- dovecot - dovecot.org

[Dovecot] LDAP Memory Leak
by Daniel 16 Oct '06

16 Oct '06

Hi Timo I use LDAP auth on a system with around 2000 email account. I use dual OpenLDAP servers. I haven't noticed a leak of memory. Is there any more information and I will have a look to see if I can see anything that might help. Is it only affecting certain machines or all? Regards Daniel Rowe Date: Mon, 16 Oct 2006 02:39:26 +0300 From: Timo Sirainen <tss(a)iki.fi> Subject: [Dovecot] 1.0.rc10 released To: dovecot-news(a)dovecot.org, dovecot(a)dovecot.org Message-ID: <1160955566.5448.126.camel@hurina> Content-Type: text/plain; charset="us-ascii" http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz.sig I've finally read all the mails in the mailing list and in my INBOX. If I haven't replied to some of your mail, please resend it. Remember that since 1.0.rc9 release dovecot.index.cache files will get rebuilt in 64bit systems, and it's probably better to delete them manually so you don't get errors in log files. There are only a couple of issues left in my v1.0-TODO list: - Master process appears to be leaking log fds with kqueue. Could someone again give me access to a system where this happens? - Login process problems. How well does it work now? Hopefully well enough that v1.0 could be released. - LDAP authentication is leaking memory? Can anyone confirm this? Even better, can someone figure out what exactly is leaking? :) Not a v1.0 blocker though. I think v1.0 will be released once no-one has reported any major problems for a Dovecot release in 2-4 weeks. I think login process handling is the only potentially major problem left. There are a few patches from people that I haven't forgotten, but I've decided not to put them into v1.0 anymore: - Filesystem quota group. I don't think it's that important feature, and it might break something. - HFS+ hardlink avoiding - Managesieve - vmailmgr support And finally the changes in this release: * When matching allowed_nets IPs, convert IPv6-mapped-IPv4 addresses to actual IPv4 addresses first. + IMAP: Try to avoid sending duplicate/useless message flag updates + Added support for non-plaintext authentication for vpopmail if it returns plaintext passwords. Based on patch by Remi Gacogne. + Added %D modified to return "sub.domain.org" as "sub,dc=domain,dc=org" (for LDAP queries). Patch by Andrey Panin. - rc9 broke cache files in 64bit systems - deliver works now with mail_chroot - auth cache didn't work properly with multiple passdbs - Fixes to handling CRLF linefeeds in mboxes.

1 0

[Dovecot] Apple Mail quota display
by Timothy Martin 16 Oct '06

16 Oct '06

I know this isn't necessarily a dovecot issue, but I was wondering if anyone has the quota displaying correctly in Apple Mail? I have it set up and working and displaying properly in thunderbird, roundcube (webmail), and squirrelmail. But for some reason Apple's Mail doesn't show the values or its nice thermometer bar. Are there additional configuration options for quota not documented on the wiki? .tim

2 3

[Dovecot] Duplicate mails
by Vegar Nilsen 16 Oct '06

16 Oct '06

Hi, one of our customers reported a problem after we moved her maildir to another disk. (Jail in FreeBSD 6, moved to another disk with rsync.) For some reason she's seeing duplicates of almost every message from November, 2005 until June, 2006 (the move happened in September, 2006.) It seems like these mails have been respooled somehow and been inserted into the maildir with the same date and time as the original: root#loc [</var/gopostal/maildirs/wow/lina/cur>] diff 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac root#loc [</var/gopostal/maildirs/wow/lina/cur>] ls -l 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf -rw------- 1 mailnull mail 7755 Nov 24 2005 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf root#loc [</var/gopostal/maildirs/wow/lina/cur>] ls -l 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac -rw------- 1 mailnull mail 7755 Nov 24 2005 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac As the diff command shows these mails are identical, except that one was created about 10 months after the other. 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac was written by Exim in November (we've configured Exim to add the size (",S=7755") to the file name), but I have no idea where the other file comes from. Could this be Dovecot that has recreated these mails for some reason? (Since the file names are different I doubt that this happened during the rsync, instead it must come from some program that conforms to the maildir standard of naming files. The mailserver had a different name back in November, mail9 was the old name, locusts is the new one.) Originally this file 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf was named 1158863410.P19488Q34M511758.locusts.copyleft.no:2,bf which, if I understand it correctly, means it's unread. (The customer has deleted it since reporting this problem.) root#loc [</var/gopostal/maildirs/wow/lina/cur>] uname -r ; dovecot --version ; exim -bV 6.1-RELEASE 1.0.beta3 Exim version 4.60 #0 (FreeBSD 6.0) built 22-Feb-2006 13:01:52 If anybody has an idea as to what caused this I would really appreciate any pointers or info. Thanks in advance, Vegar Nilsen -- Copyleft Software AS < http://www.copyleft.no/ >

