- dovecot - dovecot.org

Re: [Dovecot] Suggestion for dovecot default SSL configuration...
by Timo Sirainen 11 Aug '06

11 Aug '06

On Mon, 2006-07-24 at 13:48 -0700, Douglas Moore wrote: > First off, thanks for the effort on this software, it's a world > better than the uw-imap that I used to have to deal with... > > This isn't a bug report per se, but rather a response to something > that came up during some recent security scans. Given that SSLv2 > has it's share of issues, I'd like to suggest that you remove it from > the default ciphers supplied with the source distribution. A > simple :!SSLv2 added to the default cipher list would aid in the > overall security of the package. I'm not an expert in SSL, so I'd rather be sure that it's actually more helpful than harmful. Does something still use SSLv2? If I do the change, I guess the only thing it does is to break those clients that still try to use it? Is its security already bad enough that it's just better to break them?

1 0

[Dovecot] SSL CRL checking
by Timo Sirainen 11 Aug '06

11 Aug '06

Is there a reason that CRL is required to exist in the ssl_ca_file? Could it just use it only if it's there, but otherwise ignore it? Or is this a bad idea? Is it even possible at all to tell that to OpenSSL?

1 0

[Dovecot] Seeing dovecot crash under rc6, seems to go almost exactly every 2.5 hours...
by Dean Blackburn 11 Aug '06

11 Aug '06

We're getting the following crash report, but I'm not sure it contains anything immediately useful (especially since we're running on a minority platform in OS X)... Anyone see where we might be able to resolve this? The crash doesn't kill existing imap processes, but dovecot/imap-login needs to be restarted. ********** Host Name: mailserver Date/Time: 2006-08-10 14:24:16.131 -0700 OS Version: 10.4.6 (Build 8I127) Report Version: 4 Command: dovecot Path: /opt/local/sbin/dovecot Parent: dovecot [10099] Version: ??? (???) PID: 13818 Thread: 0 Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000020 Thread 0 Crashed: 0 dovecot 0x0000482c log_set_prefix + 36 (log.c:190) 1 dovecot 0x000070b0 create_mail_process + 1576 (mail-process.c:535) 2 dovecot 0x00005150 auth_master_callback + 96 (login-process.c:92) 3 dovecot 0x00002d9c auth_process_input + 460 (auth-process.c:121) 4 dovecot 0x00017d58 io_loop_handler_run + 388 (ioloop-select.c:140) 5 dovecot 0x0001006c io_loop_run + 48 (ioloop.c:273) 6 dovecot 0x00008c54 main + 1816 (main.c:577) 7 dovecot 0x000020a8 _start + 344 (crt.c:272) 8 dovecot 0x00001f4c start + 60 Thread 0 crashed with PPC Thread State 64: srr0: 0x000000000000482c srr1: 0x100000000200d030 vrsave: 0x0000000000000000 cr: 0x84002404 xer: 0x0000000020000000 lr: 0x0000000000004810 ctr: 0x00000000901313a0 r0: 0x00000000000070b0 r1: 0x00000000bffff320 r2: 0x0000000000024810 r3: 0x0000000000000000 r4: 0x000000000006f380 r5: 0x0000000000000001 r6: 0x0000000000000000 r7: 0x0000000000000002 r8: 0x000000006b690073 r9: 0x000000000006f104 r10: 0x00000000bffff310 r11: 0x0000000000020b3c r12: 0x000000000006f399 r13: 0x00000000ffffffff r14: 0x0000000000000000 r15: 0x0000000000000000 r16: 0x000000000006f113 r17: 0x000000000006f228 r18: 0x0000000000000000 r19: 0x000000000006f0fc r20: 0x0000000000000014 r21: 0x000000000001b0c0 r22: 0x000000000000041a r23: 0x000000000001b0c0 r24: 0x00000000018006e8 r25: 0x000000000001bfe0 r26: 0x000000000006f133 r27: 0x000000000006f2a8 r28: 0x000000000006f380 r29: 0x0000000000000000 r30: 0x0000000024002422 r31: 0x0000000000004810 Binary Images Description: 0x1000 - 0x1ffff dovecot /opt/local/sbin/dovecot 0x8fe00000 - 0x8fe51fff dyld 44.4 /usr/lib/dyld 0x90000000 - 0x901bbfff libSystem.B.dylib /usr/lib/libSystem.B.dylib 0x90213000 - 0x90218fff libmathCommon.A.dylib /usr/lib/system/libmathCommon.A.dylib 0x936d1000 - 0x936f2fff libmx.A.dylib /usr/lib/libmx.A.dylib

3 2

[Dovecot] dovecot process no longer dies
by Ceasar V. Navato, Jr. 11 Aug '06

11 Aug '06

Bill, After applying the patch from http://dovecot.org/list/dovecot-cvs/2006- August/006209.html, my dovecot rc6 is finally working. Thank you very much for the info. Regards, -- Ceasar V. Navato, Jr.

