- dovecot - dovecot.org

[Dovecot] check pass; user unknown in logs
by james edwards 16 Jun '06

16 Jun '06

I am seeing lots of these in my logs and there are often a hundered or so imap/dovecat process running. I am running RC Core3. Can anyone shead some light on how to correct this ? Jun 16 08:38:24 jidmail dovecot(pam_unix)[27653]: check pass; user unknown Jun 16 08:38:24 jidmail dovecot(pam_unix)[27653]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jun 16 08:38:24 jidmail dovecot(pam_unix)[27657]: check pass; user unknown Jun 16 08:38:24 jidmail dovecot(pam_unix)[27657]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jun 16 08:38:24 jidmail dovecot(pam_unix)[27658]: check pass; user unknown Jun 16 08:38:24 jidmail dovecot(pam_unix)[27658]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jun 16 08:38:26 jidmail dovecot(pam_unix)[27684]: check pass; user unknown Jun 16 08:38:26 jidmail dovecot(pam_unix)[27684]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jun 16 08:38:27 jidmail dovecot(pam_unix)[27690]: check pass; user unknown Jun 16 08:38:27 jidmail dovecot(pam_unix)[27690]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jun 16 08:38:27 jidmail dovecot(pam_unix)[27693]: check pass; user unknown Jun 16 08:38:27 jidmail dovecot(pam_unix)[27693]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jun 16 08:38:29 jidmail dovecot(pam_unix)[27712]: check pass; user unknown Jun 16 08:38:29 jidmail dovecot(pam_unix)[27712]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jun 16 08:38:30 jidmail dovecot(pam_unix)[27713]: check pass; user unknown Jun 16 08:38:30 jidmail dovecot(pam_unix)[27713]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jun 16 08:38:30 jidmail dovecot(pam_unix)[27716]: check pass; user unknown Jun 16 08:38:30 jidmail dovecot(pam_unix)[27716]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= -- James H. Edwards Network Systems Administrator Judicial Information Division jedwards(a)nmcourts.com

1 0

[Dovecot] Problem with Dovecot LDA / Postfix
by Dominique Feyer 16 Jun '06

16 Jun '06

Our setup is ok with Postfix / Dovecot. I just need to add dovecot LDA. I use the 1.0beta9 LDA Configuration: protocol lda { postmaster_address = postmaster(a)clm.net4all.ch #hostname = #mail_plugins = #mail_plugin_dir = /usr/lib/dovecot/imap #sendmail_path = /usr/lib/sendmail auth_socket_path = /var/run/dovecot/auth-master } auth default-socket { mechanisms = plain login passdb sql { args = /usr/local/dovecot-1.0-beta9/etc/dovecot-pgsql.conf } userdb sql { args = /usr/local/dovecot-1.0-beta8/etc/dovecot-pgsql.conf } socket listen { master { path = /var/run/dovecot/auth-master mode = 0660 user = vmail group = mail } } user = dovecot count = 1 } Postfix configuration, like the dovecot LDA wiki page Master.cf: dovecot unix - n n - - pipe flags=DRhu user=mail:mail argv=/usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver -d ${recipient} Main.cf default_destination_recipient_limit = 1 Log: Jun 15 19:15:43 mail2 postfix/qmgr[4226]: 31FA27FF2: from=<root(a)localhost.localdomain>, size=343, nrcpt=1 (queue active) Jun 15 19:15:43 mail2 dovecot: auth(default-socket): master in: USER^I1^Iinfo(a)lda.net4all.ch^Iservice=deliver Jun 15 19:15:43 mail2 dovecot: auth(default-socket): sql(info(a)lda.net4all.ch): SELECT '/var/spool/mail/'||home AS home, uid, gid FROM users WHERE userid = 'info(a)lda.net4all.ch' Jun 15 19:15:43 mail2 dovecot: auth(default-socket): master out: USER^I1^Iinfo@lda.net4all.ch^Ihome=/var/spool/mail/lda.net4all.ch/mails/info^Iuid=1999^Igid=1999 Jun 15 19:15:43 mail2 dovecot: auth(default-socket): Jun 15 19:15:43 mail2 postfix/pipe[4314]: 31FA27FF2: to=<info(a)lda.net4all.ch>, relay=dovecot, delay=0, status=bounced (Command died with status 89: "/usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver") The status 89 is for default error ... so no more informations with this. Permision on deliver is setuid (we use a different UID per domain) mail2:/etc/dovecot# stat /usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver File: `/usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver' Size: 2507575 Blocks: 4912 IO Block: 4096 fichier r�gulier Device: 805h/2053d Inode: 65010 Links: 1 Access: (6755/-rwsr-sr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2006-06-15 19:15:43.314434576 +0200 Modify: 2006-06-15 13:46:15.000000000 +0200 Change: 2006-06-15 19:18:32.821665560 +0200 Can anyone help me ? Thanks, -- Dominique Feyer Administrateur Système Ch. de la Colline 5bis CH-1007 Lausanne dfeyer(a)net4all.ch