2 1

[Dovecot] Authenticating dovecot against Active Directory using bsdauth and login_ldap
by Martin Croker 16 Oct '06

16 Oct '06

All, I'm working in a multi-platform environment where user accounts are already held in Active Directory. I'm been trying to setup dovecot to perform user authentication against Active Directory using ldap. My Environment is: Platform OpenBSD 3.9 Dovecot Version 1.0.rc7 Active Directory Windows 2003 The approach I've taken (being the only one I was able to make work) is to use login_ldap to perform bind authentication against Active Directory/LDAP and authenticate dovecot using bsdauth. As far as I can tell the dovecot ldap authentication module requires access to the encrypted password field to which Active Directory does not permit access. Simulated LDAP login fails and when debug is enabled writes the following to /var/log/maillog ==== /var/log/maillog ================ Oct 15 20:12:27 server dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=***********************== Oct 15 20:12:27 server dovecot: auth(default): bsdauth(mcrokerx,127.0.0.1): invalid password field Oct 15 20:12:28 server dovecot: auth(default): client out: FAIL 1 user=mcrokerx Oct 15 20:12:38 server dovecot: imap-login: Aborted login: user=<mcrokerx>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured ======================================= It appears that the cause of these log messages are the following lines of code in src/auth/passdb-bsdauth.c ==== src/auth/passdb-bsdauth.c ======== 29 if (!IS_VALID_PASSWD(pw->pw_passwd)) { 30 auth_request_log_info(request, "bsdauth", 31 "invalid password field"); 32 callback(PASSDB_RESULT_USER_DISABLED, request); 33 return; 34 } ======================================= These lines seem to require that the pw structure contains the encrypted password in pw->pw_passwd. Where login_ldap is used against Active Directory the encrypted password is not available to bsdauth and instead pw->pw_passwd contains '*'. If auth_userokay is called independently it is however able to authenticate the user correctly, as such I wonder if the IS_VALID_PASSWD check is actually necessary. It could be that my entire approach is wrong in which case I'm happy to be put right; however it seems that lines 29-34 need modification to correctly support this behaviour of bsdauth. This is beyond my limited ability in c but temporarily removing these lines of code from passdb-bsdauth.c has enabled me to authenticate dovecot against login_ldap (and thereby against Active Directory). My config files are: ==== /etc/dovecot.conf ================ base_dir = /var/dovecot/ ssl_cert_file = /etc/ssl/certs/server.crt ssl_key_file = /etc/ssl/private/server.key disable_plaintext_auth = no login_dir = /var/dovecot/login login_user = _dovecot mmap_no_write = yes protocol imap { imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { pop3_uidl_format = %08Xu%08Xv pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth default { mechanisms = plain passdb bsdauth { } userdb passwd-file { args = /etc/passwd } user = root } plugin { } ======================================= ==== /etc/login.conf (exert) ========== staff:\ :auth=-ldap:\ :x-ldap-server=10.0.0.23:\ :x-ldap-port=389:\ :x-ldap-noreferrals:\ :x-ldap-uscope=subtree:\ :x-ldap-basedn=dc=my,dc=domain,dc=co,dc=uk:\ :x-ldap-binddn=cn=UnixUser,cn=Users,dc=my,dc=domain,dc=co,dc=uk:\ :x-ldap-bindpw=mypassword:\ :x-ldap-filter=(&(objectClass=user)(mail=%u)):\ :datasize-cur=512M:\ :datasize-max=infinity:\ :maxproc-max=256:\ :maxproc-cur=128:\ :requirehome@:\ :tc=default: ======================================= Note: for login_ldap to work it is necessary that the user information (minus password) is replicated on the localhost. I've done this using a relatively inelegant script which for completeness is below. I guess adding some error checking would be a good idea. ==== ldapsync.ksh ===================== #!/bin/ksh ldapsearch -h 10.0.0.23 \ -D cn=UnixUser,cn=Users,dc=my,dc=domain,dc=co,dc=uk \ -b cn=Users,dc=my,dc=domain,dc=co,dc=uk \ -w mypassword \ -v \ -x "(objectClass=user)" | while read key value ; do if [ "$key" == name: ]; then ldap_name="$value" fi # User Mail field as Unix name - remove @my.domain.co.uk if necessary if [ "$key" == mail: ]; then ldap_mail=$( echo "$value" | sed 's/@.*//g' ) if ( id 2>/dev/null >/dev/null $ldap_mail ); then usermod -c "$ldap_name" -s osbin/nologin -g staff -L staff $ldap_mail else useradd -d /home/$ldap_mail -c "$ldap_name" -s /sbin/nologin -m -g staff -L staff $ldap_mail fi ldap_name="" ldap_mail="" fi done ======================================= Martin