1 0

[Dovecot] LDA Command time limit exceeded
by Dominique Feyer 11 Aug '06

11 Aug '06

I have many errors of this type in my logs: 2 * postfix/pipe[21511]: BC8DD3356A: to=<*****@******>, relay=dovecot, delay=1001, status=bounced (Command time limit exceeded: "/usr/local/dovecot-1.0-rc2/libexec/dovecot/deliver") My command time limit is 1000s in postfix (more than 15 minutes) After many check, I found that a lots of this error is not really an error. The mail is delivered in the mailbox, but postfix send an error message. Like if Dovecot LDA process dont exit correctly after sending a mail. Do you know this bug ? As workaround i set the command time limit to 1400s but this is too long for our customer. They need in time service. We use an NFS server as storage for all our mail. Output of nfstat: Server nfs v3: null getattr setattr lookup access readlink 1 0% 744955962 21% 34845109 1% 397981329 11% 818838045 24% 0 0% read write create mkdir symlink mknod 649838729 19% 502171416 14% 29188492 0% 301741 0% 0 0% 0 0% remove rmdir rename link readdir readdirplus 54138192 1% 19903 0% 30702957 0% 27796623 0% 1294453 0% 84457031 2% fsstat fsinfo pathconf commit 48529 0% 31463 0% 0 0% 11339977 0% Output of iostat: Linux 2.4.27-3-686-smp (data.clm.net4all.ch) 21. 07. 06 cpu-moy: %user %nice %sys %iowait %idle 0,16 0,00 1,65 0,00 98,19 Device: tps Blk_lus/s Blk_�crits/s Blk_lus Blk_�crits scsi/host0/bus0/target0/lun0/disc 165,50 310,46 617,07 1800983948 3579692632 scsi/host0/bus0/target0/lun0/part1 165,48 309,32 617,06 1794404866 3579616544 scsi/host0/bus0/target0/lun0/part5 0,02 1,13 0,01 6579064 76088 Thanks for your answers, -- Net4all S.A. Dominique Feyer Administrateur Système Ch. de la Colline 5bis CH-1007 Lausanne dfeyer(a)net4all.ch

2 1

[Dovecot] xfs quota support
by polish 11 Aug '06

11 Aug '06

Hello, quota support is out of action on xfs filesystem on my centos 4.x . Problem is that i haven't these file #include <linux/dqblk_xfs.h> on my system. Solution is simple. After instalation xfsprogs-devel you get necessary files, but you must use another header file in dovecot/src/plugins/quota/quota-fs.c. Instead <linux/dqblk_xfs.h> you should use <xfs/xqm.h>. If you advise me, how can i detect if <xfs/xqm.h> exist instead <linux/dqblk_xfs.h>, i can send patch back. I'm not familiar with autotools. existing code in dovecot/src/plugins/quota/quota-fs.c : #ifdef HAVE_LINUX_DQBLK_XFS_H # include <linux/dqblk_xfs.h> #endif new code : #ifdef HAVE_XFS_XQM_H #include<xfs/xqm.h> #endif Best regards Polish -- ********************************************************** * starnem a porad nic, rozum jako kdyby se nam vyhybal * **********************************************************

2 1

[Dovecot] Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable
by Matt Roman 11 Aug '06

11 Aug '06

So I just upgraded from Dovecot 0.99 to the latest 1.0 RC2 because I was having all sorts of Authentication problems and crashes in 0.99. The upgrade did not solve the problem apparently. Dovecot still crashes periodically and always needs to be manually rebooted. The log file errors at the time of the crash: dovecot: Jul 12 14:30:59 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:04 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:09 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:14 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:19 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:24 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:29 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:30 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:33 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:35 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:39 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:40 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:44 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:45 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:49 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:50 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:54 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:55 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:59 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:59 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:31:59 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:00 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:04 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:04 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:04 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:05 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:09 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:09 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable dovecot: Jul 12 14:32:09 Error: imap-login: Can't connect to auth server at default: Resource temporarily unavailable I use PAM on the dovecot server connecting to a separate OpenLDAP server with the maildirs on NFS. Currently only the dovecot server talks to the maildirs. Postfix is also on this server, using the same PAM Authentication for SASL and works fine - It does not appear to be a problem with the Authentication server. Thanks in advance!!! -Matt