2 2

Re: [Dovecot] Problem with Dovecot LDA / Postfix
by Dominique Feyer 16 Jun '06

16 Jun '06

I have only postfix log (in syslog mail facility), no dovecot log from the LDA deliver binary (with mail_debug = yes), this is strange ... Jun 16 14:37:58 mail2 postfix/pickup[6014]: 5407F7FF3: uid=0 from=<root> Jun 16 14:37:58 mail2 postfix/cleanup[6073]: 5407F7FF3: message-id=<20060616123758.5407F7FF3(a)mail2.clm.net4all.ch> Jun 16 14:37:58 mail2 postfix/qmgr[6015]: 5407F7FF3: from=<root(a)localhost.localdomain>, size=326, nrcpt=1 (queue active) Jun 16 14:37:58 mail2 postfix/pipe[6076]: 5407F7FF3: to=<info(a)lda.net4all.ch>, relay=dovecot, delay=0, status=bounced (Command died with status 89: "/usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver") Can i activate log for the LDA in the configuration file or deliver command argument in master.cf ? Thanks Le vendredi 16 juin 2006 à 08:24 -0400, My BSD a écrit : > On Thu, 15 Jun 2006 19:18:40 +0200 > Dominique Feyer <dfeyer(a)net4all.ch> wrote: > > > Our setup is ok with Postfix / Dovecot. > > > > I just need to add dovecot LDA. > > > > I use the 1.0beta9 > > > > LDA Configuration: > > > > protocol lda { > > postmaster_address = postmaster(a)clm.net4all.ch > > #hostname = > > #mail_plugins = > > #mail_plugin_dir = /usr/lib/dovecot/imap > > #sendmail_path = /usr/lib/sendmail > > auth_socket_path = /var/run/dovecot/auth-master > > } > > auth default-socket { > > mechanisms = plain login > > passdb sql { > > args = /usr/local/dovecot-1.0-beta9/etc/dovecot-pgsql.conf > > } > > userdb sql { > > args = /usr/local/dovecot-1.0-beta8/etc/dovecot-pgsql.conf > > } > > socket listen { > > master { > > path = /var/run/dovecot/auth-master > > mode = 0660 > > user = vmail > > group = mail > > } > > } > > user = dovecot > > count = 1 > > } > > > > Postfix configuration, like the dovecot LDA wiki page > > > > Master.cf: > > dovecot unix - n n - - pipe > > flags=DRhu user=mail:mail > > argv=/usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver -d > > ${recipient} > > > > Main.cf > > default_destination_recipient_limit = 1 > > > > Log: > > > > Jun 15 19:15:43 mail2 postfix/qmgr[4226]: 31FA27FF2: > > from=<root(a)localhost.localdomain>, size=343, nrcpt=1 (queue active) > > Jun 15 19:15:43 mail2 dovecot: auth(default-socket): master in: > > USER^I1^Iinfo(a)lda.net4all.ch^Iservice=deliver > > Jun 15 19:15:43 mail2 dovecot: auth(default-socket): > > sql(info(a)lda.net4all.ch): SELECT '/var/spool/mail/'||home AS home, > > uid, gid FROM users WHERE userid = 'info(a)lda.net4all.ch' > > Jun 15 19:15:43 mail2 dovecot: auth(default-socket): master out: > > USER^I1^Iinfo@lda.net4all.ch^Ihome=/var/spool/mail/lda.net4all.ch/mails/info^Iuid=1999^Igid=1999 > > Jun 15 19:15:43 mail2 dovecot: auth(default-socket): > > Jun 15 19:15:43 mail2 postfix/pipe[4314]: 31FA27FF2: > > to=<info(a)lda.net4all.ch>, relay=dovecot, delay=0, status=bounced > > (Command died with status 89: > > "/usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver") > > > > The status 89 is for default error ... so no more informations with > > this. > > > > Permision on deliver is setuid (we use a different UID per domain) > > mail2:/etc/dovecot# > > stat /usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver > > File: `/usr/local/dovecot-1.0-beta9/libexec/dovecot/deliver' > > Size: 2507575 Blocks: 4912 IO Block: 4096 fichier > > r�gulier > > Device: 805h/2053d Inode: 65010 Links: 1 > > Access: (6755/-rwsr-sr-x) Uid: ( 0/ root) Gid: ( 0/ > > root) Access: 2006-06-15 19:15:43.314434576 +0200 > > Modify: 2006-06-15 13:46:15.000000000 +0200 > > Change: 2006-06-15 19:18:32.821665560 +0200 > > > > Can anyone help me ? Thanks, > > > > -- > > Dominique Feyer > > Administrateur Système > > Ch. de la Colline 5bis > > CH-1007 Lausanne > > dfeyer(a)net4all.ch > > > > > > What are the corresponding "dovecot" log entries? > > (I use exim and was finally able to get "deliver" working by studying > "dovecot" log entries.) > -- Dominique Feyer Administrateur Système Ch. de la Colline 5bis CH-1007 Lausanne dfeyer(a)net4all.ch