2 1

[Dovecot] unknown dovecot error. imap or logging rate?
by OpenMacNews 16 Oct '06

16 Oct '06

hi, i've dovecot cvs 10branch installed on OSX 10.4.7. when i login from my MUA (in this example, Mulberry), functionally all looks OK. BUT, i *do* see one error in the log output, dovecot: Aug 27 20:43:25 Error: IMAP(testuser(a)mydomain.com): Sending log messages too fast, throttling.. Is this an imap error? or is it 'just' the error of logging too fast? if the latter, what to do about it? or, is the throttling normal behavior? the complete context follows: dovecot: Aug 27 20:43:25 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=10.0.0.6 rip=10.0.0.6 dovecot: Aug 27 20:43:25 Info: auth(default): client out: CONT 1 dovecot: Aug 27 20:43:25 Info: auth(default): client in: CONT<hidden> dovecot: Aug 27 20:43:25 Info: auth(default): client out: OK 1 user=testuser(a)mydomain.com quota=maildir:storage=4096 dovecot: Aug 27 20:43:25 Info: auth(default): master in: REQUEST 27335 1 dovecot: Aug 27 20:43:25 Info: auth(default): master out: USER 2 testuser(a)mydomain.com static uid=301 gid=301 home=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser nice=10 dovecot: Aug 27 20:43:25 Info: imap-login: Login: user=<testuser(a)mydomain.com>, method=PLAIN, rip=10.0.0.6, lip=10.0.0.6, TLS dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Effective uid=301, gid=301 dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Loading modules from directory: /usr/local/dovecot-plugins/imap dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Module loaded: /usr/local/dovecot-plugins/imap/lib01_quota_plugin.so dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Module loaded: /usr/local/dovecot-plugins/imap/lib02_imap_quota_plugin.so dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=private, prefix=Private/, sep=/, inbox=yes, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser/Maildir:INDEX… dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser/Maildir, index=/var/Mail/Dovecot/Indexes/mydomain.com/testuser, control=, inbox= dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=public, prefix=Public/, sep=/, inbox=no, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Public dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Public, index=/var/Mail/Dovecot/Domains/mydomain.com/Public, control=, inbox= dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=shared, prefix=Shared/, sep=/, inbox=no, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Error: IMAP(testuser(a)mydomain.com): Sending log messages too fast, throttling.. dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Shared dovecot: Aug 27 20:43:26 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Shared, index=/var/Mail/Dovecot/Domains/mydomain.com/Shared, control=, inbox= thanks, richard -- /"\ \ / ASCII Ribbon Campaign X against HTML email, vCards / \ & micro$oft attachments [GPG] OpenMacNews at gmail dot com fingerprint: 50C9 1C46 2F8F DE42 2EDB D460 95F7 DDBD 3671 08C6

2 1

[Dovecot] Messages not expunged
by Jackie Hunt 16 Oct '06

16 Oct '06

Hi all, I'm doing some testing between U of Washington IMAP server (which we currently run) and Dovecot on a IBM AIX system. I created a 50M mailbox, made up of 262 msgs. I'm using a Perl Script with the imap::client module to fetch each message and then flag it for deletion. At the end of the test, I run an expunge to delete all the messages. UofW imap server ran fine, messages gone. With dovecot I found the messages were not being expunged. The log indicated they were, but then said 262 messages existed at the end. After more checking, I found the file system I was using was low on disk space (<50M). As soon as I added more disk space, and reran the test with dovecot the messages were indeed expunged. Is this normal imap protocol behavior? I thought I would see an error message or something in the dovecot log. Does dovecot duplicate the mailbox before expunge? There wasn't room on our system to do that. Thanks much for any insights/info. Jackie --- Jackie Hunt ACNS Voice: (970) 663-3789 Colorado State University FAX: (970) 491-1958 Fort Collins, CO 80523 Email: jackie.hunt(a)colostate.edu

2 3

[Dovecot] Make user name CaSe Insensitive
by FlashWebHost.com 15 Oct '06

15 Oct '06

Hi, I have mail box info(a)mydomain.com stored in MySQL db. But dovecot is allowing me to login as both INFO(a)MYDOMAIN.COM info(a)mydomain.com Shows two mail boxes. The small letter account is the one mail server really deliver all mails. Is there any way i can specify all login names are small letters, so that user always access real mail box ? Regards, Yujin ------------------------------------ http://www.flashwebhost.com

4 6

[Dovecot] Restricting Services (POP or IMAP)
by Odhiambo WASHINGTON 15 Oct '06

15 Oct '06

It would be great to have a HOWTO in the wiki, on how to restrict services by username in dovecot, so some users are allowed IMAP and others not allowed. As concerns restricting users by IP, I believe that is a bad idea. It's almost a useless idea, imnsho, because they can connect from another IP. It's easy to restrict services by IP using a firewall or by using inetd. -Wash http://www.netmeister.org/news/learn2quote.html DISCLAIMER: See http://www.wananchi.com/bms/terms.php -- +======================================================================+ |\ _,,,---,,_ | Odhiambo Washington <wash(a)wananchi.com> Zzz /,`.-'`' -. ;-;;,_ | Wananchi Online Ltd. www.wananchi.com |,4- ) )-,_. ,\ ( `'-'| Tel: +254 20 313985-9 +254 20 313922 '---''(_/--' `-'\_) | GSM: +254 722 743223 +254 733 744121 +======================================================================+ Don't take life too seriously -- you'll never get out of it alive.