2 2

Re: [Dovecot] Dovecot deliver logging problem and procmail
by Gerhard Wiesinger 11 Aug '06

11 Aug '06

Hello Timo! Any ideas why it may take so long time to open big mbox files with indexes and delivered through dovecot deliver? So it looks like that something is wrong with the indexes or the algorithm. For details have a look below. BTW: procmail filtering through deliver works well now for me in production environment. I'll make some code cleanups and configuration options. Maybe I can release the patch today. Ciao, Gerhard On Mon, 3 Jul 2006, Timo Sirainen wrote: > On Jul 3, 2006, at 11:07 PM, Gerhard Wiesinger wrote: > >> As far as I saw dovecot's deliver process updates some header fields and the >> index files: >> Status: >> X-Keywords: (with a lot of spaces, why?) >> Content-Length: 6 > > The extra spaces are there so that if Dovecot needs to update some headers it > can take the needed space from there so it doesn't have to move the whole > mbox. > Yes, I saw it after I wrote the mail ... >> After access with dovecot the following header fields change: >> Status: O >> X-IMAPbase: 115195111 0000000009 >> X-UID: 2 >> >> So basically this isn't an advantage over the procmail or any other >> delivering process top mbox. The problem is that after the first access the >> X-UID and X-IMAPbase header must be added, so on large mbox files this might >> take a long time. > > Well, first of all Dovecot should take the space it needs from the X-Keywords > spaces, so it doesn't need to write all that much data. > > Second, the X-UID etc. headers are added by deliver if the mbox file is fully > synced against the indexes. So after you had opened it once with IMAP, after > that deliver should write the X-UID headers also as long as you don't use > something else than Dovecot to modify the mbox. Ok, that worked well. I tried to deliver some large mails (~50MB) which worked well. After sending around 500MB (10 Mails) I opened the mailbox with pine over imap. It still took a lot of time (>20s) to open the mbox. Indexes should be up2date, so why does it take so long time? After opening a second time everything is fine. Any ideas? Ciao, Gerhard

2 2

Re: [Dovecot] imap-login (proxy) Connection queue full
by Bill Boebel 11 Aug '06

11 Aug '06

On Thu, August 10, 2006 5:22 pm, Timo Sirainen <tss(a)iki.fi> said: > On Thu, 2006-08-10 at 16:28 -0400, Bill Boebel wrote: >> When running Dovecot (rc6 CVS dovecot-20060808) as a proxy, why would it log the >> following when it has not yet maxed out the allowed number of imap-login >> processes? >> >> Aug 10 16:23:34 director5 dovecot: imap-login: Disconnected: Connection queue >> full: >> >> I am seeing this logged several times per minute. From netstat, the server has >> 650 proxied IMAP connections and 450 proxied IMAPS connections, there are >> currently 10 imap-login processes running, and using the following config: > > I did some changes to CVS which hopefully should fix this? Cool, thanks. I will try this tonight. Bill

1 0

[Dovecot] 1.0.rc2 released
by Timo Sirainen 11 Aug '06

11 Aug '06

Final 1.0 release is looking to get closer. There's nothing left in my TODO list for it, so please report any old and new bugs you see. This release also makes upgrades from 0.99 more transparent with automatic renaming of .subscriptions and .customflags files with maildir. http://dovecot.org/releases/dovecot-1.0.rc2.tar.gz http://dovecot.org/releases/dovecot-1.0.rc2.tar.gz.sig * disable_plaintext_auth=yes: Removed hardcoded 127.* and ::1 IP checks. Now we just assume that the connection is secure if the local IP matches the remote IP address. * SSL code rewrite which hopefully makes it work better than before. Seems to work correctly, but if you suddently have trouble with SSL connections this is likely the reason. + verbose_ssl=yes: Log also SSL alerts and BIO errors - If namespace's location field wasn't set, the default location was supposed to be used but it wasn't. - When copying ssl-parameters.dat file from /var/lib to /var/run its permissions went wrong if it couldn't be copied with hard linking. - Fixed filesystem quota plugin to work with BSDs. - Maildir: Saving mails didn't work if quota plugin was enabled (again) - Maildir: Messages' received time wasn't saved properly when saving/copying multiple messages at a time. Also if using quota plugin the S= size was only set for the first saved file, and even that was wrong. - passdb passwd-file: Don't require valid uid/gid fields if file isn't also being used as a userdb. - PostgreSQL: Handle failures better so that there won't be "invalid fd" errors in logs. - Don't try to expunge messages if the mailbox is read-only. It'll just cause our index files to go out of sync with the real mailbox and cause errors. - ANONYMOUS authentication mechanism couldn't work because anonymous_username setting wasn't passed from master process.