1 0

[Dovecot] Broken on upgrade, "Protocol not supported"
by Ryan Hinton 16 Jun '06

16 Jun '06

Hello, and thanks in advance for your help. I was having trouble with dovecot-1.0beta2 after it worked flawlessly since January. Thunderbird was complaining that dovecot was not returning proper mail server capabilities (its log seems to confirm this). I checked the dovecot site and saw a new beta (beta9) with lots of bug fixes, so I downloaded it and installed it. The configure and make ran without incident. Before running 'sudo make install' I stopped the dovecot process with a SIGTERM. I installed and tried to restart the server, but now I get the two following errors: Error: socket() failed: Protocol not supported Fatal: listen(993) failed: Protocol not supported I went back and re-configured without IPv6 support, recompiled, and reinstalled. I even rebooted, but still the same result. Any help is greatly appreciated. I am running OpenBSD 3.5 i386. <time passes...> After some printf's, I found Error: socket() failed: Protocol not supported Error: section 2 port = 993 my_ip.family = 0 so.sin.family = 0 SOCK_STREAM = 1 AF_UNIX = 1 AF_INET = 2 AF_INET6 = 24 Fatal: listen(993) failed: Protocol not supported in function net_listen(...) in src/lib/network.c. My socket programming is a little rusty, but don't we want an address family of AF_INET or AF_INET6? Moving up into src/master/main.c I found set->protocols = imap imaps set->listen_ip.family = 2 set->listen_port = 143 set->ssl_listen_ip.family = 0 set->ssl_listen_port = 993 These print statements start at line 361, right after if (set->ssl_listen_ip.family == 0 && set->ssl_listen == NULL) set->ssl_listen_ip = set->listen_ip; Is there something going wrong in resolve_ip? I'm out of time tonight trying to track this down. Hopefully someone else will have more knowledge to pinpoint the problem. Let me know if I can provide more information. OK, one more tidbit. I hard-coded set->ssl_listen_ip.family to 2 and it seems to work beautifully. My mail server is back up. Why? --- Ryan Hinton iobass(a)email.com