5 8

Re: [Dovecot] Out of memory errors
by Bill Boebel 15 Oct '06

15 Oct '06

On Tue, October 10, 2006 1:03 pm, Timo Sirainen <tss(a)iki.fi> said: > I think I remember someone else also talking about memory leaks with > LDAP.. Unless it was also you. :) I guess I'll have to try find it, or > at least create some debugging/statistics patch which could be used to > figure out where the problem is.. > Wasn't me, but I would definitely run such a patch to help track down the source. Bill

2 1

[Dovecot] failed authentication with digest-md5 (rc9)
by LeVA 15 Oct '06

15 Oct '06

Hi! I'm using rc9 and DIGEST-MD5 passwords. Sometimes it works, sometimes it's not... When failed, I get this in the logs: 12:45:11 Info: auth(default): client in: AUTH 1 DIGEST-MD5 \ service=POP3 secured lip=<lip> rip=<rip> resp=<something_long> 12:45:11 Info: auth(default): client out: CONT 1 <something_long> 12:45:11 Info: auth(default): client in: CONT 1 <something_long> 12:45:11 Info: auth(default): digest-md5(?,<rip>): Unknown QoP value 12:45:12 Info: auth(default): client out: FAIL 1 12:45:12 Info: pop3-login: Aborted login: method=DIGEST-MD5, rip=<rip>, lip=<lip>, TLS Using KMail 1.9.4. Daniel -- LeVA

3 9

[Dovecot] Dovecot rc9 error (More information)
by Daniel 15 Oct '06

15 Oct '06

Hi This happens when email is copied/moved from the inbox to another folder on the same imap account. The mail client goes into a loop with the below errors logged. This is on a 64bit Linux machine using the Maildir storage format. After doing a 'rm dovecot*' from the Maildir folder of the account having the problem the client can log in again but if the client tries to copy again it gets the same error. RC9 appears to be broken on this box. I have tested connecting form a windows machine and I get the same with thunderbird. I have tried with different accounts and they get the same problem. I have down graded to RC8 and all is working OK so seems to be a problem introduced with RC9. I have a 32bit Linux server with RC9 installed which has around 2000 accounts on it and this has no problems so maybe not affecting 32bit machines. If I can give any more information please let me know. Am getting this error with Dovecot rc9 on a imap account. Oct 15 10:55:28 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:28 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:28 bajor dovecot: child 27632 (imap) killed with signal 6 Oct 15 10:55:28 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:29 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:29 bajor dovecot: child 27636 (imap) killed with signal 6 Oct 15 10:55:29 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:29 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:29 bajor dovecot: child 27638 (imap) killed with signal 6 Oct 15 10:55:30 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:30 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:30 bajor dovecot: child 27641 (imap) killed with signal 6 Oct 15 10:55:30 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:31 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:31 bajor dovecot: child 27645 (imap) killed with signal 6 Oct 15 10:55:31 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:31 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:31 bajor dovecot: child 27649 (imap) killed with signal 6 Oct 15 10:55:31 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:32 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:32 bajor dovecot: child 27653 (imap) killed with signal 6 -- Regards Daniel ----------------------------- Registered Linux user #234279

1 0

[Dovecot] request to have dovecot authenticator driver 'officially' included/supported
by OpenMacNews 14 Oct '06

14 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi all, per the exim docs @: http://exim.org/exim-html-4.62/doc/html/spec_html/ch36.html a cyrus_sasl authenticator driveer is 'included' in exim core. given that Dovecot has become a very attractive alternative for an increasing number of folks, and there's a patch against exim 4.43 here: http://www.exim.org/eximwiki/AuthenticatedSmtpUsingDovecot that allows use of Dovecot's native sasl implementation as an authenticator, and that is _seems_ to apply against 4.63 ok, might it be possible to get this integrated into exim core, and have it become 'official'? thanks, richard - -- /"\ \ / ASCII Ribbon Campaign X against HTML email, vCards / \ & micro$oft attachments [GPG] OpenMacNews at gmail dot com fingerprint: 50C9 1C46 2F8F DE42 2EDB D460 95F7 DDBD 3671 08C6 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) iEYEARECAAYFAkUC+eIACgkQlffdvTZxCMbG4wCgnczsi9zX6Xkg5MLi6JTez5d+ a+YAn0MIYI7gHW//8N5bxani1CoEAcJm =ZN2w -----END PGP SIGNATURE-----