9 15

[Dovecot] imap-login (proxy) Connection queue full
by Bill Boebel 11 Aug '06

11 Aug '06

When running Dovecot (rc6 CVS dovecot-20060808) as a proxy, why would it log the following when it has not yet maxed out the allowed number of imap-login processes? Aug 10 16:23:34 director5 dovecot: imap-login: Disconnected: Connection queue full: I am seeing this logged several times per minute. From netstat, the server has 650 proxied IMAP connections and 450 proxied IMAPS connections, there are currently 10 imap-login processes running, and using the following config: login_process_per_connection = no login_processes_count = 3 login_max_processes_count = 20 login_max_connections = 225 I would think that under these conditions we should never see "Connection queue full" being logged. Thanks, Bill

2 1

[Dovecot] OpenLDAP only?
by ssoo＠siliconfile.com 10 Aug '06

10 Aug '06

I tried to compile Dovecot v1.0RC2 on Opeteron/Solaris 10 box. "db-ldap.c", line 343: undefined symbol: LDAP_SASL_QUIET "LDAP_SASL_QUIET" is defined as "2U" in OpenLDAP's ldap.h but not in /usr/include/ldap.h How can I compile Dovecot with Sun's LDAP implementation?

3 3

[Dovecot] maildir++ specification compliance.
by Apps Lists 10 Aug '06

10 Aug '06

Hi folks. I was doing some testing this morning and realized Dovecot RC2 isn't fully compliant with the maildir++ specification. Most notably, it appears that Dovecot isn't creating a "maildirfolder" file (0 byte length) in folders it creates. >From http://www.inter7.com/courierimap/README.maildirquota.html "Within each subdirectory there's an empty file, maildirfolder. Its existence tells the mail delivery agent that this Maildir is a really a folder underneath a parent Maildir++." and "Make sure to create the maildirfolder file in any new folders created within the Maildir++." Also, GETQUOTAROOT on a folder (with messages in it) will always return the entire usage, not the usage in the folder itself. For example: INBOX - really has 100 mb of messages. Sent - has a few messages totalling 1mb. Drafts - no messages A GETQUOTAROOT on INBOX will return 101 mb, 100mb for INBOX and 1mb for Sent. Drafts will show zero, because there's nothing. Unfortunately, Sent will also show 101 mb, not 1mb. While Dovecot shouldn't be creating maildirsize files in each folder (the maildirfolder file is there to tell clients to look in .. for a maildirsize) ... it should still be able to answer queries about the number of messages (count of files in the folder) as well as the total size of all messages in that folder (sum of S=xxxx or by stat() on individual message files). Steve

4 4

[Dovecot] Developing new Dspam Plugin
by Timothy White 10 Aug '06

10 Aug '06

This email /was/ going to be a bit of a bitch about trying to get mysql compiled in to a dovecot plugin, but I got it all working before I finished the email! :-D Ok, basically what I am doing (Johannes permission) is modifying the dspam plugin, so that it instead talks to a database (MySQL in this case), and updates a table, so that you can do the actual training at a time of lower load. It /does/ require MySQL >= 5 cause I am using stored PROCEDURE's, which gives you the advantage, that you can use the same plugin, without changing anything, regardless of what your database looks like, or how you want the database to work! :-D I have successfully modified Johannes plugin to call SPAM and HAM in the database, with the signatures, and also upgraded it to work with beta9. I also made the small change of a define for the Spam folder, so that if your Spam folder is named differently, you don't have to change the code in 2-3 places as well ;-) I am yet to write any 'batch' code for processing the database tables, but that is fairly trivial, and I could even write it in php if I wanted ;-) (If you want something to do, go ahead and write me a C client to do this! I'll get to it eventually, and you can reuse most of the code from the plugin!) See http://members.plug.org.au/~linuxalien/dokuwiki/projects:dovecot-mysql-dspa… for more details, and the code! Feed back, comments, and criticism are all welcome! Tim -- Linux Counter user #273956

