- dovecot - dovecot.org

[Dovecot] RAID benchmarks
by Ethan Sommer 21 Nov '06

21 Nov '06

We (a small college with about 3000 active accounts) are currently in the process of moving from UW IMAP running on linux to dovecot running on a cluster of 3 or 4 new faster Linux machines. (Initially using perdition to split the load.) As we are building and designing the system, I'm attempting to take (or find) benchmarks everywhere I can in order to make informed decisions and so that when we need something faster we have something to compare it to. I've looked all over the Internet and I haven't seen very many good benchmarks running on recent hardware for things like this. Even simple things like how different raid levels perform with fast CPUs and really fast disks. We recently got the first of the cluster machines (which has the following specs: (from penguin computing) 2x 1.6ghz woodcrest (so 4 cores total) 2g ram (we may upgrade to more, depending on what we seem to need) 6x 15k SAS 73G hard drives. I've always read that RAID 10 is the RAID of choice for mail, because the checksums take time and whatnot, but on a system that fast I'm sure that's not an issue (which I could see from the cpu usage during benchmarks.) We were also wondering whether RAID6 would be a good option since it would give more redundancy. (raid6 allows 2 drive failures) All tests were run on ext3 with all 6 disks in the raid. Everything is using Linux software raid. I used bonnie++ to run the benchmarks, and here are the initial results we got: Output Input RAID "Per Chr" "Block" "Per Chr" "Block" RAID6 34628, 97983, 23316, 39077 RAID5 39559, 32715, 32036, 52231 RAID10 38816, 229062, 40645, 267418 I assume that mail running maildir (as we intend to do) is somewhere between writing one char at a time and writing huge blocks to fill 4g files. Since the Per Chr values seemed to have maxed out the CPU and we'll have 4 cores available, I tried the same thing running 4 copies of bonnie at once and adding the results. (I worked backwards and didn't bother with raid 6 for obvious reasons) Output Input RAID "Per Chr" "Block" "Per Chr" "Block" RAID5 37465, 37095, 102828, 174263 RAID10 111239, 128287, 93400, 230320 So, if our system is ever running full out, basically disk bound, it should be able to handle about 4X as many writes and at least as many reads using RAID10 than raid 5, and since raid 6 was pretty similar to raid 5 in the first tests, I assume it will be here too. I have the full bonnie results if anyone's interested. I also plan to come up with some basic benchmarks as we start to actually have dovecot working as we want it to. (Possibly using the macs in our labs and XGrid as a "client".. finally a use for that thing :) ) Do people have suggestions as to what to test for a primarily IMAP (+ a little POP) server? I was thinking of doing something similar to http://www.courier-mta.org/mbox-vs-maildir/ which selects a mail box, deletes and expunges a message, fetches a few messages, and then does some searches. Also, while I have the opportunity, are there any other benchmarks I should run? I suppose I could compare dovecot with mbox vs maildir, with indexing and without. Dovecot with indexing but the indexes deleted, etc. I could compare dovecot to uw imap. Anything else? I probably can't justify the time to get cyrus up and running. (I did that a few months ago when deciding which server to use...) Ethan Sommer -- -- Ethan Sommer Systems Administrator Gustavus Adolphus College 507-933-7042 sommere(a)gac.edu

3 5

[Dovecot] rc14 and rc15 performance issues
by Jeff A. Earickson 21 Nov '06

21 Nov '06

Hi, I am stuck at rc13 because rc14 and rc15 have both failed to keep up with imap connections on my (slow old) system. I have the problem where if a lot of people check their email at once (like at the top of the hour) then my load goes way up and things slow to a crawl. My setup: Solaris 10 on an E220R, mbox format, imap and imaps only. I also use "login_process_per_connection = no". Any suggestions? Jeff Earickson Colby College

5 6

[Dovecot] how to configure dovecot
by Hein Celliers 21 Nov '06

21 Nov '06

Hi all! I need some help....changing passwords....... Dovecot server, appears to cache the old credentials. It only discovers the change upon a restart. I need to know how to configure dovecot (dovecot-1.0-0.beta2.7) as not to cache the passwords. (Using fedora core 5) Thanks Hein Celliers

1 0

Re: [Dovecot] Dovecot on Solaris
by Joseph Tam 21 Nov '06

21 Nov '06

> For those running Dovecot on Solaris, what are your positive/negative > experiences with building the software with CC vs. GCC? We are currently > letting ./configure find our gcc and build with it, but wondered if anyone > has any experience with Sun CC (does it even compile, for example). I once used StudioCC to compile dovecot to see if the problem I had was a compiler bug, but in general, I use gcc since a lot of software is tested against it. I don't use Studio unless performance is critical. >From what I know, IMAP performance is basically disk-memory bounded, so it might not be worth sweating over: use whatever gives you the least grief. Joseph Tam <tam(a)math.ubc.ca>

