix socket and thus allowing a heavier login processes load ? what would be the difference between that and, say, changing the 'count' parameter to '2' in the 'auth default' section ? thanks. -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Pôle informatique - systèmes et réseau

2 5

[Dovecot] different configurations for individual user
by Joshua C.S. Chen 16 Jun '07

16 Jun '07

Hi everyone, I am planning to upgrade my current uw-imap to dovecot. I am using Linux (Redhat EL 4). The main purpose is to use maildir instead of mbox. For some reason, I don't want to upgrade all users' mail boxes all at a time, but I want to change the imap server first (to dovecot), while keeping all mbox files, then convert them to maildir user by user (one user at a time). My question is: Is it possible that dovecot can setup individual user's own configuration? so that some users can setup mail_location = mbox but others = maildir. Thanks in advance Joshua

2 1

[Dovecot] LDAP subtree search on AD
by Bruno Puga 16 Jun '07

16 Jun '07

Hello people! I'm new to the list and to dovecot too. In advance I'd like to thank everybody who could help me, and I'll be very glad if a could help somebody here. I'm working in a project to integrate dovecot and active directory authentication for 2 weeks without total success. I've tried so many waysto solve my problem, but no one gave me the right answer. I'll appreciate if someone could help me. First off all let me show some needed data. Distro: Debian Etch dovecot --version 1.0.0 dovecot -n # /etc/dovecot/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot-imapd.log log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable: /usr/lib/dovecot/imap-login mail_debug: yes imap_client_workarounds: outlook-idle delay-newmail auth default: verbose: yes debug: yes debug_passwords: yes passdb: driver: pam args: dovecot userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail /etc/dovecot/dovecot-ldap.conf hosts = 192.168.0.11 dn = cn=dovecot,cn=Users,dc=tecnicopias01,dc=com,dc=br dnpass = password ldap_version = 3 auth_bind = yes base = DC=tecnicopias01,DC=com,DC=br deref = never scope = subtree user_attrs = info=mail user_filter = (&(objectClass=organizationalPerson)(sAMAccountName=%u)) user_global_uid = 5000 user_global_gid = 5000 I can authenticate using pam+krb5 with success, but when I try to make a userdb search to get maillocation for the authenticated user, I get in trouble. The ldap_search doesn't make subtree search, making only onelevel search. So, if I point the base directive (/etc/dovecot/dovecot-ldap.conf) to where the user that is authenticating in that moment is, I can perfect login and get the maillocation. My question is: Why dovecot doesn't make ldap subtree search? Or, am I missing anything? Thanks Bruno.

2 5

[Dovecot] Looking for plugin docs
by Rajkumar S 16 Jun '07

16 Jun '07

Hello all, I had gone through the wiki, but could not find any page about writing new plugins. Any pointers towards plugin api/docs will be very helpful. with warm regards, raj

3 14

Re: [Dovecot] auth process(es)
by Kenny Dail 15 Jun '07

15 Jun '07

> > - is it safe to increment the number of auth processes (the 'count' > > parameter in the auth block (auth_default { ...} for instance) ? > > Should be. > > > - my understanding is that login processes communicate with auth > > processes through a unix type socket (named 'default') : > > > > can I create a second auth block in dovecot.conf (for instance > > 'aut extra {...}') in addition to the existing 'auth default {...}' > > one ? would it create an second unix socket and thus allowing a heavier > > login processes load ? > > > > what would be the difference between that and, say, changing the > > 'count' parameter to '2' in the 'auth default' section ? > > Increasing count allows heavier load, because there are then more > processes listening for incoming connections in the same socket. Actually increasing the count doesn't work. At least not for me on 1.0.0: Jun 14 12:28:39 mail5 dovecot: Dovecot v1.0.0 starting up Jun 14 12:28:39 mail5 dovecot: Auth process died too early - shutting down Jun 14 12:28:39 mail5 dovecot: child 19080 (auth) returned error 89 Jun 14 12:28:39 mail5 dovecot: auth(default): Socket already exists: /var/run/dovecot/auth-client -- Kenny Dail <kend(a)amigo.net>

3 2

[Dovecot] shared folders
by T. Horsnell 14 Jun '07

14 Jun '07

A number of our users would greatly benefit from truly shareable mail folders. I know we can bodge this with symlinks, but mailbox corruptions seem to occur when simultaneous updates are made, but this may be a client issue I guess. So I wonder if true shareability is creeping up the agenda. By true shareability, I mean such that if two users have the same folder open and one of them makes a modification to it, the display of that folder on the other user's screen immediately reflects that change. I guess this may well require a co-operating client... Cheers, Terry --

2 1