5 12

[Dovecot] Complex MySQL query in dovecot-sql.conf
by Timo Neuvonen 10 Aug '06

10 Aug '06

Is there some limit for the maximum length of the line in dovecot-sql.conf? In particular, I would be writing a long MySQL password query. And further, can a long line be somehow split to several pieces? I tried the common unix-style way of putting backslash as the last character of the first line, but it results in an error immediatedly while restarting Dovecot (while parsing the conf, ie. not a MySQL error): (in conf:) password_query = SELECT user, password FROM users\ WHERE user='%u' AND active='Y' (results in log, line 88 refers to line starting with 'WHERE':) auth(default): Error in configuration file /etc/dovecot-mysql.conf line 88: Expecting '=' The example above is just the beginning, what comes to my question about a long line. I would be checking %r (remote ip) against user-specific allowed ip-address ranges given in the database. Actually, I'd like to use some MySQL user-defined variables within my query, for example to keep only the 3 highest octets of the IPv4 representation of %r (eg. '192.168.0') so I could easily check against allowed /24 networks stored in the database. That seems to run into another problem. A very simplified example what happens when I try to define a variable within the query: (in conf, split to two lines for news only:) password_query = SET @yes='Y'; SELECT user, password FROM users WHERE user='%u' AND active=@yes (results in log:) Password query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '; SELECT user, password FROM users WHERE user='testi' AND active=@yes' at line 1 Anyway, a similar one-line construct works from the MySQL command line: SET @yes='Y'; SELECT user, password FROM users WHERE user='testi' AND active=@yes; (reults the following:) +-------+----------+ | user | password | +-------+----------+ | testi | 123 | +-------+----------+ Any ideas? Am I doing something in a completely wrong way? Of course, split lines & variables are not absolutely necessary, they just would improve readability & shorten the query. But if there is no limit on the length of the query, I propably can write everything as a one long SELECT command... I'm trying all this on Fedora Core 5, having - dovecot-1.0-0.beta8.2.fc5 - mysql-5.0.22-1.FC5.1 Regards, Timo Neuvonen

2 1

[Dovecot] My view on 1.0 release and version numbering
by Marc Perkel 10 Aug '06

10 Aug '06

Just throwing out some thoughts here. I know Timo has high standards and is trying to make 1.0 bug free before calling it 1.0. But I want to argue for an earlier less perfect 1.0. Dovecot is already way past the quality of most 1.0 releases. So it is good enough by common standards. No one really expects a 1.0 release to be perfect. But - some people don't consider a product ripe until it reaches 1.0. Once you cross the line then more people will pick it up and you will get more bug reports because of a larger base. This would actually accelerate the debugging process. And it will spur acceptance of the product and perhaps bring in more developer resources. Generally 1.0 is still buggy. It is usually followed quickly with 1.0.1, 1.0.2 ... and then stabilizes. Then as more people ask for new features it spawns 1.1.0 which is somewhat buggy and then 1.1.1 and by 1.1.2 it's rock solid. So - I'm not suggesting Timo go to 1.0 immediately. I'm just saying that I think it's pretty ripe and sooner is better than later. My 2 centz ...

14 20

[Dovecot] Dovecot under daemontools
by dale gallagher 10 Aug '06

10 Aug '06

Hi there I'm having difficulties in getting dovecot to run under daemontools. Also, from a sysadmin perspective, so far, I find dovecot's config rather complex - I suppose that's what happens when one attempts to appease all authentication methods... anyway, I digress. System details, to set the scene: OS: Slackware Linux Linux Kernel: 2.4.29 GCC: 3.2.2 Dovecot version: 1.0.rc6 Dovecot configure options: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --with-checkpassword --without-passwd --without-passwd-file --without-shadow --without-pam --without-bsdauth --without-gssapi --without-ldap --without-vpopmail --with-prefetch-userdb --without-sql --without-pgsql --without-mysql --with-ssl=openssl --without-pop3d --with-storages=maildir --without-deliver MTA: qmail Storage: Maildirs under a single virtual user (vmail) Checkpassword: /var/qmail/bin/qmail-vpoplogin (modified cdb checkpassword) User DB: /var/qmail/users/vpasswd.cdb /etc/dovecot.conf base_dir = /var/run/dovecot protocols = imap listen = 127.0.0.1 ssl_disable = yes shutdown_clients = yes log_path = /var/log/dovecot login_dir = /var/run/dovecot/login maildir_copy_with_hardlinks = yes protocol imap { # only require access from webmail on same host listen = 127.0.0.1:143 } auth default { passdb checkpassword { args = /var/qmail/bin/qmail-vpoplogin } userdb prefetch { } # user who can access user/passwd db user = auth } Firstly, I cannot run dovecot as an unprivileged user, as the OS moans that the user doesn't have permission to write to /dev/stderr. I've had a similar issue running Clamav, but a patch to Clamav resolved this? This seems to be related to referencing /dev/stderr directly. Any ideas? Should I be running dovecot as the virtual mailbox user vmail? Before I ramble on about what I've tried, could someone explain to me what dovecot actually does, in terms of privilege separation? The online docs are somewhat convoluted. This would help shed light on the solution. I also noticed the posts re daemontools some time ago, yet they do not include any setup solutions etc - I'd appreciate details from those of you who've succeeded in this regard. Thanks Dale