1 0

[Dovecot] manageSIEVE implementation
by Brian G. Peterson 20 Nov '06

20 Nov '06

I found a thread from last year that suggested that a manageSIEVE (port 2000) implementation for dovecot-sieve doesn't exist yet. I assume that this is still true. Could somebody please provide a status on this? Thanks, - Brian

3 3

Re: [Dovecot] Auth checking also the service
by Andrey Panin 20 Nov '06

20 Nov '06

On 322, 11 18, 2006 at 12:56:41 +0100, Alessandro Astarita wrote: > Alle 12:14, sabato 18 novembre 2006, Johannes Berg ha scritto: > > I don't see why it wouldn't be possible but haven't looked at the code. > > > > I wonder why you even need to distinguish between these though. Are we > > still in the days where encryption is a value-added service? :) > > I have to distinguish pop3/pop3s and imap/imaps because I need mailboxes with > ssl access only. It's a way to force users to do secure connection. :-) Please try attached patch. It adds %c variable which expands to "TLS" if connection is secure. > -- > Alessandro 'Asterix' Astarita <aleast(a)capri.it> > Capri Online S.r.l. http://www.caprionline.it/ > "Unix IS user friendly. It's just selective about who its friend are" > -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

3 2

[Dovecot] BUG: passdb checkpassword {} and lastauth file
by Max A 20 Nov '06

20 Nov '06

(Repeat, because on the first message there was no reaction) Hi. If checkpassword interface is used for working with vpopmail, function vpopmail "Record time and ip of last auth attempt" (--enable-auth-logging option for configure) won't work - the file "lastauth" is created in Maildir, but does not contain ip-address. If I had correctly understood, dovecot woldn't have set a enviroment variable TCPREMOTEIP for vchkpw. If changes are made in auth/passdb-checkpassword.c (a patch in attachment), everything will work. Probably, the patch is incorrect and does not solve all problems, however the request is to pay attention to existence of the problem. Also it is possible, that a similar problem exists with other variables TCP UCSPI protocol (http://cr.yp.to/proto/ucspi-tcp.txt) P.S. If use the interface vpopmail instead of checkpassword, the file "lastauth" will not be created at all, that is a little bit inconvenient. ********************************** System: dovecot-1.0.rc10 vpopmail-5.4.17 ASP Linux Server II (RHEL3 clone) kernel 2.4.21-47.EL.aspsmp CPU architecture: x86 (IBM xSeries 336) Filesystem: ext3 ********************************** dovecot configuration: base_dir = /var/run/dovecot/ protocols = imap pop3 disable_plaintext_auth = no ssl_disable = yes login_greeting = Ready. first_valid_uid = 89 last_valid_uid = 89 first_valid_gid = 89 last_valid_gid = 89 protocol imap { listen = 81.26.136.8:144 mail_executable = /usr/local/libexec/dovecot/imap mail_plugins = quota imap_quota mail_plugin_dir = /usr/local/lib/dovecot/imap imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { listen = 81.26.136.8:112 login_executable = /usr/local/libexec/dovecot/pop3-login mail_executable = /usr/local/libexec/dovecot/pop3 pop3_uidl_format = %f mail_plugins = quota mail_plugin_dir = /usr/local/lib/dovecot/pop3 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth default { mechanisms = plain login passdb checkpassword { args = /var/qmail/vpopmail/bin/vchkpw } userdb prefetch { } user = root } dict { } plugin { quota = maildir } *************************************** dovecot configure options: ./configure \ --disable-ipv6 \ --prefix=/usr/local \ --sysconfdir=/etc/dovecot \ --without-passwd \ --without-passwd-file \ --without-shadow \ --without-pam \ --without-bsdauth \ --with-checkpassword \ --with-vpopmail \ --without-static-userdb \ --with-prefetch-userdb \ --without-sql \ --without-pgsql \ --without-mysql \ --without-sqlite \ --with-ssl=openssl \ --with-pop3d \ --without-deliver \ --with-storages=maildir \ --with-docs ***************************************** vpopmail configure options: ./configure \ --enable-auth-module=cdb \ --enable-logging=p \ --enable-md5-passwords \ --enable-make-seekable \ --enable-file-sync \ --enable-ip-alias-domains \ --enable-clear-passwd \ --disable-roaming-users \ --disable-learn-passwords \ --disable-passwd \ --enable-auth-logging diff -ur dovecot-1.0.rc10.orig/src/auth/passdb-checkpassword.c dovecot-1.0.rc10/src/auth/passdb-checkpassword.c --- dovecot-1.0.rc10.orig/src/auth/passdb-checkpassword.c 2006-08-22 06:37:56.000000000 +0400 +++ dovecot-1.0.rc10/src/auth/passdb-checkpassword.c 2006-10-17 16:47:09.000000000 +0400 @@ -226,6 +226,10 @@ env_put(t_strconcat("REMOTE_IP=", net_ip2addr(&request->remote_ip), NULL)); + env_put(t_strconcat("TCPREMOTEIP=", + net_ip2addr(&request->remote_ip), + NULL)); + } if (request->master_user != NULL) { env_put(t_strconcat("MASTER_USER=",