3 2

[Dovecot] LDAP with Active Directory
by B Hatoum 16 Jun '06

16 Jun '06

Hello, I have successfully used dovecot 1.0 Beta 9 to do SASL authentication for postfix using the unix passwd/shadow files. I need to authenticate with a windows 2003 server using active directory. My system does not support PAM (I'm using slackware) so I cannot take that route. I do not need to use dovecot for POP or IMAP at the present time and so I would like to avoid modifying my active directory schema. Dovecot seems to be communicating with the active directory server, however it is sending an authentication failure to postfix: postfix/smtpd[24540]: warning: unknown[XXX.XXX.XXX.X]: SASL LOGIN authentication failed: UxxvcmxxQ6 I don't see any messages in the log from dovecot. Here is my dovecot-ldap.conf: hosts = 192.168.1.2:389 dn = "cn=dovecot,cn=Users,dc=DOM,dc=local" dnpass = "password" auth_bind = yes ldap_version = 3 base = cn=Users,dc=DOM,dc=local deref = never scope = subtree default_pass_scheme = CRYPT user_global_uid = 900 user_global_gid = 900 Can someone point out what I am missing? I can't find documentation on this type of setup. Thanks in advance. B Hatoum

4 3

[Dovecot] fedora directory server
by Alfonso Sparano 16 Jun '06

16 Jun '06

Hi all someone is successful to use fedora directory server as an ldap server for user/password and also with the LDA? I'm testing protocol smtp: sendmail + dovecot lda + fedora directory server and also: protocol pop3 and imap: dovecot + fedora directory server Thanks a lot folks Alfonso

1 0

[Dovecot] Dovecot-auth relicensing to BSD/MIT
by Timo Sirainen 15 Jun '06

15 Jun '06

Bcc'd to everyone who have sent me patches to dovecot-auth or related code. Once in a while people ask me if Dovecot's authentication server code could be relicensed to BSD so they could use it for their project. Usually they have been other BSD-licensed open source projects which just prefer not to use LGPL code. Now there's again this company asking me to give them a bit less restrictive license (they want to link it statically to a closed source program). They'd want to move the code to a separate SASL package and create a library out of it. They want SASL client code too, so they'd apparently write it for the package as well. I've been thinking about separating the dovecot-auth to be a separate package for a while too, although only around the time when Dovecot v2.0 is released (certainly not before v1.0). So, I think changing the Dovecot-auth's license from LGPL to BSD or MIT wouldn't really hurt and it could get it more widely used. Most of Dovecot's lib/ code is already MIT-licensed, so MIT would be more consistent. But I don't think there really is any real difference between BSD and MIT, so either one is fine for me. :) Now, this mail is mostly meant for asking people who have sent me patches to dovecot-auth if they allow the license change for their patch. If not, I'll either rewrite the part of the code, or for larger code parts (eg. NTLM auth) I'll just leave it LGPL licensed but so that it can be compiled out optionally. So, bcc'd people, please reply to me which one of these you're okay with: 1) I allow license change to either BSD or MIT 2) I allow license change to BSD 3) I allow license change to MIT 4) I don't allow license change

2 2

[Dovecot] SASL AUTH LOGIN mechanism problems
by Anders Karlsson 15 Jun '06

15 Jun '06

Hi all, Have anyone had problems with Exhange 2003 servers trying to use sasl against Postfix+Dovecot SASL using the AUTH LOGIN Mechanism ? I've done some smtp debugging, and it seems that Exchange sends the usename at the same time as AUTH LOGIN i.e: AUTH LOGIN <base64_username> It then expects to be able to send the password. mech-login.c silently discards all data after AUTH LOGIN and just prompts the username prompt whetever the username has already been supplied during initial AUTH LOGIN request. I've attached a patch to make mech-login.c check if additional data has been sent along with AUTH LOGIN, and in this case skip ahead directly to the Password: prompt. Cheers Anders

2 1

[Dovecot] nfs, dovecot, and maildirs
by bofh list 15 Jun '06

15 Jun '06

Hello - I know I am not the only one that will be trying, or has tried this before. Here are my questions! NFS Clients, multiple servers running dovecot - linux with 2.6 kernel with relevant patches (utime, etc) Backend - netapp filer End users - various clients all running IMAP It looks like 1.0.beta8 is definately the way to go. I have a few questions with regards to setup. Is it now possible to reliably store index files over nfs? If not, the alternative is keeping index files in memory, or on local disk - on each server. How big of a performance hit is this if imap connections are round-robined between imap servers? I've seen various people using different actimeo settings, some set at 0, some slightly higher - as much as 30. Can anyone speak on experience they have had with netapps on this subject? The following sound like they are required: mmap_disable=yes lock_method=dotlock Has anyone been successful with fnctl() on netapps with dovecot? Thanks in advance!