5 16

[Dovecot] MySQL stored proc authorization
by Chaos Engine 14 Oct '06

14 Oct '06

On my Gentoo box until today I had dovecot-1.0_rc7 and used following entry in /etc/dovecot/dovecot-sql.conf password_query = call Authorize('%u', '%n', '%d') Simply put dovecot is calling my mysql stored routine which handles authorization. Until today, when I updated dovecot to dovecot-1.0_rc8 it worked flawlessly. With this version executing stored proc dies with: Password query failed: PROCEDURE mailsql.Authorize can't return a result set in the given context Replacing stored proc call with select .... statement does the thing, but it's stored procedures are ... generally better to do things on DB imvho :-) Downgrading to dovetot-1.0_rc7 fixes the problem immediately. Of course /etc/dovecot/dovecot.conf remains the same in either case. Is this a bug or change made on purpose? -- Chaos greets U

2 6

[Dovecot] MySQL "access denied" problems
by Timo Sirainen 14 Oct '06

14 Oct '06

Now that I was able to debug it myself, I found that it's caused by the same problem as before: Conflicting sha1_result symbol. This time only linking succeeded without errors, but at runtime it was still using the wrong one. So I updated the wiki page: http://wiki.dovecot.org/MysqlProblems

1 1

[Dovecot] child 29480 (auth) returned error 89, FC5, Postfix, MySql, mbox....arghhhh
by Kent Iverson 14 Oct '06

14 Oct '06

Hi all, I have been putting a small (simple?)dedicated email server together to (ultimately) host a couple of domains. I am currently getting the configuration to work with one domain w/local mbox users and then plan to extend it to virtual users and an additional domain. Dovecot has been a problem to integrate in the configuration. The basic pieces are FC5, Postfix, Dovecot, with Cyrus-sasl and MySql user/password databases. I have installed, configured, and verified Postfix, Cyrus-sasl, and MySql both separately and working together. All applications are standard Yum sourced FC5 binaries. Dovecot, however, stubbornly refuses to join the party. I have searched for clues on-line and have not found anything that has helped, thus this message. The problem seems to be tied tightly to using mySQL as an access mechanism for passdb/userdb information since if I remove that access mechanism Dovecot runs fine. The reason I am looking to use mySQL is that it seemed an easy way to have a common database for user name and domain identification with a single common FQDN login authentication format for current local users and future virtual users. As I understand it, the default PAM passwd doesn't support FQDN user names. The symptom: =========== Dovecot starts and immediately exits. Maillog shows the following immediately after executing /sbin/service dovecot start Oct 12 21:36:24 Playtime dovecot: Dovecot v1.0.beta8 starting up Oct 12 21:36:25 Playtime dovecot: child 29479 (auth) returned error 89 Oct 12 21:36:25 Playtime dovecot: child 29480 (auth) returned error 89 Oct 12 21:36:25 Playtime dovecot: Auth process died too early - shutting down Oct 12 21:36:25 Playtime dovecot: auth(default): net_connect_unix(/var/run/dovecot/auth-worker.29480) failed: Permission denied Oct 12 21:36:25 Playtime dovecot: auth(default): net_connect_unix(/var/run/dovecot/auth-worker.29479) failed: Permission denied It appears that the dovecot-auth process is immediately exiting with a non-specific error (89) and no collateral info. There are two sets of error 89's because the process count is set to 2 in dovecot.conf (see below). Looking at the messages log, you find a line reflecting the empty sockets as below: Oct 12 21:36:25 Playtime kernel: audit(1160714185.460:373): avc: denied { write } for pid=29479 comm="dovecot-auth" name="auth-worker.29479" dev=dm-0 ino=692358 scontext=user_u:system_r:dovecot_auth_t:s0 tcontext=user_u:object_r:dovecot_var_run_t:s0 tclass=sock_file There is nothing in the auth log other than happy noises from Postfix about its mySQL accesses. I am unaware of any other logs that might shed some light. Troubleshooting: ============= --- I have been using standard FC5 compiled binaries sourced through YUM for all applications. To the best of my knowledge, the package that Yum pulled for Dovecot is built --with-mysql and thus should support mysql access. I found this tidbit of info in the /usr/src/redhat/SPECS/dovecot.spec document. -- I have rolled back the dovecot.conf to remove the mysql passwd/userdb configuration leaving the default PAM configuration and found that Dovecot behaves correctly and joins the party. However, since Postfix is using mySQL data, the client FQDN login user names it uses don't match up with the simple UNIX user names that Dovecot's default PAM password mechanism is supporting (thus my attempt to get them both to use the mySql database.) So from this I know that the problem appears to be basic to startup of dovecot-auth and the mysql configuration. -- I have verified the location of the dovecot-sql.conf file as configured in dovecot.conf -- I have verified that the 'connect' parameters in the dovecot-sql.conf.work from a command line and the password_query syntax from inside mysql. Configuration details: dovecot.conf: ======================================================================= # things uncommented from defaults: base_dir = /var/run/dovecot protocols = imap imaps pop3 pop3s listen = * shutdown_clients = yes #for debug...seems to have made no difference. mail_debug = yes mbox_very_dirty_syncs = yes # authentication section # this next was left at default and I checked the ownership and it is correct. #auth_executable = /usr/libexec/dovecot/dovecot-auth #more debug auth_verbose = yes auth_debug = yes auth_debug_passwords = no # auth-worker process limit auth_worker_max_count = 30 #and into auth default: auth default { mechanisms = plain # default PAM passdb pam { } # SQL passdb sql { args = /etc/dovecot-sql.conf } # userdb userdb static { args = uid=690 gid=768 home=/var/mail/%n } #note there is no SQL userdb access defined. We will always use userdb static for now user = root count = 2 } ============================= dovecot-sql.conf ============================================================================== # Our mysql table actually is: (defined to support postfix password db) # CREATE TABLE users ( # id int(11) unsigned NOT NULL auto_increment, #table index # username varchar(255) NOT NULL default '0', #user part in user@userrealm # userrealm varchar(255) NOT NULL default 'firstdomain.com', #domain part in user@userrealm # userpassword varchar(255) NOT NULL default '94go283xc', #email password # auth tinyint(1) default '1', #Relay authority 1 = yes # active char(1) NOT NULL default 'y' #active Dovecot user? #}; driver = mysql connect = host=127.0.0.1 dbname=user_db user=dovecot password=xxxyy0x0 default_pass_scheme = PLAIN password_query = SELECT password FROM users WHERE username='%n' AND userrealm='%d' AND active='y' # there is no userdb sql access mechanism defined so this is left null user_query = ========================================================================================= Thats about it. I'm stumped....any thoughts or debug suggestions would be appreciated. Thanks -Kent I.