2 5

[Dovecot] dovecot and ldap passwords.
by Mauro Sanna 20 Nov '06

20 Nov '06

Hallo. First of all I'm sorry for my bad english. I have a question about how dovecot use passwords. I have all my mail accounts in a ldap database. The user password are stored in form: {crypt}mypasswd. In dovecot-ldap.conf I have default_pass_scheme = CRYPT. All is working fine. The problem in the crypt scheme is that I can't have passwords more than 8 characters long. So I've tried to change the type of the ldap passwords in SSHA or SMD5, but in this way the users can't authenticate yourselfs. Dovecot doesn't understand SSHA or SMD5?

3 3

[Dovecot] Problem with rc10
by Steven F Siirila 20 Nov '06

20 Nov '06

I just upgraded our test server from rc6 to rc10... ISSUE #1 I noticed that we no longer are getting two "From_" lines. However, the one that was good (had the original sender e-mail address) is now gone. The one with "dovecot.deliver" remains. I attempted to add "-d test" to the mailbox_command line in main.cf as follows: mailbox_command = /opt/dovecot/libexec/dovecot/deliver -d test and things turned ugly and caused Postfix to defer messages: Oct 17 16:31:50 hostname postfix/local[7230]: D14632C9C: to=<someuser@somehost>, relay=local, delay=3.6, delays=3/0.02/0/0.62, dsn=4.3.0, status=deferred (temporary failure) I removed the "-d test" from the Postfix main.cf and the problem went away. So, how do I fix the "From_" lines? ISSUE #2 After upgrading, messages cannot be moved from the INBOX to a folder. Thunderbird claims there was an internal error and to consule the server logs, but I see nothing in the dovecot logs that would indicate what's going on. For example, I attempted to move a message into my Trash folder which did not currently have any index files. Here is a Solaris truss output of that attempt: poll(0x000B4C98, 2, 999) = 0 poll(0x000B4C98, 2, 0) = 0 poll(0x000B4C98, 2, 999) = 1 read(0, " D O N E\r\n", 3323) = 6 write(1, " 2 8 O K I d l e c".., 23) = 23 read(0, 0x000BC5BB, 3317) Err#11 EAGAIN poll(0x000B4C98, 2, 675) = 1 read(0, " 3 0 u i d c o p y ".., 3317) = 27 stat64("/home/sfs/Trash", 0xFFBFF5C8) = 0 alarm(120) = 0 fcntl(6, F_SETLKW64, 0xFFBFF308) = 0 alarm(0) = 120 stat64("/home/sfs/Trash", 0xFFBFF640) = 0 mkdir("/home/sfs/.imap/Trash", 0770) Err#17 EEXIST stat64("/home/sfs/.imap/Trash", 0xFFBFF4C0) = 0 stat64("/home/sfs/Trash", 0xFFBFF4C0) = 0 time() = 1161122396 open64("/home/sfs/.imap/Trash/dovecot.index", O_RDWR) Err#2 ENOENT open64("/home/sfs/.imap/Trash/dovecot.index", O_RDWR) Err#2 ENOENT write(1, " 3 0 N O I n t e r n".., 96) = 96 poll(0x000B4C98, 2, 588) = 0 poll(0x000B4C98, 2, 0) = 0 poll(0x000B4C98, 2, 410) = 0 Someone else using a different IMAP client caused these errors to occur (this is even after I wiped all of their dovecot index files): Oct 17 16:43:11 earth.tc.umn.edu dovecot: IMAP(kor): Corrupted transaction log file /home/kor/.imap/INBOX/dovecot.index.log: invalid indexid (1161121145 != 1156185395) Oct 17 16:43:11 earth.tc.umn.edu dovecot: IMAP(kor): Corrupted transaction log file /home/kor/.imap/INBOX/dovecot.index.log: invalid new transaction log sequence (6 >= 6) Oct 17 16:47:09 earth.tc.umn.edu dovecot: IMAP(kor): Corrupted transaction log file /home/kor/.imap/INBOX/dovecot.index.log: invalid indexid (1161121145 != 1161120959) Oct 17 16:47:09 earth.tc.umn.edu dovecot: IMAP(kor): Corrupted transaction log file /home/kor/.imap/INBOX/dovecot.index.log: invalid new transaction log sequence (2 >= 2) Oct 17 17:05:59 earth.tc.umn.edu dovecot: IMAP(kor): Corrupted transaction log file /home/kor/.imap/INBOX/dovecot.index.log: invalid indexid (1161121145 != 1161120959) Oct 17 17:05:59 earth.tc.umn.edu dovecot: IMAP(kor): Corrupted transaction log file /home/kor/.imap/INBOX/dovecot.index.log: invalid new transaction log sequence (4 >= 4) Here are our non-standard dovecot.conf items: protocols = imap imaps pop3 pop3s shutdown_clients = no syslog_facility = local6 ssl_cert_file = /etc/opt/openssl/certs/dovecot.pem ssl_key_file = /etc/opt/openssl/private/dovecot.pem default_mail_env = mbox:~/:INBOX=/var/mail/%u # Default namespace namespace private { separator = / prefix = location = mbox:~/:INBOX=/var/mail/%u inbox = yes hidden = yes } mail_full_filesystem_access = yes first_valid_uid = 100 max_mail_processes = 8192 mbox_min_index_size = 128 imap_client_workarounds = delay-newmail outlook-idle tb-extra-mailbox-sep pop3_uidl_format = %08Xu%08Xv protocol lda { postmaster_address = postmaster(a)umn.edu mail_plugins = cmusieve } auth_verbose = yes auth_debug = yes auth default { passdb pam { args = session=yes * } } I am now backing out to rc6 for now... we never saw this behavior on rc6. -- Steven F. Siirila Office: Lind Hall, Room 130B Internet Services E-mail: sfs(a)umn.edu Office of Information Technology Voice: (612) 626-0244 University of Minnesota Fax: (612) 626-7593