3 2

[Dovecot] How to open only these dovecot ports?
by M. Fioretti 15 Jun '06

15 Jun '06

Hello, I have not clear, due to the new syntax, how to configure dovecot 1.0 to listen only for the following combinations of ports and services: no pop3, from whatever host accept imap connections only if coming from localhost (since I understand this is secure _and_ the only way to make squirrelmail talk to dovecot) listen on the internet only for imaps and pop3s connections, accept them only if DIGEST-MD5 authentication succeeds. Thanks in advance for any explanation, Marco -- Marco Fioretti mfioretti, at the server mclink.it Fedora Core 3 for low memory http://www.rule-project.org/ We shall serve God, family and country, in that order, because without the one before it, each would perish.

2 2

[Dovecot] Error: socket() failed: Protocol not supported ERROR in dovecot-1.0.beta9
by Jeff Gardiner 14 Jun '06

14 Jun '06

I'm trying to get IMAPS working with dovecot-1.0.beta9. I'm building it on a Solaris 10 box, with openssl-0.9.8b installed. Here is the results of my ./configure: Install prefix ...................... : /usr/local/dovecot-1.0.beta9 File offsets ........................ : 64bit I/O loop method ..................... : poll File change notification method ..... : none Building with SSL support ........... : yes (OpenSSL) Building with IPv6 support .......... : yes Building with pop3 server ........... : yes Building with GSSAPI support ........ : no Building with user database modules . : static prefetch passwd passwd-file checkpassword (modules) Building with password lookup modules : passwd passwd-file shadow pam checkpassword (modules) Building with SQL drivers ............: I've attached a copy of my dovecot.conf file (striped of comments). When I try running dovecot I get the following error: Error: socket() failed: Protocol not supported Fatal: listen(993) failed: Protocol not supported When I change ssl_disable = no to ssl_disable = yes, everything works. Anyone have any suggestions? Cheers Jeff protocols = imap imaps listen = * disable_plaintext_auth = no log_path = /var/log/dovecot ssl_disable = no ssl_cert_file = /usr/local/ssl/certs/Imaging_Dovecot_cert.pem ssl_key_file = /usr/local/ssl/private/Imaging_Dovecot_key.pem ssl_parameters_regenerate = 168 verbose_ssl = yes default_mail_env = maildir:%h/.email protocol imap { } protocol pop3 { } protocol lda { postmaster_address = postmaster(a)example.com } auth default { mechanisms = plain digest-md5 cram-md5 passdb pam { args = dovecot } userdb passwd { } user = root } plugin { }

5 5

[Dovecot] Problems with dovecot.beta9
by Adnae Mac Uthidir 14 Jun '06

14 Jun '06

Dear all :) I have been upgraded dovecot today and I get following errors: Jun 14 12:08:54 [dovecot] IMAP(adnae(a)xxxxxx.xxx): inotify_init() failed: Function not implemented Jun 14 12:08:54 [dovecot] IMAP(auftrag(a)xxxxxxx.xxx): inotify_init() failed: Function not implemented Jun 14 12:08:54 [dovecot] IMAP(swolf(a)xxxxxx.xxx): inotify_init() failed: Function not implemented I have a 64 bit system (Gentoo [amd64]) and I have enabled this function on my kernel: Kernel: 2.6.16-gentoo-r9: [*] Inotify file change notification support thx for your help :)

1 0

Re: [Dovecot] Quick thanks for wonderful ACLS!
by Gavin Henry 14 Jun '06

14 Jun '06

<quote who="Marc Perkel"> > Looks cute but - why do I want it? What's it good for? I must be missing > something .... > > Well, in a big company, you might not want users to delete any e-mails they have sent out of the company. Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