9 29

[Dovecot] userdb prefetch problem..
by Mike 10 Aug '06

10 Aug '06

I have a setup that I'm working on migrating to Dovecot for thousands of users across a few dozen domains.. All users are authed from LDAP.. In LDAP, each user has a unique uidNumber, and varying gidNumber (for use in other applications) As far as mail storage, the entire Maildir structure is owned by UID/GID: vmail/vmail So, the uidNumber/gidNumber from LDAP is not needed. global uid/gid is set to 'vmail' When using "passdb ldap" and "userdb ldap" both pointing to dovecot-ldap.conf, and removing the "uidNumber=uid"..etc from the "_attrs" lines, this works just fine. I would like to use "userdb prefetch" to use one less ldap query, but the uid/gid stuff is giving me some problems. The appropriate line in - dovecot-ldap.conf: pass_attrs = mail=user,userPassword=password,homeDirectory=userdb_home I get the following erros in the log: .... .... dovecot: auth(default): prefetch(user(a)domain.com,127.0.0.1): userdb_uid not returned dovecot: auth(default): prefetch(user(a)domain.com,127.0.0.1): userdb_gid not returned dovecot: auth(default): userdb(user(a)domain.com,127.0.0.1): user not found from userdb dovecot: auth(default): master out: NOTFOUND 1 dovecot: pop3-login: Internal login failure: user=<user(a)domain.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Any help is appreciated! -Mike FreeBSD 6-1-RELEASE OpenLDAP 2.3 Dovecot 1.0rc2

3 2

[Dovecot] 1.0 RC1 status
by Timo Sirainen 10 Aug '06

10 Aug '06

Today I finally caught up with my mail. I've now read all the mails from the Dovecot list from this year and all my private mails from last few years (totaling around 500 unread mails). If you think there's still something I should have replied to, please re-send it because I've either missed it or just skipped it for some reason. (Except there are still a couple of mails from this week I've yet to reply to.) Besides reading mails I've also fixed a lot of bugs today. What's left from my original 1.0 roadmap is: - Solaris sendfile is broken? Is it? Can someone try? You can test it with maildir by setting mail_save_crlf=yes, saving a somewhat large mail and FETCHing it (and truss that it really uses sendfile) - LDA: empty mail gives an error. - quota code should probably be always doing some quota_set_critical() instead of using mail_storage_set_critical(), so that quota_last_error() would work properly - rfc2557 support for BODYSTRUCTURE, as specified by RFC3501 - keywords: add some limits to how many there can be - don't return \* in PERMANENTFLAGS when we're full - mbox: how well does dirty sync + status work? it reads the last mail every time? not very good.. - mbox: dirty state should be stored to index (with mbox_very_dirty_syncs) I think 1.0 could be released without any of those changes. But what about the connection hangs that some people have had? Do they still occur? Is it only with SSL? I guess I should look at my previous ssl-proxy rewrite, figure out what went wrong with it and try again. I'm thinking about releasing 1.0 RC1 within a few days. Would be nice if that release actually worked, so testing would be appreciated :) You can try it by getting the dovecot-latest from http://dovecot.org/nightly/ The current changes include: * PAM: If user's password is expired, give "Password expired" error message to the user. Now actually working thanks to Vaidas Pilkauskas * Relicensed dovecot-auth, lib-sql and lib-ntlm to MIT license. See COPYING file for more information. * Abuse prevention: When creating a mailbox, limit the number of hierarchies (up to 20) and the length of the mailbox name within a hierarchy (up to 200 characters). * mbox: If saved mail doesn't end with LF, add it ourself so that the mails always have one empty line before the next From-line. + Added --with-statedir configure option which defaults to $localstatedir/lib/dovecot. ssl-parameters.dat is permanently stored in that directory and is copied to login_dirs from there. + IMAP: Support SASL-IR extension (SASL initial response) + Support initial SASL response with LOGIN mechanism. Patch by Anders Karlsson + Added PLAIN-MD4 password scheme. Patch by Andrey Panin. + Added support for XFS disk quotas. Patch by Pawel Jarosz + If another process deletes the opened mailbox, try to handle it without writing errors to log file. Handles the most common cases. + Added TLS support for LDAP if the library supports it. - Dovecot corrupted mbox files which had CR+LF linefeeds in headers - MySQL code could have crashed while escaping strings - MD4 code with NTLM authentication was broken with 64bit systems. Patch by Andrey Panin - Plugin loading was broken in some OSes (eg. FreeBSD) - Several fixes to handling empty values in configuration file - Several fixes to dictionary quota backend and dict server. Also changed how they're configured. - deliver: Fixed plugin handling settings - mbox_min_index_size handling was somewhat broken - passdb passwd-file: extra_args field wasn't read unless the file was also used as userdb.