2 4

[Dovecot] Problems Creating Core Dumps
by Joseph D. Wagner 20 Nov '06

20 Nov '06

Dovecot 1.0.rc15 crashed on my FC4 server, but it didn't create a core dump. Upon further research, I found these lines tucked away in the /etc/rc.d/init.d/functions file: # make sure it doesn't core dump anywhere unless requested ulimit -S -c ${DAEMON_COREFILE_LIMIT:-0} >/dev/null 2>&1 The /etc/rc.d/init.d/functions file is a master file that is referenced by all of the init scripts, so I didn't want to change it. Instead, I created a file /etc/sysconfig/dovecot with the following line: DAEMON_COREFILE_LIMIT=unlimited If I'm reading the /etc/rc.d/init.d/functions file correctly, this should work, but my bash is rusty. I was hoping someone else could check my work. Joseph D. Wagner

2 1

[Dovecot] Backtraces without core dumps
by Timo Sirainen 19 Nov '06

19 Nov '06

Since getting core dumps seems to be difficult sometimes, especially with login processes, I've now added code to log the backtrace when Dovecot crashes in some assert check (or some other reason why it decides to abort()). This code works with Linux and Solaris, but I don't know about BSDs. Apparently there exists libexecinfo library which could be used. I think this code could be used to log backtraces also for segfaults, but that's more risky so I didn't do it yet. Maybe it should be done only optionally. If you're interested in trying, the code is now in CVS and in the latest nightly snapshot. When it crashes, it prints something like: Panic: file client.c: line 55 (client_create): assertion failed: (my_client != NULL) Error: Backtrace: ./imap [0x80b2ffa] -> ./imap [0x80b2ecc] -> ./imap [0x805bbb3] -> ./imap(main+0x426) [0x80634a6] -> /lib/tls/libc.so.6 (__libc_start_main+0xc8) [0xb7e53ea8] -> ./imap [0x80566a1] Looks like the symbol name resolving doesn't work all that great. But here gdb will help you: gdb ./imap (gdb) b *0x80b2ffa Breakpoint 1 at 0x80b2ffa: file failures.c, line 126. (gdb) b *0x80b2ecc Breakpoint 2 at 0x80b2ecc: file failures.c, line 185. (gdb) b *0x805bbb3 Breakpoint 3 at 0x805bbb3 (gdb) b *0x80634a6 Breakpoint 4 at 0x80634a6: file main.c, line 223. That went pretty well, except for some reason it couldn't figure out where 0x805bbb3 was. To get some kind of an idea about that, you can do: (gdb) x 0x805bbb3 0x805bbb3 <client_create+467>: 0x90909090 If someone knows better ways to do all of this, please tell me too :)

1 0

[Dovecot] Dovecot (unofficial) patches
by Egbert Jan 19 Nov '06

19 Nov '06

Dear list, As a recent dovecot addict, I'm a bit puzzled by the sheer amount of patches available. I have not seen the history of these patches and I could not find a README explainng the patches. Are all these personal wishes/nice to have things or are they (to be) incorporated in dovecot-final? I use rpmbuild to create new rpms from the latest tarball but in that process still several patches are included during the build. I wonder if they are still needed in rc15. I use the orignal spec file (the latest I could find) was created for rc7 and in there I see: Patch2 dovecot-0.99.10-mbox-patch Seems to be to change the order of ./Mail before ./mail Patch3 dovecot-CVE-2006-2414 Overview from CVE db:Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command. I'm not a spec file wizard, so I change as less as possible. Unfortunately the maintainer (Jerome Soyer) has never responded to my emails. My server runs Mandriva Official 2007.0 and Postfix 2.3.3 and dovecot rc14 (will move to rc15 soon). TNX EgbertJan (NL)