2 1

[Dovecot] 1.0 roadmap
by Timo Sirainen 14 Jun '06

14 Jun '06

I've read about one month back this list's messages. I've still 216 messages from this year marked as "unread" which I should look into more (+258 older ones). Also I've 180 "unread" messages in my INBOX also which might contain something useful. So those messages could still contain something that should be added to this list. Anyway looking at my current TODO, I think the following things should be fixed before v1.0. Additions, comments, patches and such welcome. :) Help would be welcome in checking if these bugs are still there: - Thunderbird+POP3 DELE error. Was this fixed already? Could someone try this? See http://www.dovecot.org/list/dovecot/2005-June/007497.html and the rest of the thread. Basically put thousands of messages into mailbox, start downloading them and see if error comes. - Solaris sendfile is broken? Is it? Can someone try? You can test it with maildir by setting mail_save_crlf=yes, saving a somewhat large mail and FETCHing it (and truss that it really uses sendfile) - passdb passwd + passdb shadow -> passdb_password isn't reset to NULL (ie. probably doesn't allow logging in if the shadow password is correct?) - maildir: rename foo foo.xyz -> infinite loop possible? (doesn't seem so? why did I think it could be? look at the code) Important: - dict-server should have some config file which lists the allowed dicts - LDA: empty mail gives an error. - deliver: delivering mail to box smaller than mbox_min_index_size give close() errors - mbox: CRLFs in headers break the mbox - index: when mailbox is deleted/renamed and someone else had it open, we get stat() error messages in log file. Handle at least the most common places where it happens. - lib-storage - limit folder hierarchy levels? user can now create eg. a/a/a/a/... and then start renaming them from end to beginning, which probably will at some point start causing syscall failures which will fill up logs. Probably should be done: - mbox: dirty mode should be stored to index - quota code should probably be always doing some quota_set_critical() instead of using mail_storage_set_critical(), so that quota_last_error() would work properly - rfc2557 support for BODYSTRUCTURE, as specified by RFC3501 - keywords: add some limits to how many there can be - don't return \* in PERMANENTFLAGS when we're full - mbox: how well does dirty sync + status work? it reads the last mail every time? not very good.. - maildir: we probably shouldn't do duplicate detection/fixing?.. or at least stat() the old file before trying, because we might have just previously seen the old file and then new file and then we try to fix it..

18 37

[Dovecot] b8 fails with ACL plugin on
by Fintec 14 Jun '06

14 Jun '06

After upgrading to b8 using the ATrpm with the ACL plugin on it fails: # /etc/init.d/dovecot start Starting Dovecot Imap: Edlopen(/usr/lib/dovecot/imap/lib01_acl_plugin.so) failed: /usr/lib/dovecot/imap/lib01_acl_plugin.so: cannot open shared object file: No such file or directory Error: imap dump-capability process returned 22784 [FAILED] Anyone able to help be troubleshoot this? Gavin

1 0

[Dovecot] question about upgrade
by Ivan Arteaga 14 Jun '06

14 Jun '06

HI, First time posting here. can someone do let me know if there is a specific upgrade procedure from 0.99x to 1.x? Any comment will be appreciated. --Ivan.

2 1

Re: [Dovecot] Error: socket() failed: Protocol not supported ERROR
by Marcus Rueckert 14 Jun '06

14 Jun '06

On 2006-06-13 17:20:11 -0700, Jack Bailey wrote: > The bug seems to be in dovecot.conf. Uncomment ssl_listen and set it to * works for me: SuSE Linux 10.0 i386 1.0.beta9 with imap and pop3 enabled with listen and ssl_listen set to either "*" or "[::]". maybe run the process under truss/strace to see which call exactly fails. darix -- openSUSE - SUSE Linux is my linux openSUSE is good for you www.opensuse.org

1 0

[Dovecot] Re: [Dovecot-news] 1.0.beta9 released
by Timo Sirainen 13 Jun '06

13 Jun '06

On Tue, 2006-06-13 at 18:49 +0200, Geert Hendrickx wrote: > On Tue, Jun 13, 2006 at 07:16:50PM +0300, Timo Sirainen wrote: > > Fixes a lot of bugs. The next release will be the first "release > > candidate" instead of a beta. > > Timo, > > thanks for another release. I noticed one thing though: ./configure now > checks for c++ and f77 compilers, even though dovecot doesn't seem to use > any C++ nor Fortran. Could this check be removed again? (unless it's > necessary, of course) I've no idea how to remove them. Autoconf for some reason just wants to add checks for them. I once tried looking into it how they could be removed but couldn't figure out anything. Cc'd the mailing list, maybe someone here knows how to do that?