13 36

[Dovecot] log error file ioloop.c assertion failed
by Dominique Feyer 10 Aug '06

10 Aug '06

pop3-login process have some error like that log: dovecot: pop3-login: file ioloop.c: line 22 (io_add): assertion failed: (fd >= 0) dovecot: child 4648 (login) killed with signal 6 Any idea ? Thanks -- Net4all S.A. Dominique Feyer Administrateur Système Ch. de la Colline 5bis CH-1007 Lausanne dfeyer(a)net4all.ch

2 1

[Dovecot] Dovecot and MySQL auth - initial setup issues
by Andrew Hearn 10 Aug '06

10 Aug '06

Hello, I'm just setting up a new server and wanting to use MySQL for user authentication. Here is what I have: Fedora Core 5: 2.6.17-1.2145_FC5 Dovecot v1.0.rc2 (RPM install from atrpms.net) MySQL v5.0.22 SquirrelMail v 1.4.6-7.fc5 ...Running on a Dual XEON machine I've added the following to dovecot.conf: auth default { passdb sql { args = /etc/dovecot-mysql.conf } userdb sql { args = /etc/dovecot-mysql.conf } The rest of dovecot.conf is standard. /etc/dovecot-mysql.conf has: driver=mysql connect = host=127.0.0.1 port=3306 dbname=maildb user=root client_flags=0 password_query = SELECT password FROM users WHERE id = '%u' user_query = SELECT maildir FROM users WHERE id = '%u' (I've run the SQL queries within mysql and they give the right results) When I start Dovecot the log shows: dovecot: Jul 11 12:47:25 Info: Dovecot v1.0.rc2 starting up dovecot: Jul 11 12:47:27 Info: auth-worker(default): mysql: Connected to 127.0.0.1 (maildb) When I try to log in using SquirrelMail, it takes about 3 seconds, then I get dovecot: Jul 11 12:48:00 Info: imap-login: Aborted login: user=<andrew(a)mail-test.aaisp.net.uk>, method=PLAIN, rip=::ffff:127.0.0.1, lip=::ffff:127.0.0.1, secured ...So, no log of it trying MySQL... And SquirrelMail then says: Unknown user or password incorrect Any ideas of what I'm missing? Thanks! Andrew. -- Andrew Hearn, Senior Support Engineer Andrews & Arnold Ltd 01344 400999 For efficient support, please email: support(a)aaisp.net.uk

4 3

[Dovecot] Corrupted Indexes
by Joseph W. Breu 10 Aug '06

10 Aug '06

What are the reprecussions of a corrupted index? Jul 11 08:47:23 pop1.cfu.net dovecot: IMAP(breu(a)cfu.net): Corrupted index cache file /var/spool/mail/filer/storage//cfu.net/b/r/breu/.lists.horde-imp/dovecot.index.cache: field header names corrupted Jul 11 13:22:06 pop6.cfu.net dovecot: IMAP(breu(a)cfu.net): Corrupted index cache file /var/spool/mail/filer/storage//cfu.net/b/r/breu/dovecot.index.cache: invalid record size Thanks, --------------------------------------------------------- Joseph W. Breu, CCNA phone : +1.319.268.5228 Senior Network Administrator fax : +1.319.266.8158 Cedar Falls Utilities cell : +1.319.493.1686 support: +1.319.268.5221 url : http://www.cfu.net