2 1

[Dovecot] TLS timeout with Thunderbird
by Jason Dixon 19 Nov '06

19 Nov '06

I'm trying to get dovecot working with various clients on my new mailserver. I installed the base rc2 that comes with OpenBSD 4.0, then upgraded to rc14 when I ran into problems with TLS and Thunderbird. The server has no problems with Mail.app on my laptop, but any connection attempts from Thunderbird timeout after the TCP handshake. 13:53:41.074438 66.x.x.2.50483 > 38.x.x.248.993: S 3787736038:3787736038(0) win 65535 <mss 1460,nop,wscale 0,nop,nop,timestamp 2064284084 0,sackOK,eol> (DF) 13:53:41.074554 38.x.x.248.993 > 66.x.x.2.50483: S 1565942120:1565942120(0) ack 3787736039 win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 2681405076 2064284084> (DF) 13:53:41.459434 66.x.x.2.50483 > 38.x.x.248.993: . ack 1 win 65535 <nop,nop,timestamp 2064284084 2681405076> (DF) 13:53:47.028621 66.x.x.2.50483 > 38.x.x.248.993: F 1:1(0) ack 1 win 65535 <nop,nop,timestamp 2064284096 2681405076> (DF) The only thing logged by dovecot is a disconnection event. There is nothing else logged, even with ssl_verbose enabled. Nov 17 14:23:05 colo2 dovecot: imap-login: Disconnected: rip=66.x.x. 2, lip=38.x.x.248, TLS handshake This happens with Thunderbird 1.5.0.4 and 1.5.0.8 on Mac OS X, and Thunderbird 1.5.0.7 on Windows 2000. Any ideas would be greatly appreciated. Thanks, -- Jason Dixon DixonGroup Consulting http://www.dixongroup.net

7 11

[Dovecot] 1.0.rc15 released
by Timo Sirainen 19 Nov '06

19 Nov '06

http://dovecot.org/releases/dovecot-1.0.rc15.tar.gz http://dovecot.org/releases/dovecot-1.0.rc15.tar.gz.sig * Fixed an off-by-one buffer overflow in cache file handling. The code is executed only with mmap_disable=yes and only if index files are used (ie. INDEX=MEMORY is safe). * passdb checkpassword: Handle vpopmail's non-standard exit codes. - rc14 sometimes assert-crashed if .log.2 file existed in a mailbox (earlier versions leaked memory and file descriptors) - io_add() assert-crashfixes - Potential SSL hang fix at the beginning of the connection

1 0

[Dovecot] Security hole #2: Off-by-one buffer overflow with mmap_disable=yes
by Timo Sirainen 19 Nov '06

19 Nov '06

Version: 1.0test53 .. 1.0.rc14 (ie. all 1.0alpha, 1.0beta and 1.0rc versions so far). 0.99.x versions are safe (they don't even have mmap_disable setting). Problem: When mmap_disable=yes setting is used, dovecot.index.cache file is read to memory using "file cache" code. It contains a "mapped pages" bitmask buffer. In some conditions when updating the buffer it allocates one byte too little. Exploitability: I think it's going to be pretty difficult to cause anything else than a crash, but I wouldn't say impossible. Only logged in IMAP/POP3 users can exploit this. In theory you might be able to exploit this for other users as well by sending them a lot of specially crafted emails, but this requires knowing what dovecot.index.cache file contains. Normally its contents can't be predicted, although perhaps with POP3 users it gets empty often enough that the exploit could be tried. Then again, the exploit requires having at least 4MB cache file, which won't happen with POP3 users before the mailbox has about 170k mails (if I counted right). With IMAP the cache file is used more, so it's easier to fill the 4MB with for example a lot of To-headers. Workaround: Use INDEX=MEMORY so the cache files aren't used at all. Fix: 1.0.rc15 fixes this. You can also use this patch: http://dovecot.org/patches/1.0/file-cache-buffer-overflow-fix.diff