3 3

[Dovecot] fcntl Bad file descriptor
by Bill Boebel 13 Oct '06

13 Oct '06

I've seen a couple of these in the log while testing the proxy too. Do you know what would cause this? Aug 10 23:30:29 director5 dovecot: imap-login: fcntl(-1, F_GETFL) failed: Bad file descriptor Aug 10 23:30:29 director5 dovecot: imap-login: fd_set_nonblock(-1) failed: Bad file descriptor Aug 10 23:30:29 director5 dovecot: child 14016 (login) returned error 89

2 1

Re: [Dovecot] Dovecot LDA
by Steven F Siirila 13 Oct '06

13 Oct '06

On Sun, Oct 08, 2006 at 10:25:53PM +0300, Timo Sirainen wrote: > On Fri, 2006-10-06 at 21:00 -0500, Steven F Siirila wrote: > > I am running Dovecot 1.0-rc6 along with dovecot-sieve from 2006-10-05 CVS. > > I am calling dovecot deliver from Postfix (main.cf): > > > > mailbox_command = /opt/dovecot/libexec/dovecot/deliver > > > > Upon switching to dovecot deliver, I observed two problems: > > > > 1) An extraneous "From " header now appears at the top of each message > > delivered, e.g.: > > > > From dovecot.deliver Fri Oct 06 19:59:57 2006 > > From sfs(a)tc.umn.edu Fri Oct 6 19:59:57 2006 > > Return-Path: <sfs(a)tc.umn.edu> > > > > Using Postfix delivery the first of these lines does not appear. > > This, of course, confuses MUAs. > > Don't give F flag to Postfix's pipe command. In looking into this further, I see what you're getting at. There are commands in postfix/master.cf which specify different flags depending on what external delivery program is used. However, I haven't touched that and none of the entries that came with the standard master.cf file reference Dovecot, so I'm not sure if any of those entries even apply. What I changed to cause Dovecot delivery to be initiated was simply the mailbox_command in postfix/main.cf: mailbox_command = /opt/dovecot/libexec/dovecot/deliver I have been unable to determine what, if any, changes are necessary in the master.cf file to customize what parameters are sent to Dovecot deliver. Anyone? > Although this reminds me that the "dovecot.deliver" is wrong in there.. > Hmm. I think I'll add a maildrop-compatible -f <envelope> parameter > here. Great. Now if I could only figure out how to get Postfix to specify that. :) > There, done in CVS. I'll also make 1.0rc8 release today. > > > 2) The "Content-Length:" header appears after a blank line, essentially > > putting it into the RFC822 body, e.g.: > > > > User-Agent: Mutt/1.4.2.1i > > X-UID: 11510 > > Status: > > X-Keywords: > > > > Content-Length: 200 > > > > test > > Are you sure it's a blank line? Dovecot adds lots of spaces after > X-Keywords which could just make it look like that. > > If it really is a blank line, then it's most likely something else than > Dovecot that changes the spaces that way. -- Steven F. Siirila Office: Lind Hall, Room 130B Internet Services E-mail: sfs(a)umn.edu Office of Information Technology Voice: (612) 626-0244 University of Minnesota Fax: (612) 626-7593