3 2

[Dovecot] no protocols inhibits dovecot --exec-mail
by Johannes Berg 10 Aug '06

10 Aug '06

Hi, Running the current debian unstable version (1.0.beta2) dovecot tells me: $ /usr/sbin/dovecot --exec-mail imap Error: No protocols given in configuration file Could this be changed? I don't need dovecot listening on any ports but would still like to allow this usage... Or should I configure protocols but no listen addresses instead? [if so the debian package needs an update because it filters out the case of no protocols and doesn't start dovecot in that case] johannes

5 11

[Dovecot] Bug#377840: dovecot: imap segfaults on small mbox files (2 bytes)
by Roland Stigge 10 Aug '06

10 Aug '06

Package: dovecot Severity: important Tags: patch Hi, a recent addition in src/lib-storage/index/mbox/istream-raw-mbox.c: ======================================================================================== [...] if (pos == 2) { /* we're at the end of file with CR+LF linefeeds? need more data to verify it. */ rstream->input_peak_offset = stream->istream.v_offset + pos; return _read(stream); } [...] ======================================================================================== makes my imap process crash, resulting in repeatedly spawned (and killed) processes in my log file: ======================================================================================== [...] Jul 11 15:31:04 localhost dovecot: imap-login: Login: user=<ernie>, method=plain, rip=127.0.0.1, lip=127.0.0.1, secured Jul 11 15:31:04 localhost dovecot: child 31284 (imap) killed with signal 11 Jul 11 15:31:04 localhost dovecot: child 31287 (imap) killed with signal 11 Jul 11 15:31:04 localhost dovecot: imap-login: Login: user=<ernie>, method=plain, rip=127.0.0.1, lip=127.0.0.1, secured Jul 11 15:31:05 localhost dovecot: imap-login: Login: user=<ernie>, method=plain, rip=127.0.0.1, lip=127.0.0.1, secured Jul 11 15:31:05 localhost dovecot: child 31293 (imap) killed with signal 11 Jul 11 15:31:05 localhost dovecot: imap-login: Login: user=<ernie>, method=plain, rip=127.0.0.1, lip=127.0.0.1, secured Jul 11 15:31:05 localhost dovecot: child 31296 (imap) killed with signal 11 Jul 11 15:31:05 localhost dovecot: child 31299 (imap) killed with signal 11 Jul 11 15:31:05 localhost dovecot: imap-login: Login: user=<ernie>, method=plain, rip=127.0.0.1, lip=127.0.0.1, secured Jul 11 15:31:06 localhost dovecot: child 31310 (imap) killed with signal 11 Jul 11 15:31:07 localhost dovecot: imap-login: Login: user=<ernie>, method=plain, rip=127.0.0.1, lip=127.0.0.1, secured Jul 11 15:31:07 localhost dovecot: imap-login: Login: user=<ernie>, method=plain, rip=127.0.0.1, lip=127.0.0.1, secured Jul 11 15:31:07 localhost dovecot: child 31313 (imap) killed with signal 11 Jul 11 15:31:07 localhost dovecot: child 31316 (imap) killed with signal 11 Jul 11 15:31:07 localhost dovecot: imap-login: Login: user=<ernie>, method=plain, rip=127.0.0.1, lip=127.0.0.1, secured [...] ======================================================================================== This is caused by the infinite recursive loop made by the "return _read(stream);" The problem is triggered in my mbox directories because I have .svn/format files lying around (mail under svn revision control). In this case, the file is 2 bytes long: ======================================================================================== ernie@dent:~/Mail$ hexdump -C .svn/format 00000000 34 0a |4.| 00000002 ======================================================================================== The attached patch (guarding against eof) is a reasonable workaround. bye, Roland -- System Information: Debian Release: testing/unstable APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.17-1-686 Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_GB.UTF-8)

2 2

[Dovecot] dovecot-lda and sendmail.
by Jeremy Koski 10 Aug '06

10 Aug '06

I'm trying to use dovecot-lda with sieve support using RC6 and sendmail. I followed the instructions at http://wiki.dovecot.org/LDA but could not get them to work with sendmail. Could anybody help? Anybody have an example sendmail macro(s) and/or working sendmail config?

1 0