1 0

[Dovecot] I/O leak
by Jim Horner 19 Nov '06

19 Nov '06

I upgraded from rc12 to rc14 last night... sifting through the logs I noticed the following. I point this out since it appears dovecot is in high gear bug-fix mode. This issue is not big for me; I rarely stop dovecot. My init.d script for dovecot is basically stop) killall dovecot imap-login I am guessing there might be a more graceful way to stop dovecot? Or rc14 fixed this? I see in rc14 changelog: - rc13 crashed if client disconnected while IDLEing but only user1 was IDLE. Nov 15 21:53:23 myserver dovecot: IMAP(user1(a)arinbe.com): Disconnected in IDLE Nov 15 21:53:23 myserver dovecot: imap-login: Killed with signal 15 Nov 15 21:53:23 myserver dovecot: IMAP(user2(a)arinbe.com): Disconnected Nov 15 21:53:23 myserver dovecot: imap-login: Killed with signal 15 Nov 15 21:53:23 myserver dovecot: IMAP(user3(a)arinbe.com): Disconnected Nov 15 21:53:23 myserver dovecot: imap-login: Killed with signal 15 Nov 15 21:53:23 myserver dovecot: I/O leak: 0x804d7a0 (17) Nov 15 21:53:23 myserver dovecot: I/O leak: 0x804d7a0 (15) Nov 15 21:53:23 myserver dovecot: I/O leak: 0x804d7a0 (19) Nov 15 21:53:30 myserver postfix/master[31974]: terminating on signal 15 Nov 15 21:54:02 myserver dovecot: Dovecot v1.0.rc14 starting up Jim

2 2

[Dovecot] 1.0.rc14 released
by Timo Sirainen 19 Nov '06

19 Nov '06

http://dovecot.org/releases/dovecot-1.0.rc14.tar.gz http://dovecot.org/releases/dovecot-1.0.rc14.tar.gz.sig More fixes. "Duplicate header extension keywords" is the only known problem (or if I forgot something, remind me). I'll try to figure out a way to reproduce it easily and then get it fixed. * LDAP: Don't try to use ldap_bind() with empty passwords, since Windows 2003 AD skips password checking with them and just returns success. * verbose_ssl=yes: Don't bother logging "syscall failed: EOF" messages. No-one cares about them. + Dovecot sources should now compile without any warnings with gcc 3.2+ - rc13 crashed if client disconnected while IDLEing - LDAP: auth_bind=yes fixes - %variables: Fixed zero padding handling and documented it. %0.1n shouldn't enable it, and it really shouldn't stay for the next %variable. -sign also shouldn't stay for the next variable. - Don't leak opened .log.2 transaction logs. - Fixed a potential hang in IDLE command (probably really rare). - Fixed potential problems with client disconnecting while master was handling the login. - quota plugin didn't work in Mac OS X

4 7

[Dovecot] quota plugin enhancement request
by Michael Tibben 19 Nov '06

19 Nov '06

Hi am having a small issue with the quota plugin In Squirrelmail when a message is deleted, it seems to be copied to the Trash folder *before* it is deleted from the current folder. However if it is a large message being deleted and the mailbox is close to its quota limit, it means dovecot will deny the copy operation as the quota will be exceeded if the message is copied Because of this, I am wondering if it is possible to have an option for the quota plugin to track, but not enforce the quota. This is because I don't require quota enforcement on IMAP, as Postfix will enforce quota on incoming mail anyway. I hope this makes sense... Michael

5 6

[Dovecot] Is "Resource temporarily unavailable" an old problem?
by Ricardo Dias Campos 19 Nov '06

19 Nov '06

Hi. I've installed dovecot recently in a Fedora 5 Linux. It seemed to be OK but I begun to get the message "Can't connect to auth server at default: Resource temporarily unavailable". When I get the message, dovecot hangs. The problem is that "temporarily" is not quite true since the only way to get dovecot running again is to restart it. As a matter of fact, I cannot say that it never recovers. What I know is that it is out for a long, long time. Then a new problem arose: the time between hang-ups begun to diminish. Trying to find why I discovered that the number or dovecot-auth processes was too high (last time I got 169 processes, a lot of them <defuncts>). It seems that, if I kill all these processes, it takes more time before it hangs again. I looked up for messages in the Internet and I found a mail exchange between people from this list. The first hint I got was to upgrade dovecot. As I said, I'm using Fedora 5 and the version distributed with it was dovecot-1.0-0.beta2.7.i386. I upgraded it to dovecot-1.0-0.beta8.2.fc5.i386. I couldn't make any direct relantionship between this versions and the ones in dovecot site so I cannot tell what dovecot version I'm using in terms of dovecot site versioning. Any help is welcome. Thanks, Ricardo

3 3

[Dovecot] CHANGE REQUEST: Move config files out of main $sysconfdir
by Brian G. Peterson 19 Nov '06

19 Nov '06

Currently, dovecot places it's config files in $sysconfdir In Makefile.am, this is defines as: confdir = $(sysconfdir) It would be far more friendly to an already overloaded /etc/ directory, and easier to locate the files, to follow the now-common convention and place files in $sysconfdir / dovecot / ... on most systems this would mean: /etc/dovecot/ If there is only a dovecot.conf, it doesn't really matter, but when additional config files get added for ldap, sql, sieve, it starts to add up. Some distributions already make this change, but placing this change in the dovecot core would make it unnecessary for downstream packagers to make a change to the core dovecot distribution files. Regards, - Brian