4 12

[Dovecot] you got chocolate in my peanut butter?!
by Logan Shaw 13 Oct '06

13 Oct '06

Hey everyone, Ran into something positively perplexing today. A user came to me and said that this morning when they checked their mail, they got about 120 strange new messages. Upon further inspection, it seems the "new" messages are all addressed to a certain other different user and are all 3 or 4 months old. And looking in that other user's /var/mail/(username) mailbox, I see the same messages that arrived mistakenly. And they're not in the /var/mail mailbox of the user whose desktop computer they ended up on. So it would appear that, possibly, when this user connected to the server, they got someone else's messages! Messages that, in fact, came from an account they don't even have the password to! I'm really curious if anyone has seen something like this before. We're using dovecot-1.0.beta9, and have been since mid-June. I've never seen anything happen like this before. I'm perfectly willing to upgrade to the latest release candidate, but it's hard for me to "upgrade and see if that fixes it", because it happens so rarely and it won't be easy to know empirically. So what I'm really hoping for is confirmation that this is/was a known problem, if in fact it is. Of course, I don't know that this is a dovecot bug, but I could imagine that it might be (maybe a daemon forgets to switch users after one session is closed and another is opened?), so I thought I'd ask. I did see what looked like TLS fixes and login fixes in the changelogs, so it doesn't seem out of the question that such a bug could've existed. Some more information: I checked the user's settings on their desktop computer, where the unexpected messages appear, and sure enough, there is only one POP server account configured there, and it has the correct username. What's more, I asked them what time this happened, and they said probably at 7:00am or maybe a little earlier. Looking at my dovecot logs, I see this (where 'theuser' is the user who received the messages): Sep 28 06:59:49 myhostname dovecot: pop3-login: Disconnected: user=<theuser>, method=PLAIN, rip=192.168.1.245, lip=192.168.1.20, TLS Sep 28 06:59:55 myhostname dovecot: pop3-login: Login: user=<theuser>, method=PLAIN, rip=192.168.1.245, lip=192.168.1.20, TLS Sep 28 06:59:55 myhostname dovecot: POP3(theuser): Disconnected: Logged out top=0/0, retr=0/0, del=0/9, size=130585 So, it would seem that the user did login at the time they claimed and it was at that time (or close to it) that the weird messages appeared. Also, I checked the logs for logins from the person whose messages accidentally got downloaded, and it doesn't show them logging in until several hours later. Oh, and there are no log entries for either of the two users in question before that, at least not for over 12 hours before that. The user is running Outlook 2003, with POP3 + TLS access to the mailbox. My dovecot.conf has nothing fancy in it: base_dir = /var/run/dovecot/ ssl_cert_file = /etc/mail/certs/server.crt ssl_key_file = /etc/mail/certs/server.key protocols = imap imaps pop3 pop3s disable_plaintext_auth = no login_dir = /var/run/dovecot/login syslog_facility = local0 first_valid_uid = 100 protocol imap { } protocol pop3 { pop3_lock_session = yes pop3_uidl_format = %08Xv%08Xu } auth default { mechanisms = plain user = root passdb shadow { } userdb passwd { } } The accounts are all coming out of LDAP via nsswitch (and this is all happening on Slackware 10.2), but I'm fairly sure that's irrelevant since "getent passwd", etc. all show the right stuff. Thanks for any help anyone can give... - Logan

5 9

[Dovecot] Login process died before initialization - FIX
by Timo Sirainen 13 Oct '06

13 Oct '06

I think this should do it: http://dovecot.org/list/dovecot-cvs/2006-October/006504.html

1 0

[Dovecot] parser bug
by DINH Viêt Hoà 13 Oct '06

13 Oct '06

hello Timo (and maybe other Dovecot developers), It looks like the MIME parser won't parse this correctly : Content-type: text/html Note the lower-case '-type' in 'Content-type'. -- DINH V. Hoa

2 1

[Dovecot] Feature req: auth_cache_relookup
by Bill Boebel 13 Oct '06

13 Oct '06

With auth_cache_size set to a value greater than zero, when our users change passwords their accounts stop working for a few minutes, because they are trying to log in with their new password, but Dovecot is comparing that against the cached old password. It would be nice if an option could be added so that if the login password does not match the cached password, the cache value is dropped and dovecot-auth queries the userDB, but only if the previous login was successful (to avoid frequent queries for bad logins). Maybe this option could be called "auth_cache_relookup" Bill