2 1

[Dovecot] POP3 notice if password expired
by Vaidas Pilkauskas 13 Jun '06

13 Jun '06

Hi, We just migrated our IMAP service to Dovecot and it performs very well. We also want to migrate our POP3 service (qpopper) to Dovecot. The problem is that Dovecot and Qpopper differently act on expired passwords: Qpopper: -ERR "user": password expired. Dovecot: -ERR Authentication failed. Are there any way to tell Dovecot to report about expired passwords? We have about 30000 users and 84 days password lifecycle. "Password expired" notifications highly reduce the number of support calls from our users. Server setup info: Solaris 9 SPARC, PAM authentication. Thanks, Vaidas Pilkauskas Vilnius University

2 3

[Dovecot] ssl-proxy: client certificates and crl check
by HenkJan Wolthuis 13 Jun '06

13 Jun '06

Hi, I've attached a new version of my patch against ssl_proxy-openssl.c which: - disconnects when no clientcertificate is presented - checks the clientcertificate against the crl for our root cert. (so you can't use a revoked client cert.) - returns the CommonName from the client cert. in ssl_proxy_get_peer_name (this way it's easier to use dovecot as imap-proxy with a passwd-like userdb + ssl_require_client_cert + ssl_username_from_cert, it "binds" the emailuser to the clientcertificate, so a user / clientcert. can access only the account from the userdb) In order to use it, the CAfile must be a file which contains the CAcertificate (pem format) followed by the CRL (also in pem format). (servercert and the clientcerts are signed with a self-signed rootcert) changes in this version: - found the proper way to extract the CommonName from a certificate! - code cleanup there are some issues with the patch: - it needs openssl > 0.9.7. the way I do CRL loading/checking is new in 0.9.7. There are some examples on the openssl-devel list, but not much documentation. - ssl_verify_client_cert now returns 0 in case of an invalid cert. was there a reason why it always returned 1? - ssl_proxy_get_peer_name is changed, code depending on this function returning "X509_NAME_oneline" can break.. (at the moment it is only used for the ssl_username_from_cert config option, i think) I'd like comments / ideas etc. -- groeten, HenkJan Wolthuis --- ssl-proxy-openssl.c.orig 2006-04-04 10:32:58.000000000 +0200 +++ ssl-proxy-openssl.c 2006-06-01 09:24:57.000000000 +0200 @@ -498,7 +498,7 @@ const char *ssl_proxy_get_peer_name(struct ssl_proxy *proxy) { X509 *x509; - char buf[1024]; + char buf[256]; const char *name; if (!ssl_proxy_has_valid_client_cert(proxy)) @@ -508,10 +508,16 @@ if (x509 == NULL) return NULL; /* we should have had it.. */ - X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf)); - name = t_strndup(buf, sizeof(buf)); + /* HJHJ */ + /* the X509_N_gtbN can return -1 without 0-terminating buf */ + /* if the call succeeds buf is 0-terminated (openssl 0.9.7e / 0.9.8b src) */ + buf[0] = '\0'; + if( X509_NAME_get_text_by_NID(X509_get_subject_name(x509),NID_commonName,buf,sizeof(buf)) < 0 ) + { buf[0] = '\0'; } + name = t_strndup(buf, sizeof(buf) ); X509_free(x509); - + /* HJHJ */ + return *name == '\0' ? NULL : name; } @@ -582,10 +588,22 @@ proxy = SSL_get_ex_data(ssl, extdata_index); proxy->cert_received = TRUE; + + /* HJHJ */ + char buf[1024]; + X509_NAME_oneline( X509_get_subject_name(ctx->current_cert),buf,sizeof(buf)); + if (!preverify_ok) + { proxy->cert_broken = TRUE; + i_warning("BAD CERT %s: %s",X509_verify_cert_error_string(ctx->error),buf); + } + else + { i_warning("CERT: %s",buf); } /* logging */ - return 1; + return preverify_ok; + /* HJHJ */ + } static int @@ -666,10 +684,20 @@ if (getenv("SSL_VERIFY_CLIENT_CERT") != NULL) { SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER | - SSL_VERIFY_CLIENT_ONCE, + SSL_VERIFY_FAIL_IF_NO_PEER_CERT, ssl_verify_client_cert); } + /* HJHJ */ +#if OPENSSL_VERSION_NUMBER >= 0x00907000L + X509_STORE *store; + if( (store=SSL_CTX_get_cert_store(ssl_ctx)) != NULL ) + { X509_STORE_set_flags( store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL); } + else + { i_warning("X509 get cert store failed..."); } +#endif + /* HJHJ */ + /* PRNG initialization might want to use /dev/urandom, make sure it does it before chrooting. We might not have enough entropy at the first try, so this function may fail. It's still been