3 2

Re: [Dovecot] NTLM authentication from Outlook
by Lars Skovgaard 19 Nov '06

19 Nov '06

> Hi all > > I've enabled ntlm authentication in dovecot, and use dovecot sasl in > postfix as well. > > Authentication with ntlm works well from Mac OS X Mail.app, as well > as from Outlook Express, but fails with Outlook. Strangely enough, > ntml authentication works in Outlook when using smtp (via postfix), > but neither from imap or pop3 (both dovecot). As dovecot sasl handles > all authentication against a mysql userdb, this strikes me as very > strange. > > I've instructed my clients with Outlook to fetch mail using a ssl- > encrypted connection, and to send using ntlm-authentication. This > works, but I would like to have ntlm available as an option to all my > clients, without forcing them to change mail-clients. > > I've turned on auth_verbose, auth_debug and auth_debug_passwords, and > compared the passwordstring with the one calculated using dovecotpw, > and they match. The only odd thing is that the username is returned > from Outlook as an all-caps string, so user(a)domain.tld becomes > USER(a)DOMAIN.TLD. I don't know if it matters, but I don't think so, as > changing the user-login to an all-caps version doesn't solve the > problem. > > Any hints will be most welcome. > > /Lars Greetings, everyone I'm sorry, but I seem to have made a mistake regarding the passwordstring from Outlook – seems like the string I looked at was from MS Entourage... (that's what you get from trying to debug something when you're too tired to think straight). I've now enabled debugging again, and have tried logging in from Outlook with ntlm-authentication. The log-entries are as follows: Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: AUTH 1 NTLM service=IMAP lip=192.168.2.2 rip=192.168.2.13 Nov 16 23:29:09 SD-Server dovecot: auth(default): client out: CONT 1 Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: CONT 1 TlRM7IIog0ADQAuAAAFASgKAAAAD0AABgATVNTUAABYUEFSQkVKRFNHUlVQUAAAABGACgAAA lNQUNEU= Nov 16 23:29:09 SD-Server dovecot: auth(default): client out: CONT 1 TlRMTVNAAAAFAHgAeAAAAAAAADAA +H1XooTUAACAAAAyZ9yMNkAAdgBlAHIALgBsAG8AACYAJgBOAAAAUwBEAC0AUwBlAHIAYwBh AGwAAwAeAFMAyAC4AbABvsAAAAAGMAYRAAtAFMAZQByAHYAZQBQBAAA= Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: CONT 1 TlRMAYAHwAAAAYABgAlAAAAAwADTVNTUAFQAAAAMAAAAAAAAEAH3ZyprYRPWIAAAAAAcgBkA EkATQBBAEMAWABQAAAAACsAAADAAAAGAABIAqMx1XpiwbAAAHAAcwAcABQNAEEAQwBYAFAAT ABpAHMAYQAgAFMAawBvAHYAZwBhAGAAAAAKIAgUBKAoAAAAPSQBAAAAAAAAAAAJILBz4x4RA Ixsp2rhFi8VB6g== Nov 16 23:29:09 SD-Server dovecot: auth(default): ntlm(?, 192.168.2.13): Username contains disallowed characters Nov 16 23:29:10 SD-Server dovecot: auth(default): client out: FAIL 1 The same account logs in without problems if I use a plaintext password (SSL-encrypted, since plaintext-login is disabled). in dovecot.conf I have the following: auth default { mechanisms = plain digest-md5 cram-md5 ntlm rpa } The authentication is done against a mysql-db, which until now has worked with every client I've tested (except Outlook). I have set up postfix to use dovecot-sasl, and use the same userdb for smtp-authentication. Strangely enough the exact same data is accepted when using ntml-authentication with smtp, though a warning is added to my logs. This is an example of a log-entry from an Outlook-user sending a mail: Nov 14 16:40:49 SD-Server postfix/smtpd[8354]: connect from unknown [hid.den.ip.adr] Nov 14 16:40:49 SD-Server dovecot: auth-worker(default): mysql: Connected to localhost (dovecot_auth) Nov 14 16:40:51 SD-Server postfix/smtpd[8354]: warning: unknown [hid.den.ip.adr]: SASL NTLM authentication failed: TlRMTVNTUAACAAMAZYAAQByAHAFAooAOINYZ// +97QAAAAAAAAUwBEAC0AUwBlAHIAdgBlAHIALgBsAG8AYwBhAGwAAwAeAFMARAAtAFAbABvA GMAYAAAAHgAeADAQAAAAAACYAJgBOBZQByAC4sAAAAAAA= Nov 14 16:40:51 SD-Server postfix/smtpd[8354]: AC6402D668E: client=unknown[hid.den.ip.adr], sasl_method=NTLM, sasl_username=user(a)domain.dk Nov 14 16:40:51 SD-Server postfix/cleanup[8358]: AC6402D668E: message- id=<006a01c70803$4dcd1b00$0200a8c0@acerce5220052b> Nov 14 16:41:13 SD-Server postfix/qmgr[8494]: AC6402D668E: from=<user(a)domain.dk>, size=819330, nrcpt=1 (queue active) Nov 14 16:41:16 SD-Server postfix/smtpd[8354]: disconnect from unknown [hid.den.ip.adr] Nov 14 16:41:29 SD-Server postfix/smtp[8361]: AC6402D668E: to=<user(a)otherdomain.dk>, relay=smtp.domain.dk[hid.den.ip.adr]:25, delay=37, delays=22/0.08/0.06/15, dsn=2.0.0, status=sent (250 156794624 mailfe12 Message accepted for delivery) Nov 14 16:41:29 SD-Server postfix/qmgr[8494]: AC6402D668E: removed The same warning is issued from postfix when a user sends mail from Outlook Express, but not when the same user sends from Thunderbird or Mail.app. In fact, I've only seen these problems when the users are using MS products. I really hope someone can shed some light on what is going on. Best regards Lars