2 1

[Dovecot] default_mail_env renaming
by Timo Sirainen 13 Oct '06

13 Oct '06

I was thinking about renaming default_mail_env to something that is more understandable. I'll keep it working for backwards compatibility anyway. How about: # Location for users' mailboxes. This is the same as the old default_mail_env # setting. The default is empty, which means that Dovecot tries to find the # mailboxes automatically. This won't work if the user doesn't have any mail # yet, so you should explicitly tell Dovecot the full location. # # If you're using mbox, giving a path to INBOX file (eg. /var/mail/%u) isn't # enough. You'll also need to tell Dovecot where the other mailboxes are and # where Dovecot can place its index files. # # There are a few special variables you can use, eg.: # # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if there's no domain # %h - home directory # # See doc/variables.txt for full list. Some examples: # # mail_location = maildir:/var/mail/%1u/%u/Maildir # mail_location = mbox:~/mail/:INBOX=/var/mail/%u # mail_location = mbox:/var/mail/%d/%n/:INDEX=/var/indexes/%d/%n # # http://wiki.dovecot.org/MailLocation # #mail_location =

2 2

[Dovecot] Todo page?
by Francisco Reyes 13 Oct '06

13 Oct '06

Is there a Todo list? Looking for it in search function I think I saw one in CVS.. Is there a web CVS interface? I found the changelog in http://dovecot.org/nightly/, but did not see a Todo.

2 2

[Dovecot] 1.0.rc8 released
by Timo Sirainen 13 Oct '06

13 Oct '06

I've still over 200 mails unread in the mailing list, and important things left in TODO. This release is an improvement over rc7 anyway, hopefully I'll have time to fix the rest soon. http://dovecot.org/releases/dovecot-1.0.rc8.tar.gz http://dovecot.org/releases/dovecot-1.0.rc8.tar.gz.sig * GSSAPI: Changed POP3 service name to "pop", which is what the standard says * "mbox:/var/mail/%u" no longer works as the mail location. You'll have to specify the mail root explicitly, just like the examples always have: "mbox:~/mail:INBOX=/var/mail/%u" + SHA1, LDAP-MD5, PLAIN-MD5, PLAIN-MD4: The password can be now either hex or base64 encoded. The encoding is detected automatically based on the password string length. + Allow running only Dovecot master and dovecot-auth processes with protocols=none setting + deliver: -f <envelope sender> parameter can be used to set mbox From_-line's sender address + deliver: Log all mail saves and failures + Tru64 SIA passdb support. Patch by Simon L Jackson. - INBOX was listed twice in mailbox list if namespace prefix was used - INBOX-prefixed namespaces were a bit broken - kqueue: Fix 100% CPU usage - deliver: Duplicate storage was a bit broken - dictionary code was broken (ie. dict quota) - SIGHUP caused crashes sometimes

3 14

[Dovecot] 1.0rc8: another problem? Possibly 64-bit index?
by David Lee 13 Oct '06

13 Oct '06

Yesterday I gave a status report about 10.rc8 in production, which mentioned a problem about "Login process died too early..." Timo suggested a patch for logging error messages. I've applied this. Others suggested increasing "login_max_processes_count". That was already way above our likely maximum, but I've doubled it anyway. Today, I've just repeated the trial, but with one significant difference and one significant new problem. The significant difference is that today's machine is not a 32-bit i686 but a 64-bit (and faster) x86_64. The new problem is lots of occurences of: [...]: IMAP([...]): file ../../../src/lib-index/mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) [...]: child 4365 (imap) killed with signal 6 and: [...]: IMAP([...]): file ../../../../src/lib-storage/index/index-mail.c: line 105 (index_mail_get_fixed_field): assertion failed: (buffer_get_used_size(buf) == data_size) [...]: child 15009 (imap) killed with signal 6 Naturally, I've backed off quickly. Theoretically, this problem could be attributed to any of the three changes: logging, max processes, different (64-bit) machine. I suspect it's not the "login_max_processes_count" increase. Is it a side-effect of the better logging? (That is, was it always happening but the information simply not getting logged?) Note that our index files (and mail spool (INBOX, folder) areas) are on an NFS (NetApp) shared area accessed by all three classes of our machines: o existing UW-IMAP (which doesn't use the indexes) o yesterday-dovecot (32-bit) o today-dovecot (64-bit) My sneaky suspicion is that this is a subtle 64-bit-ism, either on its own, or in some sort of interaction with an indexes created from yesterday's 32-bit client. (Yes, theoretically, I could try another test to attempt to confirm or eliminate the 32/64 difference. But these issues didn't show up under testing, but only when we began trial service; I can't experiment on the users!) -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : Durham University : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. :

8 10