2 5

[Dovecot] Using MySQL to store email?
by Marc Perkel 13 Jun '06

13 Jun '06

So Timo, Have you considered the idea of storing all the email in a MySQL database? Seems to me that MySQL could somplify all the backend stuff that everyone struggles with and with replication one could create very massive and reliable systems. What would it take to use MySQL that way?

26 62

[Dovecot] Multiple quota roots
by Timo Sirainen 13 Jun '06

13 Jun '06

IMAP RFC defines a way to have multiple quota roots. For example with filesystem quota the first quota root would be "available disk space in filesystem" and second quota root would be the user's normal quota. I guess this could similarly be useful for example to have a per-domain quota (eg. 10GB) and each user have their own separate quota (eg. 1GB), so that 20 the users together still couldn't use more than the 10GB. Anyway the most important reason why I need to implement them now is to allow a configuration where you could have eg. 1GB quota normally, but also extra 100MB allowed for Trash mailbox. So even when you're over quota your IMAP client can still do its copy-to-Trash operations. I guess with Maildir++ quota backend this should need to be implemented in a backwards compatible way so that the main maildirsize file contains the 1GB quota limit but still tracks the entire usage so it can grow to 1,1GB there. Now, anyone have suggestions how all of this should be configured in config file to make it as useful for different purposes as possible? :)

1 1

[Dovecot] strange behaviour: connecting to mysql, but no queries after upgrade on ubuntu...
by Nikolaus Schlemm 13 Jun '06

13 Jun '06

hi all, I'm having trouble using dovecot with mysql after upgrading to 1.0.beta3 on ubuntu. according to the mysql log, dovecot connects but doesn't issue any queries.. any hints what might be wrong or where I should look? -- Cheers, Nikl

1 0

[Dovecot] what is the correct password file format?
by M. Fioretti 13 Jun '06

13 Jun '06

Hello, I'm trying to set up dovecot installed from RPM (version dovecot-0.99.11-2.EL4.1, the one included in Centos 4.3). I get this error: dovecot-auth: passwd-file(user@domail): unknown user even if user@domain exists: auth_userdb = passwd-file /etc/imap.virtual_users auth_passdb = passwd-file /etc/imap.virtual_users -bash-3.00# cat /etc/imap.v_users user@domain:{DIGEST-MD5}thepassword:uid_value:gid_value::/absolute/path/to/virtual/mailboxes why do I get this error? and what is the correct config format for this version of dovecot? TIA, Marco -- Marco Fioretti mfioretti, at the server mclink.it Fedora Core 3 for low memory http://www.rule-project.org/ Furious activity is no substitute for understanding. -- H.H. Williams

1 0

Re: [Dovecot] Dovecot fails to start after enabling "deliver" executable settings to config file
by infowolfe 12 Jun '06

12 Jun '06

On 6/12/06, My BSD <MyBSD(a)comcast.net> wrote: > The directory should have been "/opt/local/var/run/dovecot/". > > However, when "user" and "group" are set to "9999" dovecot will not > start with the following error log entries: > > ------------------------------------------- > dovecot: Jun 12 12:52:36 Error: auth(default): User doesn't exist: 9999 > dovecot: Jun 12 12:52:36 Error: Auth process died too early - shutting > down dovecot: Jun 12 12:52:36 Error: child 29585 (auth) returned error > 89 > ------------------------------------------- cat /etc/passwd | grep 9999 if you don't see any output, then cat /etc/passwd | more and pick a different uid/gid to launch dovecot as ;-)

1 0