2 1

[Dovecot] dovecot:IMAP(user) killed with signal 6
by Spil Oss 18 Nov '06

18 Nov '06

Hi all, After rc10 I have problems with imap and imaps Hi all, After rc10 I have problems with imap and imaps Nov 16 15:42:39 beastie dovecot: IMAP(user1): open(/home/user1/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:44:09 beastie dovecot: IMAP(user2): open(/home/user2/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:44:09 beastie dovecot: IMAP(user2): file maildir-keywords.c: line 222 (maildir_keywords_lookup_or_create): assertion failed: (mk->synced) Nov 16 15:44:09 beastie dovecot: child 98798 (imap) killed with signal 6 Nov 16 15:46:10 beastie dovecot: IMAP(user2): open(/home/user2/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:46:10 beastie dovecot: IMAP(user2): file maildir-keywords.c: line 222 (maildir_keywords_lookup_or_create): assertion failed: (mk->synced) Nov 16 15:46:10 beastie dovecot: child 98819 (imap) killed with signal 6 The Permission denied messages where there in rc10 as well, but that was not causing problems. These folders are symlinks to shared spam and ham folders for spamassassin learning. Any clue on how to fix this? FreeBSD-i386 6.1-RELEASE-p10 dovecot-1.0.r13 from ports Kind regards, Spil.

3 3

[Dovecot] updated gentoo ebuild provides dovecot-sieve
by Brian G. Peterson 18 Nov '06

18 Nov '06

I'm hoping that there are some Gentoo users on this list who will chime in on a bug that is near and dear to my heart. We've created an updated Gentoo ebuild that adds a sieve USE flag and builds dovecot-sieve if the use flag is enabled. The gentoo bug is here: https://bugs.gentoo.org/show_bug.cgi?id=141743 and the ebuild is available as an attachment to that bug, or as a patch attachment (in case you're not running rc14, or just prefer the look of a unified diff) Any gentoo users on this list are urged to install from the ebuild/patch on the bug, and *report back* on the bug or this list, so that the Gentoo dev will know that it's safe to add this to portage CVS. Thank You. Regards, - Brian

2 1

[Dovecot] Dovecot LDA, LDAP, Postfix and Spawning programs..
by Jorgen Lundman 18 Nov '06

18 Nov '06

Qmail, when using LDAP, a user can specify delvieryProgramPath, or a .qmail file, to launch something like procmail. Qmail correctly setuid() to the uids set for the user in LDAP, as well as set up the common env vars (HOME, USER, MAILDIR). We moved to Postfix but found that it is quite lacking in the features supported when it comes to "virtual" users. No .forward, and if you set up an alternate transport, they are run as "any user but root, nor postfix, nor the virtual-user's uid". And worse, does not even supply the HOME/MAILDIR values to transport delivery plugin. (Forcing it to getpwnam() or similar). I have an option to make my own setuid program to query LDAP (postmap -q would work), setuid() and call, say, procmail. It has been suggested I can use "maildrop" as it can talk to LDAP. However, I picked "Dovecot" as my pop3/imap program due to an irrational dislike of Courier imap. So, if I tried Dovecot-LDA, would it support the user optionally having a ".forward" file, or perhaps the LDAP attribute deliveryProgramPath, or some other way to filter based on subject/body to sort, and/or forward, mail? If it can use LDAP, will it setuid() to the users uid (as set in LDAP, assuming I cook the LDAP conf entries correctly) when delivering(I'd hope so!) and running external filters? I am still running rc10, which works well but flips out regularly. (Previously mentioned 'too many files open' bug, some leaks in locks) I will upgrade when the LDAP changes are deemed stable. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

2 1

[Dovecot] Failed Assert in RC13 on FC4
by Joseph D. Wagner 18 Nov '06

18 Nov '06

I received the following notices from logwatch: dovecot: IMAP(userid): file ioloop.c: line 22 (io_add): assertion failed: (fd >= 0): 1 Time(s) dovecot: child 16976 (imap) killed with signal 6: 1 Time(s) Please let me know if you need any further information from me. Joseph D. Wagner

2 1